Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1467380
MD5:	990159d65a7268e9f9da50e115e7fcec
SHA1:	ce4ef81f35dae8b12628d6588534a4510c429776
SHA256:	9b5bb6664b66132e313e9f3e6bf35452008d2e47a91913918a633b348133b617
Tags:	exeSmokeLoader
Infos:

Detection

LummaC, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected LummaC Stealer

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Too many similar processes found

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6864 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 990159D65A7268E9F9DA50E115E7FCEC)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

1E47.exe (PID: 1196 cmdline: C:\Users\user\AppData\Local\Temp\1E47.exe MD5: BD2EAC64CBDED877608468D86786594A)

5239.exe (PID: 3400 cmdline: C:\Users\user\AppData\Local\Temp\5239.exe MD5: 60172CA946DE57C3529E9F05CC502870)

setup.exe (PID: 1516 cmdline: "C:\Users\user\AppData\Local\Temp\setup.exe" MD5: FF2293FBFF53F4BD2BFF91780FABFD60)

GamePall.exe (PID: 5644 cmdline: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1740 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3260 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5804 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3644 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2188 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=4004 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6120 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6904 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1188 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 604 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 180 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2436 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 3868 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5844 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6332 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 600 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 940 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2476 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 4496 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6180 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 416 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6212 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5428 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5032 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1640 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 3224 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6152 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720060670928462 --launch-time-ticks=6109120652 --mojo-platform-channel-handle=4000 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6404 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6492 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720060670928462 --launch-time-ticks=6109617818 --mojo-platform-channel-handle=4336 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6716 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6116 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

abrjicd (PID: 6816 cmdline: C:\Users\user\AppData\Roaming\abrjicd MD5: 990159D65A7268E9F9DA50E115E7FCEC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: LummaC

{"C2 url": ["pedestriankodwu.xyz", "towerxxuytwi.xyz", "ellaboratepwsz.xyz", "penetratedpoopp.xyz", "swellfrrgwwos.xyz", "contintnetksows.shop", "foodypannyjsud.shop", "potterryisiw.shop", "foodypannyjsud.shop"], "Build id": "bOKHNM--"}

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://evilos.cc/tmp/index.php", "http://gebeus.ru/tmp/index.php", "http://office-techs.biz/tmp/index.php", "http://cx5519.com/tmp/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1708841402.0000000004961000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1708841402.0000000004961000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000003.00000002.1955753241.0000000004B11000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.1955753241.0000000004B11000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000003.00000002.1955502229.0000000002D70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1708546917.0000000002D30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1708546917.0000000002D30000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000003.00000002.1955545560.0000000002D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.1955545560.0000000002D90000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1708529493.0000000002D20000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000003.00000002.1955623146.0000000002DBF000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6e9c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1708748359.0000000002ECF000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x714c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Process Memory Space: 1E47.exe PID: 1196	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 1E47.exe PID: 1196	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 1E47.exe PID: 1196	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 11 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\setup.exe, ProcessId: 1516, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GamePall

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\abrjicd, CommandLine: C:\Users\user\AppData\Roaming\abrjicd, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\abrjicd, NewProcessName: C:\Users\user\AppData\Roaming\abrjicd, OriginalFileName: C:\Users\user\AppData\Roaming\abrjicd, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Users\user\AppData\Roaming\abrjicd, ProcessId: 6816, ProcessName: abrjicd

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://foodypannyjsud.shop/p	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/s	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/w	Avira URL Cloud: Label: malware
Source: http://gebeus.ru/tmp/index.php	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop:443/apiTAXZVCPS.pdfPK	Avira URL Cloud: Label: malware
Source: http://cx5519.com/tmp/index.php	Avira URL Cloud: Label: malware
Source: contintnetksows.shop	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop:443/apiCLSID	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/:s	Avira URL Cloud: Label: malware
Source: http://evilos.cc/tmp/index.php	Avira URL Cloud: Label: malware
Source: ellaboratepwsz.xyz	Avira URL Cloud: Label: malware
Source: swellfrrgwwos.xyz	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/-	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/apiN	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/apiL	Avira URL Cloud: Label: malware
Source: foodypannyjsud.shop	Avira URL Cloud: Label: malware
Source: pedestriankodwu.xyz	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/nd	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Avira: detection malicious, Label: HEUR/AGEN.1313486
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Avira: detection malicious, Label: HEUR/AGEN.1359405
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Avira: detection malicious, Label: HEUR/AGEN.1352426
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Avira: detection malicious, Label: HEUR/AGEN.1359405
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat	Avira: detection malicious, Label: HEUR/AGEN.1359405

Found malware configuration

Source: 00000000.00000002.1708546917.0000000002D30000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://evilos.cc/tmp/index.php", "http://gebeus.ru/tmp/index.php", "http://office-techs.biz/tmp/index.php", "http://cx5519.com/tmp/index.php"]}
Source: 6.2.1E47.exe.5f0000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["pedestriankodwu.xyz", "towerxxuytwi.xyz", "ellaboratepwsz.xyz", "penetratedpoopp.xyz", "swellfrrgwwos.xyz", "contintnetksows.shop", "foodypannyjsud.shop", "potterryisiw.shop", "foodypannyjsud.shop"], "Build id": "bOKHNM--"}

Multi AV Scanner detection for domain / URL

Source: http://gebeus.ru/tmp/index.php	Virustotal: Detection: 15%	Perma Link
Source: http://cx5519.com/tmp/index.php	Virustotal: Detection: 11%	Perma Link
Source: contintnetksows.shop	Virustotal: Detection: 15%	Perma Link
Source: http://evilos.cc/tmp/index.php	Virustotal: Detection: 12%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1E47.exe	ReversingLabs: Detection: 67%
Source: C:\Users\user\AppData\Local\Temp\5239.exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Roaming\abrjicd	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 44%
Source: file.exe	Virustotal: Detection: 39%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\GamePall\Del.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\abrjicd	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 6.2.1E47.exe.5f0000.0.unpack	String decryptor: pedestriankodwu.xyz
Source: 6.2.1E47.exe.5f0000.0.unpack	String decryptor: towerxxuytwi.xyz
Source: 6.2.1E47.exe.5f0000.0.unpack	String decryptor: ellaboratepwsz.xyz
Source: 6.2.1E47.exe.5f0000.0.unpack	String decryptor: penetratedpoopp.xyz
Source: 6.2.1E47.exe.5f0000.0.unpack	String decryptor: swellfrrgwwos.xyz
Source: 6.2.1E47.exe.5f0000.0.unpack	String decryptor: contintnetksows.shop
Source: 6.2.1E47.exe.5f0000.0.unpack	String decryptor: foodypannyjsud.shop
Source: 6.2.1E47.exe.5f0000.0.unpack	String decryptor: potterryisiw.shop
Source: 6.2.1E47.exe.5f0000.0.unpack	String decryptor: foodypannyjsud.shop
Source: 6.2.1E47.exe.5f0000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 6.2.1E47.exe.5f0000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 6.2.1E47.exe.5f0000.0.unpack	String decryptor: - Screen Resoluton:
Source: 6.2.1E47.exe.5f0000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 6.2.1E47.exe.5f0000.0.unpack	String decryptor: Workgroup: -
Source: 6.2.1E47.exe.5f0000.0.unpack	String decryptor: bOKHNM--

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GamePall

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: c:\DotNetZip\Zip\obj\Release\Ionic.Zip.pdb source: Ionic.Zip.dll.10.dr
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\WidevineCdm\_platform_specific\win_x86\widevinecdmadapter.dll.pdb source: widevinecdmadapter.dll.10.dr
Source:	Binary string: c:\DotNetZip\Zip\obj\Release\Ionic.Zip.pdb$# source: Ionic.Zip.dll.10.dr
Source:	Binary string: D3DCompiler_43.pdb source: d3dcompiler_43.dll.10.dr
Source:	Binary string: libEGL.dll.pdb source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: h:\work\newContent\secondBranch\DeleteProgram\DeleteProgram\obj\Release\KlMain.pdb source: Del.exe.10.dr
Source:	Binary string: e:\work\newContent\secondBranch\new\GamePall\obj\Release\GamePall.pdb source: GamePall.exe, 0000000B.00000000.3257849566.0000000000162000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdb source: GamePall.exe, GamePall.exe, 00000013.00000002.3387324686.00000000058F2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdbLK source: GamePall.exe, 00000013.00000002.3353796307.0000000004D92000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdbSHA256 source: GamePall.exe, 00000013.00000002.3387324686.00000000058F2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\WidevineCdm\_platform_specific\win_x86\widevinecdmadapter.dll.pdbGCTL source: widevinecdmadapter.dll.10.dr
Source:	Binary string: D3DCompiler_43.pdb` source: d3dcompiler_43.dll.10.dr
Source:	Binary string: *?\|<>/":%s%s.dllC:\Users\user\AppData\Roaming\GamePall\GamePall.exeewall.dllll.pdbC:\Users\user\AppData\Roaming\GamePall\Uninstall.exemePalll source: setup.exe, 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdb source: GamePall.exe, GamePall.exe, 00000013.00000002.3353796307.0000000004D92000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: libGLESv2.dll.pdb source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Xilium.CefGlue.pdb source: setup.exe, 0000000A.00000002.3687315305.00000000005CF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \swiftshaderXilium.CefGlue.pdb source: setup.exe, 0000000A.00000002.3687315305.00000000005CF000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Directory queried: number of queries: 1793

Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 10_2_00405B4A CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	10_2_00405B4A
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 10_2_004066FF FindFirstFileA,FindClose,	10_2_004066FF
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 10_2_004027AA FindFirstFileA,	10_2_004027AA

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 137.74.196.132 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 77.221.157.163 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 127.0.0.127 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 188.114.96.3 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 190.224.203.37 80	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: pedestriankodwu.xyz
Source: Malware configuration extractor	URLs: towerxxuytwi.xyz
Source: Malware configuration extractor	URLs: ellaboratepwsz.xyz
Source: Malware configuration extractor	URLs: penetratedpoopp.xyz
Source: Malware configuration extractor	URLs: swellfrrgwwos.xyz
Source: Malware configuration extractor	URLs: contintnetksows.shop
Source: Malware configuration extractor	URLs: foodypannyjsud.shop
Source: Malware configuration extractor	URLs: potterryisiw.shop
Source: Malware configuration extractor	URLs: foodypannyjsud.shop
Source: Malware configuration extractor	URLs: http://evilos.cc/tmp/index.php
Source: Malware configuration extractor	URLs: http://gebeus.ru/tmp/index.php
Source: Malware configuration extractor	URLs: http://office-techs.biz/tmp/index.php
Source: Malware configuration extractor	URLs: http://cx5519.com/tmp/index.php

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: OVHFR OVHFR
Source: Joe Sandbox View	ASN Name: INFOBOX-ASInfoboxruAutonomousSystemRU INFOBOX-ASInfoboxruAutonomousSystemRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: GamePall.exe, 00000027.00000002.4101970686.00000000028EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.install-stat.debug.world/clients/activity
Source: GamePall.exe, 00000027.00000002.4101970686.00000000028EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.install-stat.debug.world/clients/installs
Source: GamePall.exe, 0000001F.00000002.3777158800.0000000002F17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bageyou.xyz
Source: GamePall.exe, 0000000B.00000002.3589831341.0000000002607000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bageyou.xyz/c/g
Source: GamePall.exe, 0000000B.00000002.3589831341.0000000002607000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bageyou.xyz/c/g4
Source: 1E47.exe, 00000006.00000003.2096929517.00000000039EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 1E47.exe, 00000006.00000003.2096929517.00000000039EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: explorer.exe, 00000001.00000000.1695356893.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1696709117.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: 1E47.exe, 00000006.00000003.2096929517.00000000039EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 1E47.exe, 00000006.00000003.2096929517.00000000039EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 1E47.exe, 00000006.00000003.2096929517.00000000039EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: explorer.exe, 00000001.00000000.1695356893.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1696709117.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: 1E47.exe, 00000006.00000003.2096929517.00000000039EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: explorer.exe, 00000001.00000000.1695356893.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1696709117.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: 1E47.exe, 00000006.00000003.2096929517.00000000039EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: log4net.xml.10.dr	String found in binary or memory: http://logging.apache.org/log4j
Source: GamePall.exe	String found in binary or memory: http://logging.apache.org/log4ne
Source: GamePall.exe, 00000013.00000002.3353796307.0000000004D92000.00000002.00000001.01000000.00000010.sdmp, log4net.xml.10.dr	String found in binary or memory: http://logging.apache.org/log4net/release/faq.html#trouble-EventLog
Source: log4net.xml.10.dr	String found in binary or memory: http://logging.apache.org/log4net/schemas/log4net-events-1.2>
Source: setup.exe, setup.exe, 0000000A.00000003.3258540365.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000000.2974819055.000000000040A000.00000008.00000001.01000000.0000000C.sdmp, setup.exe, 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: 5239.exe, 00000008.00000000.2152368616.000000000040A000.00000008.00000001.01000000.00000008.sdmp, setup.exe, 0000000A.00000003.3258540365.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000000.2974819055.000000000040A000.00000008.00000001.01000000.0000000C.sdmp, setup.exe, 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000001.00000000.1695356893.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1696709117.000000000982D000.00000004.00000001.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2096929517.00000000039EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000001.00000000.1695356893.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: 1E47.exe, 00000006.00000003.2096929517.00000000039EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: explorer.exe, 00000001.00000000.1697167435.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mi
Source: explorer.exe, 00000001.00000000.1697167435.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.micr
Source: explorer.exe, 00000001.00000000.1697353413.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1696324558.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1695994884.0000000007F40000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: GamePall.exe, 0000000B.00000002.3589831341.00000000028F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: GamePall.exe, GamePall.exe, 00000013.00000002.3353796307.0000000004D92000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.apache.org/).
Source: GamePall.exe, GamePall.exe, 00000013.00000002.3353796307.0000000004D92000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: GamePall.exe	String found in binary or memory: http://www.apache.org/licenses/LICEN
Source: GamePall.exe, 00000013.00000002.3353796307.0000000004D92000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000001.00000000.1698485774.000000000C964000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Ionic.Zip.dll.10.dr	String found in binary or memory: http://www.codeplex.com/DotNetZip
Source: log4net.xml.10.dr	String found in binary or memory: http://www.connectionstrings.com/
Source: log4net.xml.10.dr	String found in binary or memory: http://www.faqs.org/rfcs/rfc3164.html.
Source: log4net.xml.10.dr	String found in binary or memory: http://www.iana.org/assignments/multicast-addresses
Source: icudtl.dat.10.dr	String found in binary or memory: http://www.unicode.org/copyright.html
Source: 1E47.exe, 00000006.00000003.2096929517.00000000039EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 1E47.exe, 00000006.00000003.2096929517.00000000039EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 5239.exe, 00000008.00000003.2155125500.0000000003070000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xiexie.wf/22_551/huge.dat
Source: 1E47.exe, 00000006.00000003.2071827301.0000000003A0A000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2071902300.0000000003A08000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2072038196.0000000003A08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000001.00000000.1698485774.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000000.1695356893.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000000.1695356893.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000001.00000000.1698485774.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000001.00000000.1696709117.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1696709117.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1694661960.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1694129838.0000000001240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000000.1696709117.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1696709117.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000001.00000000.1696709117.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: 1E47.exe, 00000006.00000003.2098338690.00000000015AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 1E47.exe, 00000006.00000003.2098338690.00000000015AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: 1E47.exe, 00000006.00000003.2071827301.0000000003A0A000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2071902300.0000000003A08000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2072038196.0000000003A08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000000.1695356893.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000000.1695356893.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: 1E47.exe, 00000006.00000003.2071827301.0000000003A0A000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2071902300.0000000003A08000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2072038196.0000000003A08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 1E47.exe, 00000006.00000003.2071827301.0000000003A0A000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2071902300.0000000003A08000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2072038196.0000000003A08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: bn.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=bn&category=theme81https://myactivity.google.com/myactivity/?u
Source: bn.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=bnCtrl$1
Source: en-US.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u
Source: en-US.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=enCtrl$1
Source: et.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=et&category=theme81https://myactivity.google.com/myactivity/?u
Source: et.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=etCtrl$1
Source: lt.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=lt&category=theme81https://myactivity.google.com/myactivity/?u
Source: lt.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=ltCtrl$1
Source: mr.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=mr&category=theme81https://myactivity.google.com/myactivity/?u
Source: mr.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=mrCtrl$1
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=tr&category=theme81https://myactivity.google.com/myactivity/?u
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=uk&category=theme81https://myactivity.google.com/myactivity/?u
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=ukCtrl$1
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, ur.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, ur.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=urCtrl$2
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, vi.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, vi.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=viCtrl$1
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CN&category=theme81https://myactivity.google.com/myactivity
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.10.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CNCtrl$1
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TW&category=theme81https://myactivity.google.com/myactivity
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TWCtrl$1
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	String found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: 1E47.exe, 00000006.00000003.2098338690.00000000015AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 1E47.exe, 00000006.00000003.2098338690.00000000015AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 1E47.exe, 00000006.00000003.2071827301.0000000003A0A000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2071902300.0000000003A08000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2072038196.0000000003A08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 1E47.exe, 00000006.00000003.2071827301.0000000003A0A000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2071902300.0000000003A08000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2072038196.0000000003A08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 1E47.exe, 00000006.00000003.2071827301.0000000003A0A000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2071902300.0000000003A08000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2072038196.0000000003A08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: GamePall.exe, 0000000B.00000002.3589831341.0000000002903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ertizersec.com/toilover-camlp1.php?key=skufin-lp1
Source: GamePall.exe, 0000000B.00000002.3589831341.0000000002903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ertizersec.com/toilover-camlp1.php?key=skufin-lp1&SUBID=832264253426634752&cost=0.009900&zon
Source: explorer.exe, 00000001.00000000.1698485774.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: 1E47.exe, 00000006.00000002.2171656080.000000000159E000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2122962920.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/
Source: 1E47.exe, 00000006.00000003.2121910526.0000000001599000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2122962920.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/-
Source: 1E47.exe, 00000006.00000003.2169591396.000000000159E000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2146319631.000000000159E000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000002.2171656080.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/:s
Source: 1E47.exe, 00000006.00000003.2141069391.0000000001517000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000002.2171629559.0000000001592000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2169738899.000000000158F000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2068224657.0000000001566000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2141280012.0000000001594000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2136229126.0000000001517000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/api
Source: 1E47.exe, 00000006.00000003.2068224657.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/api(c
Source: 1E47.exe, 00000006.00000002.2171392448.0000000001517000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2121935428.0000000001517000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2141069391.0000000001517000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2136229126.0000000001517000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/apiL
Source: 1E47.exe, 00000006.00000002.2172239410.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/apiN
Source: 1E47.exe, 00000006.00000003.2068224657.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/apiXd%
Source: 1E47.exe, 00000006.00000003.2169591396.000000000159E000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2146319631.000000000159E000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000002.2171656080.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/bu
Source: 1E47.exe, 00000006.00000003.2068224657.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/nd
Source: 1E47.exe, 00000006.00000003.2121935428.0000000001517000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/p
Source: 1E47.exe, 00000006.00000003.2169591396.000000000159E000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2146319631.000000000159E000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000002.2171656080.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/pi
Source: 1E47.exe, 00000006.00000003.2121910526.0000000001599000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2122962920.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/s
Source: 1E47.exe, 00000006.00000003.2068224657.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/sd
Source: 1E47.exe, 00000006.00000003.2121910526.0000000001599000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2122962920.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/w
Source: 1E47.exe, 00000006.00000003.2146319631.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop:443/apiCLSID
Source: 1E47.exe, 00000006.00000003.2121935428.0000000001517000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop:443/apiTAXZVCPS.pdfPK
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000000.1695356893.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: 1E47.exe, 00000006.00000003.2098338690.00000000015AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	String found in binary or memory: https://myactivity.google.com/
Source: explorer.exe, 00000001.00000000.1698485774.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, ur.pak.10.dr, lt.pak.10.dr	String found in binary or memory: https://passwords.google.com
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, en-US.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	String found in binary or memory: https://passwords.google.comGoogle
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, vi.pak.10.dr	String found in binary or memory: https://passwords.google.comT
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	String found in binary or memory: https://policies.google.com/
Source: explorer.exe, 00000001.00000000.1698485774.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: 1E47.exe, 00000006.00000003.2069699920.0000000003A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: 1E47.exe, 00000006.00000003.2098033572.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 1E47.exe, 00000006.00000003.2098033572.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 1E47.exe, 00000006.00000003.2069699920.0000000003A1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 1E47.exe, 00000006.00000003.2069699920.0000000003A1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: GamePall.exe, GamePall.exe, 00000013.00000002.3353796307.0000000004D92000.00000002.00000001.01000000.00000010.sdmp, GamePall.exe, 00000013.00000002.3356672545.0000000004DD6000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://svn.apache.org/repos/asf/logging/log4net/tags/2.0.8RC1
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1698485774.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000001.00000000.1698485774.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: 1E47.exe, 00000006.00000003.2098338690.00000000015AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: 1E47.exe, 00000006.00000003.2071827301.0000000003A0A000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2071902300.0000000003A08000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2072038196.0000000003A08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 1E47.exe, 00000006.00000003.2098338690.00000000015AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, mr.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, ur.pak.10.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html&
Source: et.pak.10.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlA&biHaldab
Source: en-US.pak.10.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlH&elpManaged
Source: lt.pak.10.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlP&agalbaTvarko
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, vi.pak.10.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlT&r
Source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlYar&d
Source: 1E47.exe, 00000006.00000003.2071827301.0000000003A0A000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2071902300.0000000003A08000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2072038196.0000000003A08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 1E47.exe, 00000006.00000003.2098033572.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 1E47.exe, 00000006.00000003.2098033572.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 1E47.exe, 00000006.00000003.2098033572.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 1E47.exe, 00000006.00000003.2098033572.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 1E47.exe, 00000006.00000003.2098033572.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1695356893.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1695356893.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.1708841402.0000000004961000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1955753241.0000000004B11000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708546917.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1955545560.0000000002D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Code function: 10_2_004055E7 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

10_2_004055E7

Source: GamePall.exe

Process created: 56

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1708841402.0000000004961000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000003.00000002.1955753241.0000000004B11000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000003.00000002.1955502229.0000000002D70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1708546917.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000003.00000002.1955545560.0000000002D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1708529493.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000003.00000002.1955623146.0000000002DBF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1708748359.0000000002ECF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401538 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401538
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402FE9 RtlCreateUserThread,NtTerminateProcess,	0_2_00402FE9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004014DE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401496 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401496
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401543 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401543
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401565 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401565
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401579 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401579
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040157C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040157C
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_00401538 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401538
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_00402FE9 RtlCreateUserThread,NtTerminateProcess,	3_2_00402FE9
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_004014DE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_004014DE
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_00401496 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401496
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_00401543 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401543
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_00401565 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401565
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_00401579 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401579
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_0040157C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_0040157C

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Code function: 10_2_004034CC EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

10_2_004034CC

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02ECF584	0_2_02ECF584
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 10_2_00406A88	10_2_00406A88
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 11_2_00954F58	11_2_00954F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_02EA4F58	14_2_02EA4F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_02EA3860	14_2_02EA3860
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_02EA1049	14_2_02EA1049
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 15_2_027A4F58	15_2_027A4F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 15_2_027A3860	15_2_027A3860
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 16_2_00AA4F58	16_2_00AA4F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 18_2_02FC4F58	18_2_02FC4F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 18_2_02FC3860	18_2_02FC3860
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 18_2_02FC1049	18_2_02FC1049
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 20_2_00A24F58	20_2_00A24F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 21_2_00A74F58	21_2_00A74F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 23_2_00D24F58	23_2_00D24F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 23_2_00D23860	23_2_00D23860
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 23_2_00D21049	23_2_00D21049
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 25_2_01454F58	25_2_01454F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 26_2_014F4F58	26_2_014F4F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 26_2_014F3860	26_2_014F3860
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 26_2_014F1049	26_2_014F1049

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat B9BC473FC866909F089E005BAF2537EE7FF2825668D40D67C960D5C2AFB34E9F
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\1E47.exe CAE992788853230AF91501546F6EAD07CFD767CB8429C98A273093A90BBCB5AD

Source: file.exe, 00000000.00000002.1708476490.0000000002BEA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesAtlassing2 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamesAtlassing2 vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1708841402.0000000004961000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000003.00000002.1955753241.0000000004B11000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000003.00000002.1955502229.0000000002D70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1708546917.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000003.00000002.1955545560.0000000002D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1708529493.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000003.00000002.1955623146.0000000002DBF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1708748359.0000000002ECF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: abrjicd.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Ionic.Zip.dll.10.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformBlock'
Source: Ionic.Zip.dll.10.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Ionic.Zip.dll.10.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: GamePall.exe.10.dr, Program.cs

Base64 encoded string: 'pizR9uKkcZIkMW+F1cRjYV0LMt6eYXmLuiNCndESDPkTO3eY1Mjv7Hs2Qvo+t26G', 'ZTDMzZVpdA1FSa2RiY6ZCl2QGyLDtQ3OBRa/N40wO2xxcvcDsATtLRGwKtaEB36dqPJnDF8qXNs92JbMBlsOyg==', 'nYQvMVlU2Asj2rNkmi7xBNqGCkGzSnaP0raCPfB8A9hSwWFTIjPcsKgDrCVAEwSQ1lHf/WOhnKR59a5JjrkJVUOFvV43wO8MM1FKgjYuj7ZzvvuGve+okViUQx+oGN+llGnjS4Fm9o1MUn7p+qcPVIDZRcvMal1ARjQNk+bFvT5vC4J8slkhLZYtvBYmOybvSK90G7/f/U8GPBdM7WBmfFdHzzGxw6WFcHlkdySP8Nvmzff08RdOn8QOu8FlABEqqEjQ0W84v+/lU0lmhvzugpodd8fIp2kb2/twZPg9/Jsy5viOC65K8bs1ES63SA2d62f5cJYpFf1f0WBQbCBcSzfwiDlBCWVIW9vFXW1awyEMdm3q36+BViyETC5tnyHuoLRgf3bXoQAwqE0OIII5DROfW+LmqqHY82rVXHAqhVjdA2wZRWcSI1zxV7+qTfhmp9qbIQAWSuuXTzhbIvI3gjvtPCdz9uBv8rjyg1XZNxfdgYdtF+klyGgKdefnu5G2pgjfT3Kb/VbjgkFvLlqtWNr5K7iC080FVeHsZazMHUrrDtsmNdChtvnX8Zj77rIGVxi9RfvHhhIhBj+WSos+lJ2nuvQkUpqVEa1mrZSwPezG/uoh0qvs+BAHbNFNjv99WS6tgWIkvcQVCi2h3cfxTGQiZDetQZqB+N/mnvgC6WdrcRKGHBE4mp6bpgTY9+nt3lPiH6OZnlxC8rdHbuGtY6R/FgNFYkw49JWXYeZ1VV3KnjSrFMvDlkyMCAW1X9/1VoC+f73WVYMLwXafDKtGO2lfr9vwKms+8HoEgs7bj0aroIPdmLK/z/djAsFZO8Vp', 'T7BWwqrn4yISEECEAnARpwE8R+3lDHSc+RlcJT90an1SNsS27lGBQjOx4RmDHlrj7oJnnzx1IWXOkbTfLzBeCfU6UJhOIoQKhcWidAxAKIxvqZnoB6AujIU0F7dEj65vahyTdEvkIxzFaV2+akbl53KcDi5RPBOP16iXVi0WJdHV5AbSCI9WCEcSX/fUpmukBh4bjVF/T/P/B6TFVtNZintCOSO2Ha+2va2CJMOnJ020zYskwuvcH9d1rGD3Zf9RBC2obzrhRNK2LXTEIYnifs6L2UdqFhw5aANXILziQtzKvsTQKvc15hvHCCoeXJCyyK7/WgA/oRu7bdrTs2DwCQ==', 'ZY0WCEgzqiLEU8ZUVJwGTpbkuL9KoMwYVloBqJXjur8rfBZEXTysQNKRQ1H7/vn7o0wyHAux60SVy06r4v6So5WWxddei09LXvL6ZwK/tyY=', 's7iS2XfzyI+IBoARaZQlTINg1kEy7qT7EopaSHQzpqktZBtc7UiOYrPdv/6f4cNI', 'o2ZleBui4P9C2ZjnB98Vuesy1C+WucHiXjQJ8RANoX6TheGfnLYAWDsXRfSeNCDHWdkBP2RBrkWPBy/nuM2NFLMETMUsPFeG3JHWafvGKzaNEjYO3Up9m61SnaY5tINvLCYJ/TKITszJ9H1YSm2chnmQGLUzbz4pwvWvvKfH8m7z585W73/QZrtw3l/30vcZaVocgwemYusDJYsOTgeWc0okiDahD7qtJcBYZ0aOzxZZmHDMBYigkRVf8GTJ/xucA/i7EHBFpaWoLVZVcuGFMA==', 'T7BWwqrn4yISEECEAnARp+JyVgG3cZc2/9+3VbyOjc4PuRSCU7ZfXuXpIIH8uj2roUU+W7nSmXHqTuxLhe6DBfNVh8PFZrhNX/YhIexDxrk=', 'G4TxOgdwfNBdU+6bscw2hqt3kZYZMfoEuKZtmCxRLrF8xJCK1+L0ocd8eSQjty7d', 'PcG64iM3U1vDIVDm7HuwTSvKhuz45f/WPqYoWZvzLHcapbEfkynZkUjmDgg30eof', 'XGcq7Js3+2f2oGHGFzxJPiYsrodwK+bTw/0lKjiUd0tSWMHEjdVqzAclD1/nPksq3sGhVTN8oFeHMRE7wAt3mCLVCEXKF9JLnNeWw9vvCbs=', 'T7BWwqrn4yISEECEAnARp8UQ6kvfa8mDiwe39obQZ+Rxfj5bbo//kf+4mlTsZUEg0QM/4QBKb6sUDMsk9OTdYg==', 'T7BWwqrn4yISEECEAnARp/U1NCwfjpQ4K5UKuMbDqXSrjfU6Tf/pOCpHlHXtYnU5', 'Gg/rFkGmnFrfPAny9sQ3qerPGxlC7+cuu92x2tgXrCRkqABwTbbIR8+hJN0krbBD9OJX8s2JqeR+xICuD2u17N7KjlWCZwpg4+c7mG1xAahALfXXbu/EvJy+KsAzQlzR9bu8P4wbyuM6r6/7kdf+VQ==', 'Zh3o1d4Zr0FJ548CrzCJDMeQhe52nu1Hz4hkTFOalLT3pudJg4gGhcEax3IHwBI0R5vZR7J9mjUQ8R9MdKz/Fw==', 'Zh3o1d4Zr0FJ548CrzCJDMeQhe52nu1Hz4hkTFOalLTcCwJrbTmNGWmZutw1Di2FSZ+3JxFtC00BiemuQuq2+A=='

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@321/113@0/7

Source: C:\Users\user\AppData\Local\Temp\setup.exe

10_2_004034CC

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Code function: 10_2_00404897 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

10_2_00404897

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_02ED617A CreateToolhelp32Snapshot,Module32First,

0_2_02ED617A

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Code function: 10_2_00402173 CoCreateInstance,MultiByteToWideChar,

10_2_00402173

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\abrjicd

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Mutant created: \Sessions\1\BaseNamedObjects\C__Users_user_AppData_Roaming_GamePall_Logs_rendLog.txt
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Mutant created: \Sessions\1\BaseNamedObjects\C__Users_user_AppData_Roaming_GamePall_Logs_mainLog.txt

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\1E47.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: 1E47.exe, 00000006.00000003.2070809031.00000000039F5000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2071902300.00000000039D9000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 44%
Source: file.exe	Virustotal: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\abrjicd C:\Users\user\AppData\Roaming\abrjicd
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\1E47.exe C:\Users\user\AppData\Local\Temp\1E47.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5239.exe C:\Users\user\AppData\Local\Temp\5239.exe
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Process created: C:\Users\user\AppData\Local\Temp\setup.exe "C:\Users\user\AppData\Local\Temp\setup.exe"
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3260 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3644 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=4004 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720060670928462 --launch-time-ticks=6109120652 --mojo-platform-channel-handle=4000 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720060670928462 --launch-time-ticks=6109617818 --mojo-platform-channel-handle=4336 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\1E47.exe C:\Users\user\AppData\Local\Temp\1E47.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5239.exe C:\Users\user\AppData\Local\Temp\5239.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Process created: C:\Users\user\AppData\Local\Temp\setup.exe "C:\Users\user\AppData\Local\Temp\setup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3260 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3644 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=4004 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720060670928462 --launch-time-ticks=6109120652 --mojo-platform-channel-handle=4000 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720060670928462 --launch-time-ticks=6109617818 --mojo-platform-channel-handle=4336 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfsrcsnk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cdprt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\abrjicd	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\abrjicd	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\abrjicd	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\abrjicd	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: chrome_elf.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mdmregistration.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mdmregistration.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: omadmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iri.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GamePall

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: c:\DotNetZip\Zip\obj\Release\Ionic.Zip.pdb source: Ionic.Zip.dll.10.dr
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\WidevineCdm\_platform_specific\win_x86\widevinecdmadapter.dll.pdb source: widevinecdmadapter.dll.10.dr
Source:	Binary string: c:\DotNetZip\Zip\obj\Release\Ionic.Zip.pdb$# source: Ionic.Zip.dll.10.dr
Source:	Binary string: D3DCompiler_43.pdb source: d3dcompiler_43.dll.10.dr
Source:	Binary string: libEGL.dll.pdb source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: h:\work\newContent\secondBranch\DeleteProgram\DeleteProgram\obj\Release\KlMain.pdb source: Del.exe.10.dr
Source:	Binary string: e:\work\newContent\secondBranch\new\GamePall\obj\Release\GamePall.pdb source: GamePall.exe, 0000000B.00000000.3257849566.0000000000162000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdb source: GamePall.exe, GamePall.exe, 00000013.00000002.3387324686.00000000058F2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdbLK source: GamePall.exe, 00000013.00000002.3353796307.0000000004D92000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdbSHA256 source: GamePall.exe, 00000013.00000002.3387324686.00000000058F2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\WidevineCdm\_platform_specific\win_x86\widevinecdmadapter.dll.pdbGCTL source: widevinecdmadapter.dll.10.dr
Source:	Binary string: D3DCompiler_43.pdb` source: d3dcompiler_43.dll.10.dr
Source:	Binary string: *?\|<>/":%s%s.dllC:\Users\user\AppData\Roaming\GamePall\GamePall.exeewall.dllll.pdbC:\Users\user\AppData\Roaming\GamePall\Uninstall.exemePalll source: setup.exe, 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdb source: GamePall.exe, GamePall.exe, 00000013.00000002.3353796307.0000000004D92000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: libGLESv2.dll.pdb source: setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Xilium.CefGlue.pdb source: setup.exe, 0000000A.00000002.3687315305.00000000005CF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \swiftshaderXilium.CefGlue.pdb source: setup.exe, 0000000A.00000002.3687315305.00000000005CF000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\abrjicd	Unpacked PE file: 3.2.abrjicd.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;

Source: Newtonsoft.Json.dll.10.dr

Static PE information: 0xF68F744F [Mon Jan 31 06:35:59 2101 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .vmpLp

Source: 1E47.exe.1.dr	Static PE information: section name: .vmpLp
Source: 1E47.exe.1.dr	Static PE information: section name: .vmpLp
Source: 1E47.exe.1.dr	Static PE information: section name: .vmpLp
Source: libGLESv2.dll.10.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.10.dr	Static PE information: section name: .voltbl
Source: chrome_elf.dll.10.dr	Static PE information: section name: .00cfg
Source: chrome_elf.dll.10.dr	Static PE information: section name: .crthunk
Source: chrome_elf.dll.10.dr	Static PE information: section name: CPADinfo
Source: chrome_elf.dll.10.dr	Static PE information: section name: malloc_h
Source: libEGL.dll.10.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll0.10.dr	Static PE information: section name: .00cfg
Source: libcef.dll.10.dr	Static PE information: section name: .00cfg
Source: libcef.dll.10.dr	Static PE information: section name: .rodata
Source: libcef.dll.10.dr	Static PE information: section name: CPADinfo
Source: libcef.dll.10.dr	Static PE information: section name: malloc_h

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408616 push eax; retf 0000h	0_2_00408619
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401CD1 push ecx; ret	0_2_00401CD2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004084E6 push FFFFFFFBh; iretd	0_2_004084FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401C91 push 00000076h; iretd	0_2_00401C93
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E96 push B92A2F4Ch; retf	0_2_00402E9B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D21CF8 push 00000076h; iretd	0_2_02D21CFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D22EFD push B92A2F4Ch; retf	0_2_02D22F02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D2867D push eax; retf 0000h	0_2_02D28680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D2854D push FFFFFFFBh; iretd	0_2_02D28563
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D21D38 push ecx; ret	0_2_02D21D39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02EDDC4A push FFFFFFFBh; iretd	0_2_02EDDC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02ECF444 pushad ; retf	0_2_02ECF445
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02EDBBCC push edx; ret	0_2_02EDBBCD
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_00408616 push eax; retf 0000h	3_2_00408619
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_00401CD1 push ecx; ret	3_2_00401CD2
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_004084E6 push FFFFFFFBh; iretd	3_2_004084FC
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_00401C91 push 00000076h; iretd	3_2_00401C93
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_00402E96 push B92A2F4Ch; retf	3_2_00402E9B
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_02D72EFD push B92A2F4Ch; retf	3_2_02D72F02
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_02D71CF8 push 00000076h; iretd	3_2_02D71CFA
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_02D7867D push eax; retf 0000h	3_2_02D78680
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_02D7854D push FFFFFFFBh; iretd	3_2_02D78563
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_02D71D38 push ecx; ret	3_2_02D71D39
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_02DCD99A push FFFFFFFBh; iretd	3_2_02DCD9B0
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_02DCB91C push edx; ret	3_2_02DCB91D
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 11_2_009565F5 push cs; ret	11_2_00956602
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 11_2_009566A8 push cs; ret	11_2_009566AA
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 11_2_00956608 push cs; ret	11_2_0095660A
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 11_2_00956637 push cs; ret	11_2_0095663A
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 11_2_00956640 push cs; ret	11_2_00956642
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 11_2_009559B7 push es; ret	11_2_009559BA

Source: file.exe	Static PE information: section name: .text entropy: 7.650997921754289
Source: abrjicd.1.dr	Static PE information: section name: .text entropy: 7.650997921754289
Source: Ionic.Zip.dll.10.dr	Static PE information: section name: .text entropy: 6.821349263259562

Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\log4net.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\chrome_elf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\nshF9DF.tmp\liteFirewall.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5239.exe	File created: C:\Users\user\AppData\Local\Temp\nsh4B73.tmp\blowfish.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5239.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5239.exe	File created: C:\Users\user\AppData\Local\Temp\nsh4B73.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Del.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5239.exe	File created: C:\Users\user\AppData\Local\Temp\nsh4B73.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\libcef.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\abrjicd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5239.exe	File created: C:\Users\user\AppData\Local\Temp\setup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5239.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\1E47.exe	Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\abrjicd

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\setup.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GamePall			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GamePall			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\file.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\abrjicd:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\abrjicd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\abrjicd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\abrjicd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\abrjicd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\abrjicd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\abrjicd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1E47.exe

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\file.exe	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\Desktop\file.exe	API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Roaming\abrjicd	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\AppData\Roaming\abrjicd	API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	API/Special instruction interceptor: Address: 96AA71
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	API/Special instruction interceptor: Address: 9776F5
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	API/Special instruction interceptor: Address: A54E89
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	API/Special instruction interceptor: Address: B19E6B
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	API/Special instruction interceptor: Address: ED4DE8
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	API/Special instruction interceptor: Address: B48181
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	API/Special instruction interceptor: Address: B5F069

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe, 00000000.00000002.1708634186.0000000002EBE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOKO

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 25B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 11A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2D60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2AD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2EA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3110000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2F10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 27A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2A30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4A30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: AA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2650000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2470000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2F80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3150000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 5150000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2410000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2660000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2470000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: A20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 26A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 46A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: A70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 27C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: E50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: A20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 26B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: CF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: D20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2700000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4700000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: D40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2800000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4800000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1170000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2F70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1170000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 14F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3090000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2DB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2150000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2310000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4310000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1660000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3300000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1880000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2040000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2240000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4240000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2710000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 28B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 48B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1320000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2EC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4EC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 21C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2380000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 21E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2D80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3060000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 5060000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1360000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2F60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2EA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: BA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 28D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2810000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 15E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3010000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1660000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2780000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 28E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 48E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1610000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3240000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1610000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: E40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 28C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2750000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: B30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 24F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 44F0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 372	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1159	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 944	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 3487	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 880	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 871	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\log4net.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Del.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsh4B73.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\libcef.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nshF9DF.tmp\liteFirewall.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsh4B73.tmp\blowfish.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5239.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsh4B73.tmp\nsProcess.dll	Jump to dropped file

Source: C:\Windows\explorer.exe TID: 7088	Thread sleep time: -115900s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7084	Thread sleep time: -94400s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3140	Thread sleep time: -32200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1360	Thread sleep time: -32600s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7088	Thread sleep time: -348700s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe TID: 3288	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe TID: 4348	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe TID: 2488	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe TID: 5856	Thread sleep count: 32 > 30
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe TID: 1368	Thread sleep count: 37 > 30

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 10_2_00405B4A CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	10_2_00405B4A
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 10_2_004066FF FindFirstFileA,FindClose,	10_2_004066FF
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 10_2_004027AA FindFirstFileA,	10_2_004027AA

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: explorer.exe, 00000001.00000000.1697167435.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1696709117.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1695356893.00000000078A0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1697167435.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1694129838.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: GamePall.exe, 00000020.00000002.3821930124.0000000000711000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SA
Source: explorer.exe, 00000001.00000000.1697167435.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: 1E47.exe, 00000006.00000002.2171392448.00000000014EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(%T
Source: setup.exe, 0000000A.00000002.3687315305.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: explorer.exe, 00000001.00000000.1695356893.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000001.00000000.1696709117.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: explorer.exe, 00000001.00000000.1696709117.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1696709117.000000000982D000.00000004.00000001.00020000.00000000.sdmp, 1E47.exe, 00000006.00000002.2171392448.000000000153B000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2067969535.000000000153B000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2135489188.000000000153B000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2136229126.000000000153B000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2122141143.000000000153B000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2141069391.000000000153B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000000.1697167435.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000001.00000000.1695356893.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 00000001.00000000.1696709117.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000001.00000000.1694129838.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000001.00000000.1694129838.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Local\Temp\setup.exe

API call chain: ExitProcess graph end node

graph_10-3649

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\file.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\abrjicd	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\abrjicd	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D20D90 mov eax, dword ptr fs:[00000030h]	0_2_02D20D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D2092B mov eax, dword ptr fs:[00000030h]	0_2_02D2092B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02ED5A57 push dword ptr fs:[00000030h]	0_2_02ED5A57
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_02D70D90 mov eax, dword ptr fs:[00000030h]	3_2_02D70D90
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_02D7092B mov eax, dword ptr fs:[00000030h]	3_2_02D7092B
Source: C:\Users\user\AppData\Roaming\abrjicd	Code function: 3_2_02DC57A7 push dword ptr fs:[00000030h]	3_2_02DC57A7

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: abrjicd.1.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 137.74.196.132 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 77.221.157.163 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 127.0.0.127 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 188.114.96.3 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 190.224.203.37 80	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\file.exe	Thread created: C:\Windows\explorer.exe EIP: 31419D0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\abrjicd	Thread created: unknown EIP: 8B719D0			Jump to behavior

LummaC encrypted strings found

Source: 1E47.exe, 00000006.00000002.2170199921.000000000062D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: pedestriankodwu.xyz
Source: 1E47.exe, 00000006.00000002.2170199921.000000000062D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: towerxxuytwi.xyz
Source: 1E47.exe, 00000006.00000002.2170199921.000000000062D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: ellaboratepwsz.xyz
Source: 1E47.exe, 00000006.00000002.2170199921.000000000062D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: penetratedpoopp.xyz
Source: 1E47.exe, 00000006.00000002.2170199921.000000000062D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: swellfrrgwwos.xyz
Source: 1E47.exe, 00000006.00000002.2170199921.000000000062D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: contintnetksows.shop
Source: 1E47.exe, 00000006.00000002.2170199921.000000000062D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: foodypannyjsud.shop
Source: 1E47.exe, 00000006.00000002.2170199921.000000000062D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: potterryisiw.shop

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\file.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\abrjicd	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\abrjicd	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3260 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3644 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=4004 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720060670928462 --launch-time-ticks=6109120652 --mojo-platform-channel-handle=4000 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720060670928462 --launch-time-ticks=6109617818 --mojo-platform-channel-handle=4336 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_2 like mac os x) applewebkit/605.1.15 (khtml, like gecko) gsa/323.0.647062479 mobile/15e148 safari/604.1" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3260 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:2
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-us --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_2 like mac os x) applewebkit/605.1.15 (khtml, like gecko) gsa/323.0.647062479 mobile/15e148 safari/604.1" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3644 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-us --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_2 like mac os x) applewebkit/605.1.15 (khtml, like gecko) gsa/323.0.647062479 mobile/15e148 safari/604.1" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=4004 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_2 like mac os x) applewebkit/605.1.15 (khtml, like gecko) gsa/323.0.647062479 mobile/15e148 safari/604.1" --user-data-dir="c:\users\user\appdata\local\cef\user data" --first-renderer-process --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720060670928462 --launch-time-ticks=6109120652 --mojo-platform-channel-handle=4000 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_2 like mac os x) applewebkit/605.1.15 (khtml, like gecko) gsa/323.0.647062479 mobile/15e148 safari/604.1" --user-data-dir="c:\users\user\appdata\local\cef\user data" --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720060670928462 --launch-time-ticks=6109617818 --mojo-platform-channel-handle=4336 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_2 like mac os x) applewebkit/605.1.15 (khtml, like gecko) gsa/323.0.647062479 mobile/15e148 safari/604.1" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3260 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-us --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_2 like mac os x) applewebkit/605.1.15 (khtml, like gecko) gsa/323.0.647062479 mobile/15e148 safari/604.1" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3644 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-us --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_2 like mac os x) applewebkit/605.1.15 (khtml, like gecko) gsa/323.0.647062479 mobile/15e148 safari/604.1" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=4004 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_2 like mac os x) applewebkit/605.1.15 (khtml, like gecko) gsa/323.0.647062479 mobile/15e148 safari/604.1" --user-data-dir="c:\users\user\appdata\local\cef\user data" --first-renderer-process --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720060670928462 --launch-time-ticks=6109120652 --mojo-platform-channel-handle=4000 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_2 like mac os x) applewebkit/605.1.15 (khtml, like gecko) gsa/323.0.647062479 mobile/15e148 safari/604.1" --user-data-dir="c:\users\user\appdata\local\cef\user data" --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720060670928462 --launch-time-ticks=6109617818 --mojo-platform-channel-handle=4336 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1	Jump to behavior

Source: explorer.exe, 00000001.00000000.1694346331.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1696709117.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1695219208.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1694346331.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.1694129838.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1694346331.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1694346331.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\setup.exe

10_2_004034CC

Source: C:\Users\user\AppData\Local\Temp\1E47.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 1E47.exe, 00000006.00000003.2136229126.000000000158F000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2136676832.0000000001592000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2136229126.0000000001566000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1E47.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1E47.exe PID: 1196, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.1708841402.0000000004961000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1955753241.0000000004B11000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708546917.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1955545560.0000000002D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 1E47.exe, 00000006.00000003.2141280012.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: 1E47.exe, 00000006.00000003.2141280012.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: 1E47.exe, 00000006.00000003.2122526269.0000000001592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty.
Source: 1E47.exe, 00000006.00000003.2141280012.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 1E47.exe, 00000006.00000003.2135489188.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 1E47.exe, 00000006.00000003.2121935428.0000000001510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: 1E47.exe, 00000006.00000003.2141280012.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: 1E47.exe, 00000006.00000003.2121935428.000000000152D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 1E47.exe, 00000006.00000003.2121935428.0000000001510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla\Notes9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1E47.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Directory queried: number of queries: 1793

Source: Yara match

File source: Process Memory Space: 1E47.exe PID: 1196, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1E47.exe PID: 1196, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.1708841402.0000000004961000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1955753241.0000000004B11000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708546917.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1955545560.0000000002D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	22 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 Windows Service	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	LSASS Memory	115 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Windows Service	21 Obfuscated Files or Information	Security Account Manager	631 Security Software Discovery	SMB/Windows Admin Shares	1 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	312 Process Injection	12 Software Packing	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	3 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	241 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	312 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	45%	ReversingLabs	Win32.Trojan.Generic
file.exe	39%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1E47.exe	100%	Avira	HEUR/AGEN.1313486
C:\Users\user\AppData\Local\Temp\setup.exe	100%	Avira	HEUR/AGEN.1359405
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	100%	Avira	HEUR/AGEN.1352426
C:\Users\user\AppData\Local\Temp\5239.exe	100%	Avira	HEUR/AGEN.1359405
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat	100%	Avira	HEUR/AGEN.1359405
C:\Users\user\AppData\Roaming\GamePall\Del.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1E47.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\abrjicd	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat	3%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1E47.exe	68%	ReversingLabs	Win32.Trojan.Smokeloader
C:\Users\user\AppData\Local\Temp\5239.exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsh4B73.tmp\INetC.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsh4B73.tmp\blowfish.dll	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsh4B73.tmp\nsProcess.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nshF9DF.tmp\liteFirewall.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\setup.exe	3%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\GamePall\Del.exe	7%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	3%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\chrome_elf.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\libcef.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\log4net.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\abrjicd	45%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label	Link
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
https://excel.office.com	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://aka.ms/odirmr	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://foodypannyjsud.shop/p	100%	Avira URL Cloud	malware
https://foodypannyjsud.shop/s	100%	Avira URL Cloud	malware
https://chrome.google.com/webstore?hl=mr&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
https://foodypannyjsud.shop/w	100%	Avira URL Cloud	malware
https://chrome.google.com/webstore?hl=mr&category=theme81https://myactivity.google.com/myactivity/?u	0%	Virustotal		Browse
http://www.apache.org/licenses/LICEN	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	Virustotal		Browse
https://aka.ms/odirmr	0%	Virustotal		Browse
https://support.google.com/chrome/answer/6098869	0%	Avira URL Cloud	safe
https://www.google.com/chrome/privacy/eula_text.html	0%	Avira URL Cloud	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	Avira URL Cloud	safe
http://gebeus.ru/tmp/index.php	100%	Avira URL Cloud	malware
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
http://www.apache.org/licenses/LICEN	0%	Virustotal		Browse
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=et&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
https://support.google.com/chrome/answer/6098869	0%	Virustotal		Browse
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	0%	Virustotal		Browse
https://chrome.google.com/webstore?hl=etCtrl$1	0%	Avira URL Cloud	safe
https://www.google.com/chrome/privacy/eula_text.html	1%	Virustotal		Browse
https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u	0%	Virustotal		Browse
https://foodypannyjsud.shop:443/apiTAXZVCPS.pdfPK	100%	Avira URL Cloud	malware
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=urCtrl$2	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=et&category=theme81https://myactivity.google.com/myactivity/?u	0%	Virustotal		Browse
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	Avira URL Cloud	safe
https://photos.google.com/settings?referrer=CHROME_NTP	0%	Avira URL Cloud	safe
http://gebeus.ru/tmp/index.php	16%	Virustotal		Browse
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=ltCtrl$1	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
https://photos.google.com/settings?referrer=CHROME_NTP	0%	Virustotal		Browse
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	0%	Avira URL Cloud	safe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	0%	Avira URL Cloud	safe
http://cx5519.com/tmp/index.php	100%	Avira URL Cloud	malware
https://passwords.google.com	0%	Avira URL Cloud	safe
contintnetksows.shop	100%	Avira URL Cloud	malware
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	0%	Virustotal		Browse
http://www.iana.org/assignments/multicast-addresses	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	0%	Virustotal		Browse
http://cx5519.com/tmp/index.php	12%	Virustotal		Browse
https://ertizersec.com/toilover-camlp1.php?key=skufin-lp1&SUBID=832264253426634752&cost=0.009900&zon	0%	Avira URL Cloud	safe
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	0%	Avira URL Cloud	safe
https://foodypannyjsud.shop:443/apiCLSID	100%	Avira URL Cloud	malware
https://passwords.google.com	0%	Virustotal		Browse
https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=bnCtrl$1	0%	Avira URL Cloud	safe
https://foodypannyjsud.shop/:s	100%	Avira URL Cloud	malware
http://www.iana.org/assignments/multicast-addresses	0%	Virustotal		Browse
http://bageyou.xyz	0%	Avira URL Cloud	safe
https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22	0%	Virustotal		Browse
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	0%	Virustotal		Browse
contintnetksows.shop	16%	Virustotal		Browse
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	Virustotal		Browse
http://logging.apache.org/log4ne	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	Avira URL Cloud	safe
http://evilos.cc/tmp/index.php	100%	Avira URL Cloud	malware
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3/J	0%	Avira URL Cloud	safe
http://evilos.cc/tmp/index.php	13%	Virustotal		Browse
http://bageyou.xyz	0%	Virustotal		Browse
https://wns.windows.com/L	0%	Avira URL Cloud	safe
http://www.connectionstrings.com/	0%	Avira URL Cloud	safe
https://word.office.com	0%	Avira URL Cloud	safe
https://support.google.com/chromebook?p=app_intent	0%	Avira URL Cloud	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	0%	Avira URL Cloud	safe
https://ertizersec.com/toilover-camlp1.php?key=skufin-lp1	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	Avira URL Cloud	safe
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=mrCtrl$1	0%	Avira URL Cloud	safe
https://www.google.com/chrome/privacy/eula_text.html&	0%	Avira URL Cloud	safe
http://logging.apache.org/log4j	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=lt&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
https://www.google.com/chrome/privacy/eula_text.htmlT&r	0%	Avira URL Cloud	safe
ellaboratepwsz.xyz	100%	Avira URL Cloud	malware
http://schemas.micr	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	0%	Avira URL Cloud	safe
swellfrrgwwos.xyz	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://gebeus.ru/tmp/index.php	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://cx5519.com/tmp/index.php	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
contintnetksows.shop	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://evilos.cc/tmp/index.php	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
ellaboratepwsz.xyz	true	Avira URL Cloud: malware	unknown
swellfrrgwwos.xyz	true	Avira URL Cloud: malware	unknown
foodypannyjsud.shop	true	Avira URL Cloud: malware	unknown
pedestriankodwu.xyz	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, vi.pak.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/odirmr	explorer.exe, 00000001.00000000.1695356893.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	1E47.exe, 00000006.00000003.2071827301.0000000003A0A000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2071902300.0000000003A08000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2072038196.0000000003A08000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop/p	1E47.exe, 00000006.00000003.2121935428.0000000001517000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	1E47.exe, 00000006.00000003.2071827301.0000000003A0A000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2071902300.0000000003A08000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2072038196.0000000003A08000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop/s	1E47.exe, 00000006.00000003.2121910526.0000000001599000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2122962920.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chrome.google.com/webstore?hl=mr&category=theme81https://myactivity.google.com/myactivity/?u	mr.pak.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop/w	1E47.exe, 00000006.00000003.2121910526.0000000001599000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2122962920.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.apache.org/licenses/LICEN	GamePall.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.google.com/chrome/answer/6098869	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/chrome/privacy/eula_text.html	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, mr.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1696709117.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	1E47.exe, 00000006.00000003.2098338690.00000000015AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	GamePall.exe, 00000013.00000002.3353796307.0000000004D92000.00000002.00000001.01000000.00000010.sdmp, log4net.xml.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=et&category=theme81https://myactivity.google.com/myactivity/?u	et.pak.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=etCtrl$1	et.pak.10.dr	false	Avira URL Cloud: safe	unknown
https://excel.office.com	explorer.exe, 00000001.00000000.1698485774.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://foodypannyjsud.shop:443/apiTAXZVCPS.pdfPK	1E47.exe, 00000006.00000003.2121935428.0000000001517000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=urCtrl$2	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, ur.pak.10.dr	false	Avira URL Cloud: safe	unknown
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://photos.google.com/settings?referrer=CHROME_NTP	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=ltCtrl$1	lt.pak.10.dr	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	1E47.exe, 00000006.00000003.2098338690.00000000015AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000001.00000000.1695356893.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://passwords.google.com	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, ur.pak.10.dr, lt.pak.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.iana.org/assignments/multicast-addresses	log4net.xml.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ertizersec.com/toilover-camlp1.php?key=skufin-lp1&SUBID=832264253426634752&cost=0.009900&zon	GamePall.exe, 0000000B.00000002.3589831341.0000000002903000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop:443/apiCLSID	1E47.exe, 00000006.00000003.2146319631.000000000159E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000001.00000000.1698485774.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=bnCtrl$1	bn.pak.10.dr	false	Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop/:s	1E47.exe, 00000006.00000003.2169591396.000000000159E000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2146319631.000000000159E000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000002.2171656080.000000000159E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	GamePall.exe, 0000000B.00000002.3589831341.00000000028F3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://bageyou.xyz	GamePall.exe, 0000001F.00000002.3777158800.0000000002F17000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://logging.apache.org/log4ne	GamePall.exe	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, ur.pak.10.dr	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	1E47.exe, 00000006.00000003.2098338690.00000000015AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000001.00000000.1698485774.000000000C964000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wns.windows.com/L	explorer.exe, 00000001.00000000.1698485774.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.connectionstrings.com/	log4net.xml.10.dr	false	Avira URL Cloud: safe	unknown
https://word.office.com	explorer.exe, 00000001.00000000.1698485774.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chromebook?p=app_intent	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000001.00000000.1695356893.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ertizersec.com/toilover-camlp1.php?key=skufin-lp1	GamePall.exe, 0000000B.00000002.3589831341.0000000002903000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u	en-US.pak.10.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	1E47.exe, 00000006.00000003.2071827301.0000000003A0A000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2071902300.0000000003A08000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2072038196.0000000003A08000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	1E47.exe, 00000006.00000003.2096929517.00000000039EF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	1E47.exe, 00000006.00000003.2098338690.00000000015AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	1E47.exe, 00000006.00000003.2096929517.00000000039EF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=mrCtrl$1	mr.pak.10.dr	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	1E47.exe, 00000006.00000003.2069699920.0000000003A1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	5239.exe, 00000008.00000000.2152368616.000000000040A000.00000008.00000001.01000000.00000008.sdmp, setup.exe, 0000000A.00000003.3258540365.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000000.2974819055.000000000040A000.00000008.00000001.01000000.0000000C.sdmp, setup.exe, 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/chrome/privacy/eula_text.html&	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, ur.pak.10.dr	false	Avira URL Cloud: safe	unknown
http://logging.apache.org/log4j	log4net.xml.10.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=lt&category=theme81https://myactivity.google.com/myactivity/?u	lt.pak.10.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/privacy/eula_text.htmlT&r	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, vi.pak.10.dr	false	Avira URL Cloud: safe	unknown
http://schemas.micr	explorer.exe, 00000001.00000000.1697167435.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	1E47.exe, 00000006.00000003.2071827301.0000000003A0A000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2071902300.0000000003A08000.00000004.00000800.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2072038196.0000000003A08000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xiexie.wf/22_551/huge.dat	5239.exe, 00000008.00000003.2155125500.0000000003070000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	1E47.exe, 00000006.00000003.2098033572.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://foodypannyjsud.shop/-	1E47.exe, 00000006.00000003.2121910526.0000000001599000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2122962920.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://foodypannyjsud.shop/apiN	1E47.exe, 00000006.00000002.2172239410.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/chrome/privacy/eula_text.htmlA&biHaldab	et.pak.10.dr	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, en-US.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	false	Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop/apiL	1E47.exe, 00000006.00000002.2171392448.0000000001517000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2121935428.0000000001517000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2141069391.0000000001517000.00000004.00000020.00020000.00000000.sdmp, 1E47.exe, 00000006.00000003.2136229126.0000000001517000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://nsis.sf.net/NSIS_Error	setup.exe, setup.exe, 0000000A.00000003.3258540365.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000000.2974819055.000000000040A000.00000008.00000001.01000000.0000000C.sdmp, setup.exe, 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=tr&category=theme81https://myactivity.google.com/myactivity/?u	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=ukCtrl$1	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000001.00000000.1698485774.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://api.install-stat.debug.world/clients/installs	GamePall.exe, 00000027.00000002.4101970686.00000000028EB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.microsof	1E47.exe, 00000006.00000003.2069699920.0000000003A1F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/a/answer/9122284	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, et.pak.10.dr, mr.pak.10.dr, ur.pak.10.dr, lt.pak.10.dr, vi.pak.10.dr, zh-CN.pak.10.dr, bn.pak.10.dr	false	Avira URL Cloud: safe	unknown
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000001.00000000.1695356893.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop/nd	1E47.exe, 00000006.00000003.2068224657.0000000001566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.com_	explorer.exe, 00000001.00000000.1698485774.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=uk&category=theme81https://myactivity.google.com/myactivity/?u	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000001.00000000.1695356893.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=zh-CN&category=theme81https://myactivity.google.com/myactivity	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.10.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=zh-CNCtrl$1	setup.exe, 0000000A.00000002.3864876604.000000000273B000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.10.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
137.74.196.132	unknown	France	16276	OVHFR	true
77.221.157.163	unknown	Russian Federation	30968	INFOBOX-ASInfoboxruAutonomousSystemRU	true
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
188.114.96.3	unknown	European Union	13335	CLOUDFLARENETUS	true
190.224.203.37	unknown	Argentina	7303	TelecomArgentinaSAAR	true
104.21.45.251	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.127

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467380
Start date and time:	2024-07-04 06:06:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@321/113@0/7
EGA Information:	Successful, ratio: 58.8%
HCA Information:	Successful, ratio: 83% Number of executed functions: 412 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target 1E47.exe, PID 1196 because there are no executed function
Execution Graph export aborted for target GamePall.exe, PID 1740 because it is empty
Execution Graph export aborted for target GamePall.exe, PID 2188 because it is empty
Execution Graph export aborted for target GamePall.exe, PID 5804 because it is empty
Execution Graph export aborted for target GamePall.exe, PID 6404 because it is empty
Execution Graph export aborted for target GamePall.exe, PID 6492 because it is empty
Execution Graph export aborted for target GamePall.exe, PID 6716 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
00:07:01	API Interceptor	370348x Sleep call for process: explorer.exe modified
00:07:35	API Interceptor	8x Sleep call for process: 1E47.exe modified
00:09:39	API Interceptor	1x Sleep call for process: GamePall.exe modified
05:07:17	Task Scheduler	Run new task: Firefox Default Browser Agent 0A8AA75E3E440333 path: C:\Users\user\AppData\Roaming\abrjicd
05:09:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run GamePall C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
05:09:45	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run GamePall C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
137.74.196.132	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
77.221.157.163	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	5GOuTtZoQn.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
188.114.97.3	new order.exe	Get hash	malicious	FormBook	Browse	www.coinwab.com/efdt/
	http://sp.26skins.com/steamstore/category/action_run_jump/?snr=1_1530_4__12	Get hash	malicious	Unknown	Browse	sp.26skins.com/favicon.ico
	BL Draft.exe	Get hash	malicious	FormBook	Browse	www.gazeta-ufaley.ru/wjr5/
	Your file name without extension goes here.exe	Get hash	malicious	FormBook	Browse	www.pu6wac.buzz/g2ww/
	Purchase Order No.P7696#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/OWlnEE9J/download
	Purchase Order No.P7696#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/OWlnEE9J/download
	MKCC-MEC-RFQ-115-2024.exe	Get hash	malicious	FormBook	Browse	www.checkout4xgrow.shop/ts59/?S0GhCH=DR-Lh8FH5BP&Upql=F3s9qclS9ajlyltz5vx8YuFcODa05tGO2XwI753moUwU8ctXmF/lD/LedP+MQBQFZjkX
	62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	podval.top/LineToPythonJsLowupdateLongpollWindowsFlower.php
	MUdeeReQ5R.exe	Get hash	malicious	FormBook	Browse	www.ilodezu.com/z48v/
	RR1h1iO6W2.exe	Get hash	malicious	FormBook	Browse	www.intervisitation.sbs/clrm/
188.114.96.3	http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	Get hash	malicious	HTMLPhisher	Browse	business.ifbsmetaiidentiityconfirms.com/favicon.ico
	BL Draft.exe	Get hash	malicious	FormBook	Browse	www.ediancai.cn/x7r2/
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/btd2ptah/download
	Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Get hash	malicious	FormBook	Browse	www.ad14.fun/oc7s/
	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	www.ad14.fun/oc7s/
	9098393827383039.exe	Get hash	malicious	FormBook	Browse	www.coinwab.com/kqqj/
	SOA 020724.exe	Get hash	malicious	FormBook	Browse	www.ad14.fun/az6h/?Vn=Ydx4qJJ0n&3jJlx=2tWzkzncG4ra8DBegJJBToW7oB13AdJXZ1KkbDLW+Ah9MGsNEQDOdLre6u2t4zOJ63yLnsPJ97sPnqMxsSzbOxuABFq0Im2Ecm9EQ8GOdhogxDCvRrrALITlDFg7ZHNgcXHQPxMcHnGf
	Adjunto confirmacion de pedido.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.coinwab.com/kqqj/
	aAEsSBx24sxHhRz.exe	Get hash	malicious	FormBook	Browse	www.camperelektrikde.shop/dy13/?GdIHAFZ=8bNdgr3QvPw6/pDIZNt+55DvjzemDI0RO+pYD3qlulbIe6f7Sn3K06Z4F4Tg3hK83Y0/&BhU=5jl0ddZhNnYlOrV0
	http://sp.26skins.com/steamstore/category/adventure_rpg/?snr=1_5_9__12	Get hash	malicious	Unknown	Browse	sp.26skins.com/favicon.ico

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	new order.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	https://googie-anaiytics.com	Get hash	malicious	Unknown	Browse	104.22.74.216
	https://seismic.com/products/	Get hash	malicious	Unknown	Browse	104.18.37.212
	PRE ALERT Docs_PONBOM01577.xlsx.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Encrypted Doc-[izO-3902181].pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://click.pstmrk.it/3s/frutilandia.com%2Ffaq%2F/gRC2/yGq2AQ/AQ/a2d2de19-7d91-4f73-a067-0dd3f808145b/1/-HKuJv7KgC	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://reservation.exnetehovervs.com/apart/285z92aaza77z	Get hash	malicious	Unknown	Browse	104.22.70.197
	https://rules-pear-kft5d2.mystrikingly.com/	Get hash	malicious	Unknown	Browse	162.247.243.29
	http://sp.26skins.com/steamstore/category/adventure_rpg/?snr=1_5_9__12	Get hash	malicious	Unknown	Browse	188.114.96.3
	Encrypted Doc-[Ogi-5917842].pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
CLOUDFLARENETUS	new order.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	https://googie-anaiytics.com	Get hash	malicious	Unknown	Browse	104.22.74.216
	https://seismic.com/products/	Get hash	malicious	Unknown	Browse	104.18.37.212
	PRE ALERT Docs_PONBOM01577.xlsx.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Encrypted Doc-[izO-3902181].pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://click.pstmrk.it/3s/frutilandia.com%2Ffaq%2F/gRC2/yGq2AQ/AQ/a2d2de19-7d91-4f73-a067-0dd3f808145b/1/-HKuJv7KgC	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://reservation.exnetehovervs.com/apart/285z92aaza77z	Get hash	malicious	Unknown	Browse	104.22.70.197
	https://rules-pear-kft5d2.mystrikingly.com/	Get hash	malicious	Unknown	Browse	162.247.243.29
	http://sp.26skins.com/steamstore/category/adventure_rpg/?snr=1_5_9__12	Get hash	malicious	Unknown	Browse	188.114.96.3
	Encrypted Doc-[Ogi-5917842].pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
OVHFR	Encrypted Doc-[izO-3902181].pdf	Get hash	malicious	HTMLPhisher	Browse	149.56.200.84
	Encrypted Doc-[Ogi-5917842].pdf	Get hash	malicious	HTMLPhisher	Browse	149.56.200.84
	http://multichaindappsx.pages.dev/	Get hash	malicious	Unknown	Browse	5.135.209.100
	https://troy-acoustics.neetoform.com/25d7349ac44d8bc00661	Get hash	malicious	Phisher	Browse	167.114.173.136
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	137.74.196.132
	H50bdqfVH2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	51.195.62.41
	bv8iPF7cTY.exe	Get hash	malicious	AgentTesla	Browse	198.50.154.144
	VG0x1LZCFb.exe	Get hash	malicious	AgentTesla	Browse	51.255.149.48
	https://us-east-2.protection.sophos.com/?d=beehiiv.com&u=aHR0cHM6Ly9saW5rLm1haWwuYmVlaGlpdi5jb20vbHMvY2xpY2s_dXBuPXUwMDEublhka2JOSUpSeEZBS3VJWUJaMjU1N3l4Ujd6TmpDcFhIYW5SQnlyQXY3ZHMzMDZEQ091c3dBUU0yYzhiZFN4b1BudElFVWpoUzJhdzI1aDJUcWNiZVVCdXQ3WEhqcHZMejN4aS0yRnBZN2NYb3RNbXNIRlVyUkd5RDAzTGhIZms2a2E1ZGZEVFpCSlVkWnpOandHYUJsR0x3U1B4MlN1TVNIWEl5ZlI3YVdDNW1aeFNQLTJCUWFOUmpzMlpwblRwbmxpLTJGX245c19sZUtscWNRUnJvOGtNTXJocHFZOENpeTQ4MnhLUmJTM1NZcE16TVUtMkY5c0VvdjNqMExCNE1kOVZ3WUJvOEY2bEhJTllZbE90LTJGcjRQd1FwOXdCVmFuUXpmRy0yQnZlaFF5WVBjamlVbFpSN3VSaHJFbWFrLTJCYXY5T2RyYldyREphTmo3ck1iNmlhckR2Rjh1d2xPeDZ5VFY5ODFHLTJGejZiRDczakVOVHk4M0pXa2kzVzNTSzRBRURwQjd3dEg4blRyZ203ZjYxaEg2enlzYjFLYVl0S0pyWUJjU2QxNTN2SDQ5eDlTeW5acVZ0TGdqN2RrWU1FRkE1NzV6WWF6b2UwQmw2UnVUM1RHTkJiU2JpOHhUNUFnRGJMUjY4TlU1ay0yRmtDVFJtOHJrWWRMSDBNRGgtMkY3c1J6dVE4TEJxeDBvQzZ6WXVFQk0xRVFBdGI3eGxMZVEtMkJ5SEtiOE4yVHV0TFdpVEk4amc4b3U5MTkxRlM5SDEyLTJCbnJpT0hESVo2Nk1yd3pIeTRScFBQWlAtMkJ0Y1NscGt2Z01HT2F5Nmx6UGlCdE1MeGRrODI5eGU3TThFT1VLRDR2UHIxZFdYZ3c3MjFQQjFNa3k=&i=NWNiNGNiOGY1NWZlOGIxMTAwZmUxN2Uy&t=YUVvbWN0aDQzMW4yV29uam9nK2tUNmU1dStvM2VicUNJeENiWDR5Zk1nTT0=&h=ddfea45e1610491898abc824d1dabad5&s=AVNPUEhUT0NFTkNSWVBUSVaKXvCVdmaYUeJ4sMCGgh9xhnT0RF3qCfPvI6ciaUbnMg	Get hash	malicious	Unknown	Browse	66.70.176.204
	https://hr.economictimes.indiatimes.com/etl.php?url=https://hr.economictimes.indiatimes.com/etl.php?url=//bgvhdjcbjfdhjkbgfddgfghgfd.pages.dev/#?email=dGVzdEB0ZXN0by5jb20=	Get hash	malicious	Unknown	Browse	149.202.238.104
INFOBOX-ASInfoboxruAutonomousSystemRU	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	77.221.157.163
	5GOuTtZoQn.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	77.221.157.163
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	77.221.157.163
	Eclf71HXa1.exe	Get hash	malicious	Unknown	Browse	77.221.149.185
	Eclf71HXa1.exe	Get hash	malicious	Unknown	Browse	77.221.149.185
	file.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse	77.221.149.185
	file.exe	Get hash	malicious	PureLog Stealer	Browse	77.221.140.76
	file.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	77.221.140.76
	file.exe	Get hash	malicious	PureLog Stealer	Browse	77.221.140.76
	SecuriteInfo.com.Win64.MalwareX-gen.13147.14133.exe	Get hash	malicious	Unknown	Browse	77.221.159.5

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\1E47.exe	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	5GOuTtZoQn.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	JuHVfiAuLo.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	LXbM8RbhLa.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	EiPVv5yELP.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	6IMo1kM9CC.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.2850.19434.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	5GOuTtZoQn.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	JuHVfiAuLo.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	LXbM8RbhLa.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	EiPVv5yELP.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	6IMo1kM9CC.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.2850.19434.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\5239.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	107232830
Entropy (8bit):	7.999946456161068
Encrypted:	true
SSDEEP:	1572864:6F6Q78DDbO8pDfwpK5ZAQ5WKor2G5N6Y7ZxFo9jk7WUTLECglga1R7P435MZZDXA:jPNVfsQZoL5NJdo9jKWergS89P4qZZc
MD5:	FF2293FBFF53F4BD2BFF91780FABFD60
SHA1:	61A9EDCF46228DC907AD523AA6FD035CC26C9209
SHA-256:	B9BC473FC866909F089E005BAF2537EE7FF2825668D40D67C960D5C2AFB34E9F
SHA-512:	C31A0046BA580926097422DF34619B614AA0DEB6435EC5CE68A553846FAD15BC61908B8C8292D25EE061BA1974637A7B91D72F19CCCCC2C76B9AC737B1CB4A5E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: 5GOuTtZoQn.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe, Detection: malicious, Browse Filename: JuHVfiAuLo.exe, Detection: malicious, Browse Filename: LXbM8RbhLa.exe, Detection: malicious, Browse Filename: EiPVv5yELP.exe, Detection: malicious, Browse Filename: 6IMo1kM9CC.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.2850.19434.exe, Detection: malicious, Browse Filename: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........................................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1E47.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6642176
Entropy (8bit):	7.866419732571782
Encrypted:	false
SSDEEP:	98304:LqhZ67opwYckx35SF2XKgxVvHuCPU8GSbO3JAXV1LrA+ZlL9CxpzTp2:LgErupSgKORuCT43JeV1LE+/s3p
MD5:	BD2EAC64CBDED877608468D86786594A
SHA1:	778AD44AFD5629F0A5B3B7DF9D6F02522AE94D91
SHA-256:	CAE992788853230AF91501546F6EAD07CFD767CB8429C98A273093A90BBCB5AD
SHA-512:	3C8F43045F27ADDCB5FB23807C2CE1D3F247CC30DD1596134A141B0BBC7FA4D30D138791214D939DC4F34FD925B9EC450EA340E5871E2F4F64844226ED394312
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: 5GOuTtZoQn.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe, Detection: malicious, Browse Filename: JuHVfiAuLo.exe, Detection: malicious, Browse Filename: LXbM8RbhLa.exe, Detection: malicious, Browse Filename: EiPVv5yELP.exe, Detection: malicious, Browse Filename: 6IMo1kM9CC.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.2850.19434.exe, Detection: malicious, Browse Filename: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....U~f..............................M...........@...................................e...@..................................O......P......................@.......................................................@3..............................text...+........................... ..`.rdata...*..........................@..@.data.... ..........................@....vmpL.p.....0...................... ..`.vmpL.p@....@3.....................@....vmpL.p..]..P3...]................. ..`.reloc.......@........].............@..@.rsrc.......P...f....].............@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5239.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	modified
Size (bytes):	293869
Entropy (8bit):	5.61569579822855
Encrypted:	false
SSDEEP:	3072:lFi6z/VXzAf3ocMNqB3r1Josf+OMhERMlm+twHBumSYyDgIoIPM7l0UGHM7:lxFSIjs+OM2eLFmSFgIZk7+HM7
MD5:	60172CA946DE57C3529E9F05CC502870
SHA1:	DE8F59D6973A5811BB10A9A4410801FA63BC8B56
SHA-256:	42CEB2252FEC41FD0ACC6874B41C91E0BA07C367045D6A9A7850D59781C2584C
SHA-512:	15D37AF3CAB96FC9026A1898E09C775FE0D277098A3FE20C2E591272DE996A243850D43F3B48B4C037C5FED359E57795A7CF1652547D7AD8B16B186AB9508792
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........`..X............................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...X....`......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsh4B73.tmp\INetC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5239.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.668346578219837
Encrypted:	false
SSDEEP:	384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
MD5:	92EC4DD8C0DDD8C4305AE1684AB65FB0
SHA1:	D850013D582A62E502942F0DD282CC0C29C4310E
SHA-256:	5520208A33E6409C129B4EA1270771F741D95AFE5B048C2A1E6A2CC2AD829934
SHA-512:	581351AEF694F2489E1A0977EBCA55C4D7268CA167127CEFB217ED0D2098136C7EB433058469449F75BE82B8E5D484C9E7B6CF0B32535063709272D7810EC651
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9<.EXR.EXR.EXR.b.).LXR.EXS..XR.b. .FXR.b.(.DXR.b...DXR.b.*.DXR.RichEXR.................PE..L....I6V...........!.....8...P......Q?.......P...................................................................... G..l....?..d.......(...............................................................................P............................text....7.......8.................. ..`.data...<<...P.......<..............@....rsrc...(............D..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsh4B73.tmp\blowfish.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5239.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.674611218414922
Encrypted:	false
SSDEEP:	384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
MD5:	5AFD4A9B7E69E7C6E312B2CE4040394A
SHA1:	FBD07ADB3F02F866DC3A327A86B0F319D4A94502
SHA-256:	053B4487D22AACF8274BAB448AE1D665FE7926102197B47BFBA6C7ED5493B3AE
SHA-512:	F78EFE9D1FA7D2FFC731D5F878F81E4DCBFAF0C561FDFBF4C133BA2CE1366C95C4672D67CAE6A8BD8FCC7D04861A9DA389D98361055AC46FC9793828D9776511
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................6..........dD.......P....@.....................................................................Y.......................................p...................................................................................CODE....\|4.......6.................. ..`DATA....8....P.......:..............@...BSS..........p.......L...................idata...............L..............@....edata..Y............P..............@..P.reloc..p............R..............@..P.rsrc................V..............@..P.....................X..............@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsh4B73.tmp\nsProcess.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5239.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	4.666004851298707
Encrypted:	false
SSDEEP:	48:iYXzAm8HGJLvwM8GJFd6I7W4JtT2bxNNAa4GsNf+CJ8aYqmtlKdgAtgma1QvtCSJ:lz2mJkpGR6GY74GQ1YqmstgGCtR
MD5:	FAA7F034B38E729A983965C04CC70FC1
SHA1:	DF8BDA55B498976EA47D25D8A77539B049DAB55E
SHA-256:	579A034FF5AB9B732A318B1636C2902840F604E8E664F5B93C07A99253B3C9CF
SHA-512:	7868F9B437FCF829AD993FF57995F58836AD578458994361C72AE1BF1DFB74022F9F9E948B48AFD3361ED3426C4F85B4BB0D595E38EE278FEE5C4425C4491DBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.I...I...I...n\|f.L...I...Q...@..K...@..H...@..H...RichI...........PE..L...`..N...........!......................... ...............................`.......................................#....... ..<....@.......................P..\|.................................................... ..`............................text............................... ..`.rdata....... ......................@..@.data... ....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nshF9DF.tmp\liteFirewall.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	6.389604568119155
Encrypted:	false
SSDEEP:	1536:Dli3i1jKfTV0LzYpAzMk2nACScLw5jPAT:j9KLQ+ScLw5jPAT
MD5:	165E1EF5C79475E8C33D19A870E672D4
SHA1:	965F02BFD103F094AC6B3EEF3ABE7FDCB8D9E2A5
SHA-256:	9DB9C58E44DFF2D985DC078FDBB7498DCC66C4CC4EB12F68DE6A98A5D665ABBD
SHA-512:	CD10EAF0928E5DF048BF0488D9DBFE9442E2E106396A0967462BEF440BF0B528CDF3AB06024FB6FDAF9F247E2B7F3CA0CEA78AFC0CE6943650EF9D6C91FEE52A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W=.e9n.e9n.e9n...n.e9n...n.e9n..Bn.e9n.e8n.e9n.7.n.e9n...n.e9n...n.e9n...n.e9nRich.e9n........PE..L...,.N...........!.........^.......%...............................................3..................................`...$'..d....`.......................p...................................... ...@...............h............................text...1........................... ..`.rdata..P/.......0..................@..@.data........0......................@....rsrc........`.......*..............@..@.reloc.......p.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsp8FF8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	358363995
Entropy (8bit):	6.972150585647623
Encrypted:	false
SSDEEP:	3145728:KTzytRGD/CYRNIPKYTFBhfmOS9KBaVzTx9OSsKV97nM:KnUs4tvaVzTD99M
MD5:	5F9D89B40243E83C0B48206CE4EB77D1
SHA1:	477A019AB11E5793168B3E41D83B80A8AC8F1D43
SHA-256:	2BF31800E731EF63E7E5BDEECD87B50B349EC8F5C9D752AACB807AC0E82E95B9
SHA-512:	5B812C2D341FE8A9296EF68E416E0EFA8185FB3ECCEC0917AB206CD7639E1810E6444538B61583E2260F1A46D4209E1995CFBF940A1D9836C4155ADF0504940B
Malicious:	false
Reputation:	unknown
Preview:	........,.......................H...........................................................................................................................................................................................................................................................e...i...............j.......................3.......................................................................................................................t....V..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\setup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5239.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	107232830
Entropy (8bit):	7.999946456161068
Encrypted:	true
SSDEEP:	1572864:6F6Q78DDbO8pDfwpK5ZAQ5WKor2G5N6Y7ZxFo9jk7WUTLECglga1R7P435MZZDXA:jPNVfsQZoL5NJdo9jKWergS89P4qZZc
MD5:	FF2293FBFF53F4BD2BFF91780FABFD60
SHA1:	61A9EDCF46228DC907AD523AA6FD035CC26C9209
SHA-256:	B9BC473FC866909F089E005BAF2537EE7FF2825668D40D67C960D5C2AFB34E9F
SHA-512:	C31A0046BA580926097422DF34619B614AA0DEB6435EC5CE68A553846FAD15BC61908B8C8292D25EE061BA1974637A7B91D72F19CCCCC2C76B9AC737B1CB4A5E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........................................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_0

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Reputation:	unknown
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_1

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012096502606932763
Encrypted:	false
SSDEEP:	3:MsEllllkXl:/M/6
MD5:	259E7ED5FB3C6C90533B963DA5B2FC1B
SHA1:	DF90EABDA434CA50828ABB039B4F80B7F051EC77
SHA-256:	35BB2F189C643DCF52ECF037603D104035ECDC490BF059B7736E58EF7D821A09
SHA-512:	9D401053AC21A73863B461B0361DF1A17850F42FD5FC7A77763A124AA33F2E9493FAD018C78CDFF63CA10F6710E53255CE891AD6EC56EC77D770C4630F274933
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_2

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_3

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	modified
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\index

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlXillll:Ls3y/l
MD5:	DB61E4B8EF9C2D0BD0A5338188F42FAA
SHA1:	898D2C636CCFAA7AA67AB7470C24F9127D17C0B7
SHA-256:	83ED4C6E0E704EB5FAB00A089658965436F37E59A0EB1059D977BD7A8CE5D621
SHA-512:	4655413560A349BBD707714B1B644ED01B51F4605255B504AA22D1FBDE3C8056FE7243ACC1CE9EB73F3DFAA57AD67254F53F9C71B2E418C83286C3D34343AFD9
Malicious:	false
Reputation:	unknown
Preview:	.........................................q..z/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\Del.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.622398838808078
Encrypted:	false
SSDEEP:	96:QPjzIyfbInD3W0IwrBmEH7UewW4ORIhmY5XO40uK8DDzNt:pQIS0IwrJbU7W4kIX5e4kgF
MD5:	97D4D47D539CB8171BE2AEFD64C6EBB1
SHA1:	44ABF82DD553CCE0C1F41B9B78D853075DDD1F16
SHA-256:	8D996D5F68BF2248F223C4F3549303BC6A8EC58CC97FCB63B7BB7D8068850273
SHA-512:	7D402847B093E208410C695095DE815A3F5D5DA81630FD51C88C009C48C269D0EA5016D626351BB9D38862163FAD930645072C50ACCCD743DC0E19531A592FDE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....&.].........."...0.............64... ...@....@.. ....................................@..................................3..O....@.......................`.......2............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H........#...............1...............................................0..-.......(....r...p(.....(.......(....,...(....(........0..T........~....(.....~....(.....(....s....%.o....%.o....%.o....%.o....%~....o....(....&..&..........PP.......0..6.......(....(......( ...r...p~....r...p(!.....("...,...(#......0..........r...p.~$.....o%.....,..~....o&......,..o'....ra..p.~$.....o%.....,..~....o(......,..o'....r...p.~$.....o%.....,..~....o(......,..o'......&..*....4.......#..

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_0

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Reputation:	unknown
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_1

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012096502606932763
Encrypted:	false
SSDEEP:	3:MsEllllkXl:/M/6
MD5:	259E7ED5FB3C6C90533B963DA5B2FC1B
SHA1:	DF90EABDA434CA50828ABB039B4F80B7F051EC77
SHA-256:	35BB2F189C643DCF52ECF037603D104035ECDC490BF059B7736E58EF7D821A09
SHA-512:	9D401053AC21A73863B461B0361DF1A17850F42FD5FC7A77763A124AA33F2E9493FAD018C78CDFF63CA10F6710E53255CE891AD6EC56EC77D770C4630F274933
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_2

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_3

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\index

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlOlll:Ls3Oll
MD5:	61EF3959E29136AD02381999ADE98683
SHA1:	6CC43EB3382198AFA23EDA870A6DC77882893D58
SHA-256:	43D3AF9931FC93D7859034EAD0075F8F65F4CBDEA2D222CECAB3FE3BE9738A12
SHA-512:	B6E5FFD7FBCE515E688C491EB0377AFBDA2EDBEE7DC3755F57446FE786999A6F00B88EF978E35C882C09E9B019A0020371AD48D3096A5C6C3810E0D9707C8CAE
Malicious:	false
Reputation:	unknown
Preview:	............................................z/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	296448
Entropy (8bit):	5.660420770467009
Encrypted:	false
SSDEEP:	3072:xTpjI4TptgvmHMaellnhblkK0m2QEk0xjo4OVzdvayfvYn6A:ppbVtsg1e5b2Px2zdyyq
MD5:	7A3502C1119795D35569535DE243B6FE
SHA1:	DA0D16BC66614C7D273C47F321C5EE0652FB5575
SHA-256:	B18FEFB56ED7B89E45CEC8A5494FBEC81E36A5CB5538CCBB8DE41CCE960FAA30
SHA-512:	258B111AC256CD8145CBE212D59DFF5840D67E70EFFD7CDDC157B2A3461B398BBC3446004980131FAA6A8762C19305F56E7B793F045331B56B8BD17D85B884C4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....rf..............0.............>.... ........@.. ....................................@....................................O.......t............................................................................ ............... ..H............text...d.... ...................... ..`.rsrc...t...........................@..@.reloc..............................@..B................ .......H....... ...$...........D...p............................................(....s....Z..(....,...(....(.....(......(......(............~........0..W.......(....".....(......,..o....-...o.....+...( .....o....&..(!...-...........o"....."...BZ.......%..A.......0..Q.......(....(........,..o....-...o.....+...( .....o....&.._...(!...-...........o"..............!. A.......0..V.......(....(......,..o....-.~#.....o.....+...( ...."...B[..o....&..(!...-...........o"....*......

C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	462336
Entropy (8bit):	6.803831500359682
Encrypted:	false
SSDEEP:	6144:leSYvQAd10GtSV41OJDsTDDVUMle6ZjxLV/rHo0Oaaz2R9IY:oJBdBS4msNUCe65frHMnz2R9
MD5:	6DED8FCBF5F1D9E422B327CA51625E24
SHA1:	8A1140CEBC39F6994EEF7E8DE4627FB7B72A2DD9
SHA-256:	3B3E541682E48F3FD2872F85A06278DA2F3E7877EE956DA89B90D732A1EAA0BD
SHA-512:	BDA3A65133B7B1E2765C7D07C7DA5103292B3C4C2F0673640428B3E7E8637B11539F06C330AB5D0BA6E2274BD2DCD2C50312BE6579E75C4008FF5AE7DAE34CE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=N...........!................N#... ...@....@.. ..............................T.....@.................................."..O....@..P....................`......."............................................... ............... ..H............text...T.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................0#......H.......0U..l...........P%.../..P ......................................6..`N.?O...%.C.k_..d...I......5a.......9x......R...gg8...JM...`.[. .o..eE1$_.M.h.q.oz..1..........@....s.c/J..wk.D.....t..&...(.......0..2........r...p(....}.......}"....(........(.........(......r...p(....}.......}"....(........(......0..j.........o....-..s#...+..}......(......(......}.....(....s....}......}......}......(......%-.&r...p}......j(#...rr!..p.{.....{.....B...(....*..0..A........{..

C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	574376
Entropy (8bit):	5.8881470355864725
Encrypted:	false
SSDEEP:	12288:ZzfhypmNGgHA37YyUD1AboTf3xnpJbC8VGSBJjRuz7:ZoI1AbQf3xnpJbC8VLBJjRuz7
MD5:	8F81C9520104B730C25D90A9DD511148
SHA1:	7CF46CB81C3B51965C1F78762840EB5797594778
SHA-256:	F1F01B3474B92D6E1C3D6ADFAE74EE0EA0EBA6E9935565FE2317686D80A2E886
SHA-512:	B4A66389BF06A6611DF47E81B818CC2FCD0A854324A2564A4438866953F148950F59CD4C07C9D40CC3A9043B5CE12B150C8A56CCCDF98D5E3F0225EDF8C516F3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ot............" ..0.............6.... ........... ....................................@....................................O.......................................T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........f...P............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{E....3...{D......(....,...{D.....{F.......-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..

C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	561424
Entropy (8bit):	4.606896607960262
Encrypted:	false
SSDEEP:	6144:XqqUmk/Rik2rH6dl0/IaHNpOVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QyMYFLse:DUK
MD5:	928ED37DB61C1E98A2831C8C01F6157C
SHA1:	98103C2133EBDA28BE78BFE3E2D81D41924A23EE
SHA-256:	39F6A4DB1BE658D6BAFF643FA05AAE7809139D9665475BFCA10D37DCA3384F21
SHA-512:	F59387BFA914C7DB234161E31AD6075031ACA17AAEF4B8D4F4B95C78C7A6A8D0E64211566CA2FD4549B9DA45231F57A4191FBCD3809404653F86EE2ABD4937A4
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Newtonsoft.Json</name>.. </assembly>.. <members>.. <member name="T:Newtonsoft.Json.Bson.BsonObjectId">.. <summary>.. Represents a BSON Oid (object id)... </summary>.. </member>.. <member name="P:Newtonsoft.Json.Bson.BsonObjectId.Value">.. <summary>.. Gets or sets the value of the Oid... </summary>.. <value>The value of the Oid.</value>.. </member>.. <member name="M:Newtonsoft.Json.Bson.BsonObjectId.#ctor(System.Byte[])">.. <summary>.. Initializes a new instance of the <see cref="T:Newtonsoft.Json.Bson.BsonObjectId"/> class... </summary>.. <param name="value">The Oid value.</param>.. </member>.. <member name="T:Newtonsoft.Json.Bson.BsonReader">.. <summary>.. Represents a reader that provides fast, non-cached, forward-only access to s

C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	215862
Entropy (8bit):	5.849338245796311
Encrypted:	false
SSDEEP:	3072:rFi6z/VXzAf3oc8+vat7fvYnDAdOVz5kNx:rxFSI+y1qk6zuNx
MD5:	9D21A25AA1B5985A2C8CBCE7F7007295
SHA1:	86EBF56352B4DBB831FAE0CCA180B4ADD951240D
SHA-256:	E41F984C39183BA4FD1578134D71E203F4A7A8C23F278924562876326FC40EE2
SHA-512:	EE4A1AC97968F2DDA3C54A49AC33D3FCE28C4DAE72032D9FDD1F8D8BA41B07A1D78D15E11586DA54AD5E0F2BD4A48C79A0CBAC84DE3D957B2AC6C1B5F41A33BB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........................................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	875520
Entropy (8bit):	5.621956468920589
Encrypted:	false
SSDEEP:	12288:jsRfnBqqvFXWesd2HiZ9fyn+5FHrvUR1Qnzx7LuQ:jsRITeWAQ5vtu
MD5:	B03C7F6072A0CB1A1D6A92EE7B82705A
SHA1:	6675839C5E266075E7E1812AD8E856A2468274DD
SHA-256:	F561713347544E9D06D30F02A3DFCEC5FE593B38894593AEEDF5700666B35027
SHA-512:	19D6792EB9BA8584B94D0D59E07CE9D1C9C4DA5516490F4ABCE5AE0D7D55B357BDA45B2093B3E9EB9D6858061E9D3F530A6655C4779A50C911501AE23925C566
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..R...........p... ........... ....................................@..................................p..O.......x............................o..T............................................ ............... ..H............text....P... ...R.................. ..`.rsrc...x............T..............@..@.reloc...............Z..............@..B.................p......H....... .................................................................(......(......(....^.(.......=...%...}....:.(......}....:.(......}....^.(.......>...%...}....:.(......}.....(.............0..,.......(....o.......3......... ....3.(....-.....0..L.......~..... . ..(......(....-..(....r...p( ...,.......&...~....(!...,..("..............+1...........4.......~.....~......(.....~....,..(#...-.(....-..(....+.r...ps$...z(..........b.r...p(%...~.....(....&*.r

C:\Users\user\AppData\Roaming\GamePall\cef.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1946739
Entropy (8bit):	7.989700491058983
Encrypted:	false
SSDEEP:	49152:fpXzD2VLpS71ycdao6LreGCL/0jJZWOiBiXkbEia9T:xjyFgZ0Lr2/0jJU5BiIEN
MD5:	96AD47D78A70B33158961585D9154ECC
SHA1:	149BF6F6905A76B0CC9E9ACA580357BD6C3497A2
SHA-256:	C861117D1F1DBF02867B46FA87CB8C65C3213D196029EE81A02B617D131236E2
SHA-512:	6A971F742B5754EEF39C6C2C64DB13DFDCB74D8CB23833404E9EF5AD89E142278E5DF789F508DB561C5E957013AE0C60D002CDFA93BCD87CA4967D610DF1579B
Malicious:	false
Reputation:	unknown
Preview:	........V...f.....g.7........................!.....%....o8...).>...).F...).H...).X...).a...)i...).k...).q...)Lt...).v...)Tw...).x...).}...).....)I....)i....)....).....).....)L....)....)....)t....).....).....).....)s....).... )....!)....")....#)....$)}...%)+...&)h#..').'..().-..)).>..).A..+).C..,).Q..-)CU...).]..<).d..=).l..>)i...?)G...@)H...A)r...B)....C)z...T)....U)....V)+...W)....X)....Y)....Z)....[)#...\)}...]).!..^)R1.._).2..`).;..a).=..b)mE..c)QG..d).H..e)qL..f).U..g).]..h).b..i))d..j).e..k).g..l)Pi..m).p..n).z..s).z...).....)b....).....)'....).....)....)....).....).....)....).....)s....)F....)j....)....).....)....)....)....)h....)H....)....).....).....)k....).....)L....)q....)2....).....).....).....).....).....)N....)\|....).....).....).....).!...).)...).6...).C...)RE...).L...).N...).O...).U...)bV...).W...).^...)o_...)(g...)Si...).v...).....)0....)/....).....),....)..........F....]....3....v........v...................$... ....!8..."....#....$....%*..

C:\Users\user\AppData\Roaming\GamePall\cef_100_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	214119
Entropy (8bit):	7.955451054538398
Encrypted:	false
SSDEEP:	6144:m5S+8U5mtp0ra7rFrJzw95T9OHCZg0Gb0OveGe04mExhLY:mWU5OGUFoqoORehrQ
MD5:	391F512173ECEC14EB5CE31299858DE1
SHA1:	3A5A41A190C1FB682F9D9C84F500FF50308617FC
SHA-256:	E0F5C754C969CCA0AC4594A6F3F2C23D080A09EEA992AF29E19F4291FD1E0B06
SHA-512:	44D7B9BCB3544C3F5550150EF3522BF6A0B36900695E6A13E44F5616E16A058548189D4FEA4A22248B1CB2B273B0EAA7D559EB2D8F013BED520E4097BD45D800
Malicious:	false
Reputation:	unknown
Preview:	........................#.b...&.....:.g....7.....7.....7.....7\|(...7.-...7t5...7.6...7.9...7s:...7hB...7.E...7.G...7.K...7qN...7.Q...7yR...7.S...7.W...7.\...7.b...7.i...7.k...76m...7Vq...7.r...7.v...7.y...7.{...7.~...7Z....75....7;....7W....7.....7c....7u....7b....7.....7.....7.....7Q....7*....7\....8."...8,)..<FqG..=F7I..>F.L..?F$O..@F.P..AFaQ..BFnT..CF.W..DF.Y..EFJ\..FF.^..MF(b..NF.c..QF.e..RF.f..YFZg..ZF.p..[F.x..\F.{..]F.{...L.\|...L.....L....Ni....N.....NJ....N2....N+....N^....No....N9....NK....N....N1....N$....N....Nh....N.....N.....U.....U.....U.....U.....U.....U[....U.&...Uh(...U?/...U.4...U.:...U.@...U.B...U,G...U.K...U)N...U.R...UF\...U.`...U.b...U.j...U]s...UEt...U.u...U.w...U.z...Uh{...U.}...U#....U.....U^....U.....U\|....U.....U.....U.....U.....U.....U.....U.....U.....U.....U]....U?....U.....U9....U....U.....Um....U<....U!....U.....U.....U....Uq....U3....U!....U.....U....U.....Uu....UJ....U.....U.....U.....U.....U`....U'....U.....U.....Ul....U%....U7....U.....U.....UW.

C:\Users\user\AppData\Roaming\GamePall\cef_200_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	290001
Entropy (8bit):	7.9670215100557735
Encrypted:	false
SSDEEP:	6144:tS+8U5mtp0ra7rFriDQYaF+9bQHgs4jTlmOHCZVWGMRe8InVXYopym74:CU5OGUFrfs4gs4jTQ6ebVIo374
MD5:	BF59A047984EAFC79E40B0011ED4116D
SHA1:	DF747125F31F3FF7E3DFE5849F701C3483B32C5E
SHA-256:	CD9BE67AA0527F16E309189FA2369E1A2596D0601A7D55C405F8A619F4D095E9
SHA-512:	85A545758E8C89EF47BF11B553C57D23ED7DA6AE89A8BCCB262F509AABE61A1121C3F87EC9200791F2670225BAEECC3C92AED6AFDA86C08CA0FD611DA2E595D2
Malicious:	false
Reputation:	unknown
Preview:	........................#.....&.....:......7.....7.....7.....7.+...7.1...7.8...7.9...7)<...7.=...7xE...7.H...7.J...7'N...7.Q...7.T...7.U...7.W...7.Z...7._...7.e...7.l...7.n...7Fp...7ft...7.v...7)y...7.\|...7.~...7.....7j....7E....7K....7g....7.....7s....7.....7r....7.....7.....7.....7a....7:....7l"...8.%...8<,..<F.J..=F.N..>FtV..?F9\..@Fw_..AFr`..BF0g..CFll..DF\|o..EF.v..FF){..MF....NF...QFf...RF....YF`...ZF...[F....\F....]F....L....L.....L.....N.....N.....N.....N.....N.....N.....N.#...N.&...N.'...N.)...N....N.+...Nv,...N.-...N;r...N.\|...Um....U.....UM....UV....U.....U....UC....U.....U....UM....U.....U.....Um....U.....U.....U.....U.....UQ....U.....U7....U.....U.....Uk....U.....U.....U.....U.....U.....U.....U.....U.....U.....U{....U.....U.....U.....U~&...U.)...U.Q...U.Q...U.V...U.[...U.\...U._...U.`...U?a...U.a...Uic...U.d...U\f...U.g...U.i...U1l...U.p...U.u...U.}...U.....U.....U^....U.....U.....Ux....U....U.....Uy....U6....U.....U....UR....Uq....U.....U.....U_....U.....U.....U..

C:\Users\user\AppData\Roaming\GamePall\cef_extensions.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1305142
Entropy (8bit):	7.99463351416358
Encrypted:	true
SSDEEP:	24576:8AkckSbnVLjWG13xdT0b+SLzRYt2k+lbG9EjJNH/osm22O+EcRfPLP:88zVXWG1hdAKSxY4k5EFNHgvPPLP
MD5:	20DDA02AF522924E45223D7262D0E1ED
SHA1:	378E88033A7083AAC24E6CD2144F7BC706F00837
SHA-256:	8448C2BA10A3D7DC8CA3FB24F580BF99D91F746107B1A06E74932749CC1CAB01
SHA-512:	E71320B2AA0CB52938206EC00187D78274646C4C7D3579B33A0163262C063B7813FE7ACD0D2E5807082ADE772069AA577FED7F594964790C2F7C061CE38467B6
Malicious:	false
Reputation:	unknown
Preview:	........i...f+....i+....l+....m+{...n+q...o+7(..p+.1..q+X3..r+~5..s+aI..t+.]..u+.f..v+Ui..w+'k..x+.l..y+.q..z+.s..{+O{..\|+...}+=...~+.....+....+-....+.....+.....+.....+.....+.....+.....+.....+.....+.....+%....+.....+&(...+.Q...+.Y...+Xe...+Bj...+cv...+.}...+....+H....+....+Q....+l....+I....+.....+ ....+T....+!....+m....+.....+.....+U....+.....+.....+.....+l....+~....+.....+=....+w....+.....+-"...+.(...+.0...+.2...+.4...+.G...+uS...+.....+9....+y....+.....+.....+N....+....+0....+.....+.....+.....+_....+.....+.....+.....+.....+.....+.....+.....+.....+S....7`....7R...(7/...)7.....L.m...LO....L.....Mk....M.....M.....M>....M.....M.....Mq....M.....M.....M\....M.....M.....M.....M.....M.....M.....M.....M.....M.....MO....M.....M.....M.!...M.(...Mf5...M.;...M&E...M.P...M.T...M<]...M.`...M.j.. M.k..!M2v.."M.w..#M.z..$M....%M...&M...'M#...(M@...)M....*M(...+MY...,Mu...-M$....M..../MV...0M;...1Mx...2M....3M....4Mi...5M....6M....7MP...8M"...DM....EM.....Mi....M.~...M.~...Mb....M_....M....M.

C:\Users\user\AppData\Roaming\GamePall\cef_sandbox.lib

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	87182312
Entropy (8bit):	5.477474753748716
Encrypted:	false
SSDEEP:	196608:v0b1XAJ5V8XYcrfCNJsTtU0ZhdYHbgMnn6d25JOcLRiLnIrBcnK0EAeg1GF:78JaNJyZhdE6383rWEAR8
MD5:	FFD456A85E341D430AFA0C07C1068538
SHA1:	59394310B45F7B2B2882D55ADD9310C692C7144F
SHA-256:	F188B96639B5157E64222BB8483D76CD21A99141FC2614EF275E20639C739264
SHA-512:	EB4CB388383CB37B1D89531D560169985A80DF9335F005AFBBFDE56F9031821A933D735138B1086CF81D006E480FF14711A8A95B3DB8A0FD4037AA6EFD926B50
Malicious:	false
Reputation:	unknown
Preview:	!<arch>./ 1696073295 0 1940897 `...Y..:.t.:.>.:...:...:...:...:...;/..;/..;/..;/..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..@...@...@...@...@...A...A...A...A...A...A...A...A...A...A...A...A...Co..Co..Co..Co..Co..Co..Co..Co..Co..Co..E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...G..G..G..G..G..G..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=.

C:\Users\user\AppData\Roaming\GamePall\chrome_100_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	656926
Entropy (8bit):	7.964275415195004
Encrypted:	false
SSDEEP:	12288:fI3Hdjzgsz5B0GDJQrnKs8SNP+QSsSilRBdNze0Vc+gIXgt4z8oO0TehEr7:g397zEEmPLSOdNze05gUgmz8oO0TOW
MD5:	3404DD2B0E63D9418F755430336C7164
SHA1:	0D7D8540FDC056BB741D9BAF2DC7A931C517C471
SHA-256:	0D3FCA7584613EB1A38BAF971A7DD94F70803FC130135885EC675E83D16A4889
SHA-512:	685D63633DB8A57D84225C2B92C92016E1CE98BA2BF8D3DDACE2EB120B3BCF84C718787D59DB6EC61F34CF91CB651500B4E4FF0AC37AEB89561CDCC586946C80
Malicious:	false
Reputation:	unknown
Preview:	..........+...........................&..........;.....;N....;.....;"....;.....;.....;N....;.....;.....;s....;....;.....;.....;....;4....;.....;.....;0....;.....;c....;7....;.....;.....;.....;.....;?....;:....;G....;.....;n....;x....;.....;.....;.....;#....;.....;.....;B....;.....;.....;.....;N....;.....;.....;+....;.....;% ...;c!...;.!...;."...;E+...;t4...;qH...;I\...;.]...;.^...;>a...;.c...;.g...;.o...;pw...;.\|...;h....;.....;.....;....;.....;....;o....;.....;.....;.....;....;y....;.....;.....;3....;9....;h....;.....;.....;.....;F....;."...;.+...;.0...;.8...;?:...;'X...;.q...;.....;....;.....;t....;.....;.....;.....;./...;.X...; m...;....;.....;.....;.....;+....;.....<O....<.....<.....<=....<2$...<y+...<.3...<.<...<aA...<.L...<.W...<.[...<._...<.d...<Dv...<t....<!....<....<....<.....<.....<.....<V....<.....<.#...<.8...<\|F...<hP...<bW.. <i^..!<ts.."<(...#<{...)<`...<c...+<d...,<"...;<x...<<k...=<....><-...?<....@<....A<'...B<g...C<....D<U...E<....F<....G<....J<....K<....L<v%

C:\Users\user\AppData\Roaming\GamePall\chrome_200_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1017158
Entropy (8bit):	7.951759131641406
Encrypted:	false
SSDEEP:	24576:m3Tl5zLmmibkFR8+mZRUumegvQtc05UwvdAbatzk6edhOLoe9:m3Tl53mNbkFRJmHURhQW05JvdlzkjrOH
MD5:	3FBF52922588A52245DC927BCC36DBB3
SHA1:	EF3C463C707A919876BF17C3E1CD05C0D2C28CA9
SHA-256:	C6FE346106C5E4950161ED72EB0A81FE3537A94E4A59461AAF54E750D1904F76
SHA-512:	682EB6D61B564C878FDB971A6439FCDA9F1E108BD021A32E8990B68B1338986A4866A0965DEA62567501C8826D43CEBF2B7C8BE8323DE415A75E8D89A9D592E7
Malicious:	false
Reputation:	unknown
Preview:	..........+.....................b................;.....;&....;.....;.....;.....;.....;b....;....;8....;.....;.....;o....;....;<....;.....;.....;l....;....;/....;.....;[....;Q....;.....;j....;.....;.....;L'...;.E...;lZ...;.o...;.q...;.r...;.s...;.{...;.{...;.~...;"....;.....;U....;.....;.....;.....;....;d....;.....;.....;i....;.....;f....;....;0....;.....;.....;.(...;+...;.+...;A....;54...;.9...;,O...;.`...;.n...;.~...;.....;.....;M....;....;;....;q....;Z....;.....;.....;.-...;\=...;.P...;.d...;@\|...;.....;Y....;#....;_....;/....;.....;.#...;.;...;.J...;gc...;cf...;W....;....;W....;.....;.....;.....;7....;.-...;.I...;Y\...;W....;....;.....;S....;.....;t....;.....;.....<W....<.&...<9<...<iG...<jQ...<.X...</a...<gi...<.n...<Pz...<.....<f....<.....<I....<.....<.....<.....<4C...<4d...<....<....<.....<.....<.....<D8...<.e...<_....<....<.... <I...!<...."<.E..#<.E..)<.G..<%j..+<N...,<....;<....<<v...=<....><....?<....@<y...A<....B<....C<....D<....E<"F..F<.J..G<.O..J<.X..K<.e..L<.r

C:\Users\user\AppData\Roaming\GamePall\chrome_elf.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1174528
Entropy (8bit):	6.475826085865088
Encrypted:	false
SSDEEP:	24576:I3lp87thPKuxyj+tWF8lCwOvzr90p5OM3:FauY+tWF8b5OM3
MD5:	207AC4BE98A6A5A72BE027E0A9904462
SHA1:	D58D2C70EA0656D81C627D424F8F4EFCCEF57C86
SHA-256:	2BA904DA93ACC4766639E7018AC93CC32AA685DB475F3A59B464C6BC8B981457
SHA-512:	BFB6C58774829DB3D5FADC92CB51477FF4EAC8FB934DB6583A312BB1157468F6DD3A4A3AFAF25A687B74890DC8A69857A12D0B38B18D83E82836E92E02046FF3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....v...p......P.....................................................@A........................vT......AX..<.......x...........................<<.......................;......(...............<[.......O.......................text....u.......v.................. ..`.rdata..\............z..............@..@.data...H...........................@....00cfg...............F..............@..@.crthunk.............H..............@..@.tls.................J..............@...CPADinfo(............L..............@...malloc_h.............N.............. ..`.rsrc...x............P..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2106216
Entropy (8bit):	6.4563314852745375
Encrypted:	false
SSDEEP:	49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
MD5:	1C9B45E87528B8BB8CFA884EA0099A85
SHA1:	98BE17E1D324790A5B206E1EA1CC4E64FBE21240
SHA-256:	2F23182EC6F4889397AC4BF03D62536136C5BDBA825C7D2C4EF08C827F3A8A1C
SHA-512:	B76D780810E8617B80331B4AD56E9C753652AF2E55B66795F7A7D67D6AFCEC5EF00D120D9B2C64126309076D8169239A721AE8B34784B639B3A3E2BF50D6EE34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.h...;...;...;..];...;...;...;.._;...;..h;0..;..i;'..;..X;...;..l;D..;?M.;...;..Y;...;..^;...;Rich...;........PE..L...92.K...........!.........d...............................................p .....O. ...@.........................@.......@...P..................... .h............................................i..@............................................text...S........................... ..`.data....~.......B..................@....rsrc................(..............@..@.reloc..D............,..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4127200
Entropy (8bit):	6.577665867424953
Encrypted:	false
SSDEEP:	49152:OS7PQ+besnXqRtHKzhwSsz6Ku1FVVOsLQuouM0MeAD36FqxLfeIgSNwLTzHiU2Ir:O4PhqqFVUsLQl6FqVCLTzHxJIMd
MD5:	3B4647BCB9FEB591C2C05D1A606ED988
SHA1:	B42C59F96FB069FD49009DFD94550A7764E6C97C
SHA-256:	35773C397036B368C1E75D4E0D62C36D98139EBE74E42C1FF7BE71C6B5A19FD7
SHA-512:	00CD443B36F53985212AC43B44F56C18BF70E25119BBF9C59D05E2358FF45254B957F1EC63FC70FB57B1726FD8F76CCFAD8103C67454B817A4F183F9122E3F50
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!7P.OdP.OdP.Od..NeR.OdP.Nd..OdY..dU.Od.Jem.Od.KeQ.Od...dQ.Od..Leo.Od..Je..Od..OeQ.Od..Ge..Od..Kec.Od...dQ.Od..MeQ.OdRichP.Od................PE..L..................!.....2<..*...............P<...............................?.......?...@A.........................<<.u.....=.P.....=.@.............>..%....=.........T....................u..........@.............=..............................text...e0<......2<................. ..`.data...`"...P<......6<.............@....idata........=.......<.............@..@.rsrc...@.....=.......<.............@..@.reloc........=.......<.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\devtools_resources.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	2205743
Entropy (8bit):	7.923318114432295
Encrypted:	false
SSDEEP:	49152:qHlbrhXKMVp/DVegxF2Xe1WFG4F3KMWB7rwz3yY+23:qFnhXKwggr0cWEgaMi7rwrw23
MD5:	54D4E14BFF05C268248CAB2EEDFB61DD
SHA1:	33AF472176F6E5FB821FFE23C9FBCCC7C735B5B9
SHA-256:	2CAC401BFFA9FD4DFFE11E05EE18FC5CA7A30EC5BF7EF6A3EA8518A4F3344790
SHA-512:	5A6893E7EA30EAA0EFF44687B0D15366A8224E476E4AE8FE0D5C7EF2B3C62E6B0184F73EAD36C4E4E08D6936524CEF8429660B3EC29453EED128E3C5368CE78C
Malicious:	false
Reputation:	unknown
Preview:	........K....[.....[.....[.....[Y....[.....[.....[.....[.....[P ...[.!...[."...[.#...[.$...[.%...[.%...[T&...[0'...[/(...[.(...[.(...[....[.+...[{,...[1-...[.-...[3....[b/...[.0...[.1...[.2...[.3...[,4...[.4...[P5...[.5...[#6...[!8...[.8...[.9...[.9...[::...[q;...[Y=...[.=...[ ?...[.@...[0A...[iB...[?D...[.E...[pE...[UF...[.G...[.H...[)I...[.I...[.M...[.M...[DN...[.N...[FO...[.O...[.Q...[oV...[uW...[cX...[[\...[.]...[Ea...[bc...[.c...[ d...[.d...[oe...[.f...[.h...[.i...[Xj...[.k...[.l...[An...[.o...[.p...[.....[....[.....[.....[.....[.....[[!...[.%...[d....[x1...[.4...[.4...[.9...[.C...[.Q...[KS...[#V...[=]...\.b...\.z...\Q}...\.....\.....\....\`....\.^...\7b...\uy...\g....\.....\.....\=....\....\....\....\'....\.....\....\.... \....!\...."\....$\....%\....&\....)\....\....+\.Q..,\.S..-\.U...\..../\w...0\....1\8...2\....3\....4\....5\....6\....7\.T..8\.z..9\6...:\....;\c...<\)&..=\...>\>5..?\JU..@\.r..A\....B\9...C\....D\S...E\....F\\y..G\Y...H\%...I\....J\M...K\.a..L\.j..M\.n

C:\Users\user\AppData\Roaming\GamePall\icudtl.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	10717392
Entropy (8bit):	6.282534560973548
Encrypted:	false
SSDEEP:	196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
MD5:	E0F1AD85C0933ECCE2E003A2C59AE726
SHA1:	A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
SHA-256:	F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
SHA-512:	714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
Malicious:	false
Reputation:	unknown
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW..K..P...L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

C:\Users\user\AppData\Roaming\GamePall\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	377856
Entropy (8bit):	6.602916265542373
Encrypted:	false
SSDEEP:	6144:oJ4tr7XVkL/2qBCOeRMIKVpqtXmzKwdo23zqyU73omBT095OiZH:2NfBCOeR/KVpqtio23zqyOsOo
MD5:	8BC03B20348D4FEBE6AEDAA32AFBBF47
SHA1:	B1843C83808D9C8FBA32181CD3A033C66648C685
SHA-256:	CBEE7AC19C7DCCCA15581BD5C6AD037A35820DDFE7C64E50792292F3F2E391E6
SHA-512:	3F9EEC2C75D2A2684C5B278A47FB0E78B57F4F11591FAC4F61DE929F716BBAA8F7DF05E10390408AD6628538611541548C26869822372E9C38D2C9C43881651E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....`...`............................................... ............@A........................8,..h....:..(.......x........................>..........................D........p..............(<..`............................text....^.......`.................. ..`.rdata..L....p.......d..............@..@.data....4...p.......`..............@....00cfg...............\|..............@..@.tls.................~..............@....rsrc...x...........................@..@.reloc...>.......>..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6635008
Entropy (8bit):	6.832077162910607
Encrypted:	false
SSDEEP:	196608:HrmMLEFtac5bM68f8Oi3WjH13GzSW3430aTwQCe:a+ktad68f8Oi3oH13GztokaTwbe
MD5:	63988D35D7AB96823B5403BE3C110F7F
SHA1:	8CC4D3F4D2F1A2285535706961A26D02595AF55C
SHA-256:	E03606B05EEAED4D567EA0412350721C0D566B3096B18C23BD0B3FCDE239E45A
SHA-512:	D5F5ACA00BE9E875FCD61531CC7F04F520FB12999E36E4FE06BEAAE491B47D2E9FE182015DB1CBFBB8E78CF679F2EB49E20ECDF1B16D1D42058D6F2D91BC3359
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!......L...........@.......................................e...........@A.........................].......^.d.....a.......................a.."...U]......................T].....X.L.............H.^.@.....].@....................text.....L.......L................. ..`.rdata...I....L..J....L.............@..@.data...X....._.......^.............@....00cfg........a.......a.............@..@.tls..........a.......a.............@....rsrc.........a.......a.............@..@.reloc..."....a..$....a.............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\libcef.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176517632
Entropy (8bit):	7.025874989859836
Encrypted:	false
SSDEEP:	1572864:VSuR7JVHywK/Sf1rWID4Pu2v8zgguHWJEqM90Hw4DclJkBLrWXmfnehuWNIPKtlL:MCYRNIPKYTFBhfmOS9KBaVz
MD5:	F5259CC7721CA2BCC8AC97B76B1D3C7A
SHA1:	C2FC0C8396D8CD6764809A2A592972E2EBCA64BA
SHA-256:	3FE6A262EF01CB8FD4DC2D4373DE0F1F0A89EE51953452ED4557CB55F1DA9AB4
SHA-512:	2D01B1F2B24717EFF37965BBC32D167434A65F3DFFF74342D2E2FA8FBB0E97C3F61FDF673A13AD63031D630D9CE46A6F9F0C4F89EBD30C31F3EA55817B9D1331
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.........N.......k....................................................@A........................#..........h....0J.(C....................L.\|.\.P................................?..............`.......LY..@....................text............................... ..`.rdata...%2..0...&2.................@..@.data...dr+..`.......>..............@....00cfg........I.......&.............@..@.rodata.@.....I.......&............. ..`.tls..........J.......&.............@...CPADinfo(.....J.......&.............@...malloc_h..... J.......&............. ..`.rsrc...(C...0J..D....&.............@..@.reloc..\|.\...L..0\..B).............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\libcef.lib

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	40258
Entropy (8bit):	4.547436244061504
Encrypted:	false
SSDEEP:
MD5:	310744A0E10BD9C2C6F50C525E4447F9
SHA1:	9BA62D6AC2CB8EFF46C9B21051677FC1DC66D718
SHA-256:	E9C55CFF925E26812139CDCAD6612E0D69E317CB7BB1435C9EB5113D338ACCE7
SHA-512:	6DF9E3F9AFD7CDEC750B006987E5AEC445E163DD0B9CF1A9EA53F78DB2EE5FD654E3B4F82BCA3E1F4BEDB189F5DFA51189C820905676AD048DBE2E0AD405BF5B
Malicious:	false
Reputation:	unknown
Preview:	!<arch>./ 0 0 0 0 14390 `.......8z..:&..:...;...;...<&..<&..<...<...=...=...=...=...>...>...>...>...>...>...?f..?f..?...?...@B..@B..@...@...A$..A$..A...A...B"..B"..B...B...C...C...C...C...D...D...D...D...D...D...E...E...E...E...Fn..Fn..F...F...GZ..GZ..G...G...HJ..HJ..H...H...I$..I$..I...I...J...J...J...J...K ..K ..K...K...L...L...L...L...M...M...M...M...N...N...N\|..N\|..N...N...Od..Od..O...O...P`..P`..P...P...QP..QP..Q...Q...RT..RT..R...R...S@..S@..S...S...T...T...T...T...U...U...Un..Un..U...U...VP..VP..V...V...W,..W,..W...W...X...X...X...X...X...X...Y\..Y\..Y...Y...ZB..ZB..Z...Z...[,..[,..[...[...\...\...\...\...\...\...]b..]b..]...]...^N..^N..^...^..._6.._6.._..._...`$..`$..`...`...a...a...a...a...b...b...b...b...c...c...c...c...c...c...dj..dj..d...d...e^..e^..e...e...fV..fV..f...f...g8..g8..g...g...h..h..h...h...i"..i"..i...i...j...j...j...j...k...k...k...k...l...l...l...l...l...l...mh..mh..m...m...nN..nN..n...n...o2..o2..o...o...p...p...p.

C:\Users\user\AppData\Roaming\GamePall\locales\af.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	470498
Entropy (8bit):	5.409080468053459
Encrypted:	false
SSDEEP:
MD5:	64F46DC20A140F2FA3D4677E7CD85DD1
SHA1:	5A4102E3E34C1360F833507A48E61DFD31707377
SHA-256:	BA5CA0A98E873799A20FD0DF39FDB55AAB140E3CC6021E0B597C04CCE534246D
SHA-512:	F7D789427316595764C99B00AF0EF1861204F74B33F9FAB0450F670CB56290C92BFB06EF7D1D3B3BF0B6ACDC6295E77F842C49579BD9973E3D5805920CDB2527
Malicious:	false
Reputation:	unknown
Preview:	........$$..e.>...h.F...i.N...j.Z...k.i...l.t...n.\|...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................&...........5.....<.....C.....D.....E.....J.....W.....f.....w.................x.................A.......................S.........................................%.....{.......................V.......................J.......................Y.......................e.......................a.......................l...................................O.....f.......................).....z.......................6.....u.......................Q.......................E.....w.................!.....I.....R.............................l.......................f.................+.............................f.......................D.......................<......................._.......................2.....~.................2.....v.................X...........$.....8.................P.....r...........6.....j.....}.................1.....?...................

C:\Users\user\AppData\Roaming\GamePall\locales\am.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	763010
Entropy (8bit):	4.909167677028143
Encrypted:	false
SSDEEP:
MD5:	3B0D0F3EC195A0796A6E2FAB0C282BFB
SHA1:	6FCFCD102DE06A0095584A0186BD307AA49E49BD
SHA-256:	F9F620F599BC00E84A9826948C3DA985AC9ADB7A6FFB4C6E4FBEFEAF6A94CF85
SHA-512:	CA9217F22C52EF44E4F25142D1AD5DD9D16E4CCC3B6641609E1F4C2650944E35BA4CAB59CA5CD9EA6FEFD6BE1D3E8227FC0E3E6BDEDD14B059CA2C72D096D836
Malicious:	false
Reputation:	unknown
Preview:	........>${.e.r...h.z...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.(...\|.....}.@.....H.....M.....U.....].....e.....l.....s.....z.....{.....\|...............................................F.....f.....'...........V...........Y.............................5.................F.................!.................d.....z...............................................C...........\.................z...........h...........3...........$.....C.................e.................i.................,.......................X.............................h.......................!.....\|...........$.............................1.....}.........................................Z.................\|...........'.....N...........F.................;.............................G.................v............ ....4 ..... ....X!.....!.....!....x"....."....Z#.....#....M$.....%.....%.....%.....&....+'.....'.....'.....(....D).....).....)....2....................+....",.....,

C:\Users\user\AppData\Roaming\GamePall\locales\ar.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	838413
Entropy (8bit):	4.920788245468804
Encrypted:	false
SSDEEP:
MD5:	C70B71B05A8CA5B8243C951B96D67453
SHA1:	DEED73A89F0B3EDAB8FF74117CC6B31CB4F426E8
SHA-256:	5E0D4BC0893A334B6FFF610F66E4A00920530D73EC3257EB9D37A96EBD555C13
SHA-512:	E000FD3592AC5FE700C4CE117868915C066AC66D5954A1DE4F5AFF0F4559C93F7DFF47623F1837CE827FFF94E91ECD89A974037BE9CCCC8E672E229A1E8115E9
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.!...n.)...o.....p.;...q.A...r.M...s.^...t.g...v.\|...w.....y.....z.....\|.....}.........................................................................-.....d.................n...........A...........u.......................O.......................D.................Y...........3.....J...........=.....g.....~.....&.................O.......................B.....!...........u...........5...........).....W.................3.....N.....U.....B...........!.........../.....Y........... .......................g...........).....I.................#.....A...........@.................6........... .....D...........I.................%.............................=.................?...................................G...................................).....t............ ..... ..... ..... ....o!.....!....6"....\"....."....S#.....#.....#.....$.....%....V&.....&....5'.....'.....(....J(.....(....X).....).....).........z..............t+.....,....{,.....,....--

C:\Users\user\AppData\Roaming\GamePall\locales\bg.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	869469
Entropy (8bit):	4.677916300869337
Encrypted:	false
SSDEEP:
MD5:	12A9400F521EC1D3975257B2061F5790
SHA1:	100EA691E0C53B240C72EAEC15C84A686E808067
SHA-256:	B7FD85B33B69D7B50F6C3FDC4D48070E8D853C255F2711EEDAA40D1BA835F993
SHA-512:	31EAA1CBF13BC711750B257C6B75813ACC8E4E04E9262815E399A88B96BA7B5BE64CE2450638B5521D5CB36750C64848944168C3234D2CE15A7E3E844A1E1667
Malicious:	false
Reputation:	unknown
Preview:	........%$..e.@...h.H...i.P...j.\...k.k...l.v...n.~...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}................... .....(.....0.....7.....>.....E.....F.....G.....L.....n...................................I...........Q...........q.......................T.................E.......................7.....~...........<.................:.....&...........F.................X...........$.................Z...........X...........m.................C.........................................{...........:.....a...................................8................._...........O.....}...................................$.....h.........................................2.............................3 ....e .....!.....!.....!.....".....".....#....W#.....#....{$....-%.....%.....%.....&....k'.....'....T(.....).....).....).....).....*....`+.....+.....+.....,....p-.....-....&....../...../.....0.....0.....1....o2.....2....73.....4.....4.....4....-5.....5....X6.....6.....6.....7.....8.....9

C:\Users\user\AppData\Roaming\GamePall\locales\bn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1118348
Entropy (8bit):	4.2989199535081895
Encrypted:	false
SSDEEP:
MD5:	89A24AF99D5592AB8964B701F13E1706
SHA1:	2177122C6DCC20E1D07EF43AF5A112E8E5C6B95B
SHA-256:	5BDBBCD0D07B6AE3A7F96F07871EE541F4111D90D73FD6E112C5ABE040025C96
SHA-512:	60F6CD73BF35886EF54FA6200F86BCED78DD11F612C8071F63EB31108F109C166D45609879E8E5107024A025BAFCFCF1C80051B6D8FF650D92DCF17136384EB1
Malicious:	false
Reputation:	unknown
Preview:	........($..e.F...h.N...i._...j.k...k.z...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......#.....(.....0.....8.....=.....E.....L.....S.....Z.....[.....\.....a.............................=.....G...........?.....4...........................................................B.....}.....>...........k...........X...........].............................q.....W...................................W...........S...........e.............................I.....m.....e..........._.....(.................9...........q.................p...........5.....X.....8...........Q...........M...........I.....u.....-...........!.....G............ ..... ..... .....!....P".....".....".....#.....%.....%.....&.....'.....'....^(.....(....;).....).........6.....+.....+....1,....],....E-................-/...../....x0.....0.....0.....1.....2.....2.....3...."4.....4....x5.....5.....6....78....*9....]9.....:.....;....;<.....<.....=....?>.....>.....>.....?....y@.....@.... A....&B.....B

C:\Users\user\AppData\Roaming\GamePall\locales\ca.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	537139
Entropy (8bit):	5.397688491907634
Encrypted:	false
SSDEEP:
MD5:	37B54705BD9620E69E7E9305CDFAC7AB
SHA1:	D9059289D5A4CAB287F1F877470605ED6BBDA2C8
SHA-256:	98B2B599C57675EFC1456B38B23CE5657B142E0547F89AB1530870652C8EB4BA
SHA-512:	42D667FEB59BB5FA619AC43DC94629ED1157CBE602643FB21378A2C524EF1F6E32098E7C62D3F3DE35D9FEDEF6607FE034908601AE3C49156CD0916E2514D2F9
Malicious:	false
Reputation:	unknown
Preview:	........%$..e.@...h.H...i.P...j.\...k.k...l.v...n.~...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}................... .....(.....0.....7.....>.....E.....F.....G.....I.....c.....\|................._...........[.....z...........O.................D...........(.....G.................B....._.................A.....T.................8.....I...........3.....u...........(.......................p.................,.......................1.................T.....o.............................v.......................b.......................@.......................@.......................O.......................<.............................`.......................P.........................................M.......................H......................._.........................................n.......................Q.......................[.............................1.................>.........................................6.............................\|...........".....>.

C:\Users\user\AppData\Roaming\GamePall\locales\cs.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	545011
Entropy (8bit):	5.844949195905198
Encrypted:	false
SSDEEP:
MD5:	65A2C2A73232AB1073E44E0FB6310A5F
SHA1:	F3158AA527538819C93F57E2C778198A94416C98
SHA-256:	E9A1610AFFCA9F69CD651C8D2EDD71B5A0F82CB3910A8A9D783F68E701DB5BB0
SHA-512:	20ED527F3BBBA2CECE03D7B251B19D6DCC9D345B5425291D8139FCDD5646EC34D585891160CC4BD96C668D18FFFFDD56F4D159880CFC0D538749F429F7F65512
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.&...i.....j.:...k.I...l.T...n.\...o.a...p.n...q.t...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................#.....$.....%.....'.....7.....I.....[.....p.............................\|.................%...........(.........................................3......................./.......................2.......................z...........I.....k...........R.......................v................./.......................z...........=.....W.................&.....=....................... .....o.......................^.......................r.......................m.......................b.......................z.................0...........%.....i.......................3.....G.......................(.......................1.................R................./.....J.....^...........A.....q.................`.................,...................................V.....w...........Z.......................O.....t.................b.......

C:\Users\user\AppData\Roaming\GamePall\locales\da.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	496165
Entropy (8bit):	5.446061543230436
Encrypted:	false
SSDEEP:
MD5:	A44EC6AAA456A6129FD820CA75E968BE
SHA1:	9B5B17AFD57ADB8513D2DA9A72223E8A003975A5
SHA-256:	F01F9C3E4E6204425F2969F77BF6241D1111CE86CDD169BDF27E5D2D4B86C91A
SHA-512:	947DB81EA64009CC301CD2DCE06384202E56446F6D75E62390334B91D09B564CB0681E06BF7A945033BD6C28C2171346A91EE16693262C4E373A31B51AD42A9E
Malicious:	false
Reputation:	unknown
Preview:	........,$..e.N...h.V...i.g...j.s...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}."........../.....7.....?.....G.....N.....U.....\.....].....^.....`.....n.....~.........................................Q..................................q.................].......................P.....w.................8.....b.....p...........9.....h.................n.................7.......................^............................. .....p...................................q.......................X.......................1...............................................".............................{.......................Z.......................C.....p.....~...........y.................4.............................l.......................I.....f.....v...........^.................................................................F.......................B...................................O.....~...........J.....z.................$.....@.....M.................F.

C:\Users\user\AppData\Roaming\GamePall\locales\de.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	534726
Entropy (8bit):	5.49306456316532
Encrypted:	false
SSDEEP:
MD5:	49CA708EBB7A4913C36F7461F094886B
SHA1:	13A6B5E8DC8B4DF7A976A0859684DC0AA70F1B12
SHA-256:	8AE7D6B77C51A4FE67459860ABDAE463F10766FAF2BA54F2BB85FD9E859D2324
SHA-512:	6908F96BFDF7499B33E76697AA96103E89ACB3E25EDBD6156B610564AF14D4ED474C547A760503490B6327A801478E223039836BEEF2B938AF76827A15C0F751
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.%...y.+...z.:...\|.@...}.R.....Z....._.....g.....o.....w.....~.................................................................X.................E...................................^.....x...........n................./.......................Z...................................U.....w.............................h...........&.....7...........9.....w........... ................. ..........._.................D.......................U.......................h...................................a.....x...........f.........................................F.......................u...........).....;...........j.................A.......................;.......................9.......................t...........,.....`...........-.....K.....b...........G.....s.................}.................T...........,.....6...........S................./.......................K.......................t...........*.

C:\Users\user\AppData\Roaming\GamePall\locales\el.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	950999
Entropy (8bit):	4.76377388695373
Encrypted:	false
SSDEEP:
MD5:	9CBC320E39CFF7C29F61BD367C0BF3BB
SHA1:	2AF07EFFF54A0CF916CF1C0A657F7B7ADF2029FF
SHA-256:	E8837DEFA908EB2FD8B4EB6344412C93403A4258F75EC63A69547EB06A8E53B3
SHA-512:	F7D84185F4520E7AAF3F3CACF38B53E9638BB7D5023FA244020EC8D141FFD5C10B198FF089824D69671FE8350F931B0BB19B6CAF14AF47B0838953367A146DD0
Malicious:	false
Reputation:	unknown
Preview:	........)$..e.H...h.P...i.X...j.b...k.q...l.\|...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................&...........6.....=.....D.....K.....L.....M.....O.....v.......................5...................................V.................h...........F.....i...........~...........{...........a...........'.................&.......................M.....U.....O............................./.....J.....1..........._...........{.....6................. .............................g.......................<.................J...........8.....t.....O.....).......................U............................................................ ..... .....!.....!.....".....#.....$.....$.....$.....%....\|&.....&.....'.....'....;(....t(.....(....M).....)....;....h....U+.....,.....,.....,.....-....8.....t...........f/....(0.....0.....0.....1....S2.....2.....3....64....Q5.....6....@6....A7....(8.....8.....8.....9.....:....o;.....;....[<....%=.....=.....=.....>.....?....6@

C:\Users\user\AppData\Roaming\GamePall\locales\en-GB.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	430665
Entropy (8bit):	5.517246002357965
Encrypted:	false
SSDEEP:
MD5:	0F1E2BC597771A8DB11D1D3AC59B84F3
SHA1:	C1F782C550AC733852C6BED9AD62AB79FC004049
SHA-256:	E4798E5FF84069C3BFD7D64734CCD9FF5C8A606315B44A714ACDCABDDAF3CA6E
SHA-512:	07E9B98357C880995576059AD4E91E0F145DC0F2FFF2DFDAD8649FA42EB46FA86F7F093503C41019EAD4550784E26C553D171518355FBBF995E38B1F6D7ABFF0
Malicious:	false
Reputation:	unknown
Preview:	.........$ .e.(...h.0...i.>...j.J...k.Y...l.d...n.l...o.q...p.~...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................%.....,.....3.....4.....5.....:.....G.....V.....f.....w...........J.......................H.....y.................I.......................@.....o.......................?.....M............................._.......................B.......................8.............................[............................V.....a................l............................. .....^.............................A.....b.....n.................H.....[.......................+.....t.......................5.....y.......................:.....c.....n...........'.....d.....y.................).....?.............................G.............................].......................4.....O.....^.................6.....F.................#.....;.................V.....d...........$.....[.....x.................F.....U.............................k.............

C:\Users\user\AppData\Roaming\GamePall\locales\en-US.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	434598
Entropy (8bit):	5.509004494756697
Encrypted:	false
SSDEEP:
MD5:	FEAB603B4C7520CCFA84D48B243B1EC0
SHA1:	E04138F1C2928D8EECE6037025B4DA2995F13CB4
SHA-256:	C5B8FBDBB26F390A921DCACC546715F5CC5021CD7C132FD77D8A1562758F21F4
SHA-512:	E6B3970A46D87BFD59E23743B624DA8116D0E1A9912D014557C38FD2664F513E56317AFA536DF52E7E703863FBD92136BE57EE759A2FFC2958AB028F6287E8B7
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.,...y.2...z.A...\|.G...}.Y.....a.....f.....n.....v.....~.................................................................G.......................\.......................Q.......................T......................./.....t.......................7.....^.....k.................".....9.................!.....9.............................i.......................7.......................!.............................K.....f.....u.............................Y.............................k.......................G.....t.......................7.....B.............................J.......................$.....~.......................^.............................=.....R.............................q.......................X.............................X.......................7.....o.................X.......................k.......................a.......................!.....C.....S.................,.

C:\Users\user\AppData\Roaming\GamePall\locales\es-419.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	524728
Entropy (8bit):	5.377464936206393
Encrypted:	false
SSDEEP:
MD5:	32A59B6D9C8CA99FBD77CAA2F586509A
SHA1:	7E8356D940D4D4CC2E673460483656915AA59893
SHA-256:	AA4A5AA83DD5F8476867005844F54664DB1F5464A855EF47EC3A821DAF08E8F2
SHA-512:	860BA06228BBA31EEC7EB8BD437DDB6E93BABD0129033FB6EFF168F2FB01B54E2B93D2AB50A5D4F5D2FB7B04A5D0DD5541999D708CC2613B74AADD17B3E98735
Malicious:	false
Reputation:	unknown
Preview:	........5$..e.`...h.h...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.,.....4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....j.....\|.......................J...........>.....Y...........1.....v..........."...................................L.....g.................4.....G.................,.....=...........7.....}...........6...................................6.....I.................\.....s..........._.................Z...........2.....Y.......................:.......................".......................0.................R.....e...........).....g.....s.................P.....[.................4.....>.................L.....\...........O.................!.....v.................+.....x.................i.................:.................2.......................!.......................0.................I.....c...........x.............................B.....p...........V.......................G.....j.....}...........n.............

C:\Users\user\AppData\Roaming\GamePall\locales\es.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	523181
Entropy (8bit):	5.356449408331279
Encrypted:	false
SSDEEP:
MD5:	3D1720FE1D801D54420438A54CBE1547
SHA1:	8B1B0735AE0E473858C59C54111697609831D65A
SHA-256:	AE32D66C0329104B9624BA0811FE79149D1680D28299440EC85835DBA41C7BD2
SHA-512:	C033BBB5261EC114DCB076EDB5E4B3293F37D60C813674A947F996606A6289204C04D2E4315356D92EEEB43FF41D534997DBEBBF960B17F2F24AA731AFE4B7E1
Malicious:	false
Reputation:	unknown
Preview:	........5$..e.`...h.h...i.p...j.\|...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.+.....3.....8.....@.....H.....P.....W.....^.....e.....f.....g.....i.....\|.......................O...........G.....b...........D.................0........... .....:.................Y.....t.........../.....^.....n...........0.....X.....i...........c.................W...................................I.....Z................f.....{...........o.................g...........+.....P.................8.....N.................".....1......................@.................?.....R.................;.....G.................%.....0.............................y...................................D.....^.................@.....].................5.....T...........;.....`.....s...........h.................M.......................A.......................W.............................&.................)...................................A.....U................. .....3.................D.

C:\Users\user\AppData\Roaming\GamePall\locales\et.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	475733
Entropy (8bit):	5.456553040437113
Encrypted:	false
SSDEEP:
MD5:	C00D66D3FD4FD9D777949E2F115F11FB
SHA1:	A8EAAD96CABCDFB7987AF56CB53FA5E16143EC48
SHA-256:	26C438935E3F666329EE8D1DABA66B39179BCF26EBAC902F9B957A784BDC9B4A
SHA-512:	E7E8C083B556DD05874AC669B58A4D1CD05D1E1B771EB4C32942869E387C6FA2B317B5F489138BD90135117DAEB051D96A7823B531DF0303BD4245A036F25A20
Malicious:	false
Reputation:	unknown
Preview:	........@$y.e.v...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...\|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................S...........J.....e...........4.....d.....w...........Y.......................u.......................m.......................\.......................[.........................................7.......................;.......................K.......................x...........;.....R.................9.....T................. .....,.............................w...........#......................./.....=.................'...../.................".....1.................$.....,.................O.....g.................4.....J.................,.....O.................4.....A.................=.....i.................&.....7.................#.....;.................?.....Z...........U.................C...................................@.....M...........................................

C:\Users\user\AppData\Roaming\GamePall\locales\fa.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	773397
Entropy (8bit):	5.04618630633187
Encrypted:	false
SSDEEP:
MD5:	C998140F7970B81117B073A87430A748
SHA1:	8A6662C3AABDAC68083A4D00862205689008110C
SHA-256:	182F18E4EFCA13CA59AFD1DF2A49B09733449D42526EE4700B11A9C5E6AAC357
SHA-512:	5A947A44F674F9556FDD44D2E4FF8CF0E0AAC4475FFA12480CA1BD07CFE7514961B7CACE6760189432B4B4BEB5EA5816701158EB3CB827A806F3063853C46D5E
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.#...s.4...t.=...v.R...w._...y.e...z.t...\|.z...}...............................................................................-.....T.....9.......................^...........u..........._.............................H.................a...........S.....f...................................?.................j..........._.............................'...........f.......................I.......................v.............................Q.....u...........}.................S...........).....@...........x.................m...........M.....d...........p.................H.................:...........`.................`...........l...............................................s...........C...........0.....P.......................;...........1 ....V ....q ....+!.....!....'"....I"....."....\|#.....#.....#.....$.....%.....&.....&....j'.....(....l(.....(....W).....)....M....p.....*....n+.....+.....+....d,.....-....P-....x-

C:\Users\user\AppData\Roaming\GamePall\locales\fi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	483378
Entropy (8bit):	5.428549632880935
Encrypted:	false
SSDEEP:
MD5:	1CFD31A6B740D95E4D5D53432743EBF1
SHA1:	20CEEEA204150BD2F7AAE5866C09A3B0AE72D4C5
SHA-256:	F821E06B4BACD9E7660A2D6912A049591FFD56C6D2A0A29B914648589B17B615
SHA-512:	C483B7347F91BE8EE515DCF352A1D7502B9A159EDE35EACCEBAA763B93A625BCE2D0C7D598C2A6111092257D6DAC7A167102E956697210D4694B9812D70C8A94
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.:...w.G...y.M...z.\...\|.b...}.t.....\|.....................................................................................................^.....q...........7.....j.....}...........Z.......................~.......................s.......................D.....d.....t........... .....F.....`...........C.......................Q.....}.................S.......................T.........................................E.............................k......................./.....P.....\.................).....3.............................p.......................L.......................0.......................%.......................B.............................g.......................e.......................d.......................M.....d.....s...........*.....T.....f...........".....[.....u...........x.................I.......................Y.......................4.....v.......................S.....~.

C:\Users\user\AppData\Roaming\GamePall\locales\fil.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	546749
Entropy (8bit):	5.197094281578282
Encrypted:	false
SSDEEP:
MD5:	6EDA0CD3C7D513AAB9856EC504C7D16F
SHA1:	BA24C4B994E7866F2C012CCEC6C22DFC1A4FCFF6
SHA-256:	3CD2BC9E887663C5E093E0334BC60CF684655A815E3DE7AD9A34BAD5EBB858B1
SHA-512:	47000F5EA882CB9EDDCF4FB42ED229423EE55AA18B4A4353D7EF85ADFA7E1B0BBB33C2469887224D7146B3E33FB2296749CD053D68D7DAF26980BC710A27C63E
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.@...h.H...i.^...j.j...k.y...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......!.....&...........6.....>.....E.....L.....S.....T.....U.....Z.....g.....\|.................K...........:.....X...........O.................Q...........>.....e...........Z.......................~.................%.......................h.................H...........^.................M.................!.................H.....b...........].................V...........B.....d...........#.....N.....k.................A.....N.................,.....;.................S.....i...........5.....k.....z...........=.....o.....}...........>.....o.....}...........@.....r...................................R.......................L.......................<.......................e.................U.................F.....`...........>.....q.........................................%.................4.................4.................J.....b.................B.....X...........N.......

C:\Users\user\AppData\Roaming\GamePall\locales\fr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	568277
Entropy (8bit):	5.380723339968972
Encrypted:	false
SSDEEP:
MD5:	D185162DF4CAC9DCE7D70926099D1CF1
SHA1:	46594ADB3FC06A090675CA48FFA943E299874BBD
SHA-256:	E40C07183A32B75930242F166C5AAE28F4CD769BB2268391BEAA241814E7D45A
SHA-512:	987D9CC6AD5F2ED6A87537FDADF105F6EB31A97B11156E70814FE021047E5D8D08398F008812038DF3CCDCB6254BF5B744D9982FE04F79D407AC2F53BB046E25
Malicious:	false
Reputation:	unknown
Preview:	.........$..e. ...h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}..................................... .....'.........../.....0.....2.....B.....P.....b.....q.................6.....X...........?.................'.................(.................W.................4.....`.....p...........D.........................................{...........(.....L...........*.....i.....{...........S.........................................}...........i.................N.......................H.....r.................N.......................f.......................}.......................x.......................e.......................d.................+.................&.......................8.....~.......................k.................0...........;.......................f.........................................d.................6...........4................."...................................R.....k.................G.....[...........G.......

C:\Users\user\AppData\Roaming\GamePall\locales\gu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1103776
Entropy (8bit):	4.336526106451521
Encrypted:	false
SSDEEP:
MD5:	44F704DB17F0203FA5195DC4572C946C
SHA1:	205CBCC20ADCCCF40E80AA53272FBA8CD07389CA
SHA-256:	4B073F08F0C8C035974B5EC43AA500F8BDD50E6CFE91A2FB972A39E0F15ECEDD
SHA-512:	3CFD4501556845141EE9B461C831CA59779AD99F0E83E8D03433DE78D774378E87DE752DD9711C112A0C584259AD1DA6DC891D92F3F447F63A4D84263CD5BFCE
Malicious:	false
Reputation:	unknown
Preview:	........4$..e.^...h.f...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.#...\|.)...}.;.....C.....H.....P.....X.....`.....g.....n.....u.....v.....w.....\|.......................&.....b....._.....0.....l....._..... ...............................................a.......................G.................r...........\.....\|....._...........z.......................V...........n.....B...................................7.....4...../.......................".......................4.....p...........P...........E.....m.......................................................................'...........}.......................C.................j .....!....u!.....!.....".....#....\$.....$....K%.....%....R&....{&.....'.....'.....'.....'.....(....b).....).....*....'+.....+....t,.....,.....-....9.....\|............/....W0.....0.....0.....1.....2....33....f3.....4.....5.....6.....6.....7.....8....<9.....9....\|:....H;.....;.....;.....<....s=.....=.....=.....?.....?.....@

C:\Users\user\AppData\Roaming\GamePall\locales\he.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	681555
Entropy (8bit):	4.658620623200349
Encrypted:	false
SSDEEP:
MD5:	E75086A24ECAA25CD18D547AB041C65A
SHA1:	C88CE46E6321E4A21032308DFD72C272FB267DBD
SHA-256:	55BE8A5ED9FB9C129AC45B7FC99574B9907350AFD024BAA5D07525F43E995F6B
SHA-512:	01D7FDD90B8D0D3779B8442250E2AA767481B2E581F880BF9C3DCBB15FCE52E477B1881F3704FBCB3172DB77DB10241BCB24851BFE30066D1E9B66244B3C6877
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.....j.'...k.6...l.A...n.I...o.N...p.[...q.a...r.m...s.~...t.....v.....w.....y.....z.....\|.....}.........................................................................+.....D.....].....z.....?...........~...........).............................O.................T...........#.....E...........:.......................w.................W................./...........F.................V...........5.....T...........K.................3.............................o...................................E.........../.....a.....t.............................z...........,.....?...........5.....v.................q.................5.......................r.................1...........X.................I.......................y.................$.................k...........).................!.......................#.................7.....P...........e.......................e.............................w...........W ..... ....$!....K!.....!....7"....g"....."....@#.....#....-$

C:\Users\user\AppData\Roaming\GamePall\locales\hi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1167065
Entropy (8bit):	4.308980564019689
Encrypted:	false
SSDEEP:
MD5:	1FF8A0B82218A956D2701A5E4BFA84EF
SHA1:	56BB8218963E14ADCC435F2455891F3A0453D053
SHA-256:	62E7C3ABC317931723BE11ADD3712DD15EAAB0A35A4D8E7DB0B6347104EC5733
SHA-512:	3330D983401953AA5ED4856A8D10FFCBEEFC2A4E594CF850566A0AD38837BC1164870BB1270B6BBE5D7DD6FB1ECA29CDE85869A5C51808B901CDC282E04764E4
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.%...n.-...o.2...p.?...q.E...r.Q...s.b...t.k...v.....w.....y.....z.....\|.....}...............................................................................?.....j.............................................../.....j.........................................N.....}.....P...........^...........F...........A.....d.....K...........N.............................L.....&...........V...........f...................................L.....~.................{.................A.................y..........}...........;........................................[.................,.....K...................................j ..... ..... .....!....J".....".....".....#.....$....T%.....%....@&.....&....8'....d'.....'.....(.....(.....(.....)....6..........*.....+.....,.....-....c-......................%/.....0.....0.....1.....1.....2....i3.....4....B4.....5.....6.....7.....7.....9.....9....S:.....:.....;.....<....F=.....=.....>....N?.....?.....@.....@.....A....LB

C:\Users\user\AppData\Roaming\GamePall\locales\hr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	526575
Entropy (8bit):	5.518614920030561
Encrypted:	false
SSDEEP:
MD5:	0BD2F9847C151F9A6FC0D59A0074770C
SHA1:	EA5313A194E9D99489E9F1D7B4DFC0BC986C8E17
SHA-256:	5F2F1AA2E2EC78F375084A9C35275E84692EE68A1E87BBEF5A12A2C0FCF7F37A
SHA-512:	0032C0B41FDF769DAA1AF23C443D4195B127DF9EA8621174F1AABDBAFAE4954383095FA1EEAD14FC458188B8837BBE9AECA0D5338E4D47F10D976FBED8609496
Malicious:	false
Reputation:	unknown
Preview:	........F$s.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.)...y./...z.>...\|.D...}.V.....^.....c.....k.....s.....{.................................................................k...........Y.....z...........F.....~...................................e.......................y.......................m.......................l................. .................q................._.........................................A.............................4.......................j.......................D.....f.....w.................*.....:.................4.....I.................&.....5.................8.....M................. .....0.........................................S.....n.................0.....M.......................3....................... .................E.....v...........!.....F.....\...........).....[.....t...........U.................M...........(.....:...........".....`.................G.....v.................$.....B.....T...........0.....n.

C:\Users\user\AppData\Roaming\GamePall\locales\hu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	566819
Entropy (8bit):	5.6387082185760935
Encrypted:	false
SSDEEP:
MD5:	4C27A1C79AB9A058C0A7DFFD22134AFD
SHA1:	5F0A1B34E808B91ADB1E431E462D9FCF82F4FFF2
SHA-256:	AD98C0A367B51EB217E69D66FA6A946946E85EC8452FC5A7AE0F179F35BE28C3
SHA-512:	0F066DB5905EB24B6CB4FBC7C81F017B43AFB7A6E975886644D871E979406B990509905D100653496EE2D20969A77434B702FF1EA5D348274AE54EA597A91D5E
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.!...j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................+.....A.....V.....j.................9.....W...........N.............................................".....X.....q...........K.....r.................Y.................?................."...........I.................7.......................k...........'.....7...........:................./.................:.................Z.....w...........O.....v.................f.................5.................(...........2.....u...................................M.................0...........6.....x...................................m.................)................. .....I.................O.....g...........c.................O.......................E.......................r...........'.....H...........v.............................l...........7.........................................5...........& ....q

C:\Users\user\AppData\Roaming\GamePall\locales\id.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	466959
Entropy (8bit):	5.379636778781472
Encrypted:	false
SSDEEP:
MD5:	1466C484179769A2263542E943742E59
SHA1:	18E45A08661FD6D34BADE01CDB1E1D5184BA2B67
SHA-256:	C331293D16B16B08DEF73BE73437845D58C593941320C547A377DB423749AEBB
SHA-512:	ABC54D5CAAA663578F064E43CC0465BEB97EFC46991936708EBF3FCD64BD007E47072AB4834A5361B21F064BB0F6527E247BC2C2F0DFB8336F50C2FF3E15A59C
Malicious:	false
Reputation:	unknown
Preview:	........ $..e.6...h.>...i.O...j.[...k.j...l.u...n.}...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................'...../.....6.....=.....D.....E.....F.....H.....V.....c.....s.................k................. .....l.......................l.................-.......................0.............................R.....s.................I.....x.................T.......................@.....j.....w.................L.....Y.................Z.....m...........H.......................%.....@.....Q.............................c.......................<.......................#.....t.......................L.....x.................%.....R.....^.................>.....K.................5.....G.............................J.......................".....h.......................L.....}.................#.....=.....K.................+.....:.................2.....K...........C.......................u.................,.....\|.......................C.....b.....r...........1.....h.

C:\Users\user\AppData\Roaming\GamePall\locales\it.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	522800
Entropy (8bit):	5.284113957149261
Encrypted:	false
SSDEEP:
MD5:	7767A70358D0AE6D408FF979DF9B2CD4
SHA1:	9C57A5B068DC12AAF1591778DEF5D3696377EDAB
SHA-256:	672908E77E9EACA793654C8E630442099DE3BE772FD3230A9C4045CAFBCC0B1E
SHA-512:	913AA8C49D04CD84706D08A88453D1ED36FDE6A00F7C1DF63DECEA99316A8A234924457C0C50937329B3979E437B1C2D7796E63ADF209505E212FDCEAE3BFDB5
Malicious:	false
Reputation:	unknown
Preview:	........-$..e.P...h.X...i.i...j.u...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.$.....,.....1.....9.....A.....I.....P.....W.....^....._.....`.....b.....u.......................E...........3.....O.................V.....g..........._.................o...........#.....L.............................k.......................n.................2..................................w.................5.......................R...................................c................./.....[.....y.................=.....K.............................x..............................................`.......................4.............................^.........................................B.............................F.....\.....r........... .....L.....a...........=.......................b.......................8.....c.....v...........[.................c...........S.....j...........d.................[.................).....v.......................X.............

C:\Users\user\AppData\Roaming\GamePall\locales\ja.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	634636
Entropy (8bit):	5.718480148171718
Encrypted:	false
SSDEEP:
MD5:	4A4AF69546DCF65F2D722A574E221BEA
SHA1:	EE51613F111CF5B06F5605B629952EFFE0350870
SHA-256:	7AD195AF107F2A394BAB527C3E84E08F3B7748076F23459F084CF0E05DD29655
SHA-512:	0E93F6B22F7C9176EFC9D49901BFBD281FA5AC3632780DFA76CE597CADD8C1CF570A9163A86BC320BBFBD354F48288DBEC5E36A6088999B00A3561D302A96D03
Malicious:	false
Reputation:	unknown
Preview:	........n#K.e.....h.....i.....j.....k.....l.....m.....o.%...p.2...q.8...v.D...w.Q...y.W...z.f...\|.l...}.~...............................................................................................6.....W...........}.................l........... .....8...........c.......................B.................W.......................x...................................7.....V...........e.................=.......................].......................{...........#.....2...........y.................`...................................<.....W...........j.................y...........e...................................h...........(.....:...........%.....a.....p...........{.................}...........m..................................._...................................Z.....x.............................o...................................:.....U................d.....z....."................?...........X.................`.................@.................g............ ..... ..... .....

C:\Users\user\AppData\Roaming\GamePall\locales\kn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1256908
Entropy (8bit):	4.247594585839553
Encrypted:	false
SSDEEP:
MD5:	6A41A5AB03A22BDAEC7985B9A75EC11A
SHA1:	6BB02DF557BD6522E02FE026C0243BEB9332B2E5
SHA-256:	E22873652AC7D9D18E47DAE838D121B5644EDA4C67F7B0BC110733BF7E931FEA
SHA-512:	BCA661D802D29463A847AC77EB8D5DFA41C31455E7314049CA26555957DCA3BE33701C074F7ED26D2C375A0A9C5F8A93461007B8D74F5ED3BD27C02E5DB170A5
Malicious:	false
Reputation:	unknown
Preview:	........O$j.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...\|.V...}.h.....p.....u.....}.................................................................W...........".....V.....W...................................n...........b............................._.......................<.....)...........s.......................).............................1.....7...................................[......................................................................u...........f...........K.....^........................ ..... .....!..../"....i"....=#.....#....r$.....$....I%.....%....l&.....&....p'....((.....(.....(.....)....N...............,.....-.....-................./.....0....W0.....0....z1.....1.....1.....2....Y3.....3.....4....@5.....6.....6.....7.....8.....8.....9....V9.....:....R;.....;....1<.....=....B>.....?....]?.....@....DB....BC....wC.....D.....E.....F....$G....\H....AI.....I....4J.....K.....K.....L....PL.....M....lN.....O

C:\Users\user\AppData\Roaming\GamePall\locales\ko.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	532715
Entropy (8bit):	6.0824169765918725
Encrypted:	false
SSDEEP:
MD5:	5FD9942F57FFC499481947DB0C3FDFA7
SHA1:	4D60AB21305902877467FF6151C1B7AB12553AAE
SHA-256:	09E279860E20E9E559945940E29446CAD4273D05C5F3F15D0BAD664A1D5749F2
SHA-512:	97953E580588C07769F1BD0002E2DF648FFCE5B246D2359E4475EDCFA1CD6E7286BAF168A115D7A65686B2151C313B6FD0C271E40B1F9DD4132F2F39904FE8D4
Malicious:	false
Reputation:	unknown
Preview:	........O#j.e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....y.#...z.2...\|.8...}.J.....R.....W....._.....j.....r.................................................................].................5.................O.....b...........F.......................p.................'.......................,.......................;.......................L.......................e.......................Y.......................X...................................Q.....h.................>.....U................. .....0.........................................-.....I.................A.....Q.................L....._.................K.....[.................J.....Z...........O.......................Z.....{.................U.....}.................`.................%.......................J.............................h.......................\.................+.......................m.........................................'.............................x.........................

C:\Users\user\AppData\Roaming\GamePall\locales\lt.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	573015
Entropy (8bit):	5.63016577624216
Encrypted:	false
SSDEEP:
MD5:	8745B87D09D9ECC1112C60F5DD934034
SHA1:	2F411E4EEF0E656CAC0C755FECE1AD2531CB689E
SHA-256:	D546C994C81510122E7B2359DA50F694E1F0CA4081830404E16187A5CF4D4E0D
SHA-512:	27B658C153A01AABB9595C5B1059567E535EDFC8F8187B89316D2C85694DE32696D209CFDD2A32C4826DFB1E50AC692937156563EE190E68DB358C40F9AAE15F
Malicious:	false
Reputation:	unknown
Preview:	........+$..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}. .....(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....^.....l.....y.................4...........".....=...........S.................M...........'.....A...........8.....p...................................A...................................B.....g...........z.................R...................................;.....K...........c.................T...........2.....P...........2.....Y.....t...........W.........................................E...................................D.....S...........Q.........................................S.............................B.................&.......................t...........1.....Y...........K.................+.........................................'...........N.................A.................,...........q.................d...........&.....F...........x.................(.......................H ..... .....!

C:\Users\user\AppData\Roaming\GamePall\locales\lv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	570683
Entropy (8bit):	5.624052036286866
Encrypted:	false
SSDEEP:
MD5:	E16B0B814074ACBD3A72AF677AC7BE84
SHA1:	10744490B3E40BEB939B3FDCA411075A85A34794
SHA-256:	46B5C09AA744AF0F660C79B0CDBDE8C8DBDD40A0BA1A23AAF28D37ECC4211DC5
SHA-512:	70EA9DFAC667C0992AE0E95815A47EB8E779BAAE1215E733AFE84EEE26D3BA754AD838C12E9AEE3114D7BBE11CD21B31C550F5CAFE6C5E838B69E54C6174EF18
Malicious:	false
Reputation:	unknown
Preview:	........O$j.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...\|.V...}.h.....p.....u.....}...................................................................................Z.................G.................%...........Z.................F.................6.................Q.....\...........Q.........................................\|.....#.....t...................................W.................0...........T.................B...........8.....Y...........$.....J.....`...........-.....V.....h...........;.....b.....v.............................G.......................r.........../.....>...........'.....Z.....k...........c.................@...........3.....K.................).....>...........=.....t.................c.................(.................2.......................8...........<.....q.........................................:.................8...................................N.....^...........0.....K.....m............ .....

C:\Users\user\AppData\Roaming\GamePall\locales\ml.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1307271
Entropy (8bit):	4.279854356980692
Encrypted:	false
SSDEEP:
MD5:	309E068B4E15157486D095301370B234
SHA1:	D962CDAF9361767045A928966F4323EAD22D9B37
SHA-256:	4F2C19B7E94B695C5C5CAB95DEE6E49AE53C3337C351B5C665BCB6BA4E6AE909
SHA-512:	6B1333946C7950D97D2DF29D063DB39A0EC5C0EEAA1ECA40743E4A6A0E4C972D897D3FF2BA837B53E31B8003F2C5C4BACCB7A4AB4B50C6CB47DF39AD7B8E05E7
Malicious:	false
Reputation:	unknown
Preview:	........N$k.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.,...w.9...y.?...z.N...\|.T...}.f.....n.....s.....{...........................................................$.....d.................Z.....C.......................W...........%.....r.....a.......................}.................n...........................................................I.................m.......................l.......................5.....y.............................^.............................j.......................\|............ ..... .....!.....!....".....#.....#....V$.....$....n%.....&.....&.....&.....'....n(.....(.....)..........*....W+.....+....c,....+-.....-.....-...........0.....0.....1.....1.....2....!3....Y3.....4.....4.....5....T5....06.....6.....7.....7.....9.....9.....:.....;.....;.....<.....=....Z=....\|>....s?.....@....T@.....A....UB.....C....SC.....D.....E....yF.....F.....G.....H.....I.....I....-K....(L.....L.....M.....N.....N....eO.....O.....P.....Q.....R

C:\Users\user\AppData\Roaming\GamePall\locales\mr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1075591
Entropy (8bit):	4.313573412022857
Encrypted:	false
SSDEEP:
MD5:	69C36C23D6D9841F4362FF3A0F86CFDF
SHA1:	C4C1F632EB8373107AEEBD6C26ECF036AEDA2B6B
SHA-256:	6A794C2B08F8B046BE771DF33719536BDAF2371E3825D49A0E556958B781832D
SHA-512:	8C1329BDB371677BC0A9D727A38591EDF32025BAE1E7EFE402D01C6A8BB5F647D827C59A18F40455D5C9C0482798525C98C3F1C8AC568AA886D7C1ED07D1580E
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i."...j.....k.=...l.H...n.P...o.U...p.b...q.h...r.t...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................@.....b.................%.....]...........W.................J.............................:.....@.....=...................................&.................&.....F.....P.......................h...........o...............................................c...................................R..........._.................i...............................................J.................. .....!.....!....(".....#.....#....O$....{$....B%.....&....c&.....&....F'.....(...._(.....(....R).........y.....*.....+.....-.....-................./...../...../.....0....61....l1.....1....Z2.... 3.....3.....3.....4.....5.....6.....6.....7.....8.....9....E9....u:....n;.....;....@<.....=....O>.....?....5?.....@.....A.....B.....B....MD....WE.....E....eF....nG....LH.....H.....H.....I.....J.....J.....K....5L....)M.....M

C:\Users\user\AppData\Roaming\GamePall\locales\ms.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	489457
Entropy (8bit):	5.250540323172458
Encrypted:	false
SSDEEP:
MD5:	A1253E64F8910162B15B56883798E3C0
SHA1:	68D402D94D2145704DC3760914BF616CC71FC65D
SHA-256:	E033BFAD6CD73EA7B001DFAF44B7102E3BBE2A1C418F005C149E4FB2565DB19F
SHA-512:	ABD63713093049ECC8E24FD8145EAE065340058A3C38758A59EE8796FBED7E6CFBC54982D650889F1CEB54797060C7DDA12EEE2A963B14C5E907A110C2057DBE
Malicious:	false
Reputation:	unknown
Preview:	........T$e.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...\|.W...}.i.....q.....v.....~........................................................................................._.....{...........:.....n.....~...........\.................#.......................=.......................1.......................3.......................Y.................*.....z.......................W.......................E.......................b.........../.....A.............................N.......................$.....x.......................r.......................z.......................p.......................^.......................Q.......................r.................!.....s.......................S.....w.................6....._.....p.................T.....w.......................#.......................$.................2.....K...........B.......................s.................,.............................P.....r.................0.....].

C:\Users\user\AppData\Roaming\GamePall\locales\nb.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	476208
Entropy (8bit):	5.4272499712806965
Encrypted:	false
SSDEEP:
MD5:	622ED80836E0EF3F949ED8A379CBE6DF
SHA1:	9A94CD80E747B88582470EF49B7337B9E5DE6C28
SHA-256:	560B2F09C1B6E6BB7E6A5A5F9BF85A88BD2ACA054B7D4A5955D9C91B6D7CA67C
SHA-512:	950627E74180E1451BB35AE4A7416AC14D42D67BBBB59DC51D7B69E4CEB61715F8F9B0EB9D7F35FCEFD4D43FABE5CE2103F1AF3709CAE6733C25AC19E6339A83
Malicious:	false
Reputation:	unknown
Preview:	........2$..e.Z...h.b...i.y...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....o.....p.....r.....}.......................N...........A.....V.................X.....k...........z.................K.......................L.......................:.......................;.......................g................./...........<.........................................R.................1...........Q.......................\.....u.................1.....V.....f.................9.....I.................H.....\.................J.....Z...........".....T.....d.................@.....P.................<.....J...........4.....y.................B.....h.....{...........&.....E.....^.................-.....?...........,.....k.................V.....\|.................b.......................i.................&.......................s...........9.....b...........*.....V.....i.................".....0.................).

C:\Users\user\AppData\Roaming\GamePall\locales\nl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	491139
Entropy (8bit):	5.362822162782947
Encrypted:	false
SSDEEP:
MD5:	C8378A81039DB6943F97286CC8C629F1
SHA1:	758D9AB331C394709F097361612C6D44BDE4E8FE
SHA-256:	318FB294CE025BDA7636B062CA7B6A1FB1E30C485D01856159CB5DB928782818
SHA-512:	6687FFE4DE0D5A2314743EB3134096292724163D4E0332D2F47922B4807B0CDE7C20E2D57D2662E403D801BC7A20BC247F5D0EDD787AB650E5766B49AF7D3C63
Malicious:	false
Reputation:	unknown
Preview:	.........$..e....h.2...i.C...j.O...k.^...l.i...n.q...o.v...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................#..........1.....8.....9.....:.....<.....H.....X.....i.....{.............................X.......................\|...........4.....J.................M.....d.................8.....G.......................).................8.....Y...........1.....h.................F.....{.................U.........................................\.................4.............................Y.......................-.....~.......................}.......................v.......................V.......................5.....a.....n...........*.....^.....m...........I.......................X.......................>....._.....v...........,.....T.....f...........8.....o.................=.....[.....o...........3.....e.....v...........H.....................................................E.....j...........5.....f.....{.................B.....R.................B.

C:\Users\user\AppData\Roaming\GamePall\locales\pl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	550453
Entropy (8bit):	5.757462673735937
Encrypted:	false
SSDEEP:
MD5:	80C5893068C1D6CE9AEF23525ECAD83C
SHA1:	A2A7ADEE70503771483A2500786BF0D707B3DF6B
SHA-256:	0069648995532EFD5E8D01CC6F7DD75BD6D072E86C3AE06791088A1A9B6DACC4
SHA-512:	3D1C41A851E1CF7247539B196AD7D8EE909B4F47C3CFB5BA5166D82CDA1C38049B81A109C23FA6D887490E42EE587CC2A6BD96A3EA890267C089AC74710C755F
Malicious:	false
Reputation:	unknown
Preview:	........6$..e.b...h.j...i.{...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....o.....p.....r.............................X...........S.....o...........=.....w...................................i...............................................z.................$.................1.....W...........M.................*.......................@.......................l...........0.....L...........].................9.....v.......................E.....h.....x.................,.....:.................<.....P.................>.....P.................6.....F.......................-.........................................e.....}.................4.....K.......................;.................+.....@.................a.................+.....I.....`.................9.....U...........2.....}...................................w...........'.....R.................9.....J.............................v.............

C:\Users\user\AppData\Roaming\GamePall\locales\pt-BR.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	516256
Entropy (8bit):	5.426294949123783
Encrypted:	false
SSDEEP:
MD5:	3BA426E91C34E1C33F13912974835F7D
SHA1:	467A1B05BAD23252A08EE22E6B9EBB4404F6A0F0
SHA-256:	CB66D88D3B3938FE1E42C50ECB85CEDB0D57E0F0AB2FA2A5FC0E4CDEA640E2B7
SHA-512:	824A4301DC4D935FF34CE88FAA0354440FC1A3A8E79B0F4B0B2DCC8F12542ECEF65828FB930EDF5B35BF16863296BBAE39E9306962B4D3CFA9F6495AC05BDEF4
Malicious:	false
Reputation:	unknown
Preview:	........9$..e.h...h.p...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.$...\|.*...}.<.....D.....I.....Q.....Y.....a.....h.....o.....v.....w.....x.....}.............................d...........L.....h.........../.....h.....x.............................w.................(.....y.......................^...................................:.....j..........._.................:......................._...................................K.....d...........p.................5.............................q.......................n.......................w.......................p.......................O.....}.................).....W.....a.................V.....g...........b................. .....j.......................;.....a.................=.....U...........N.................2.....W.....p...........8.....p.................S.................@.................0...........1.....{.................X.......................0.....V.....k...........C...................

C:\Users\user\AppData\Roaming\GamePall\locales\pt-PT.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	518861
Entropy (8bit):	5.4029194034596575
Encrypted:	false
SSDEEP:
MD5:	4D7D724BE592BD0280ED28388EAA8D43
SHA1:	8E3C46B77639EB480A90AD27383FBB14C4176960
SHA-256:	4724D82866C0A693C2B02D1FFA67D880B59CDB0D3334317B34EC0C91C3D3E2A2
SHA-512:	D05388F66C50E039F7D3393515740F6B2593F9C0EF8651F9CDE910C5FF06656E0D22FDB066B22665289EE495837EA16CC085ECB3F85B0F6FB498AECDAA19ADF7
Malicious:	false
Reputation:	unknown
Preview:	........I$p.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v."...w./...y.5...z.D...\|.J...}.\.....d.....i.....q.....y.......................................................................u...........Z.....u...........@.................).................$.................S.....w.................D.....T.................(.....:...........(.....j.................x.................H.......................g...................................9.....N...........D.......................p.......................^.......................a.......................q.......................r.......................U.............................[.....e.................P.....a...........?.......................O.....y.............................?.................0.....J...........#.....p.................9.....c.....u...........#.....Y.....n.........../.....}...............................................G.....k...........N.......................B.....g.....\|...........J.......

C:\Users\user\AppData\Roaming\GamePall\locales\ro.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	537125
Entropy (8bit):	5.4566742297332596
Encrypted:	false
SSDEEP:
MD5:	4F1C0A8632218F6FEF6BAB0917BEB84F
SHA1:	05E497C8525CB1ADE6A0DAEFE09370EC45176E35
SHA-256:	9C19835F237B1427000D72C93703311CFCBEFF6C2B709474B16DB93E629BC928
SHA-512:	A7CDF94F79CD888BB81FD167F6B09BF1BEF2C749218869E5A12A0A3B2C2506D1A63F64B63D8E48EA49375636041C639082563BF9D526FE44003FC5A5E8D50E9D
Malicious:	false
Reputation:	unknown
Preview:	........0$..e.V...h.^...i.o...j.y...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....f.....u.......................3.................+.................%.....9...........@.................1.......................Q.......................4.......................C...................................>.....b...........@.......................d.........................................p...........@.....n.................+.....H.............................h.......................M.......................J.......................7.............................].......................E.....t...................................?.............................W.....w.................\.................).......................f.......................W.........................................'...........$.....y...................................f.......................j.......................l...........+.

C:\Users\user\AppData\Roaming\GamePall\locales\ru.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	878725
Entropy (8bit):	4.848685093578222
Encrypted:	false
SSDEEP:
MD5:	3A3D0D865A78399306924D3ED058274E
SHA1:	AA1A42DB6021666B2297A65094D29978792CE29B
SHA-256:	EAB4C32FEBE084CC7A3A272CDA008B69D6617ED6D042376B0316BE185B9E66FE
SHA-512:	ACA8C87D0B2BB35A325726F7774F8A0232B99C8EFE0F948AB68210958E23B95E9D9026A9430D96FC2D5CEBA94815F4217896EF877C9A6E1D0E56F73533FB1D12
Malicious:	false
Reputation:	unknown
Preview:	.........#/.e.....h.....i.#...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................9.....V.....n...........V.......................g...........i...........l.....).................g...........,.....f.......................@.................6.....M......................./....."...........l..........._...........D.....y..... .................&.......................5.....9.....3.............................B.................r.................D...................................=.....b.........................................E.....\...........Y.................'...................................D.....n...........j.................9.......................a...........i...........v...........t...........a........................ ....,!....l!.....!....j"....."....R#....\|#....O$.....%.....%.....%.....&....x'.....(....Q(.....(....z).....).....)....]..........+....$+.....+.....,.....-

C:\Users\user\AppData\Roaming\GamePall\locales\sk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	553886
Entropy (8bit):	5.812150703289796
Encrypted:	false
SSDEEP:
MD5:	A9656846F66A36BB399B65F7B702B47D
SHA1:	4B2D6B391C7C2B376534C0AF9AA6779755B4B74E
SHA-256:	02B65F48375911C821786D91698E31D908A4C0F5F4F1460DE29980A71124480E
SHA-512:	7E23CAA89FF80BF799AC5353CEAF344CBED0393F23D15FCBE8DC24EE55757F417CEA3BFC30889FD2CB41951F9FA5629C2E64B46DD9617D4A85EFEF0A255246F6
Malicious:	false
Reputation:	unknown
Preview:	........5$..e.`...h.h...i.\|...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.%...}.7.....?.....D.....L.....T.....\.....c.....j.....q.....r.....s.....u.............................h...............................................[.........../.....I.................S.....j...........9.....h.....{...........4.....].....q...........J.................?.............................%.....`.....y...........\................./.............................%.....v.................G.....g.....\|...........=.....c.....u...........6.....].....o...........O.........................................".......................3.......................R.............................-.....x.................0.....K....._.................0.....E.................G.....W...........T.................).....w.................-.......................M.............................O.................J.........................................'.........................................E.

C:\Users\user\AppData\Roaming\GamePall\locales\sl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	532410
Entropy (8bit):	5.486224954097277
Encrypted:	false
SSDEEP:
MD5:	BE49BB186EF62F55E27FF6B5FD5933F4
SHA1:	84CFD05C52A09B4E6FA62ADCAF71585538CF688E
SHA-256:	833F2E1B13381AA874E90B747931945B1637E53F2396A7409CCDA0A19CBE7A84
SHA-512:	1808631559D3C28589D3F5A4B95554CEBC342DE3D71B05DDC213F34851BF802967BFFAC3D7668C487265EE245D1E26EFCE5D317EDBFBBEEB4BC2C9F122980585
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.6...i.G...j.Q...k.`...l.k...n.s...o.x...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................%.....,.....3.....:.....;.....<.....>.....P.....^.....n...................................y.................&...........2.....}.................h.......................g.......................Z.......................v.................O...................................3.....I.................T.....h...........b.................S...........$.....J.......................(.............................n.......................z...........$.....8.................2.....C...........).....j.................;.....i.....\|...........?.....q.................[.......................g.......................L.....j.................G.......................~.................I.......................B.......................b.............................^.............................o.........................................j.......................x.......

C:\Users\user\AppData\Roaming\GamePall\locales\sr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	818089
Entropy (8bit):	4.779985663253385
Encrypted:	false
SSDEEP:
MD5:	AFA2DFBA3BD71FE0307BFFB647CDCD98
SHA1:	CD7A5C54246E891981AEEEAA88D39EC9E3F2C594
SHA-256:	1375353837629A20102C69BF62701EE5401BED84D3DC4845BED5EE43E4D322CF
SHA-512:	CE8BBBDDC33CB6B8DF4AEE127A8987E6D8C1D0761AC5BD25D685310BAA2D377F239BDF06F2C04B54295CF8FD440697A69A040644D5A7C0395C4F71A0252B8E87
Malicious:	false
Reputation:	unknown
Preview:	........=$\|.e.p...h.x...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.,...\|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~.........................................).................W...........O...........\...........z.....E...................................3...........b.................a.................5.......................1.....1...........v...........\|...........{...........`...........Y.....~.....d...................................S........... .......................{...........(.....K...........H.................c...........d...........3.................)...........B.................D.................(...........W.......................E.................~...........'.....O...........^.................~ .....!....]!....z!....J"....."....=#.....#....0$.....$.....$.....%.....%....P&.....&.....&.....'....1(.....(.....(.....).....*....5+....S+....A,.....,....Z-.....-....^...........=/....^/...../....Y0.....0.....0.....1....'2.....2

C:\Users\user\AppData\Roaming\GamePall\locales\sv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	479512
Entropy (8bit):	5.541069475898216
Encrypted:	false
SSDEEP:
MD5:	09592A0D35100CD9707C278C9FFC7618
SHA1:	B23EEF11D7521721A7D6742202209E4FE0539566
SHA-256:	9C080A2F6D4EDF0E2E94F78550B9DB59ADF5B1B9166DE2BAE496E6ABB6733304
SHA-512:	E0760B3F227A3E7EAEB4816B8E02BEE51C62730D24403724D66B36BCCBC0BDCD56DF9EAB28B073AB727EE12C8856A858E52A9803E1A1C9164FCD3CF2F716D8AF
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...q._...r.k...s.\|...t.....v.....w.....y.....z.....\|.....}.........................................................................#.....5.....I.....]...........b.................).......................e...........2.....K.................T.....p...........&.....U.....e...........%.....V.....f...........J.........................................O.......................Y..................................._.....u.............................n.......................J.......................'...............................................(.............................z.......................j.......................h.......................\|.................$.....w.......................M.....k.......................?.....Q...........).....f.................J.....i.................;.....c.....x...........1.....l...................................q.................?.................;.....N.............................p.............

C:\Users\user\AppData\Roaming\GamePall\locales\sw.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	504856
Entropy (8bit):	5.34516819438501
Encrypted:	false
SSDEEP:
MD5:	9E038A0D222055FED6F1883992DCA5A8
SHA1:	8FA17648492D7F093F89E8E98BF29C3725E3B4B5
SHA-256:	DDCA575D659545D80E715EB4176BBBBFBD3F75E24B223537B53740B0DCB282BD
SHA-512:	FB70F97E08191DFEB18E8F1A09A3AB61687E326265B1349AB2EFF5055F57E177A496BF0EA3592B61C71FE1F73C9143CA1495B05226F36EB481024827CAE6DCC4
Malicious:	false
Reputation:	unknown
Preview:	........4$..e.^...h.f...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.,.....4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....m.............................?.................$.................2.....D...........7.......................P.......................A.....l.....{...........&.....U.....c...........0.....d..................................._.......................m.......................n.............................*.......................J.....r.......................>.....G.........................................A.....O.................4.....F.................G.....R.................).....6.................).....2.................\.....u...........(.....T.....p...........2.....c.................D.......................l.................B.............................j.................+.......................j...........?.....S...........5.....x...................................P.......................r...........%.

C:\Users\user\AppData\Roaming\GamePall\locales\ta.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1298313
Entropy (8bit):	4.058495187693592
Encrypted:	false
SSDEEP:
MD5:	36104CB0D5E26E0BBB313E529C14F4B4
SHA1:	69A509DEE8419DA719DCF6DE78BFE0A6737508C5
SHA-256:	DC28C869A143424F71EDCFDB08B56DA31C2EC96E9D608535FFA7DC0B0842B7D8
SHA-512:	D46ED1AA19EB298BC4C3D61EFC28D80753D6B551F01808E6158A0869FAAE8755DF61D4B4BAFF1310DD09FCFC385ABA67E1AA7D61BBE399DF7BB2D483EBE0FEFF
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.(...h.0...i.A...j.M...k.\...l.g...n.o...o.t...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................!.....(...../.....6.....7.....8.....=.....k.................:...........5...........$.....v...........`...........(...........Z.................%.............................O...........j.....L.........................................m...........u...................................;.....c...........7.................................................................8 ..... ....m!....I".....".....".....#.....$.....%....9%....d&....n'.....(....L(....C)....4..........*.....+.....,....3-....a-....Z.....J/...../...../.....0.....1....Z2.....2.....3....:5.....6....Z6....U7....=8.....8.....8.....9.....:.....:....F;.....<.....=.....=.....>....E?....S@.....@....[A....3B.....B....IC.....C.....D.....E....[F.....F....+H....>I.....J....pJ....\L....FN.....O.....O....DQ....QR.....S....{S.....T.....V.....V....'W....+X.....Y.....Y.....Y.....[....9\.....\

C:\Users\user\AppData\Roaming\GamePall\locales\te.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1199612
Entropy (8bit):	4.314031920337284
Encrypted:	false
SSDEEP:
MD5:	98714389748A98ECC536CD2F17859BDF
SHA1:	07761AA31588F30C2CED4A1E31FE99DDC43A5E8D
SHA-256:	8A81B1A5457407E49D6372677938E7A2D28DFCA69F555FEDC8A2C9C09C333A65
SHA-512:	38CC4F064BD874EEC9DBFAB4C2A83A487FBCD89CEFB40BE4213C42231BC48AF9255341C9D325EE059BC50EE533898C5FA22CD3B3927A8E045049DEF3C5DFB2C6
Malicious:	false
Reputation:	unknown
Preview:	........N$k.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t. ...v.5...w.B...y.H...z.W...\|.]...}.o.....w.....\|.......................................................................X...........J...........\|...............................................f.........................................~.............................Y.............................A.............................d.....X.........../.....k.....b...........5...............................................'.......................L.....u ....:!.....!.....!.....".....#....$....k$.....%.....&....6'.....'.....(.....)........._*.....+....P,.....,.....-....'...........m/...../.....0.....1...."2....f2.....3.....4....R5.....5.....6....G7.....7.....7.....8....I9.....9.....9....{:....0;.....;....)<.....=.....>.....?.....?.....@....bA.....A.....B....JC....(D.....D.....D....DF.....F.....G.....G.....I....@K....qL.....L....4N....EO.....O....pP.....Q.....R....?S.....S.....T....^U.....U.....V....`W....[X.....Y

C:\Users\user\AppData\Roaming\GamePall\locales\th.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1008989
Entropy (8bit):	4.356501290091745
Encrypted:	false
SSDEEP:
MD5:	56F29DE3465795E781A52FCF736BBE08
SHA1:	EAA406E5ED938468760A29D18C8C3F16CF142472
SHA-256:	529C561747BF8B6206BE4F8BCF287A1D15E1B14A33113242DDAD5E035CA37BE6
SHA-512:	519B5B3CC7032B2AF856456EEC25019B3A6A7F2A6DB7A0318CF87C41E08C6F6BFA73E239939B0DA16972C1D357FF06177765D875E19742D23E99A95FD4AC5416
Malicious:	false
Reputation:	unknown
Preview:	........i#P.e.....h.....i.....j.....k.....l.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...\|.v...}.....................................................................................'.....{.......................^...........e...........f.................s...........I...........]...........P...........r.................{...........D.....]...........;...........$.................,.....}.....K...........v...........e...........r...........m.....................................................E.......................P.......................:.......................B.......................b.......................s.......................X.......................S..................!.....".....".....".....#....0$....\|$.....$....j%.....%....5&....l&.....'....z'.....'....!(....A).....)...............+.....,....H,....x,....M-.....-....6.....l.....k/...../....o0.....0.....1.....2....>3...._3.....4.....5....c6.....6.....7....n8.....8.....9.....9....f:.....:.....:.....;.....<....D=

C:\Users\user\AppData\Roaming\GamePall\locales\tr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	515329
Entropy (8bit):	5.616482888977033
Encrypted:	false
SSDEEP:
MD5:	46CA9EE922C3C175DE466066F40B29CE
SHA1:	5563E236A15CD9CC44AE859165DF1E4E722936C7
SHA-256:	BD8B1441FD2057F0B61512CC0AA23DFD2619560CF886B4D453FA7472E7153A3F
SHA-512:	45AA2D6896568751C2F986ABD281EA07CB731880DF8F28F2F0AEFD95736F41B1E005D8DFB6F0AEF0CED6CEF94154D34FD0DA2CB7F0B0C66D9C085F5C47F32605
Malicious:	false
Reputation:	unknown
Preview:	........c$V.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...\|.\|...}...........................................................................................)...........L.................+.......................e........... .....;.................7.....J.......................)......................................... .....B...........5.....x.................Z.......................Q.....{.................w.................Q.................!.......................'.......................&....................... ................."...../.................5.....F.................9.....F.................2.....>.................7.....D...........I.......................v.......................i.......................P.......................q.................-.....z.......................m.................,.............................*.................B................."...........(.....n.................N.....~.................l.......

C:\Users\user\AppData\Roaming\GamePall\locales\uk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	876131
Entropy (8bit):	4.88404350774067
Encrypted:	false
SSDEEP:
MD5:	1365ABDD1EFB44720EA3975E4A472530
SHA1:	8421FC4905C592EB1269C5D524AA46866D617D3C
SHA-256:	29AB0F7EE69FB7A1E1E54DD2A3746D2CFEAAA71AE5971EE30AA8E2E0F6556FA5
SHA-512:	2E806A9BEA864E689BBD1D78B800DFDBC6E4109320F9A4790E52010BFDEC20C7644655A6FE3BABDE0B84D9580208CB78EF1FA0DB3476F8676C17A13D130296C7
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.'...s.8...t.A...v.V...w.c...y.i...z.x...\|.~...}.....................................................................................1.....s.....W.......................r...........x...........m.....!.......................<.............................n...........,.................-...........\|.............................=.....y.....+...........%.....K...................................w.............................N...................................r.................O...........N.................^...........\...............................................h...............................................R.....m.....f.....6.............................W.....y...........O.....x...........K...........j...........z .....!.....!.....".....".....#....R#.....#....&$.....$.....$.....%.....%....s&.....&.... '.....(.....(....~).....).....*....Q+.....+.....,.....,....Z-.....-.....-....[............/....4/.....0.....0....$1

C:\Users\user\AppData\Roaming\GamePall\locales\ur.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	765853
Entropy (8bit):	5.17061834928747
Encrypted:	false
SSDEEP:
MD5:	3FED15E64BEAFBA75DE61B08A45AE106
SHA1:	E24953271D8C0254AD011D3A65B2C2FA57903681
SHA-256:	B6E250C3F4FBAC3AF5FB8BB1C61CACAD8685D7F2A97063DE23BC22E91B7F2E27
SHA-512:	3948D080135AFEB240815D43F7B5B8D407BA2830FF701D9B8343F2A72E610827EDAAB643444CDCEB86812ADFC9FB3FBA3AAD6DB7488843C2A04E92A3E63FE40D
Malicious:	false
Reputation:	unknown
Preview:	........1$..e.X...h.`...i.h...j.t...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.#.....+.....0.....8.....@.....H.....O.....V.....].....^....._.....d.....\|.............................n.....................................................).....^.......................<...........G.................J.................9...........E.................~...........{...........\...........L.....k.......................,.................9.....e.....C.......................>...................................8.....Z...........C.................;.................-...........L.................N.................1...........-.....y.........................................s............................p........... .......................i...........).....J.......................L...........M ..... ..... ....Y!.....!....4"....Z"....,#.....#....&$....W$....'%.....%....^&.....&....f'.....(.....(.....(.....)....3..............]+.....+.....,....F,.....,....z-.....-

C:\Users\user\AppData\Roaming\GamePall\locales\vi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	609259
Entropy (8bit):	5.796202390024141
Encrypted:	false
SSDEEP:
MD5:	CD741C24AF7597E0DC11069D3AC324E0
SHA1:	2A883DFBCF48D5093D70D4B77BBFFFA521287334
SHA-256:	13E982DC4B2B1AEE093E96BA27E02258C2B815CBB062006A4396BB3A3E6A84B1
SHA-512:	6D27998E25B57FF0CE08C3590B69031038CBA390E68333A83514022B2C56B689AF8AD9715302824027864B5320852E9AB77D74E3B8A90DC66DF59F48CEB528C9
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r....s.;...t.D...v.Y...w.f...y.l...z.{...\|.....}...........................................................................................;.......................-...........A.................[...........O.....u...........v.................6.......................+.......................}...........G.....y.....9...........K.....y.............................z...........?.....V...................................T.................X.......................r...................................9.....J...........H.......................}.................'.......................<.......................O.............................Z................._..................................)........... .....V.....v.......................j...........N.................3...................................O.....v................./.....C.......................@...........) ....^ ....w ..... ....J!....}!.....!..../".....".....#....8#

C:\Users\user\AppData\Roaming\GamePall\locales\zh-CN.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	441207
Entropy (8bit):	6.685712707138377
Encrypted:	false
SSDEEP:
MD5:	99E6ACFB46923C4F8B29058E9EE6166B
SHA1:	AF06C42E5F3578ADBC4F0BD7262DC6775FDD351F
SHA-256:	9D8498875263B19552A982D1850F2F942FF44AF4E323BC5A3A67C34413994D95
SHA-512:	4FDF5186FC2FC68210C2BE91F5B821F0979CA67D6C9B8915C14E7A20D3CE2548EB2660D5F9F398CF6C585A5C0725FA34FD3670F416F7C8A4F009C729BCF02988
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.T...h.\...i.d...j.g...k.v...l.}...m.....o.....p.....q.....r.....s.....t.....v.....w.....\|.....}...............................(.....-.....5.....<.....C.....E.....J.....S....._.....q.................v.................1......................./.......................:.......................>.............................c.......................D.....j................._.......................n.......................T.....}.................@.....o.................V.......................5.....O.....i................."...........x.......................U.......................].......................=.......................".....s.......................L.....u.................g.......................W.....w.................3.....X.....o...........&.....J.....\.................=.....].............................y.......................y...................................N.....`...........,.....d.....y...........).....O.....^.............................\|.......................x.

C:\Users\user\AppData\Roaming\GamePall\locales\zh-TW.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	439630
Entropy (8bit):	6.6906570508767995
Encrypted:	false
SSDEEP:
MD5:	BB7C995F257B9125457381BB01856D72
SHA1:	21C55FF5CBC4F223C23D5A2FBCC9E051DB78A44C
SHA-256:	F2299E03E99B0E9A9CACE3B1C72E6C8C5FE089487CA1C82F2AAF4273B62E37A2
SHA-512:	5247C5DA6F00DF6241500524DDB162041A03649FA0AFCC11AD40E820814958768A2E11CE34E1250FDBF42B2459F8C06B00AE7442B537F0731A62C6724FC8D890
Malicious:	false
Reputation:	unknown
Preview:	.........#,.e.....h.....i.)...j.-...k.<...l.G...n.O...o.T...p.\...q.b...r.n...s.....t.....v.....w.....y.....z.....\|.....}...................................................................%.....4.....C...........3.....q.................+.....T.....`........... .....R.....d.................M.....b.................3.....?.............................g.......................[.......................S.......................;.......................*.......................@.......................F.............................D.....d.....p.................2.....A.............................q.......................T.......................<.............................i.......................f.......................A.....[.....o.................!.............................u.......................^.............................h.......................P.........................................H.......................Z.......................$.....e.....z.................1.....X.....j...........#.

C:\Users\user\AppData\Roaming\GamePall\log4net.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	275968
Entropy (8bit):	5.778490068583466
Encrypted:	false
SSDEEP:
MD5:	7EA1429E71D83A1CCAA0942C4D7F1C41
SHA1:	4CE6ACF4D735354B98F416B3D94D89AF0611E563
SHA-256:	EDEC54DA1901E649588E8CB52B001AB2AEC76ED0430824457A904FCC0ABD4299
SHA-512:	91C90845A12A377B617140B67639CFA71A0648300336D5EDD422AFC362E65C6CCD3A4FF4936D4262B0EAF7BAE2B9624BCD3C7EEC79F7E7CA18ABE1EC62C4C869
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.X...........!.....,..........~K... ...`....... ..............................H.....@.................................$K..W....`...............................I............................................... ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B................`K......H...........<x...............-..P .......................................i.)V.#c....e../.`...V....j>....?.LbrzKV.x.}...........[.f)..dD`..66.61[.z....W^....>F..r...#. ..g...T...P....Ss)ii.a.v.(0.....(1...o2...s....}.......0..7........{....-%~....r...p.{....r9..p(3...(.....(.......(4.............//........{...."..}......{........0..4..........%...(5....-.~....r?..p(....+...}.......,..(6............')........{......{...."..}.......{...."..}....*.0..........

C:\Users\user\AppData\Roaming\GamePall\log4net.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1547797
Entropy (8bit):	4.370092880615517
Encrypted:	false
SSDEEP:
MD5:	32AB4E0A9A82245EE3B474EF811F558F
SHA1:	9F2C4C9EEB5720D765F2321ACD0FF9F8DD11E6A4
SHA-256:	9BBF4D15F8FB11F7D2C032BD920D2A33B2C2CB8EF62E7E023049AF6132F5D6C1
SHA-512:	A0574A170F69F9926C32BAF6119A16A381FEC9E881B304082859EE7CFF463570C78984EE14369C59CDB19E532B3ABF193D02B462F1B40D07214B6244150CD63F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>log4net</name>.. </assembly>.. <members>.. <member name="T:log4net.Appender.AdoNetAppender">.. <summary>.. Appender that logs to a database... </summary>.. <remarks>.. <para>.. <see cref="T:log4net.Appender.AdoNetAppender"/> appends logging events to a table within a.. database. The appender can be configured to specify the connection .. string by setting the <see cref="P:log4net.Appender.AdoNetAppender.ConnectionString"/> property. .. The connection type (provider) can be specified by setting the <see cref="P:log4net.Appender.AdoNetAppender.ConnectionType"/>.. property. For more information on database connection strings for.. your specific database see <a href="http://www.connectionstrings.com/">http://www.connectionstrings.com/</a>... </para>.. <para>.. Record

C:\Users\user\AppData\Roaming\GamePall\natives_blob.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	342741
Entropy (8bit):	5.496697631795104
Encrypted:	false
SSDEEP:
MD5:	A58DB728B50E6B82CBDCAA0DB61D36B1
SHA1:	7CD76526CB29A0FF5350A2B52D48D1886360458B
SHA-256:	BA2F2AC6AE9BC67399728F25772A0EB3E840695395CC747ADF4B2F8B5D6D9A46
SHA-512:	0DB9AFBDADA44364521D89BAB6055458125F4F3C8C1B09048EAFA4055A194231CCFFD82FCDADA9360AB2B19F472B893330EBFCB027391E7A0C2B1100FC51E673
Malicious:	false
Reputation:	unknown
Preview:	..mirrors....(function(a,b){."use strict";.var c=a.Array;.var d=a.isNaN;.var e=a.JSON.stringify;.var f;.var g;.var h=b.ImportNow("promise_state_symbol");.var i=b.ImportNow("promise_result_symbol");.var j;.var k;.b.Import(function(l){.f=l.MapEntries;.g=l.MapIteratorNext;.j=l.SetIteratorNext;.k=l.SetValues;.});.var m={.UNDEFINED_TYPE:'undefined',.NULL_TYPE:'null',.BOOLEAN_TYPE:'boolean',.NUMBER_TYPE:'number',.STRING_TYPE:'string',.SYMBOL_TYPE:'symbol',.OBJECT_TYPE:'object',.FUNCTION_TYPE:'function',.REGEXP_TYPE:'regexp',.ERROR_TYPE:'error',.PROPERTY_TYPE:'property',.INTERNAL_PROPERTY_TYPE:'internalProperty',.FRAME_TYPE:'frame',.SCRIPT_TYPE:'script',.CONTEXT_TYPE:'context',.SCOPE_TYPE:'scope',.PROMISE_TYPE:'promise',.MAP_TYPE:'map',.SET_TYPE:'set',.ITERATOR_TYPE:'iterator',.GENERATOR_TYPE:'generator',.}.var n=0;.var o=-1;.var p=[];.var q=true;.function MirrorCacheIsEmpty(){.return n==0&&p.length==0;.}.function ToggleMirrorCache(r){.q=r;.ClearMirrorCache();.}.function ClearMirrorCache(r){.

C:\Users\user\AppData\Roaming\GamePall\resources.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	8226870
Entropy (8bit):	7.996842728494533
Encrypted:	true
SSDEEP:
MD5:	F7EC58AEA756F3FD8A055AC582103A78
SHA1:	086B63691F5E5375A537E99E062345F56512A22C
SHA-256:	517418184EA974C33FFE67B03732D19B1234DCB9E5C1C2E9E94ED41B3BC1D064
SHA-512:	C620C6E16BBCEE9BC607E6CA75D602C756276AC69E5F3761D82DE7728164133656A71A69043EB1A86CE3051FDE4327A47EFD41D1FF47C8385699CA67C423AD7B
Malicious:	false
Reputation:	unknown
Preview:	............f.6:..{..D..\|..G..~. K.....]....._....=.....c...........9.....B.............................F.....K/.....2....54....r5.....6.....?.....@....jB.....C....hD.....E.....H....nj.....k.....r....@~...."..........W.....................;..../;'...2;P...7;....8;....C;....D;U...E;....F;....G;A,..H;.;..I;gK..J;.Z..K;.h..L;.}..M;y...N;{...O;z...P;....Q;8...R;....S;....T;C'..U;.=..V;.W..W;.m..X;....Y;....Z;D...[;....\;....];.....<.....<x....<.....<-....<\....<.....<.....<.....<.....<*(...< /...<+3...<.3..I=.3..J=.7..K=.9..R= >..S=.G..T=}V..[=;w..\=.x..]=.}..^=R..._=....`=....a=....b=....c=....e=:...f=.....=....=.....=....=`....=p....=.....=.....=.....=.....=.....=K....=.....=t....=.....=.....=.....=\....=Z....=.....=T....=[....=x....=.....=.....=D....=.....=.....=.....=l....=F....=.'...=j)...>.+...>l,...>_0...>.2...>.6...>.8..N>.\..O>~^..P>._..Q>%d..R>.k..S>.l..T>Tn..U>.p..b>.u..c>/y..d>.\|..B@....C@....D@o...E@....F@W...L@Z...M@(...N@...O@....D.....D ....D ....D;....D.....D....D..

C:\Users\user\AppData\Roaming\GamePall\snapshot_blob.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	276319
Entropy (8bit):	4.242318669799302
Encrypted:	false
SSDEEP:
MD5:	8234983533FA47D2A1D7710FF8274299
SHA1:	E4C5793B6FE6A6C6C9D8E3921B3BC341AE3448D8
SHA-256:	F95553D8066144CBB8A05EED1735C94A4B97A2E44E49F624C2302990A13017C9
SHA-512:	1E7E201B0FF9AFA7821B5FFD0A36548A49CD4DBBABA5858E13DA35058670A5053723DD3544B2FD85C619F2B8FC9E5DB48DF977BB293E7BA7DE6F22CC8DAB28CA
Malicious:	false
Reputation:	unknown
Preview:	.........X./j1N.11.8.172.9.......................................................@...y...........@..`....`....`....`b...`....`............B..............b........."..............B..............b...(Jb...)L.....@..F^.1..5.`.....(Jb...-P.....@..F^..`.....H...IDa........Db............D`.....-.D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\start.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.8731406795131327
Encrypted:	false
SSDEEP:
MD5:	2C66F3C2190A84FAFD4449DAF6440EAC
SHA1:	7B9E4C94329FE26C34E63AB8336227FD5EB553E9
SHA-256:	58EB97E30289A3FCAE270DBCC01258A862936350CB0EF781AE76D6A9444C0155
SHA-512:	62713209575426CE503605C6F451E9DFB025BE0295F0A453614862CE390F5987F0E16BAE6B37B4B1A7330A7CB5AA31249F8CF58DE37B8B701C16881E4E4E61C1
Malicious:	false
Reputation:	unknown
Preview:	start GamePall.exe OuWe5kl

C:\Users\user\AppData\Roaming\GamePall\swiftshader\Xilium.CefGlue.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	MSVC program database ver 7.00, 512*4023 bytes
Category:	dropped
Size (bytes):	2059776
Entropy (8bit):	4.067542396670122
Encrypted:	false
SSDEEP:
MD5:	70F9EAEA8A2A604E59F72EDE66F83AB4
SHA1:	0AB9EA1BFFDFF471EC22AB289C7FBC5E0CDF48BF
SHA-256:	38A07BA75CC2BBDF715CA87D380A4E5A0DCFAF9C30C5ECD30F6107871D51825B
SHA-512:	47DE4DAD93385A4907FADE307040FE026ED66989C0C9915AFC96CB2BC93DE5E106DC1274E4AD2382021C758C60FEDE06D68998CF3591E23E2951778CE09D6D4C
Malicious:	false
Reputation:	unknown
Preview:	Microsoft C/C++ MSF 7.00...DS................J..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346624
Entropy (8bit):	6.54104466243173
Encrypted:	false
SSDEEP:
MD5:	7A53AD3E5D2E65C982450E7B7453DE8A
SHA1:	99F27E54F1F61207C02110CAC476405557A8AD54
SHA-256:	24FDDD6A367792A9D86D9060FC9AA459B5FB0F67804CB7D139A100D86BBDAFF8
SHA-512:	2B5E5DB46FDC787CB46CDAEBFFC01586E248FBB864677B27AF03CDC33E956DEF51B3F836597E7092C4175CF605C44728C6F96B74BB2C9870E9715D4AF4C531A1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......_.........."!.........T............................................................@A....................................P....p...........................3..4.......................8........G...............................................text............................... ..`.rdata..............................@..@.data....4..........................@....00cfg.......@......................@..@.tls.........P......................@....voltbl......`...........................rsrc........p......................@..@.reloc...3.......4..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2445312
Entropy (8bit):	6.750207745422387
Encrypted:	false
SSDEEP:
MD5:	334C3157E63A34B22CCE25A44A04835F
SHA1:	C6B05BD55BE9FED3B0C5077C5649E2A41C10DC08
SHA-256:	3E307570B574469EC8BCF1CE6D5291DF8D627CA3812F05AACFEBBD3F00B17F89
SHA-512:	11F538ADD05515861891892EBB90163B6540B72FEB380D64B4A0AA56C6415E3B71374557BF50D0B936712B1006F2B94D59BEBFBF18CBF93BB883D9055CAAEEE9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......_.........."!.....4 .................................................p*...........@A..........................#.. ....$.d....P)......................`).......#.......................#......."...............$.P............................text.../2 ......4 ................. ..`.rdata..\....P ......8 .............@..@.data...L....@$...... $.............@....00cfg....... )......>$.............@..@.tls.........0)......@$.............@....voltbl.M....@)......B$..................rsrc........P)......D$.............@..@.reloc.......`)......H$.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	631017
Entropy (8bit):	5.144793130466209
Encrypted:	false
SSDEEP:
MD5:	0794DF29DF8DFC3ECE5C443F864F5AEB
SHA1:	BFD4A9A34BEB9751BC4203FB9A9172F1F05E5B16
SHA-256:	3EE2237E9B14871165B051CCF892C8375E45B5F12841E02F4B9D37F5D5A03283
SHA-512:	0D34E36F7455B977F086F04840FBA679284A619A7164A56B5C7FC2ADCB23A231B67A62101540EB07CF5C8192790266B08D2CC232D291621C331FE77C1F5E52C0
Malicious:	false
Reputation:	unknown
Preview:	..........d..<..11.8.172.9......................................................@...]!...S..y...-[..........`....`....`T...`b...`....`............B..............b........."..............B..............b...(Jb...)L.....@..F^.1..5.`.....(Jb...-P.....@..F^..`.....H...IDa........Db............D`.....-.D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4400640
Entropy (8bit):	6.667314807988382
Encrypted:	false
SSDEEP:
MD5:	7F913E31D00082338F073EF60D67B335
SHA1:	AC831B45F2A32E23BA9046044508E47E04CDA3A4
SHA-256:	B60E9818C4EA9396D0D2D2A4AC79C7DC40D0DFF6BB8BC734D0AB14ADC30FBF30
SHA-512:	E1AC79C775CF9137283CD2C1AE1A45EC597E0351CDB9C11D483E2E1F8B00CC2BBC5807A50DED13A3A5E76F06C1A565EFF1233F4EC727B0C5F7AA3BEAEA906750
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....$5.........P.-......................................PD...........@A........................8=?.~....\?.P.... B......................0B.X.....?.....................H.?......@5.............._?..............................text...T#5......$5................. ..`.rdata...a...@5..b...(5.............@..@.data...@N....?..x....?.............@....00cfg........B.......A.............@..@.tls....5.....B.......A.............@....rsrc........ B.......A.............@..@.reloc..X....0B.......A.............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Reputation:	unknown
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	826368
Entropy (8bit):	6.78646032943732
Encrypted:	false
SSDEEP:
MD5:	A031EB19C61942A26EF74500AD4B42DF
SHA1:	FDC6EA473234F153639E963E8EFB8D028DA1BE20
SHA-256:	207706A3A3FAA8500F88CB034B26413074EFC67221A07C5F70558F3C40985A91
SHA-512:	80F843E47FC2B41B17EF6EA1BB2BB04119B2417311599EC52120D9F9DF316B4D7B1DAF97EE5CDF2AE78CDB9475E5C65255A7F2AB2A9231804F6A82C83303FD19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....\|..........@.....................................................@A...........................<!..$...P....p..............................l..............................................P................................text....z.......\|.................. ..`.rdata..tr.......t..................@..@.data....7..........................@....00cfg.......P......................@..@.tls.........`......................@....rsrc........p......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	211456
Entropy (8bit):	6.566524833521835
Encrypted:	false
SSDEEP:
MD5:	6D7FD214164C858BBCF4AA050C114E8C
SHA1:	B8868DA6BB9A79EE7C9901A9BFAC580D5BAFCC96
SHA-256:	3F58FB22BD1A1159C351D125BEE122A16BB97BABB5FCA67FDBD9AAAED3B302E6
SHA-512:	0F8F2523C3A616AC7C72A1239B7E353F6A684FF75DA79D1CAF9B98A47FF6FE06329165825704C67C04E92073BA2C17D0FF339C57731DDF0F1489C2E97D1D0A14
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^..._...^..._q..^..._..^..._..^..._..^..._..^k.._...^..._...^...^...^k.._...^k.._...^n..^...^k.._...^Rich...^........................PE..L...Ua.X.........."!.........(......c........0............................................@.................................x...<....@.......................P..T"......8...............................@............0..0............................text............................... ..`.rdata..`....0....... ..............@..@.data...............................@....gfids.......0......................@..@.rsrc........@......................@..@.reloc..T"...P...$..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\abrjicd

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225792
Entropy (8bit):	6.358667223174591
Encrypted:	false
SSDEEP:
MD5:	990159D65A7268E9F9DA50E115E7FCEC
SHA1:	CE4EF81F35DAE8B12628D6588534A4510C429776
SHA-256:	9B5BB6664B66132E313E9F3E6BF35452008D2E47A91913918A633B348133B617
SHA-512:	50E1C5CCDF2630ABDC8896190CFDDA54316A343E7AC245AE77490ACEFD13CD1634786099EB7B1E0CC4C4A676A0EAC70C2126670638AF79710F204E34B3C3D4F2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]..3...3...3......3......3......3.......3...2...3......3......3......3.Rich..3.................PE..L.....[d.................,...$}......'.......@....@..................................".......................................l..x.....~.XR...........................l...............................f..@............@...............................text....*.......,.................. ..`.rdata..N6...@...8...0..............@..@.data.....\|..........h..............@....rsrc...XR....~..T..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\abrjicd:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.358667223174591
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	225'792 bytes
MD5:	990159d65a7268e9f9da50e115e7fcec
SHA1:	ce4ef81f35dae8b12628d6588534a4510c429776
SHA256:	9b5bb6664b66132e313e9f3e6bf35452008d2e47a91913918a633b348133b617
SHA512:	50e1c5ccdf2630abdc8896190cfdda54316a343e7ac245ae77490acefd13cd1634786099eb7b1e0cc4c4a676a0eac70c2126670638af79710f204e34b3c3d4f2
SSDEEP:	3072:4mk5pwID0GBdET653rNnGLqTEjdL51iGaP4vADr2eeienD1OBfHl:4zGQ0GBdET6LnGLqTQLHIZieeieJOBf
TLSH:	D024CF6133E2D272D4B70674B8B58AB12EBE7873A7B4818F7758133D5E203D04E653A6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]...3...3...3.......3.......3.......3.......3...2...3.......3.......3.......3.Rich..3.................PE..L.....[d...........

File Icon


Icon Hash:	63396de161436e0f

Static PE Info

General

Entrypoint:	0x4027d8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x645BB182 [Wed May 10 15:00:18 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	a41cb227b532719e916aace9338b6342

Entrypoint Preview

Instruction
call 00007F5C5C8115A1h
jmp 00007F5C5C80D89Eh
push edi
mov eax, esi
and eax, 0Fh
test eax, eax
jne 00007F5C5C80DAD7h
mov edx, ecx
and ecx, 7Fh
shr edx, 07h
je 00007F5C5C80DA77h
jmp 00007F5C5C80DA18h
lea ebx, dword ptr [ebx+00000000h]
movdqa xmm0, dqword ptr [esi]
movdqa xmm1, dqword ptr [esi+10h]
movdqa xmm2, dqword ptr [esi+20h]
movdqa xmm3, dqword ptr [esi+30h]
movdqa dqword ptr [edi], xmm0
movdqa dqword ptr [edi+10h], xmm1
movdqa dqword ptr [edi+20h], xmm2
movdqa dqword ptr [edi+30h], xmm3
movdqa xmm4, dqword ptr [esi+40h]
movdqa xmm5, dqword ptr [esi+50h]
movdqa xmm6, dqword ptr [esi+60h]
movdqa xmm7, dqword ptr [esi+70h]
movdqa dqword ptr [edi+40h], xmm4
movdqa dqword ptr [edi+50h], xmm5
movdqa dqword ptr [edi+60h], xmm6
movdqa dqword ptr [edi+70h], xmm7
lea esi, dword ptr [esi+00000080h]
lea edi, dword ptr [edi+00000080h]
dec edx
jne 00007F5C5C80D9B5h
test ecx, ecx
je 00007F5C5C80DA5Bh
mov edx, ecx
shr edx, 04h
test edx, edx
je 00007F5C5C80DA29h
lea ebx, dword ptr [ebx+00000000h]
movdqa xmm0, dqword ptr [esi]
movdqa dqword ptr [edi], xmm0
lea esi, dword ptr [esi+10h]
lea edi, dword ptr [edi+10h]
dec edx
jne 00007F5C5C80DA01h
and ecx, 0Fh
je 00007F5C5C80DA36h
mov eax, ecx
shr ecx, 02h
je 00007F5C5C80DA1Fh
mov edx, dword ptr [esi]
mov dword ptr [edi], edx
lea esi, dword ptr [esi+04h]
lea edi, dword ptr [edi+04h]
dec ecx
jne 00007F5C5C80DA05h
mov ecx, eax
and ecx, 00000000h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x26c84	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x27ea000	0x5258	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x26cfc	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x26600	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x24000	0x1a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x22ae0	0x22c00	6e3ec9719a44fba47acfdf0293a27f0d	False	0.8381997526978417	data	7.650997921754289	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x24000	0x364e	0x3800	c8feb1131c81770c3529e7c8270e7b35	False	0.35888671875	data	4.870946004306849	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x28000	0x27c1a84	0xb600	1fc877655b4663564db05eeeadd4a9ed	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x27ea000	0x5258	0x5400	d4e863244f39fd50beefae3352b48b28	False	0.49060639880952384	data	4.676131605846077	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
LUCE	0x27ed358	0x136f	ASCII text, with very long lines (4975), with no line terminators	Japanese	Japan	0.5971859296482412
RT_ICON	0x27ea250	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Japanese	Japan	0.5305299539170507
RT_ICON	0x27ea918	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Japanese	Japan	0.4186721991701245
RT_ICON	0x27ecec0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Japanese	Japan	0.4583333333333333
RT_STRING	0x27ee960	0x582	data	Japanese	Japan	0.4475177304964539
RT_STRING	0x27eeee8	0x108	data	Japanese	Japan	0.5795454545454546
RT_STRING	0x27eeff0	0x266	data	Japanese	Japan	0.4804560260586319
RT_GROUP_ICON	0x27ed328	0x30	data	Japanese	Japan	0.9375
RT_VERSION	0x27ee6c8	0x294	OpenPGP Secret Key			0.5272727272727272

Imports

DLL	Import
KERNEL32.dll	IsBadStringPtrW, GetConsoleAliasesLengthW, CommConfigDialogA, SetEndOfFile, FindResourceW, InterlockedDecrement, CreateDirectoryW, WriteConsoleInputA, GetWindowsDirectoryA, TlsSetValue, GlobalFindAtomA, LoadLibraryW, ReplaceFileA, GlobalUnlock, SetLastError, GetProcAddress, SetFileAttributesA, FindResourceA, LoadLibraryA, LocalAlloc, AddVectoredExceptionHandler, GlobalGetAtomNameW, OpenJobObjectW, EnumResourceTypesW, GetOEMCP, OpenFileMappingW, TerminateJobObject, SetStdHandle, WriteConsoleW, CloseHandle, SetFilePointer, FlushFileBuffers, GetConsoleMode, GetConsoleCP, HeapReAlloc, CreateFileA, GetDiskFreeSpaceW, GetDateFormatW, RaiseException, HeapSize, MultiByteToWideChar, GetModuleHandleW, ExitProcess, DecodePointer, GetCommandLineA, HeapSetInformation, GetStartupInfoW, IsProcessorFeaturePresent, HeapAlloc, EnterCriticalSection, LeaveCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, TerminateProcess, GetCurrentProcess, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, GetLastError, HeapFree, GetCPInfo, InterlockedIncrement, GetACP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsFree, GetCurrentThreadId, WriteFile, GetModuleFileNameW, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, HeapCreate, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, Sleep, RtlUnwind, LCMapStringW, GetStringTypeW, CreateFileW
USER32.dll	GetKeyboardLayoutNameA, SetMessageExtraInfo, GetCaretPos, InsertMenuItemW, GetClassInfoW, CharUpperBuffW, DdeKeepStringHandle
GDI32.dll	GetTextMetricsA, GetCharWidthW
ole32.dll	CoSuspendClassObjects, CoMarshalHresult
WINHTTP.dll	WinHttpCheckPlatform, WinHttpWriteData

Possible Origin

Language of compilation system	Country where language is spoken	Map
Japanese	Japan

Target ID:	0
Start time:	00:06:52
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	225'792 bytes
MD5 hash:	990159D65A7268E9F9DA50E115E7FCEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1708841402.0000000004961000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1708841402.0000000004961000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1708546917.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1708546917.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1708529493.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1708748359.0000000002ECF000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:06:58
Start date:	04/07/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	00:07:17
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\abrjicd
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\abrjicd
Imagebase:	0x400000
File size:	225'792 bytes
MD5 hash:	990159D65A7268E9F9DA50E115E7FCEC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.1955753241.0000000004B11000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000003.00000002.1955753241.0000000004B11000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000003.00000002.1955502229.0000000002D70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.1955545560.0000000002D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000003.00000002.1955545560.0000000002D90000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000003.00000002.1955623146.0000000002DBF000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:07:32
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1E47.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\1E47.exe
Imagebase:	0x5f0000
File size:	6'642'176 bytes
MD5 hash:	BD2EAC64CBDED877608468D86786594A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:07:44
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Local\Temp\5239.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5239.exe
Imagebase:	0x400000
File size:	293'869 bytes
MD5 hash:	60172CA946DE57C3529E9F05CC502870
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 21%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:09:06
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Local\Temp\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\setup.exe"
Imagebase:	0x400000
File size:	107'232'830 bytes
MD5 hash:	FF2293FBFF53F4BD2BFF91780FABFD60
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:09:34
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Imagebase:	0x160000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:09:39
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3260 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
Imagebase:	0x970000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:09:40
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3644 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Imagebase:	0xd70000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:09:40
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=4004 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Imagebase:	0x790000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:09:40
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x230000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:09:40
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720060670928462 --launch-time-ticks=6109120652 --mojo-platform-channel-handle=4000 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Imagebase:	0x3d0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	00:09:40
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xf70000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	00:09:40
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/323.0.647062479 Mobile/15E148 Safari/604.1" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720060670928462 --launch-time-ticks=6109617818 --mojo-platform-channel-handle=4336 --field-trial-handle=3264,i,8706922110688612471,15985996599334655023,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Imagebase:	0x400000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	00:09:41
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x370000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:09:43
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x530000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	00:09:43
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x3e0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	00:09:43
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x4f0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	00:09:44
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x5c0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	00:09:44
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xab0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	00:09:45
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xce0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	00:09:45
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x20000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	00:09:45
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xfe0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	00:09:45
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x10000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	00:09:46
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x600000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	00:09:47
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xd00000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	00:09:47
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xb0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	00:09:47
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xd70000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	00:09:47
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xc10000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	00:09:48
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x640000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	00:09:48
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xd80000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	00:09:49
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x610000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	00:09:49
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xda0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	00:09:49
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x5e0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	00:09:49
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x2b0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	28.6%
Signature Coverage:	65.3%
Total number of Nodes:	98
Total number of Limit Nodes:	3

Executed Functions

Function 00401496 Relevance: 10.7, APIs: 7, Instructions: 247
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.1707447765.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 5edb7204c22a8cfb94061bf161a88c3eca98da374ec15d8cd8ba2bf42dcd3747
Instruction ID: 8e4940cc2d5d294876689a6a874cb0cc3c399929e81e9dec1e5d288c8cd9e9dd
Opcode Fuzzy Hash: 5edb7204c22a8cfb94061bf161a88c3eca98da374ec15d8cd8ba2bf42dcd3747
Instruction Fuzzy Hash: F481B375500244BBEB209F91CC44FAB7BB8FF85704F10412AF952BA2F1E7749901CB69

Function 00401538 Relevance: 10.7, APIs: 7, Instructions: 207
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.1707447765.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 4af5c640631db37ac51d1c1afd1ab74928840835cbc445bb96c3204467379d38
Instruction ID: 71a4d0092025beca94809e07d65936591d52f1bb8effc294688e3fcd05e54c36
Opcode Fuzzy Hash: 4af5c640631db37ac51d1c1afd1ab74928840835cbc445bb96c3204467379d38
Instruction Fuzzy Hash: E0615171900204FBEB209F95CC89FAF7BB8FF85700F10412AF912BA2E5D6759905DB65

Function 004014DE Relevance: 10.7, APIs: 7, Instructions: 204
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.1707447765.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: c3f6308678fe624b1287adcb7156a2cf5c07ee8b7810a15753646c5694e98bc6
Instruction ID: 6a824664258ffec6fdf95c516407446232c8a84219ad61b9fd4b8efeb52f3576
Opcode Fuzzy Hash: c3f6308678fe624b1287adcb7156a2cf5c07ee8b7810a15753646c5694e98bc6
Instruction Fuzzy Hash: 9B615C75900245BFEB219F91CC88FEBBBB8FF85710F10016AF951BA2A5E7749901CB24

Function 00401543 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.1707447765.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f4faf4f0efc4cc5c307795d20c298965336779ff7452863f8b2b81be2522acaa
Instruction ID: 1fc6fb52bb36dddf8f971a96ecfe927bdbae9887f6286775c14151e9c1d92244
Opcode Fuzzy Hash: f4faf4f0efc4cc5c307795d20c298965336779ff7452863f8b2b81be2522acaa
Instruction Fuzzy Hash: 13512B71900245BBEB209F91CC88FAF7BB8EF85B00F14416AF912BA2E5D6749945CB64

Function 00401565 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.1707447765.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 40d7219ce39e026dd98d18ec02294656054e4da488103e740ba1602fb3a5db7c
Instruction ID: d88667ffe02cbbb2798d41d5ad0cf6527765788d972b82ac88077c7d238bff09
Opcode Fuzzy Hash: 40d7219ce39e026dd98d18ec02294656054e4da488103e740ba1602fb3a5db7c
Instruction Fuzzy Hash: 54511A71900205BFEF209F91CC89FAFBBB8FF85B10F104259F911AA2A5D7759941CB64

Function 00401579 Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.1707447765.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 44bf211d5ecd49b3cfb3996dc98baa0f9fc545abe5e070ef87effc0df1f686f8
Instruction ID: 7169477154cf1621f4f222e223ad54e678f31395e99d0ffd613e12cb64d905d3
Opcode Fuzzy Hash: 44bf211d5ecd49b3cfb3996dc98baa0f9fc545abe5e070ef87effc0df1f686f8
Instruction Fuzzy Hash: 2B511A75900245BBEF209F91CC88FEF7BB8FF85B10F104119F911BA2A5D6759941CB64

Function 0040157C Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.1707447765.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c4110b1088d5ef41785dfe7ea8eaa09ab46741a105747cbb29c974859abd6495
Instruction ID: 14f4b29c405daff92d21e2b3eea283823ae405efc36948ac0d92101f557811aa
Opcode Fuzzy Hash: c4110b1088d5ef41785dfe7ea8eaa09ab46741a105747cbb29c974859abd6495
Instruction Fuzzy Hash: DE51F9B5900245BBEF209F91CC88FEFBBB8FF85B10F104259F911AA2A5D6709944CB64

Function 00402FE9 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040311D
NtTerminateProcess.NTDLL ref: 00403136

Memory Dump Source

Source File: 00000000.00000002.1707447765.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 3e1675bac70c022a4e457ffe6b5fa54937b73e0116388ba90aec32851b4d9964
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: A1412431228E088FD768EF5CA885762B7D5F798311F6643AAE809D7389EA34DC1183C5

Function 02ED617A Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02ED61A2
Module32First.KERNEL32(00000000,00000224), ref: 02ED61C2

Memory Dump Source

Source File: 00000000.00000002.1708748359.0000000002ECF000.00000040.00000020.00020000.00000000.sdmp, Offset: 02ECF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ecf000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: c7836c095497c0ae0c28644d94de6235bc0c579d1ba29c2cbb1cc62686add009
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: FCF0C2315407146BD7203AB8A88CB6A72EDAF49629F105129E64A920C1CB70E8064A60

Function 02D2003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02D2024D

Strings

kernel32.dll, xrefs: 02D2008F, 02D20095
cess, xrefs: 02D2018D

Memory Dump Source

Source File: 00000000.00000002.1708529493.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: c4b03325472ff636c60c80a339d20913dbb2316f2b68f3f12d700b0ff39e12ce
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 2C525A74A01229DFDB64CF58C984BA8BBB1BF19309F1480D9E54DAB351DB30AE89DF14

Function 02D20E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02D20223,?,?), ref: 02D20E19
SetErrorMode.KERNELBASE(00000000,?,?,02D20223,?,?), ref: 02D20E1E

Memory Dump Source

Source File: 00000000.00000002.1708529493.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 0ebd9cbcc65d6fff2cee901cd3f49162a2ad40f12e8d4fbcaf4dd37bca0f864f
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: BCD0123114512877D7002A94DC09BCD7B1CDF05B67F008011FB0DD9180C770994046E5

Function 00401918 Relevance: 1.3, APIs: 1, Instructions: 57
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.1707447765.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: be810bd81fc1513bf14dac74237aa616a3cfbc48422f9378a192f31e1e69cca3
Instruction ID: 41df8370e0b5f9a47a14a91e784646d83bdfa422f97ac69dcfec837627d5bcb0
Opcode Fuzzy Hash: be810bd81fc1513bf14dac74237aa616a3cfbc48422f9378a192f31e1e69cca3
Instruction Fuzzy Hash: 6D018CF520C148E7EB016A948DB1EBA36299B45324F300233B647B91F4C57C8A03E76F

Function 00401924 Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.1707447765.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 3ad2d4b3403b833ed421c634174be831538fe621ff724946387ec8f91c54f5fa
Instruction ID: 34fc3aff5e218d4630d956a4f9c4c41b7245144a44faa4fd8074b33eba8f9d72
Opcode Fuzzy Hash: 3ad2d4b3403b833ed421c634174be831538fe621ff724946387ec8f91c54f5fa
Instruction Fuzzy Hash: 43017CF5208145E7EB015A948DB0EBA26299B45314F300237B617BA1F4C57D8602E76F

Function 02ED5E39 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02ED5E8A

Memory Dump Source

Source File: 00000000.00000002.1708748359.0000000002ECF000.00000040.00000020.00020000.00000000.sdmp, Offset: 02ECF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ecf000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 65208ea7cb9e4915d346da64d108c622b122036de528874d70c5df73864dd9d9
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: D1113979A40208EFDB01DF98C985E99BBF5AF08350F05C0A4F9489B362D371EA90DF90

Function 00401941 Relevance: 1.3, APIs: 1, Instructions: 44sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.1707447765.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 6acc595331c6a8be6e6657ef398eef7c869974a8ecae4d1fde63dfd35a725e44
Instruction ID: 53d82b158b021bc4b6cde56962adc0b8c8d23177238c0d6ee964112a53f005ae
Opcode Fuzzy Hash: 6acc595331c6a8be6e6657ef398eef7c869974a8ecae4d1fde63dfd35a725e44
Instruction Fuzzy Hash: 38F0AFB6308249F7DB01AA908DB1EBA36299B54315F300633B617B91F5C57C8A12E76F

Function 00401954 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.1707447765.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 0dfbee2e4a1c62836b2bd3ba6284fddb5b43d5507a7098400a51ac80bc720613
Instruction ID: f7568a5a22988f4b084f7ac8228f9b89e575eda69d31bfffabc36cd9cbe45c64
Opcode Fuzzy Hash: 0dfbee2e4a1c62836b2bd3ba6284fddb5b43d5507a7098400a51ac80bc720613
Instruction Fuzzy Hash: BDF0C2B6208144F7DB019AA18DB1FBA36299B44314F300233BA17B90F5C67C8612E76F

Function 0040194C Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.1707447765.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: f575feb9a37452ed4573e207967fb92b714552aa85f9b6ebf0a13cec3e485039
Instruction ID: 9d6088553fbd849a34ffa1589a5f9bffd683413c7e042594889390f4c4f3f426
Opcode Fuzzy Hash: f575feb9a37452ed4573e207967fb92b714552aa85f9b6ebf0a13cec3e485039
Instruction Fuzzy Hash: 08F0C2B2208144F7DB019A958DA0FBA36299B44314F300633B617B91F5C57C8A02E72F

Non-executed Functions

Function 02D2092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 02D20966
., xrefs: 02D2095F
GetProcAddress., xrefs: 02D209DC, 02D209DF, 02D209E4

Memory Dump Source

Source File: 00000000.00000002.1708529493.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 038ab6f28042717a672f9a5b454857f441dbe6b28788011cd9e3f070fca54bb1
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: FD314AB6905619DFDB10CF99C880AADBBF9FF68329F14404AD441B7310D771EA49CBA4

Function 02ECF584 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708748359.0000000002ECF000.00000040.00000020.00020000.00000000.sdmp, Offset: 02ECF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ecf000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec159ce33e606e61bd1d6c77bde11b2dc452677804db942bd1cd15340924a2f7
Instruction ID: a138464949b891bf488385a59c8de5e7a227b0effb53acdd69ae3d3c0e352d05
Opcode Fuzzy Hash: ec159ce33e606e61bd1d6c77bde11b2dc452677804db942bd1cd15340924a2f7
Instruction Fuzzy Hash: 30C1274288EBC05FD70357B849BA5A17F718E2701076E9AEBC0C1CF9B3E459182BD766

Function 02ED5A57 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708748359.0000000002ECF000.00000040.00000020.00020000.00000000.sdmp, Offset: 02ECF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ecf000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: c1a00fee23068bc52f785209b82e86baaefc550d6f5c194cab5644d72df12868
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 9A118E72380111AFDB44DF55DCC0EA677EAFB89224B698069ED08CB311E675E802CB60

Function 02D20D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708529493.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 7a75fc0f9b50b0fca8cb8150f97b5fa840e8c9a67b271d19633f222a3c739f19
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: E7012B766116108FDF21CF20C804BAA33F5FBA521BF0540B4D506D7341E370AC45CB80

Analysis Process: abrjicdPID: 6816, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	28.6%
Signature Coverage:	0%
Total number of Nodes:	98
Total number of Limit Nodes:	3

Executed Functions

Function 00401496 Relevance: 10.7, APIs: 7, Instructions: 247
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000003.00000002.1954358717.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_abrjicd.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 5edb7204c22a8cfb94061bf161a88c3eca98da374ec15d8cd8ba2bf42dcd3747
Instruction ID: 8e4940cc2d5d294876689a6a874cb0cc3c399929e81e9dec1e5d288c8cd9e9dd
Opcode Fuzzy Hash: 5edb7204c22a8cfb94061bf161a88c3eca98da374ec15d8cd8ba2bf42dcd3747
Instruction Fuzzy Hash: F481B375500244BBEB209F91CC44FAB7BB8FF85704F10412AF952BA2F1E7749901CB69

Function 00401538 Relevance: 10.7, APIs: 7, Instructions: 207
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000003.00000002.1954358717.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_abrjicd.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 4af5c640631db37ac51d1c1afd1ab74928840835cbc445bb96c3204467379d38
Instruction ID: 71a4d0092025beca94809e07d65936591d52f1bb8effc294688e3fcd05e54c36
Opcode Fuzzy Hash: 4af5c640631db37ac51d1c1afd1ab74928840835cbc445bb96c3204467379d38
Instruction Fuzzy Hash: E0615171900204FBEB209F95CC89FAF7BB8FF85700F10412AF912BA2E5D6759905DB65

Function 004014DE Relevance: 10.7, APIs: 7, Instructions: 204
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000003.00000002.1954358717.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_abrjicd.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: c3f6308678fe624b1287adcb7156a2cf5c07ee8b7810a15753646c5694e98bc6
Instruction ID: 6a824664258ffec6fdf95c516407446232c8a84219ad61b9fd4b8efeb52f3576
Opcode Fuzzy Hash: c3f6308678fe624b1287adcb7156a2cf5c07ee8b7810a15753646c5694e98bc6
Instruction Fuzzy Hash: 9B615C75900245BFEB219F91CC88FEBBBB8FF85710F10016AF951BA2A5E7749901CB24

Function 00401543 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000003.00000002.1954358717.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_abrjicd.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f4faf4f0efc4cc5c307795d20c298965336779ff7452863f8b2b81be2522acaa
Instruction ID: 1fc6fb52bb36dddf8f971a96ecfe927bdbae9887f6286775c14151e9c1d92244
Opcode Fuzzy Hash: f4faf4f0efc4cc5c307795d20c298965336779ff7452863f8b2b81be2522acaa
Instruction Fuzzy Hash: 13512B71900245BBEB209F91CC88FAF7BB8EF85B00F14416AF912BA2E5D6749945CB64

Function 00401565 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000003.00000002.1954358717.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_abrjicd.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 40d7219ce39e026dd98d18ec02294656054e4da488103e740ba1602fb3a5db7c
Instruction ID: d88667ffe02cbbb2798d41d5ad0cf6527765788d972b82ac88077c7d238bff09
Opcode Fuzzy Hash: 40d7219ce39e026dd98d18ec02294656054e4da488103e740ba1602fb3a5db7c
Instruction Fuzzy Hash: 54511A71900205BFEF209F91CC89FAFBBB8FF85B10F104259F911AA2A5D7759941CB64

Function 00401579 Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000003.00000002.1954358717.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_abrjicd.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 44bf211d5ecd49b3cfb3996dc98baa0f9fc545abe5e070ef87effc0df1f686f8
Instruction ID: 7169477154cf1621f4f222e223ad54e678f31395e99d0ffd613e12cb64d905d3
Opcode Fuzzy Hash: 44bf211d5ecd49b3cfb3996dc98baa0f9fc545abe5e070ef87effc0df1f686f8
Instruction Fuzzy Hash: 2B511A75900245BBEF209F91CC88FEF7BB8FF85B10F104119F911BA2A5D6759941CB64

Function 0040157C Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000003.00000002.1954358717.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_abrjicd.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c4110b1088d5ef41785dfe7ea8eaa09ab46741a105747cbb29c974859abd6495
Instruction ID: 14f4b29c405daff92d21e2b3eea283823ae405efc36948ac0d92101f557811aa
Opcode Fuzzy Hash: c4110b1088d5ef41785dfe7ea8eaa09ab46741a105747cbb29c974859abd6495
Instruction Fuzzy Hash: DE51F9B5900245BBEF209F91CC88FEFBBB8FF85B10F104259F911AA2A5D6709944CB64

Function 00402FE9 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040311D
NtTerminateProcess.NTDLL ref: 00403136

Memory Dump Source

Source File: 00000003.00000002.1954358717.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_abrjicd.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 3e1675bac70c022a4e457ffe6b5fa54937b73e0116388ba90aec32851b4d9964
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: A1412431228E088FD768EF5CA885762B7D5F798311F6643AAE809D7389EA34DC1183C5

Function 02D7003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02D7024D

Strings

cess, xrefs: 02D7018D
kernel32.dll, xrefs: 02D7008F, 02D70095

Memory Dump Source

Source File: 00000003.00000002.1955502229.0000000002D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d70000_abrjicd.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 812c7047b637651cfe57936d190c6aea0a11fb53c0fbb91790050cd524f7a457
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: B4525975A012299FDB64CF58C984BACBBB1BF09305F1480D9E54DAB391EB34AE85CF14

Function 02DC5ECA Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02DC5EF2
Module32First.KERNEL32(00000000,00000224), ref: 02DC5F12

Memory Dump Source

Source File: 00000003.00000002.1955623146.0000000002DBF000.00000040.00000020.00020000.00000000.sdmp, Offset: 02DBF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2dbf000_abrjicd.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: d3e435187cf714db9e04064cd879be5d7e6b4515b085671e7607e668324dab72
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 7BF062321007166FD7202BB5BC8CB6E76EDEF49625F64066DE642A21C0DBB0FC458A61

Function 02D70E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02D70223,?,?), ref: 02D70E19
SetErrorMode.KERNELBASE(00000000,?,?,02D70223,?,?), ref: 02D70E1E

Memory Dump Source

Source File: 00000003.00000002.1955502229.0000000002D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d70000_abrjicd.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 1e332a13354e2b6ba836fca803a86de0039a6c13a583d90132fd488c4997e204
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: E4D0123114512877D7002A94DC09BCD7B1CDF09B67F008011FB0DD9180C774994046E5

Function 00401918 Relevance: 1.3, APIs: 1, Instructions: 57
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000003.00000002.1954358717.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_abrjicd.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: be810bd81fc1513bf14dac74237aa616a3cfbc48422f9378a192f31e1e69cca3
Instruction ID: 41df8370e0b5f9a47a14a91e784646d83bdfa422f97ac69dcfec837627d5bcb0
Opcode Fuzzy Hash: be810bd81fc1513bf14dac74237aa616a3cfbc48422f9378a192f31e1e69cca3
Instruction Fuzzy Hash: 6D018CF520C148E7EB016A948DB1EBA36299B45324F300233B647B91F4C57C8A03E76F

Function 00401924 Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000003.00000002.1954358717.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_abrjicd.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 3ad2d4b3403b833ed421c634174be831538fe621ff724946387ec8f91c54f5fa
Instruction ID: 34fc3aff5e218d4630d956a4f9c4c41b7245144a44faa4fd8074b33eba8f9d72
Opcode Fuzzy Hash: 3ad2d4b3403b833ed421c634174be831538fe621ff724946387ec8f91c54f5fa
Instruction Fuzzy Hash: 43017CF5208145E7EB015A948DB0EBA26299B45314F300237B617BA1F4C57D8602E76F

Function 02DC5B89 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02DC5BDA

Memory Dump Source

Source File: 00000003.00000002.1955623146.0000000002DBF000.00000040.00000020.00020000.00000000.sdmp, Offset: 02DBF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2dbf000_abrjicd.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 9fde926381cf2bf19002fb279d7a4edcf563851d8a6145c0bf871a02d0db879d
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 96113C79A00208EFDB01DF98CA85E99BBF5EF08350F158094F948AB361D371EA90DF90

Function 00401941 Relevance: 1.3, APIs: 1, Instructions: 44sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000003.00000002.1954358717.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_abrjicd.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 6acc595331c6a8be6e6657ef398eef7c869974a8ecae4d1fde63dfd35a725e44
Instruction ID: 53d82b158b021bc4b6cde56962adc0b8c8d23177238c0d6ee964112a53f005ae
Opcode Fuzzy Hash: 6acc595331c6a8be6e6657ef398eef7c869974a8ecae4d1fde63dfd35a725e44
Instruction Fuzzy Hash: 38F0AFB6308249F7DB01AA908DB1EBA36299B54315F300633B617B91F5C57C8A12E76F

Function 00401954 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000003.00000002.1954358717.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_abrjicd.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 0dfbee2e4a1c62836b2bd3ba6284fddb5b43d5507a7098400a51ac80bc720613
Instruction ID: f7568a5a22988f4b084f7ac8228f9b89e575eda69d31bfffabc36cd9cbe45c64
Opcode Fuzzy Hash: 0dfbee2e4a1c62836b2bd3ba6284fddb5b43d5507a7098400a51ac80bc720613
Instruction Fuzzy Hash: BDF0C2B6208144F7DB019AA18DB1FBA36299B44314F300233BA17B90F5C67C8612E76F

Function 0040194C Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000003.00000002.1954358717.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_abrjicd.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: f575feb9a37452ed4573e207967fb92b714552aa85f9b6ebf0a13cec3e485039
Instruction ID: 9d6088553fbd849a34ffa1589a5f9bffd683413c7e042594889390f4c4f3f426
Opcode Fuzzy Hash: f575feb9a37452ed4573e207967fb92b714552aa85f9b6ebf0a13cec3e485039
Instruction Fuzzy Hash: 08F0C2B2208144F7DB019A958DA0FBA36299B44314F300633B617B91F5C57C8A02E72F

Analysis Process: setup.exePID: 1516, Parent PID: 3400COMMON

Execution Graph

Execution Coverage:	17.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.7%
Total number of Nodes:	1368
Total number of Limit Nodes:	27

Executed Functions

Function 004034CC Relevance: 94.9, APIs: 34, Strings: 20, Instructions: 417
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008001), ref: 004034EF
GetVersionExA.KERNEL32(?), ref: 00403518
GetVersionExA.KERNEL32(0000009C), ref: 0040352F
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004035F8
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 00403635
OleInitialize.OLE32(00000000), ref: 0040363C
SHGetFileInfoA.SHELL32(0041FD10,00000000,?,00000160,00000000,?,00000007,00000009,0000000B), ref: 0040365A
GetCommandLineA.KERNEL32(00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 0040366F
CharNextA.USER32(00000000,"C:\Users\user\AppData\Local\Temp\setup.exe",00000020,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,00000007,00000009,0000000B), ref: 004036A9
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000007,00000009,0000000B), ref: 004037A2
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 004037B3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 004037BF
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 004037D3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004037DB
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004037EC
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004037F4
DeleteFileA.KERNELBASE(1033,?,00000007,00000009,0000000B), ref: 00403808
ExitProcess.KERNEL32(?,?,00000007,00000009,0000000B), ref: 004038AE
OleUninitialize.OLE32(?,?,00000007,00000009,0000000B), ref: 004038B3
ExitProcess.KERNEL32 ref: 004038D4
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,?,00000007,00000009,0000000B), ref: 004038E7
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A1B0,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,?,00000007,00000009,0000000B), ref: 004038F6
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,?,00000007,00000009,0000000B), ref: 00403901
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp), ref: 0040390D
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 00403929
DeleteFileA.KERNEL32(0041F910,0041F910,?,00425000,?,?,00000007,00000009,0000000B), ref: 00403986
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\setup.exe,0041F910,00000001), ref: 0040399B
CloseHandle.KERNEL32(00000000,0041F910,0041F910,?,0041F910,00000000,?,00000007,00000009,0000000B), ref: 004039C8
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000009,0000000B), ref: 004039F6
OpenProcessToken.ADVAPI32(00000000), ref: 004039FD
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403A11
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403A30
ExitWindowsEx.USER32(00000002,80040002), ref: 00403A55
ExitProcess.KERNEL32 ref: 00403A76

Strings

NSIS Error, xrefs: 00403660
.tmp, xrefs: 004038FB
C:\Users\user\AppData\Local\Temp\, xrefs: 00403797, 0040379C, 004037B2, 004037BE, 004037CD, 004037DA, 004037E6, 004037EE, 004038E4, 004038F5, 00403900, 0040390C, 00403919, 00403928, 004039DD
TEMP, xrefs: 004037E7
TMP, xrefs: 004037EF
~nsu, xrefs: 004038DF
C:\Users\user\AppData\Local\Temp, xrefs: 00403906, 0040390B, 00403938
\Temp, xrefs: 004037B9
SeShutdownPrivilege, xrefs: 00403A0B
Error launching installer, xrefs: 0040386C
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403891
C:\Users\user\AppData\Local\Temp\setup.exe, xrefs: 00403996
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403787, 00403886, 0040392F, 00403939
1033, xrefs: 00403803
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034E1
A, xrefs: 0040356A
UXTHEME, xrefs: 004035EC, 004035F1, 004035F7
Low, xrefs: 004037D5
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00403675, 0040367B, 0040382A
", xrefs: 004036CC

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: "$"C:\Users\user\AppData\Local\Temp\setup.exe"$.tmp$1033$A$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\setup.exe$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2882342585-56685449
Opcode ID: 52eec0119052631d70130b9923c1eece19bfae2d8fd8cd18d56f0b379d03721e
Instruction ID: 1a4863036e4e50ed5e1acae1e6299f6db15da00d6e87979e5214c03ba8a99dba
Opcode Fuzzy Hash: 52eec0119052631d70130b9923c1eece19bfae2d8fd8cd18d56f0b379d03721e
Instruction Fuzzy Hash: 99E1D270A04354AADB21AF659D49B6F7EB89F86306F0540BFF441B61D2CB7C4A05CB2E

Function 00405B4A Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405B73
lstrcatA.KERNEL32(00421D58,\*.*,00421D58,?,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BBB
lstrcatA.KERNEL32(?,0040A014,?,00421D58,?,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BDC
lstrlenA.KERNEL32(?,?,0040A014,?,00421D58,?,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BE2
FindFirstFileA.KERNELBASE(00421D58,?,?,?,0040A014,?,00421D58,?,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BF3
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405CA0
FindClose.KERNEL32(00000000), ref: 00405CB1

Strings

\*.*, xrefs: 00405BB5
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00405B53

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$\*.*
API String ID: 2035342205-2430568624
Opcode ID: 2ba348f7f603991e7b2998a01f0f2af9ee039e7695cfc72fde993ee98a245b0d
Instruction ID: 9e5d3321e74a3647b1fb2cdcf4bec0a51507e3563529971eb59e862f6dba24c5
Opcode Fuzzy Hash: 2ba348f7f603991e7b2998a01f0f2af9ee039e7695cfc72fde993ee98a245b0d
Instruction Fuzzy Hash: 2B519130908B04AAEB316B61CC49BAF7AB8DF82755F14813FF851B51D2C73C5982DE69

Function 00406A88 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b420139e1bb7bdc71f93166ff3cf2c8d4b4e2e8bf29b11b667125d81af8f4237
Instruction ID: c2ee61ea0ab5e5811791f69f03c7ffba3fbd093a674906ee4b434ab4c587e2e9
Opcode Fuzzy Hash: b420139e1bb7bdc71f93166ff3cf2c8d4b4e2e8bf29b11b667125d81af8f4237
Instruction Fuzzy Hash: 0FF18A70D04269CBDF28CF98C8946ADBBB0FF44305F24816ED856BB281D7786A86DF45

Function 004066FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(74DF3410,004225A0,C:\,00405E4B,C:\,C:\,00000000,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0), ref: 0040670A
FindClose.KERNEL32(00000000), ref: 00406716

Strings

C:\, xrefs: 004066FF

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
Instruction ID: 083b1303d1f5dd1ba3b50291930e0491dd498af142a60d7bee4daa0eb941c193
Opcode Fuzzy Hash: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
Instruction Fuzzy Hash: B3D01231515120BBC3405B38AE0C95B7E589F093747618A36F066F22E4DB74CC6286AC

Function 00403B6E Relevance: 49.2, APIs: 13, Strings: 15, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406794: GetModuleHandleA.KERNEL32(?,00000000,?,0040360E,0000000B), ref: 004067A6
Part of subcall function 00406794: GetProcAddress.KERNEL32(00000000,?), ref: 004067C1

lstrcatA.KERNEL32(1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,74DF3410,C:\Users\user\AppData\Local\Temp\,?,"C:\Users\user\AppData\Local\Temp\setup.exe",00000009,0000000B), ref: 00403BE9
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,?,?,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000000,C:\Users\user\AppData\Roaming\GamePall,1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,74DF3410), ref: 00403C5E
lstrcmpiA.KERNEL32(?,.exe), ref: 00403C71
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,"C:\Users\user\AppData\Local\Temp\setup.exe",00000009,0000000B), ref: 00403C7C
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\GamePall), ref: 00403CC5

Part of subcall function 004062E6: wsprintfA.USER32 ref: 004062F3

RegisterClassA.USER32(00423EE0), ref: 00403D02
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403D1A
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403D4F
ShowWindow.USER32(00000005,00000000,?,"C:\Users\user\AppData\Local\Temp\setup.exe",00000009,0000000B), ref: 00403D85
GetClassInfoA.USER32(00000000,RichEdit20A,00423EE0), ref: 00403DB1
GetClassInfoA.USER32(00000000,RichEdit,00423EE0), ref: 00403DBE
RegisterClassA.USER32(00423EE0), ref: 00403DC7
DialogBoxParamA.USER32(?,00000000,00403F0B,00000000), ref: 00403DE6

Strings

>B, xrefs: 00403CD4
C:\Users\user\AppData\Local\Temp\, xrefs: 00403B73
RichEd32, xrefs: 00403D99
_Nb, xrefs: 00403CE1, 00403D49
.exe, xrefs: 00403C6B
Control Panel\Desktop\ResourceLocale, xrefs: 00403BA2
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403BF8, 00403C00, 00403C98, 00403C9E, 00403CAE
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00403C2C, 00403C34, 00403C41, 00403C8B, 00403C91
.DEFAULT\Control Panel\International, xrefs: 00403BD4
1033, xrefs: 00403B8E, 00403BE4
RichEd20, xrefs: 00403D8B
RichEdit20A, xrefs: 00403DA9, 00403DAF
PB, xrefs: 00403B9A
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00403B71
RichEdit, xrefs: 00403DB8

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$Control Panel\Desktop\ResourceLocale$PB$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$>B
API String ID: 1975747703-4005560175
Opcode ID: e590d0c5fa98f393744fb4f016bdb4800495c857999addaceec8a385476c3f6f
Instruction ID: 5836c5bb6a6ef8c4ff0aed12ec42ff3eebf2d58129c507535c8ab2622d1094a3
Opcode Fuzzy Hash: e590d0c5fa98f393744fb4f016bdb4800495c857999addaceec8a385476c3f6f
Instruction Fuzzy Hash: 4F61D670204200AED620AF65AD45F3B3A7CEB8574AF41453FF951B62E2CB7D9D028B6D

Function 00402F5C Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F70
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\setup.exe,00000400), ref: 00402F8C

Part of subcall function 00405F1B: GetFileAttributesA.KERNELBASE(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405F1F
Part of subcall function 00405F1B: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00402FD5
GlobalAlloc.KERNEL32(00000040,00000009), ref: 00403117

Strings

Inst, xrefs: 00403041
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F66, 0040312F
C:\Users\user\AppData\Local\Temp\setup.exe, xrefs: 00402F76, 00402F85, 00402F99, 00402FB6
Null, xrefs: 00403053
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403160
soft, xrefs: 0040304A
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 004031AE
C:\Users\user\AppData\Local\Temp, xrefs: 00402FB7, 00402FBC, 00402FC2
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00402F65
Error launching installer, xrefs: 00402FAC

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\setup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-1937576205
Opcode ID: 948897f0a7bf445ed3fd87f3f97ca94f99971360adfd1b44ac20b9f0a6b79c08
Instruction ID: 8a05da1d373fd2b3e089436e62a275652004ed3b6aa6cfe031be989f12afac8e
Opcode Fuzzy Hash: 948897f0a7bf445ed3fd87f3f97ca94f99971360adfd1b44ac20b9f0a6b79c08
Instruction Fuzzy Hash: 0771E231A01218ABDB20EF65DD85B9E7BACEB44356F10813BF910BA2C1D77C9E458B5C

Function 0040641B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000400), ref: 00406549
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000400,?,00420530,00000000,004054E1,00420530,00000000), ref: 0040655C
SHGetSpecialFolderLocation.SHELL32(004054E1,00000000,?,00420530,00000000,004054E1,00420530,00000000), ref: 00406598
SHGetPathFromIDListA.SHELL32(00000000,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe), ref: 004065A6
CoTaskMemFree.OLE32(00000000), ref: 004065B2
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D6
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,00420530,00000000,004054E1,00420530,00000000,00000000,00000000,00000000), ref: 00406628

Strings

C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00406445, 00406515, 00406516, 00406517, 00406533, 00406548, 0040655B, 00406577, 004065A2, 004065D5, 004065DB, 004065F3, 00406606, 00406621, 00406627, 0040662F, 00406659
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406518
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D0

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-2103940979
Opcode ID: 28fe3fa0c873c230fa859cbc890347587b683f5d94c1146f2a959db860f2b1f6
Instruction ID: f38e20b3a3e0c1a2470d5ac0c6d90f06be75126661b475aa23e0086d5b044b98
Opcode Fuzzy Hash: 28fe3fa0c873c230fa859cbc890347587b683f5d94c1146f2a959db860f2b1f6
Instruction Fuzzy Hash: 9F612370900114AEDF205F24EC90BBA3BA4EB52314F52403FE913B62D1D37D8A62DB4E

Function 00401759 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000000,00000000,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00406388: lstrcpynA.KERNEL32(0000000B,0000000B,00000400,0040366F,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406395

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Strings

C:\Users\user\AppData\Roaming\GamePall, xrefs: 00401786
C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe, xrefs: 00401826, 00401842
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe
API String ID: 1941528284-2333790722
Opcode ID: 531cf43c35c58c4dd4a4f90f95c8ebf7c3fa560a9c590302947909e1ab3ecca7
Instruction ID: 0d76be79c55a0237b493b10f9ec5be6125ba7ce9be49b25e4c886387d44134cc
Opcode Fuzzy Hash: 531cf43c35c58c4dd4a4f90f95c8ebf7c3fa560a9c590302947909e1ab3ecca7
Instruction Fuzzy Hash: E141B731900615BBCB107BB5CC45DAF3668EF45329B61833BF422F10E1D67C8A529AAE

Function 00406726 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040673D
wsprintfA.USER32 ref: 00406776
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040678A

Strings

\, xrefs: 0040674E
UXTHEME, xrefs: 0040672F
%s%s.dll, xrefs: 00406770

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
Instruction ID: 0c3db372634d2cfba6f48721b0c795b31ebca02323a8b7d7371d162bf0ec7b9a
Opcode Fuzzy Hash: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
Instruction Fuzzy Hash: FBF0FC7050021966DB15A764DD0DFEA365CAB08309F1404BEA586E20C1D6B8D5258B69

Function 004027E8 Relevance: 9.1, APIs: 6, Instructions: 91
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402849
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 00402865
GlobalFree.KERNEL32(?), ref: 004028A4
GlobalFree.KERNEL32(00000000), ref: 004028B7
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028D3
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028E6

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: Global$AllocFree$ChangeCloseDeleteFileFindNotification
String ID:
API String ID: 2989416154-0
Opcode ID: 89df3cefb7dd421bed2d3b7eed546734cb5ae329452e645b4cc4e6c356db934a
Instruction ID: cd924008ac91bdcd896aacfcc8aadc4f9c7de1b4393fc14a433ce499bdbf1d56
Opcode Fuzzy Hash: 89df3cefb7dd421bed2d3b7eed546734cb5ae329452e645b4cc4e6c356db934a
Instruction Fuzzy Hash: D931AC32800128ABDF216FA5DE49D9E7A75FF08364F24423AF450B62D0CB7949419F68

Function 00405F4A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F5E
GetTempFileNameA.KERNELBASE(0000000B,?,00000000,?,?,004034CA,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007), ref: 00405F78

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F4D
nsa, xrefs: 00405F55

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
Instruction ID: 05c77450f8afc2c62a5a11a921c51d956a1ea51751b09822177720344b0c8500
Opcode Fuzzy Hash: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
Instruction Fuzzy Hash: 02F082363042087BDB109F55DD44BAB7B9CDF91750F14C03BFE48DA180D6B4D9988798

Function 004020A5 Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 004020D0

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 004020E0
GetProcAddress.KERNEL32(00000000,?), ref: 004020F0
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040215A

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 55027bfb1e7038bef75906a0c7732c3b75841ebb17574d5b7e2f6ee6ad6aef08
Instruction ID: efc1da79dccaef9ffb2761d2644f5cd4432d5c2edc08e83b6cf0327c91c21bf2
Opcode Fuzzy Hash: 55027bfb1e7038bef75906a0c7732c3b75841ebb17574d5b7e2f6ee6ad6aef08
Instruction Fuzzy Hash: 2B210832904214E7CF207FA58E4DAAE3A60AF44358F60413FF601B61E0DBBD49819A6E

Function 00403A7C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,004038B3,?,?,00000007,00000009,0000000B), ref: 00403A8E
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,004038B3,?,?,00000007,00000009,0000000B), ref: 00403AA2

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A81
C:\Users\user\AppData\Local\Temp\nshF9DF.tmp\, xrefs: 00403AB2

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nshF9DF.tmp\
API String ID: 2962429428-1427970649
Opcode ID: 860558c91a71a64e21cfc04441b923a48857e57a960d7bb4a44cdc910ceccc08
Instruction ID: f2bf129958ed6937e4157d035670f95a6da1e01cb45a681b65e96f9405f647bf
Opcode Fuzzy Hash: 860558c91a71a64e21cfc04441b923a48857e57a960d7bb4a44cdc910ceccc08
Instruction Fuzzy Hash: F4E08631640B1896C130EF7CAD4D8853B189B413357204726F1B9F20F0C738A9574EE9

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405DB3: CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405DC1
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DC6
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DDA

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 0040596F: CreateDirectoryA.KERNEL32(?,0000000B,C:\Users\user\AppData\Local\Temp\), ref: 004059B2

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\GamePall,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\AppData\Roaming\GamePall, xrefs: 00401631

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\GamePall
API String ID: 1892508949-2308708932
Opcode ID: f3ba161a3ac08c4a0fb9ad52a50d0308f78dcdedc211e6075dac0401aebdcf48
Instruction ID: f3b3600b6319d637c5497ea1020ed17c5aedac6227b62b2eaa768bc98e31f113
Opcode Fuzzy Hash: f3ba161a3ac08c4a0fb9ad52a50d0308f78dcdedc211e6075dac0401aebdcf48
Instruction Fuzzy Hash: 09115731508140EBCF306FA54D405BF23B09E96324B28453FF8D1B22E2DA3D0C42AA3E

Function 00405E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406388: lstrcpynA.KERNEL32(0000000B,0000000B,00000400,0040366F,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406395

Part of subcall function 00405DB3: CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405DC1
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DC6
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DDA

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405E5B
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0), ref: 00405E6B

Strings

C:\, xrefs: 00405E0E, 00405E13, 00405E19, 00405E54, 00405E5A, 00405E62, 00405E6A

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 9b5a40e36fb6d6325312229f101030c034a2baba4673648e7d7a04b0a2ff685f
Instruction ID: eca821d8ca18e415d707ee210574ba5bb9731226a542ad11e9256983d04766a4
Opcode Fuzzy Hash: 9b5a40e36fb6d6325312229f101030c034a2baba4673648e7d7a04b0a2ff685f
Instruction Fuzzy Hash: F7F02831105D5116C6223336AD09AAF1644CE9732471A453FFCE1B52D2DB3C8A539CEE

Function 00406EBD Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3294aed7e6278100db64414b9f116292b07b09feaa7d8b5145f731feae0eba26
Instruction ID: 14484b0326c8a5630d33184448731c7578348ec986130544f859662fecd3ad08
Opcode Fuzzy Hash: 3294aed7e6278100db64414b9f116292b07b09feaa7d8b5145f731feae0eba26
Instruction Fuzzy Hash: 04A12471E04229CBDF28CFA8C844BADBBB1FF44305F14816AD956BB281C7786986DF45

Function 004070BE Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e067d77b8d7a9b68dd685dca04d3d71c5ee3b4c66787705bfaaaffb075589f
Instruction ID: 16a3963220edad981734dfbd86db7ae4535d0e52bcc7a87e0ef86c627c8cfaa4
Opcode Fuzzy Hash: 74e067d77b8d7a9b68dd685dca04d3d71c5ee3b4c66787705bfaaaffb075589f
Instruction Fuzzy Hash: 2D912370D04268CBDF28CF98C854BADBBB1FF44305F14816AD956BB281C7786986DF45

Function 00406DD4 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffa2499bf387f79f1209cac769e5c71ba3d3f6d53411ba5d370abef73c06fe0
Instruction ID: e981be8a744509f315cfd76b32476d9c10b76e0a4aa84739a8d113cb33934a41
Opcode Fuzzy Hash: 7ffa2499bf387f79f1209cac769e5c71ba3d3f6d53411ba5d370abef73c06fe0
Instruction Fuzzy Hash: 37812471E04228CBDF24CFA8C844BADBBB1FF45305F24816AD856BB291C7789986DF45

Function 004068D9 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b20245c0637e97ad79b0c04fd837c43a33b4178456ec09291c35722496dfe88
Instruction ID: 8182d74baebb800b0d472bca2432a1a472ea96a2662ae7b36db949844af6c4d7
Opcode Fuzzy Hash: 9b20245c0637e97ad79b0c04fd837c43a33b4178456ec09291c35722496dfe88
Instruction Fuzzy Hash: DF815971E04228DBEF24CFA8C844BADBBB1FF44305F10816AD956BB281C7786986DF45

Function 00406D27 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d628358dfeac25ccb8ac491a47a372453481bb06581bffe716440ea5054c50f9
Instruction ID: 516ab04208dd2bc2fd7cdea6c41d3130492ff38fa800e35acf718bd73fbf6333
Opcode Fuzzy Hash: d628358dfeac25ccb8ac491a47a372453481bb06581bffe716440ea5054c50f9
Instruction Fuzzy Hash: A4712271E04228CBDF24CF98C844BADBBB1FF48305F14806AD856BB281C778A986DF45

Function 00406E45 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8eb04bd933ca205c297744f59a7b7035fe2e59d11d29800bf5f20fbdb1e525a
Instruction ID: 835baf8de871759411e2c74e4a47f0112f02d54065241c3c7dcda5dc236b3f46
Opcode Fuzzy Hash: e8eb04bd933ca205c297744f59a7b7035fe2e59d11d29800bf5f20fbdb1e525a
Instruction Fuzzy Hash: 92712571E04228CBEF28CF98C844BADBBB1FF44305F15816AD856BB281C7786996DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed70085a56e3aedeea153169e26c1aa9cf9d7e4654945abbe59913f8bdc615b9
Instruction ID: ccec74d0ee3a806077926e8984c2e201e8b1f3d886c73ab216be699138b2bca7
Opcode Fuzzy Hash: ed70085a56e3aedeea153169e26c1aa9cf9d7e4654945abbe59913f8bdc615b9
Instruction Fuzzy Hash: 39715771E04228CBEF28CF98C844BADBBB1FF44305F14806AD956BB281C778A946DF45

Function 00403305 Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403319

Part of subcall function 00403484: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403182,?), ref: 00403492

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,0040322F,00000004,00000000,00000000,0000000B,?,004031A9,000000FF,00000000,00000000,00000009,?), ref: 0040334C
SetFilePointer.KERNELBASE(155C335B,00000000,00000000,004138F8,00004000,?,00000000,0040322F,00000004,00000000,00000000,0000000B,?,004031A9,000000FF,00000000), ref: 00403447

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: f3fd145fe371a3aefb2ec72eaaf4336e3a5ddfe71b6918c4f9f269c5704fa6fa
Instruction ID: 5f41a1ef9683aad456499e8308d87ccfcfa217f8aa92108fcff4f05b83e24891
Opcode Fuzzy Hash: f3fd145fe371a3aefb2ec72eaaf4336e3a5ddfe71b6918c4f9f269c5704fa6fa
Instruction Fuzzy Hash: 1F319F72A002059FC711BF2AFE849663BACE741356710C13BE814B62F0CB3859458FAD

Function 0040247E Relevance: 4.6, APIs: 3, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0040AC20,00000023,00000011,00000002), ref: 004024C9
RegSetValueExA.KERNELBASE(?,?,?,?,0040AC20,00000000,00000011,00000002), ref: 00402509
RegCloseKey.KERNELBASE(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: CloseValuelstrlen
String ID:
API String ID: 2655323295-0
Opcode ID: ef8eeb58056491ee092ed80bef3546efe310264daaab0f586760f51b4d92765b
Instruction ID: e1e6ae2a7b536448810537a1ffa9a52b32d6c636ce9630cd27147c6707bb0a71
Opcode Fuzzy Hash: ef8eeb58056491ee092ed80bef3546efe310264daaab0f586760f51b4d92765b
Instruction Fuzzy Hash: 04116371E04208AFEB10AFA5DE49AAEBA74EB84714F21443BF504F71C1DAB94D409B68

Function 00402590 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025C2
RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 004025D5
RegCloseKey.KERNELBASE(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 039baf7d42ae34e4e7f4f0d82c42536c565db7a64b10d6b3f593835efb4c20b6
Instruction ID: 33ff3e85e785963e302667c06a3cb1355a7acd8bf142a31c2560ef5bcfc7d759
Opcode Fuzzy Hash: 039baf7d42ae34e4e7f4f0d82c42536c565db7a64b10d6b3f593835efb4c20b6
Instruction Fuzzy Hash: 2C017571904104FFE7158F54DE88ABF7BACEF81358F20443EF101A61C0DAB44E449679

Function 00405B02 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405EF6: GetFileAttributesA.KERNELBASE(?,?,00405B0E,?,?,00000000,00405CF1,?,?,?,?), ref: 00405EFB
Part of subcall function 00405EF6: SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405F0F

RemoveDirectoryA.KERNELBASE(?,?,?,00000000,00405CF1), ref: 00405B1D
DeleteFileA.KERNELBASE(?,?,?,00000000,00405CF1), ref: 00405B25
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405B3D

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: fdbfe47bebcd8a5232fcae5ebebd8a359ed736e28fe734178b51a2620122945d
Instruction ID: eeb49a2f717892c2e0964ab94aaac89db2a73fdd151ed94c70539e0cf44bba43
Opcode Fuzzy Hash: fdbfe47bebcd8a5232fcae5ebebd8a359ed736e28fe734178b51a2620122945d
Instruction Fuzzy Hash: 6CE0E531109A9097C62067349908A5B7AF8EF86314F094D3AF9A1F20D0DB38B9468EBD

Function 004031FD Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000009,00000000,00000000,00000000,00000000,0000000B,?,004031A9,000000FF,00000000,00000000,00000009,?), ref: 00403222

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 966fed337372371c4087f3b005d0b036fc883b56c67f04ec2e368497ceacb8e7
Instruction ID: 301e065564a74905a78554ad982773151ad037ba2d6e6f8d8cd401a7b941de18
Opcode Fuzzy Hash: 966fed337372371c4087f3b005d0b036fc883b56c67f04ec2e368497ceacb8e7
Instruction Fuzzy Hash: E2318D30200219FFDB109F95ED45A9A3FA8EB05755B20847EB914E61D0D738DB509FA9

Function 0040251E Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 0040254E
RegCloseKey.KERNELBASE(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 6617ca3d26eaa2170afdc71dc748124b2257766e2e1ea0df1a2f7a4cdc0ba340
Instruction ID: 7c766f3f1fb2abd04e903467a79d83897fdaad9d0bba0580308fe752c8381985
Opcode Fuzzy Hash: 6617ca3d26eaa2170afdc71dc748124b2257766e2e1ea0df1a2f7a4cdc0ba340
Instruction Fuzzy Hash: 1B11BF71905205EFDB25CF64DA985AE7BB4AF11355F20483FE042B72C0D6B88A85DA1D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 04d136d289144069680b1fecce7da664cc2fd5e0b622116f853907ec40370e1b
Instruction ID: c6e23866af321c238b4b59365f681da1ab702c54c00e726fca3ee5b0521d1f72
Opcode Fuzzy Hash: 04d136d289144069680b1fecce7da664cc2fd5e0b622116f853907ec40370e1b
Instruction Fuzzy Hash: 5201D131B242109BE7194B38AE04B2A36A8E754315F51813AF851F61F1DB78CC129B4D

Function 00405A21 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422558,00000009,00000009,0000000B), ref: 00405A4A
CloseHandle.KERNEL32(?), ref: 00405A57

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
Instruction ID: 70dcd79ab4e1e9e84cc9ba673cd08f466e07e48f17d85ed3475224309c024e1a
Opcode Fuzzy Hash: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
Instruction Fuzzy Hash: A5E04FB4600209BFEB009B64ED09F7B77ACFB04244F808421BE40F2150D67899658A78

Function 00406794 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000000,?,0040360E,0000000B), ref: 004067A6
GetProcAddress.KERNEL32(00000000,?), ref: 004067C1

Part of subcall function 00406726: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040673D
Part of subcall function 00406726: wsprintfA.USER32 ref: 00406776
Part of subcall function 00406726: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040678A

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 6cfaa89c8510a3ae83a05a93334a7968bfc88d7e7cb527baf598ad9b980e56cb
Instruction ID: 2a593beb9babc16b4b5ae8275dbdfb46ef4ebf17ea7291b62b5d373670c31446
Opcode Fuzzy Hash: 6cfaa89c8510a3ae83a05a93334a7968bfc88d7e7cb527baf598ad9b980e56cb
Instruction Fuzzy Hash: B6E0863260421157D21067705E4897773ACAF94B54302043EF546F3144D7389C76966D

Function 00405F1B Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405F1F
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
Instruction ID: c1cd633b288b309c16b37b55694bd397a2d2f3fd27c3ea135bedd35eac3c4d3c
Opcode Fuzzy Hash: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
Instruction Fuzzy Hash: D9D09E31254602AFEF0D8F20DE16F2E7AA2EB84B00F11952CB682944E2DA715819AB19

Function 00405EF6 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,00405B0E,?,?,00000000,00405CF1,?,?,?,?), ref: 00405EFB
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405F0F

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7db639ec3fc6e9a5b47d3eb1dfb332e917e8410632ca84ceba79978e33b6a3d0
Instruction ID: 2a9487917742c73a52daa6fa2dda6e447083e2efb983b62a69771bacbdb33add
Opcode Fuzzy Hash: 7db639ec3fc6e9a5b47d3eb1dfb332e917e8410632ca84ceba79978e33b6a3d0
Instruction Fuzzy Hash: E3D0C972504422ABD2102728AE0889BBB55DB94271702CA35FDA5A26F1DB304C569A9C

Function 004059EC Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004034BF,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004059F2
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 00405A00

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
Instruction ID: 42ce2bd36b25b14d2ed8d631edf33fc643f4c4eb5ed9af5e51ab4a49ffb09bba
Opcode Fuzzy Hash: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
Instruction Fuzzy Hash: 9BC04C303145419AD6505B309F4DB177A54AB50741F51553A638AE01A0DA348465DD2D

Function 0040623C Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CEA,00000000,?,?), ref: 00406265

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction ID: 57b18be241489d6c3509c0f1b2cb500900bdd64e2c84313365475615acd8ae2e
Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction Fuzzy Hash: 16E0E672010109BEDF196F50DD0AD7B371DEB04341F01492EF916D4091E6B5A9309734

Function 00405FC2 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000009,00000000,00000000,00000000,00000000,0040C475,0040B8F8,00403405,0040B8F8,0040C475,004138F8,00004000,?,00000000,0040322F,00000004), ref: 00405FD6

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: d5187e51ab0d96a1766449b5dbb93cac2cdd9e80b7d20ab2fc0b5d8c8d5322e8
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: 4AE0EC3221065BABDF109E659C04EEB7B6CEB05360F004437FA55E3150D675E8219BA4

Function 00405F93 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000009,00000000,00000000,00000000,00000000,004138F8,0040B8F8,00403481,00000009,00000009,00403385,004138F8,00004000,?,00000000,0040322F), ref: 00405FA7

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
Instruction ID: 61a6516da629700e98a59d605e8380186fb5f41ecf47873683bd74a9a2ef61d4
Opcode Fuzzy Hash: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
Instruction Fuzzy Hash: 8BE08C3220161EEBEF119E508C00AEBBB6CEB00360F004433FD25E3140E234E9218BA8

Function 00403484 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403182,?), ref: 00403492

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction ID: eadcf480fe67690f272c505b4903882a1233053cb438a9b9796e5ea94341b5dd
Opcode Fuzzy Hash: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction Fuzzy Hash: 25B09231140200AADA215F409E09F057B21AB94700F208424B244280F086712025EA0D

Function 00401F7B Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Part of subcall function 00405A21: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422558,00000009,00000009,0000000B), ref: 00405A4A
Part of subcall function 00405A21: CloseHandle.KERNEL32(?), ref: 00405A57

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FC0

Part of subcall function 00406809: WaitForSingleObject.KERNEL32(?,00000064), ref: 0040681A
Part of subcall function 00406809: GetExitCodeProcess.KERNEL32(?,?), ref: 0040683C

Part of subcall function 004062E6: wsprintfA.USER32 ref: 004062F3

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: b93a315dc59908fe351c40803e733eeda605d55301c746aa3fa59235fa4bc662
Instruction ID: dce1314ccbc215d7d9c334b017be086f7c4cc40ba0f87dfe0d8145fd67a5eb82
Opcode Fuzzy Hash: b93a315dc59908fe351c40803e733eeda605d55301c746aa3fa59235fa4bc662
Instruction Fuzzy Hash: 2DF0B432A05121DBDB20BFA59EC49EEB2A4DF41318B25463FF502B21D1CB7C4D418A6E

Non-executed Functions

Function 004055E7 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405646
GetDlgItem.USER32(?,000003EE), ref: 00405655
GetClientRect.USER32(?,?), ref: 00405692
GetSystemMetrics.USER32(00000002), ref: 00405699
SendMessageA.USER32(?,0000101B,00000000,?), ref: 004056BA
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004056CB
SendMessageA.USER32(?,00001001,00000000,?), ref: 004056DE
SendMessageA.USER32(?,00001026,00000000,?), ref: 004056EC
SendMessageA.USER32(?,00001024,00000000,?), ref: 004056FF
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405721
ShowWindow.USER32(?,00000008), ref: 00405735
GetDlgItem.USER32(?,000003EC), ref: 00405756
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405766
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040577F
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 0040578B
GetDlgItem.USER32(?,000003F8), ref: 00405664

Part of subcall function 0040443A: SendMessageA.USER32(00000028,?,00000001,0040426A), ref: 00404448

GetDlgItem.USER32(?,000003EC), ref: 004057A7
CreateThread.KERNEL32(00000000,00000000,Function_0000557B,00000000), ref: 004057B5
CloseHandle.KERNEL32(00000000), ref: 004057BC
ShowWindow.USER32(00000000), ref: 004057DF
ShowWindow.USER32(?,00000008), ref: 004057E6
ShowWindow.USER32(00000008), ref: 0040582C
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405860
CreatePopupMenu.USER32 ref: 00405871
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405886
GetWindowRect.USER32(?,000000FF), ref: 004058A6
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004058BF
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004058FB
OpenClipboard.USER32(00000000), ref: 0040590B
EmptyClipboard.USER32 ref: 00405911
GlobalAlloc.KERNEL32(00000042,?), ref: 0040591A
GlobalLock.KERNEL32(00000000), ref: 00405924
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405938
GlobalUnlock.KERNEL32(00000000), ref: 00405951
SetClipboardData.USER32(00000001,00000000), ref: 0040595C
CloseClipboard.USER32 ref: 00405962

Strings

PB, xrefs: 004058D7

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: PB
API String ID: 590372296-3196168531
Opcode ID: 463c74343dc9a7e994e8db0b260deb87a45ca3f66d4da0101cb89f9be381629f
Instruction ID: 44a2cb424ceca129f1c721a27905a8e57bc1109532c064cce4e419f7e60c3497
Opcode Fuzzy Hash: 463c74343dc9a7e994e8db0b260deb87a45ca3f66d4da0101cb89f9be381629f
Instruction Fuzzy Hash: 18A13971900608FFDB11AF64DE85AAE7BB9FB48355F00403AFA41BA1A0CB754E51DF58

Function 00404897 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004048E6
SetWindowTextA.USER32(00000000,?), ref: 00404910
SHBrowseForFolderA.SHELL32(?,00420128,?), ref: 004049C1
CoTaskMemFree.OLE32(00000000), ref: 004049CC
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00420D50), ref: 004049FE
lstrcatA.KERNEL32(?,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe), ref: 00404A0A
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404A1C

Part of subcall function 00405A82: GetDlgItemTextA.USER32(?,?,00000400,00404A53), ref: 00405A95

Part of subcall function 00406666: CharNextA.USER32(0000000B,*?|<>/":,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066BE
Part of subcall function 00406666: CharNextA.USER32(0000000B,0000000B,0000000B,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066CB
Part of subcall function 00406666: CharNextA.USER32(0000000B,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066D0
Part of subcall function 00406666: CharPrevA.USER32(0000000B,0000000B,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066E0

GetDiskFreeSpaceA.KERNEL32(0041FD20,?,?,0000040F,?,0041FD20,0041FD20,?,00000001,0041FD20,?,?,000003FB,?), ref: 00404ADA
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AF5

Part of subcall function 00404C4E: lstrlenA.KERNEL32(00420D50,00420D50,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404B69,000000DF,00000000,00000400,?), ref: 00404CEC
Part of subcall function 00404C4E: wsprintfA.USER32 ref: 00404CF4
Part of subcall function 00404C4E: SetDlgItemTextA.USER32(?,00420D50), ref: 00404D07

Strings

A, xrefs: 004049BA
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 004049F8, 004049FD, 00404A08
C:\Users\user\AppData\Roaming\GamePall, xrefs: 004049E7
PB, xrefs: 00404994

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$PB
API String ID: 2624150263-3665957329
Opcode ID: 246729fcc772db5bb1fe110679472811f76dfb67008edee7d622b3e588ee8d40
Instruction ID: 03633cdec68ae3b48ba4c7d33c4768738bfb21d85bfcf2e4b9185cba9ee35c0f
Opcode Fuzzy Hash: 246729fcc772db5bb1fe110679472811f76dfb67008edee7d622b3e588ee8d40
Instruction Fuzzy Hash: 7DA150B1A00208AADB11EFA5DD45BAFB6B8EF84315F10803BF601B62D1D77C99418F6D

Function 00402173 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408418,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F8
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004022AA

Strings

C:\Users\user\AppData\Roaming\GamePall, xrefs: 00402238

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Roaming\GamePall
API String ID: 123533781-2308708932
Opcode ID: 975ab102bccf2e3ea3487b48f3b75e49990d828168e5a332ce340ef805c2210c
Instruction ID: 4a55140eb955682c0845ac661669d1effe53c60cfc8a987c49de3bb9103baba8
Opcode Fuzzy Hash: 975ab102bccf2e3ea3487b48f3b75e49990d828168e5a332ce340ef805c2210c
Instruction Fuzzy Hash: B2513575A00208AFDF10DFE4CA88A9D7BB5EF48314F2045BAF505EB2D1DA799981CB54

Function 004027AA Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 004027B9

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 3697544f2be0618a58616ff40495ed399055e36512a5e022deae8fba2564a7e1
Instruction ID: 9767438fe71d1176ff9aac627a01f72906af616df08219c0cc944b63bddc0547
Opcode Fuzzy Hash: 3697544f2be0618a58616ff40495ed399055e36512a5e022deae8fba2564a7e1
Instruction Fuzzy Hash: CCF0A0726082049AD710EBA49A49AEEB7689F51324F60057BF142F20C1D6B889459B2A

Function 00404E0A Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 491windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404E21
GetDlgItem.USER32(?,00000408), ref: 00404E2E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E7D
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404E94
SetWindowLongA.USER32(?,000000FC,0040541D), ref: 00404EAE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404EC0
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404ED4
SendMessageA.USER32(?,00001109,00000002), ref: 00404EEA
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404EF6
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404F06
DeleteObject.GDI32(00000110), ref: 00404F0B
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404F36
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404F42
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404FDC
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 0040500C

Part of subcall function 0040443A: SendMessageA.USER32(00000028,?,00000001,0040426A), ref: 00404448

SendMessageA.USER32(?,00001100,00000000,?), ref: 00405020
GetWindowLongA.USER32(?,000000F0), ref: 0040504E
SetWindowLongA.USER32(?,000000F0,00000000), ref: 0040505C
ShowWindow.USER32(?,00000005), ref: 0040506C
SendMessageA.USER32(?,00000419,00000000,?), ref: 00405167
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 004051CC
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 004051E1
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00405205
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00405225
ImageList_Destroy.COMCTL32(?), ref: 0040523A
GlobalFree.KERNEL32(?), ref: 0040524A
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 004052C3
SendMessageA.USER32(?,00001102,?,?), ref: 0040536C
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 0040537B
InvalidateRect.USER32(?,00000000,00000001), ref: 004053A6
ShowWindow.USER32(?,00000000), ref: 004053F4
GetDlgItem.USER32(?,000003FE), ref: 004053FF
ShowWindow.USER32(00000000), ref: 00405406

Strings

, xrefs: 004053DE
M, xrefs: 00404FC4
N, xrefs: 004050A5

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 4bb258af210f6716591e45ffd85afba0d9fc7d499c01c39e68e435e5f0500988
Instruction ID: c306c4130ea67d8582adb4b0d0e706bf782d7aff15223233fd0d43401108afdf
Opcode Fuzzy Hash: 4bb258af210f6716591e45ffd85afba0d9fc7d499c01c39e68e435e5f0500988
Instruction Fuzzy Hash: 6C025CB0A00609AFDB209F94DD45AAE7BB5FB84354F10817AF610BA2E1D7789D42CF58

Function 00403F0B Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403F47
ShowWindow.USER32(?), ref: 00403F67
GetWindowLongA.USER32(?,000000F0), ref: 00403F79
ShowWindow.USER32(?,00000004), ref: 00403F92
DestroyWindow.USER32 ref: 00403FA6
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403FBF
GetDlgItem.USER32(?,?), ref: 00403FDE
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403FF2
IsWindowEnabled.USER32(00000000), ref: 00403FF9
GetDlgItem.USER32(?,00000001), ref: 004040A4
GetDlgItem.USER32(?,00000002), ref: 004040AE
SetClassLongA.USER32(?,000000F2,?), ref: 004040C8
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00404119
GetDlgItem.USER32(?,00000003), ref: 004041BF
ShowWindow.USER32(00000000,?), ref: 004041E0
EnableWindow.USER32(?,?), ref: 004041F2
EnableWindow.USER32(?,?), ref: 0040420D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404223
EnableMenuItem.USER32(00000000), ref: 0040422A
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00404242
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00404255
lstrlenA.KERNEL32(00420D50,?,00420D50,00000000), ref: 0040427F
SetWindowTextA.USER32(?,00420D50), ref: 0040428E
ShowWindow.USER32(?,0000000A), ref: 004043C2

Strings

PB, xrefs: 0040426F

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID: PB
API String ID: 1860320154-3196168531
Opcode ID: a84a76c7c437068317dea6ec38f5a19867a10701d7094664a652b1a8aea3850c
Instruction ID: 6b3c419a8b2de2434844e8cd53afab52d63163afb5b1bd925d395a768d9dd0e6
Opcode Fuzzy Hash: a84a76c7c437068317dea6ec38f5a19867a10701d7094664a652b1a8aea3850c
Instruction Fuzzy Hash: ECC1D2B1A00204BBCB206F61EE45E2B3A78EB85745F41053EF781B61F1CB3998929B5D

Function 00404570 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004045FB
GetDlgItem.USER32(00000000,000003E8), ref: 0040460F
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040462D
GetSysColor.USER32(?), ref: 0040463E
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040464D
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040465C
lstrlenA.KERNEL32(?), ref: 0040465F
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 0040466E
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404683
GetDlgItem.USER32(?,0000040A), ref: 004046E5
SendMessageA.USER32(00000000), ref: 004046E8
GetDlgItem.USER32(?,000003E8), ref: 00404713
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404753
LoadCursorA.USER32(00000000,00007F02), ref: 00404762
SetCursor.USER32(00000000), ref: 0040476B
LoadCursorA.USER32(00000000,00007F00), ref: 00404781
SetCursor.USER32(00000000), ref: 00404784
SendMessageA.USER32(00000111,00000001,00000000), ref: 004047B0
SendMessageA.USER32(00000010,00000000,00000000), ref: 004047C4

Strings

N, xrefs: 00404701
6B, xrefs: 0040476F

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$6B
API String ID: 3103080414-649610290
Opcode ID: c874497606b373bfbb3475a273ba326ab034ae9c38f8566fe8320349c510c150
Instruction ID: 424ea1d81b5f8fd67bb79b8421ee67f108f717641e3cc5fc4ea293435da972af
Opcode Fuzzy Hash: c874497606b373bfbb3475a273ba326ab034ae9c38f8566fe8320349c510c150
Instruction Fuzzy Hash: CE6190B1A40208BFDB109F61DD45B6A7B69FB84715F10843AFB01BB2D1C7B8A951CF98

Function 00405FF1 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00406182,?,?), ref: 00406022
GetShortPathNameA.KERNEL32(?,00422AE0,00000400), ref: 0040602B

Part of subcall function 00405E80: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E90
Part of subcall function 00405E80: lstrlenA.KERNEL32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EC2

GetShortPathNameA.KERNEL32(?,00422EE0,00000400), ref: 00406048
wsprintfA.USER32 ref: 00406066
GetFileSize.KERNEL32(00000000,00000000,00422EE0,C0000000,00000004,00422EE0,?,?,?,?,?), ref: 004060A1
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060B0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060E8
SetFilePointer.KERNEL32(0040A3F0,00000000,00000000,00000000,00000000,004226E0,00000000,-0000000A,0040A3F0,00000000,[Rename],00000000,00000000,00000000), ref: 0040613E
GlobalFree.KERNEL32(00000000), ref: 0040614F
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406156

Part of subcall function 00405F1B: GetFileAttributesA.KERNELBASE(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405F1F
Part of subcall function 00405F1B: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

Strings

.B, xrefs: 00406044
%s=%s, xrefs: 0040605C
*B, xrefs: 00406010
[Rename], xrefs: 004060D0, 004060E2
.B, xrefs: 0040603D

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]$*B$.B$.B
API String ID: 2171350718-3836630945
Opcode ID: 2ac8773abaa14c2605e43abf0f292608002e21a2c197761b550c40717a00d302
Instruction ID: 7566a5a9e9d08134d14435fb5d3e1561ad96112206bac95af022f508aac3f812
Opcode Fuzzy Hash: 2ac8773abaa14c2605e43abf0f292608002e21a2c197761b550c40717a00d302
Instruction Fuzzy Hash: 68310531200715BBC2207B659D49F6B3A5DDF85754F15003EFE42BA2C3EA7CD8228AAD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00423F40,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: db458c2aac7b07c9de4f1dfd54ee4cc10e0d46da2aaa9c20a0cc65b716daa4c3
Instruction ID: bc851ab26da2bb863bf3a2ee07eb2f950de800ada4cbee7b2d64f78586a04119
Opcode Fuzzy Hash: db458c2aac7b07c9de4f1dfd54ee4cc10e0d46da2aaa9c20a0cc65b716daa4c3
Instruction Fuzzy Hash: 2C419D71800249AFCF058FA5DE459AF7FB9FF45314F00802AF991AA1A0C734DA55DFA4

Function 004054A9 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
SetWindowTextA.USER32(00420530,00420530), ref: 00405517
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Strings

4/@, xrefs: 004054EF, 00405501

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: 4/@
API String ID: 2531174081-3101945251
Opcode ID: 17623ae6e76ffa783ca229a28a88b1e205e4a8d30cb80da27a9000df8195634c
Instruction ID: 7ab3267fb946cf8e7efc5916356ec1270af3577e2396c2c3629ce5ef3fcb69de
Opcode Fuzzy Hash: 17623ae6e76ffa783ca229a28a88b1e205e4a8d30cb80da27a9000df8195634c
Instruction Fuzzy Hash: 0F217A71E00118BBCF119FA5DD8099EBFB9EF09354F04807AF944A6291C7788A90CFA8

Function 00406666 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(0000000B,*?|<>/":,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066BE
CharNextA.USER32(0000000B,0000000B,0000000B,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066CB
CharNextA.USER32(0000000B,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066D0
CharPrevA.USER32(0000000B,0000000B,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066E0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406667
*?|<>/":, xrefs: 004066AE
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00406666

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1678727643
Opcode ID: 6bc0e94b7f234696628355ee2fbbbdde5b7464ab094feb853247d74dffcc646e
Instruction ID: 80d428334b402c3338f843ea799862c1973996ffb1638880579f4ae0c72fc655
Opcode Fuzzy Hash: 6bc0e94b7f234696628355ee2fbbbdde5b7464ab094feb853247d74dffcc646e
Instruction Fuzzy Hash: 7E1108518047902DEB3206340C04B7B7F894F977A0F2A087FD8C6722C2D67E5C62967D

Function 00402EBD Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402ED5
GetTickCount.KERNEL32 ref: 00402EF3
wsprintfA.USER32 ref: 00402F21

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

CreateDialogParamA.USER32(0000006F,00000000,00402E25,00000000), ref: 00402F45
ShowWindow.USER32(00000000,00000005), ref: 00402F53

Part of subcall function 00402EA1: MulDiv.KERNEL32(00000000,00000064,0000D822), ref: 00402EB6

Strings

#Vh%.@, xrefs: 00402F34
... %d%%, xrefs: 00402F1B

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%$#Vh%.@
API String ID: 722711167-1706192003
Opcode ID: db62a3d36480f0b73892ce8a9fc69f21d0c49374a29e778f3850d420ffd5c07d
Instruction ID: ac0ca11ee9366edb0cc6a28cc5aeb329eacd7d00ab00b3c3670f6d564c8935e4
Opcode Fuzzy Hash: db62a3d36480f0b73892ce8a9fc69f21d0c49374a29e778f3850d420ffd5c07d
Instruction Fuzzy Hash: 3F01A170542225EBCB21BB50EF0CBAB3778EB40744B04443BF505B21D0C7F894469AEE

Function 0040446C Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404489
GetSysColor.USER32(00000000), ref: 004044C7
SetTextColor.GDI32(?,00000000), ref: 004044D3
SetBkMode.GDI32(?,?), ref: 004044DF
GetSysColor.USER32(?), ref: 004044F2
SetBkColor.GDI32(?,?), ref: 00404502
DeleteObject.GDI32(?), ref: 0040451C
CreateBrushIndirect.GDI32(?), ref: 00404526

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: d8b0c4ae085d5752a0ceb3fd9c96bfdfa4daadee6b5f884e1a531c3ceae13210
Instruction ID: 76b6fc4927f6120469f5ffa52701fcd3ddd76896e52d32ad6f55637f73cee333
Opcode Fuzzy Hash: d8b0c4ae085d5752a0ceb3fd9c96bfdfa4daadee6b5f884e1a531c3ceae13210
Instruction Fuzzy Hash: 9E2147B1501704AFCB31DF68ED08B5BBBF8AF41715B04892EEA96A26E0D734E904CB54

Function 00404D58 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404D73
GetMessagePos.USER32 ref: 00404D7B
ScreenToClient.USER32(?,?), ref: 00404D95
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404DA7
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404DCD

Strings

f, xrefs: 00404DA9

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction ID: de178be9688f757f82ef56a4cbeb6693d0582b60b2ea90e1a00f6814b48fd044
Opcode Fuzzy Hash: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction Fuzzy Hash: BB014871900219BADB01DBA4DD85BFEBBF8AF95B11F10016ABA40B61C0C6B499058BA4

Function 0040596F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,0000000B,C:\Users\user\AppData\Local\Temp\), ref: 004059B2
GetLastError.KERNEL32 ref: 004059C6
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004059DB
GetLastError.KERNEL32 ref: 004059E5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405995
!9@, xrefs: 00405984

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: !9@$C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-2369717338
Opcode ID: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
Instruction ID: 4cd508ff09270142ca7a6984d66ae253fefa4e1f6983b248f3af4f59f5a14231
Opcode Fuzzy Hash: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
Instruction Fuzzy Hash: 610108B1D00259DAEF109BA0CA45BEFBBB8EB04354F00403AD645B6290D7789648CF99

Function 00402E25 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E40
wsprintfA.USER32 ref: 00402E74
SetWindowTextA.USER32(?,?), ref: 00402E84
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402E96

Strings

unpacking data: %d%%, xrefs: 00402E62
verifying installer: %d%%, xrefs: 00402E69, 00402E72

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a45d99d8fe85d32cf27a6b993dcd334edf2177b7a3e8b64a3b444c48cc752336
Instruction ID: 7ad4584a5e884be7344c254f70e0401137e7e46ce86c3cf658bb2ab9d23be74a
Opcode Fuzzy Hash: a45d99d8fe85d32cf27a6b993dcd334edf2177b7a3e8b64a3b444c48cc752336
Instruction Fuzzy Hash: 1DF01D7054020DBAEF219F60DE0ABAE3769EB44344F00803AFA16B91D0DBB899558F99

Function 00404C4E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420D50,00420D50,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404B69,000000DF,00000000,00000400,?), ref: 00404CEC
wsprintfA.USER32 ref: 00404CF4
SetDlgItemTextA.USER32(?,00420D50), ref: 00404D07

Strings

%u.%u%s%s, xrefs: 00404CD6
PB, xrefs: 00404CDE

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$PB
API String ID: 3540041739-838025833
Opcode ID: 837710c020be2e613de14c6f4d6baa8c213068046cd931f6ce14c5213cbfad60
Instruction ID: 635705270cf82d3fa6c033b13715314544988666452c3f341a93ad76d23c3d90
Opcode Fuzzy Hash: 837710c020be2e613de14c6f4d6baa8c213068046cd931f6ce14c5213cbfad60
Instruction Fuzzy Hash: 5F11E77360512837EB00656D9D45EAE3298DB85374F26423BFE26F71D1E978CC1286E8

Function 00402D3B Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402D8F
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402DDB
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DE4
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402DFB
RegCloseKey.ADVAPI32(?,?,?), ref: 00402E06

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: e74c2f698c9890700b4790f2c47d05d8785518f345c631b22f69380fd2d26fe8
Instruction ID: 1f7d8097ab2fb743d310579a2b4365e3e31c1a4ec17ce584dda370d325fd3950
Opcode Fuzzy Hash: e74c2f698c9890700b4790f2c47d05d8785518f345c631b22f69380fd2d26fe8
Instruction Fuzzy Hash: 1D214B7150010CBBDF129F90CE89EEB7B7DEF44344F11007AF955B11A0D7B49EA49AA8

Function 00401D65 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D7E
GetClientRect.USER32(?,?), ref: 00401DCC
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401DFC
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401E10
DeleteObject.GDI32(00000000), ref: 00401E20

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 593d1372a554d47c5dd87fed6cfd69f5edd78a04abfcab04570fffcca4b878a5
Instruction ID: cb7cd4706ec086029cb46641885d9617bace417a5341e65c45b3777010ef1041
Opcode Fuzzy Hash: 593d1372a554d47c5dd87fed6cfd69f5edd78a04abfcab04570fffcca4b878a5
Instruction Fuzzy Hash: 35212A72E00109AFDF15DFA4DD85AAEBBB5EB88300F24417EF911F62A0DB389941DB14

Function 00401E35 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E38
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E52
MulDiv.KERNEL32(00000000,00000000), ref: 00401E5A
ReleaseDC.USER32(?,00000000), ref: 00401E6B
CreateFontIndirectA.GDI32(0040B820), ref: 00401EBA

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: de4b304c9a389d7a08c3fe75b8b690b37b20fc1cb77e4e41693a04eab2cef683
Instruction ID: bfe7ce59390996d5b2ac71ca67757b7c78ff13e1b53bdd881068f9c0e557254e
Opcode Fuzzy Hash: de4b304c9a389d7a08c3fe75b8b690b37b20fc1cb77e4e41693a04eab2cef683
Instruction Fuzzy Hash: 66018072504340AEE7007BB0AF8AA9A7FE8E755701F109439F241B61E2CB790449CB6C

Function 00401C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C9E
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401CB6

Strings

!, xrefs: 00401C6A

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 1399452274c26c04b05c3e26325e61428879637001adb01d26c94ca9c19498ca
Instruction ID: a12cfbdd51ff26f17676da16b1bc06906883597644a76ef85f46b7bf1251d8d3
Opcode Fuzzy Hash: 1399452274c26c04b05c3e26325e61428879637001adb01d26c94ca9c19498ca
Instruction Fuzzy Hash: 2A218271948208BEEB059FF5DA8AAAD7FB4EF84304F20447EF101B61D1D7B989819B18

Function 00405D1A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004034B9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 00405D20
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004034B9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 00405D29
lstrcatA.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405D3A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405D1A

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 78cba1d5cb2474798914f87c9b537ab1510ee16986e2efd06177e80df85e38b2
Instruction ID: 6a6775ee8fa4d5d8d60a890cb1840bbff54d6a4bc9e312217f61a2b57c53a4e0
Opcode Fuzzy Hash: 78cba1d5cb2474798914f87c9b537ab1510ee16986e2efd06177e80df85e38b2
Instruction Fuzzy Hash: 82D0A7625015307AD20167154C09DDF29488F523017094027F501B7191C67C5C1187FD

Function 00405DB3 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405DC1
CharNextA.USER32(00000000), ref: 00405DC6
CharNextA.USER32(00000000), ref: 00405DDA

Strings

C:\, xrefs: 00405DB4

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: 39b5ed16b6dfe77c974b4e4dad13ac827778716fd50118a58326aa52b160bb8b
Instruction ID: a81d310af092f64b8c374c4571b8fed5a60269d48026fa3bbeeaae68e06855d2
Opcode Fuzzy Hash: 39b5ed16b6dfe77c974b4e4dad13ac827778716fd50118a58326aa52b160bb8b
Instruction Fuzzy Hash: 71F09661904F542BFB3293648C4CB776B8DCF55351F28947BE6807A6C1C27C59808FEA

Function 0040541D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040544C
CallWindowProcA.USER32(?,?,?,?), ref: 0040549D

Part of subcall function 00404451: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00404463

Strings

, xrefs: 0040542D

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 14b3d6ef5c2a84fc52750bef5e2e8b29c93878db9a0e482e1958f3e7559ce471
Instruction ID: ce4d6245f7a5538c18ae28323cba1b5bdda0ccdff68052f186ad3da5f1ae13b7
Opcode Fuzzy Hash: 14b3d6ef5c2a84fc52750bef5e2e8b29c93878db9a0e482e1958f3e7559ce471
Instruction Fuzzy Hash: 2A015E31200608AFDF216F51DD80BAF3A66EB84716F104537FA05761D2C7799CD29F6A

Function 0040626F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,00000400,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00420530,?,?,?,00000002,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,00406527,80000002), ref: 004062B5
RegCloseKey.ADVAPI32(?,?,00406527,80000002,Software\Microsoft\Windows\CurrentVersion,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,00420530), ref: 004062C0

Strings

C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00406272, 004062A6

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: CloseQueryValue
String ID: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
API String ID: 3356406503-2798812489
Opcode ID: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
Instruction ID: 5c8aa4f59809ec7c4ed175be077f356401e74c3ba082423fbe1b6bbc42bea5f4
Opcode Fuzzy Hash: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
Instruction Fuzzy Hash: 8101BC72100209ABDF229F60CC09FDB3FA8EF45364F01407AFD56A6190D638C974CBA8

Function 00405D61 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,00402FC8,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405D67
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,00402FC8,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405D75

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00405D61

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 2709904686-47812868
Opcode ID: 46bbde6159133eac16457addd6c3fa88623ef59ff022f94c34d6ba2180d3974b
Instruction ID: 27c40c0738421aba4af956c8f0f705930dfe744a77a65273bf6dbb66402e0641
Opcode Fuzzy Hash: 46bbde6159133eac16457addd6c3fa88623ef59ff022f94c34d6ba2180d3974b
Instruction Fuzzy Hash: CBD0A772409D706EE31353208C04B8F6A48CF13300F0D4063E481A6190C2785C424BFD

Function 00405E80 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E90
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405EA8
CharNextA.USER32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EB9
lstrlenA.KERNEL32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EC2

Memory Dump Source

Source File: 0000000A.00000002.3549946415.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3543162241.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3558049694.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3561538509.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3604669543.000000000042E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_setup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
Instruction ID: 98ea32bb50e75ca8be10b873c57fc005eda9f523d07111d413316ed06cfa332a
Opcode Fuzzy Hash: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
Instruction Fuzzy Hash: 5FF06235104918AFCB129BA5DD4099EBFA8EF55350B2540B9E880F7211D674DF019BA9

Analysis Process: GamePall.exePID: 5644, Parent PID: 1516COMMON

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	0

Executed Functions

Function 0095D630 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0095D6BF

Strings

U<, xrefs: 0095D657

Memory Dump Source

Source File: 0000000B.00000002.3529736200.0000000000950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_950000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID: U<
API String ID: 3793708945-1904622143
Opcode ID: ef403dcc55eba01df54289702dc57458927a9a17ce33be188eb2974a1205099d
Instruction ID: cd2ed604e7d01e5254e6e675860d40871f5597c837eb1985748f54e416ea19f4
Opcode Fuzzy Hash: ef403dcc55eba01df54289702dc57458927a9a17ce33be188eb2974a1205099d
Instruction Fuzzy Hash: 5421E4B59012089FDB10CFAAD584ADEFFF4FB48320F14841AE958A7350D378A945CFA5

Function 0095D638 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0095D6BF

Strings

U<, xrefs: 0095D657

Memory Dump Source

Source File: 0000000B.00000002.3529736200.0000000000950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_950000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID: U<
API String ID: 3793708945-1904622143
Opcode ID: 78cfebc8c79b507b8d650e780881525a3e43970635ccbfc23a6680383c8d8146
Instruction ID: 3316416bf8a64509432253b7587a349957b99c342e9e8b0db1aec484c98babda
Opcode Fuzzy Hash: 78cfebc8c79b507b8d650e780881525a3e43970635ccbfc23a6680383c8d8146
Instruction Fuzzy Hash: 3421F5B59012089FDB10CFAAD584ADEFFF8FB48320F14841AE918A3310D378A944CFA5

Function 0095E020 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(?,?,?,?), ref: 0095E090

Strings

U<, xrefs: 0095E042

Memory Dump Source

Source File: 0000000B.00000002.3529736200.0000000000950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_950000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID: U<
API String ID: 3098949447-1904622143
Opcode ID: 8843b0273651db02fb35363bbab0596e934844ade313b465a6144bc470a771b0
Instruction ID: 1906d0658eaf3a17286f61cc9157844ed580bce70b082974271dad38ac11fa64
Opcode Fuzzy Hash: 8843b0273651db02fb35363bbab0596e934844ade313b465a6144bc470a771b0
Instruction Fuzzy Hash: 311146B5800209CFDB20DFAAC444BDEBFF5FB48320F208429E558A7251D379A945CFA5

Function 0095E028 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(?,?,?,?), ref: 0095E090

Strings

U<, xrefs: 0095E042

Memory Dump Source

Source File: 0000000B.00000002.3529736200.0000000000950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_950000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID: U<
API String ID: 3098949447-1904622143
Opcode ID: 6bc67ec76f1160143555d86aecae8d4e1643134079b9a2efbb6672e9c181489f
Instruction ID: 67ee260711c77c8b53179a4e165c7115822dffe23a55bcb5a21ac62c8235ee58
Opcode Fuzzy Hash: 6bc67ec76f1160143555d86aecae8d4e1643134079b9a2efbb6672e9c181489f
Instruction Fuzzy Hash: 131116B59002499FCB20DF9AC844BDEBFF8FB48320F208429E558A7251D379A944CFA5

Function 0067E700 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b27f0d81c5b45f0818a86f48716842d13b09f602da2391172a80a1b1729959
Instruction ID: f23eeec75fbc9b808fc906b69a641a3104549083eec927acd925dfb342d50d63
Opcode Fuzzy Hash: 90b27f0d81c5b45f0818a86f48716842d13b09f602da2391172a80a1b1729959
Instruction Fuzzy Hash: 6C21F275604204DFDB08DF18D9C0B26BBA6EB98314F20C6A9E90D4B396C337D84ACA61

Function 0067D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8acdf6281bc680488bb05cbf000827508ccff401b637e79f6f77acf9233dce72
Instruction ID: 6afa1e246d88404d26b944f2f541169997d19f1f34d03dc920119bf0c40a9e1f
Opcode Fuzzy Hash: 8acdf6281bc680488bb05cbf000827508ccff401b637e79f6f77acf9233dce72
Instruction Fuzzy Hash: 9B210171504200DFCB10DF14D984B6ABBB6FF84324F24CA69E84D4B381C37AD847CAA2

Function 0067D1CC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cc7d273768167bad6d9c8d54a9115df374a77ebb16aa8fc3fc8f03b82f58ffd
Instruction ID: 1870bfaf9d703c5e58c7fc2dc9d1eb50f71f9c0f628c419345aa001f5099f2d2
Opcode Fuzzy Hash: 4cc7d273768167bad6d9c8d54a9115df374a77ebb16aa8fc3fc8f03b82f58ffd
Instruction Fuzzy Hash: 0621F2B5504204EFDB04DF14D580B26BBB6FF94714F24C969DA0D4B396C336D947CA61

Function 0067FEFC Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4562bea5ef639e894f42988fe1c5f5b0a4cffc73ce42db124fb045fdf903b4bd
Instruction ID: 043900230d4a97fab76983b2d4283552cb3acae214ed1e311fc81e337d5cf2c9
Opcode Fuzzy Hash: 4562bea5ef639e894f42988fe1c5f5b0a4cffc73ce42db124fb045fdf903b4bd
Instruction Fuzzy Hash: CD21D171608240DFDB04DF28DA84F26BBA6EB95714F20C67DE80D4B395CB3AD846C661

Function 0067E3B8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4cb257b6cb354e05deadc4248de5fcb58b9f83f8e9c3e8aaaa68562132dd00b
Instruction ID: d2747b478ead8853014e48fb6fb7526077266a4a0056152cf1bbde7a6c171d43
Opcode Fuzzy Hash: a4cb257b6cb354e05deadc4248de5fcb58b9f83f8e9c3e8aaaa68562132dd00b
Instruction Fuzzy Hash: 0D21F3B1604240DFDB04DF24D6C4B26BBA6FB98714F20C6ADD84D4B395C337D84AC6A1

Function 0067EE68 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e915a3a43e13a9ccb19ebbee0a04e9cbbdcceac9202c2eb1f66f6932b79f491
Instruction ID: 4857588ba4384ef0b36a7fb4e5384fba1f729442ad9f105ac50be5bdf146a676
Opcode Fuzzy Hash: 6e915a3a43e13a9ccb19ebbee0a04e9cbbdcceac9202c2eb1f66f6932b79f491
Instruction Fuzzy Hash: B22127B1644240DFD704DF14D5C4B26BBA6EB98314F30CAADD90E4B791C33BD84AC661

Function 0067F278 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 488a482cb6c3a8aacacc83a7eb9e22d0cb3ff7eaa440f8ee005611f2c6ecf84b
Instruction ID: 82c3e3d389358db0f8df4409a075a7cabf330408b375c7824f7ded2381e0916b
Opcode Fuzzy Hash: 488a482cb6c3a8aacacc83a7eb9e22d0cb3ff7eaa440f8ee005611f2c6ecf84b
Instruction Fuzzy Hash: 8221D1B5644240DFD704DF64D584F2ABBA6EB94324F20C67DD90E4B392C73AD847C6A1

Function 0067F828 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9582631cd8a99691ceb669ede2dda099fd01f1db702352eb86ffe17651d44b0
Instruction ID: 92c652cf938879bda4fa6b3d1bcbed7864eea300c75e11d6c9e071729ca3db5d
Opcode Fuzzy Hash: c9582631cd8a99691ceb669ede2dda099fd01f1db702352eb86ffe17651d44b0
Instruction Fuzzy Hash: BE21DEB1604240DFDB04EF24D584F26BBB6EB94314F20C6BDD94E4B391C73AD846C6A2

Function 0067E7E8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95277e382ad5c589a407d87be9ff2717f8b19ec63248c2ee0a3a220e98fc61fe
Instruction ID: 1e08564297c9b26d8b68ca815af40b8f2c69252bd74480f405b38d40eb3896bd
Opcode Fuzzy Hash: 95277e382ad5c589a407d87be9ff2717f8b19ec63248c2ee0a3a220e98fc61fe
Instruction Fuzzy Hash: 6A2102B1644240DFDB04DF28D5C4B26BBA6EB98314F20C6BDD90E4B391C33BD84AC662

Function 0067F8F8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d8defb3d7f8d47d1271a9655629090c30c1e2cbd4359af17661c8eb10d0a8a
Instruction ID: 48d06620b37ac5a9ec16fbba0bf01e40a147f2ea2ac272ffada51a95c495b196
Opcode Fuzzy Hash: 98d8defb3d7f8d47d1271a9655629090c30c1e2cbd4359af17661c8eb10d0a8a
Instruction Fuzzy Hash: 7421F0B1604244EFDB04EF24D5C4F26BBA6EB94314F20C67DDA4E4B391C73AD846C6A2

Function 0067F5B8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c8f032cc2a23257d9b40f44349f706f3284bd37118d1850115170971d77bfcc
Instruction ID: 871ac47ce1199cd4c201699a5abca6e8a9ca4b985f39e8dfb7a0ce015ed5e7d3
Opcode Fuzzy Hash: 9c8f032cc2a23257d9b40f44349f706f3284bd37118d1850115170971d77bfcc
Instruction Fuzzy Hash: 5B21A1B16442409FD704EF24DAC4F26BBA6EB94714F20C67DD90E4B361C73AD846C661

Function 0067F688 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a39e6b593d0890fdcd4b089ea7302a93d8c4129a6b0948aec66b343bf31188
Instruction ID: 085f2497f2fdc4c6d44ded9f5a00719adaa13a4bb7d8938d49d77b9c5616f80d
Opcode Fuzzy Hash: a5a39e6b593d0890fdcd4b089ea7302a93d8c4129a6b0948aec66b343bf31188
Instruction Fuzzy Hash: BA21D1B56042409FDB08DF24E5C4F26BBA6EB94714F20C57DD90E4B351C63AD846C661

Function 0067DF98 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e9d89ae3dc8715d3c2c0f2d72550e4ef15f71c0d858196aa56f80f5869714c8
Instruction ID: c6f50ac8850f691c2579b1da43334596dc0e66caa01eb54582de470edd08ff3e
Opcode Fuzzy Hash: 9e9d89ae3dc8715d3c2c0f2d72550e4ef15f71c0d858196aa56f80f5869714c8
Instruction Fuzzy Hash: F32105B1644240DFD714DF24D5C4B26BBA6FB98314F20C5ADD90E4B391C37BD85AC661

Function 0067D002 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4d7c9c593676d2c04a458308b2613c8291f5a19ed1c1981463a7f058d1a35b7
Instruction ID: 6924eef037983f4a12bf726a3448bf41b30182a2be4ef6155c94ff216222a9ab
Opcode Fuzzy Hash: b4d7c9c593676d2c04a458308b2613c8291f5a19ed1c1981463a7f058d1a35b7
Instruction Fuzzy Hash: 4B2180755093C08FCB128F24D994756BF71EF46314F29C5DBD8888B693C33A980ACB62

Function 0067E6FB Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 88bf88fcb75358ac3d210f594081e52e78f34139a2fa6c8f60cc902f24aec0c4
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 1011BB79504280CFDB05CF14D5C4B55BBA2FB88318F24C6AAD8494B796C33BD80ACB61

Function 0067D1C7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 1168045c0fd9663e1c2245bdb8ffa2e7876ed7dddf28f1971d3273e68631cde5
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: D711BB75504280DFDB01CF20D5C4B55BBB2FB84314F28CAAAD9494B756C33AD90ACB61

Function 0067FEF7 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ca03276ac0ccff4c81988cf554042a47405952ec31bc816ea136efef3652f3
Instruction ID: 611c8cf1482b42a4e838b17a74b95c8b9138cb272d7d0c99d22ea1aa97f3550b
Opcode Fuzzy Hash: 04ca03276ac0ccff4c81988cf554042a47405952ec31bc816ea136efef3652f3
Instruction Fuzzy Hash: CF119D75504280CFDB05CF14D584B55BFA2FB95318F24C6AED8494B752C33AD80ACB51

Function 0067E3B3 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ca03276ac0ccff4c81988cf554042a47405952ec31bc816ea136efef3652f3
Instruction ID: 41ecdc38cd7eb480f42079bfad6b73b3e818aa72ac6d636f4544313994e7621a
Opcode Fuzzy Hash: 04ca03276ac0ccff4c81988cf554042a47405952ec31bc816ea136efef3652f3
Instruction Fuzzy Hash: 03119A75504280CFDB05CF14D6C4B55BBA2FB98318F24C6AAD8494B756C33AD84ACB92

Function 0067EE63 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction ID: d99ee7375be6d84eda686eeab59ef3337b6746fde7da0c33d20bbc863899546d
Opcode Fuzzy Hash: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction Fuzzy Hash: 2B11E075504280CFDB15DF14D5C4B55BBA2FB98318F24C6ADD8494BB52C33BD84ACB92

Function 0067F273 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction ID: bc7f8f1dcf0e710cad730ddc2b1617b2747826e5e68cf4c4f56743037d1c3c1d
Opcode Fuzzy Hash: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction Fuzzy Hash: CB119EB5504680CFDB15DF24D5C4B59BBA2FB54328F24C6AEC8494B752C33AD84BCB92

Function 0067F823 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction ID: 50e96219236615bb65ae5923197eec4e61f2959f2b1d1a9761e0b30ed23b2140
Opcode Fuzzy Hash: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction Fuzzy Hash: 87119E75904680CFDB15DF24D5C4B55BBB2FB54314F24C6BEC8494B792C33A984ACB92

Function 0067F8F3 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction ID: e7690889817501a27d7a9e67637a3a674591423090576cb498e67624f98ed07c
Opcode Fuzzy Hash: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction Fuzzy Hash: EE11CEB5504280DFDB05CF24D5C4B55BBA2FB94314F24C6ADC94D4B792C33A984ACB92

Function 0067F5B3 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction ID: 2cdc6efdf995617d83b62893fa3115021a978259a127ba85930ea0d2272bde36
Opcode Fuzzy Hash: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction Fuzzy Hash: 7711CEB5504280CFDB05DF24D5C4B65BBA2FB54314F24C6BEC8494B762C33A984ACBA2

Function 0067F683 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3423263950.000000000067D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_67d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction ID: ea82b7fe94c952615885014781258d71c46eaecc853c05dd465a2470671f5145
Opcode Fuzzy Hash: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction Fuzzy Hash: E8119E75504680CFDB19DF24E5C4B65BBB2FB94314F24C6ADC8494B752C33AD84ACB92

Analysis Process: GamePall.exePID: 1740, Parent PID: 5644COMMON

Executed Functions

Function 011A3750 Relevance: 3.8, Strings: 3, Instructions: 88COMMON

Download Yara Rule

Strings

(bq, xrefs: 011A37B2
(bq, xrefs: 011A3786
(bq, xrefs: 011A3820

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: 11824610ecf8a8e5c9b48bb95f318c54bc0e47ce366ed319155e79b8931092d7
Instruction ID: 6dc6702fb0bc452dc8c608a2c56ca7ae7e8816e2a7444d7a518a3cdc7d60795c
Opcode Fuzzy Hash: 11824610ecf8a8e5c9b48bb95f318c54bc0e47ce366ed319155e79b8931092d7
Instruction Fuzzy Hash: 6B2168257152A44FD71E6B7D541013E3FE7ABCA261328416ED90AC73D5DE348C0B8395

Function 011A5678 Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

(bq, xrefs: 011A589B
(bq, xrefs: 011A586F

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: 87dc992ef816050a18305ad08e6afd809fadafd8c680ff5b10b54ffc0234d4c9
Instruction ID: dc10513a1eff1e1497b3eb2a674648927fcc8adffff3fcb86fb6615868145cd1
Opcode Fuzzy Hash: 87dc992ef816050a18305ad08e6afd809fadafd8c680ff5b10b54ffc0234d4c9
Instruction Fuzzy Hash: 4E61CF74B052458FCB59DF69D494A6EBFF2AF89200F6540A9E402EB362CF749C06CB51

Function 011A3869 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

(bq, xrefs: 011A3BA1

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 0b40aea9fd35922021c7e6f479c593184a2c92031ba267d78e17f5deac1a6a30
Instruction ID: 2c2c08dd5ddb7818f6b35d49389667673c501e3d7653f85f9839733b23e47683
Opcode Fuzzy Hash: 0b40aea9fd35922021c7e6f479c593184a2c92031ba267d78e17f5deac1a6a30
Instruction Fuzzy Hash: FE812D39B10219EFDB09DFA8D954AADBBB7BF88310F208529E815A7364CB35DC45CB50

Function 011A525C Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

(bq, xrefs: 011A51F9

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: ac8372c0ca9d2245bb78922b545b9afd670fb8301ebe6badcea8b21f229a97e6
Instruction ID: a30226c4c4d49f7c9a88eb0bd0424882546d0334f90fcc4d0115651cf0b7aa15
Opcode Fuzzy Hash: ac8372c0ca9d2245bb78922b545b9afd670fb8301ebe6badcea8b21f229a97e6
Instruction Fuzzy Hash: 7871CF34A04214CFCB49DFA8D4946ADBFF3BF89300F548069E806AB3A5DB34AC42CB51

Function 011ABEAF Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

Te^q, xrefs: 011ABF75

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 83c6f3d62d6a0396c41adc1d0256d960cd9792098402abfd47089646810459d2
Instruction ID: eb02df0a1f755d66d6ca83b35cca2ae23d20ba430a99a21e3ec0d214910c03bc
Opcode Fuzzy Hash: 83c6f3d62d6a0396c41adc1d0256d960cd9792098402abfd47089646810459d2
Instruction Fuzzy Hash: F4419E347002158FC708DF2DC898A6EBBE6FF88714B6584A9E506DB3B5DB31EC018B90

Function 011ABEC0 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Te^q, xrefs: 011ABF75

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 4d0d80b849acb92a20c0e7f5718e8762f7b0a3ceb8e293200b6373b1bf0657b8
Instruction ID: a4014f0f8400ebe85722a6f322da11d7db278da6eed6cecb911b409fd277170d
Opcode Fuzzy Hash: 4d0d80b849acb92a20c0e7f5718e8762f7b0a3ceb8e293200b6373b1bf0657b8
Instruction Fuzzy Hash: FD415C347102158FC748DF6DC498A6EBBE6FF88714B2584A9E506DB3B5CB71EC018B90

Function 011A2B1F Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

LR^q, xrefs: 011A2B35

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: efb23d9910ebb6a323bd6c7c743c565225bf41939af1d089ff0031ea47546440
Instruction ID: e16d8d782410bb6ab035ace9971995967dca19caba4a8c4dd0b874d50e0543d7
Opcode Fuzzy Hash: efb23d9910ebb6a323bd6c7c743c565225bf41939af1d089ff0031ea47546440
Instruction Fuzzy Hash: 7E31FC357102058FDB09EB3AD46452E33B2EBC9A187208568D14A8F368DF35DC47CB9A

Function 011A4247 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

(bq, xrefs: 011A4295

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: bf41f0754db035ee3254bb0fe6dd065313a63fd50403db79f5d569c49ab9e4db
Instruction ID: fa92581368af525b349610d26593d4351e80647d250d86da1b34fc218b0d0244
Opcode Fuzzy Hash: bf41f0754db035ee3254bb0fe6dd065313a63fd50403db79f5d569c49ab9e4db
Instruction Fuzzy Hash: A4016432B082904FD30AAB3C682427E6FA3EFD225175945AEC482CF755CF648D4EC786

Function 011A1053 Relevance: .8, Instructions: 836COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b6afd4c477721a1d2bb01870ef3267cf520a71cbb02db628c4b3776db7bb4d
Instruction ID: ab5f3b053ee536cbd20b84763e86b7dc859bf90ffe552d922236dba2ee902d21
Opcode Fuzzy Hash: 16b6afd4c477721a1d2bb01870ef3267cf520a71cbb02db628c4b3776db7bb4d
Instruction Fuzzy Hash: 0482B179A40209DFDB06EBA4D654B6E7B77EB98300F104814E811337ACCB36AD95DB36

Function 011A1058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c369e0138addb471934a6502eb4bfde28966e37d1f4ddbd020dfdbeea515faf2
Instruction ID: 95064e10da9cab846b0dd6e0ca48979859e190d2265f1ba98b4c45b786dbf645
Opcode Fuzzy Hash: c369e0138addb471934a6502eb4bfde28966e37d1f4ddbd020dfdbeea515faf2
Instruction Fuzzy Hash: B682B179A40209DFDB06EBA4D654B6E7B77EB98300F104814E811337ACCB36AD95DB36

Function 011AB0B0 Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6867a1e3255e0e1eac49303ef38ab5d2347dd22d8e9e8be5b64d2c4f435ff0a
Instruction ID: 216b3ac9aad48c33a487925a530b6ad6b70861dbd31768ae40d5af954111d082
Opcode Fuzzy Hash: c6867a1e3255e0e1eac49303ef38ab5d2347dd22d8e9e8be5b64d2c4f435ff0a
Instruction Fuzzy Hash: F0527839A01240CFC729EF78E558A2D7BB2FF84305B948569D4268B3A9DB71EC81CF51

Function 011ABB99 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32560110eca36404abd8b3a8efc5e63889c9d0c483f5fcaff7607f43545aba7c
Instruction ID: 36e2d7b642a51027a17ffe35e49dd11fe2d2f392d6e72d28a347839f9b757d14
Opcode Fuzzy Hash: 32560110eca36404abd8b3a8efc5e63889c9d0c483f5fcaff7607f43545aba7c
Instruction Fuzzy Hash: 1D813D39A02145CFC726EF18E6A9919BBB2FB44304B55C568D1258B37DCB70EC49CF61

Function 011A5AA0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5364430e88586cffe2d9e39150682452abd77b48b868c769d1b805dbe226fad
Instruction ID: a6b60dcf60821a1bfb43e06c4c6881a4977c2cec6e9f84b6e2087226f0187d87
Opcode Fuzzy Hash: a5364430e88586cffe2d9e39150682452abd77b48b868c769d1b805dbe226fad
Instruction Fuzzy Hash: 9B515E79B002068FCB48DF68C594A6EBBF6FF8C215B514168E50ADB365DB31EC05CBA0

Function 011A38A9 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8240a9b6d24e8c28d7fd56c439706a792316da5d78493ead5aa4965cd8a36df8
Instruction ID: 592b8c5e9e521184ccb35804b0dcfff310f5a3b61bfe6f58775929e8e087a838
Opcode Fuzzy Hash: 8240a9b6d24e8c28d7fd56c439706a792316da5d78493ead5aa4965cd8a36df8
Instruction Fuzzy Hash: 8F512E38A51219EFCB09DFA8D994AADBFB6FF88310F204158E815A7364CB35EC45CB50

Function 011A2850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bdaa31e2ffcb6352cebe5adef735c71d3909e42d5cffb7a4759e94ade2173d9
Instruction ID: ae6a633fdfd318465948fa2d09bbecba1607d36a3e2fb63b5f420a91a1799c4f
Opcode Fuzzy Hash: 3bdaa31e2ffcb6352cebe5adef735c71d3909e42d5cffb7a4759e94ade2173d9
Instruction Fuzzy Hash: D3411874E50218CFDB18DFA4D994A9DBBB2FF88300F205629D915A7368EF349849CF60

Function 011AB0A0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6565bd98dc280e202ca2f2ea71fb63d0fb96c7e46271a50d4d0c5373a2a549e9
Instruction ID: 0737e2c32e7a878069309611c3808bd7b66700498b1fcc80efa4d57647a513ca
Opcode Fuzzy Hash: 6565bd98dc280e202ca2f2ea71fb63d0fb96c7e46271a50d4d0c5373a2a549e9
Instruction Fuzzy Hash: 3F3126396002199FCB18DB78D8946ADFFF6FF85304F408529D0199B3A9DF70AC098B91

Function 011A5A91 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d0d182332a0263182a50a8f51b692554d8c5f6934375aa1fe4d6779462d5ac
Instruction ID: fa57732a683b6900ea5c85730d2d82182a036a2c64121eb03c838a205e01b203
Opcode Fuzzy Hash: 75d0d182332a0263182a50a8f51b692554d8c5f6934375aa1fe4d6779462d5ac
Instruction Fuzzy Hash: 04417E79B002068FC744DF6CC584D6ABBF6FF88215B5141A9E519DB366DB30DC05CBA0

Function 011A5308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c47e9343df7a3c1da685f88c4aa35fe4edd54200d3791bbada64753416e2a85
Instruction ID: a12340d1a703eff5b0cd83446425e291685b4b87de7401b04f95c245fc785dc4
Opcode Fuzzy Hash: 1c47e9343df7a3c1da685f88c4aa35fe4edd54200d3791bbada64753416e2a85
Instruction Fuzzy Hash: A6411B39A04214DFCB48EFA5E4949ADBBB3FF88315F618165E816A7364DB349C42CF90

Function 011A2843 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece7970c2e29367c652cbf4a4740194c1156540e959ee0883ba7d02ad4caa11e
Instruction ID: b6a22658dc466d2df9aac4ff1e6cabc1b828e2beb499940e64734cdc3e5cfe26
Opcode Fuzzy Hash: ece7970c2e29367c652cbf4a4740194c1156540e959ee0883ba7d02ad4caa11e
Instruction Fuzzy Hash: 5F314774E502188FDB18DFB4D5946EDBFB2FF88300F644629D502A7268EF35984ACB20

Function 011A2C53 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739f6559372872e6391933002af4c50f7caf514030c570ce29289e281a7526a1
Instruction ID: fec1cd6437b21308e1bc792f9044ac392047f15b70249bd8bc1d18d1a317c5f1
Opcode Fuzzy Hash: 739f6559372872e6391933002af4c50f7caf514030c570ce29289e281a7526a1
Instruction Fuzzy Hash: EF312F35D0020ACFCB15EFA8D5946EEBBB2FF88314F104529D516A7368DB309A45CFA0

Function 011A2C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 823d7091ee19ebb9faf859ec1e234e3bd195345dc27acc8d7059e212b59558ba
Instruction ID: 84bb1d5e751f2823666c1e46e5fdaa442eb3c4451874850eb37adf4a9ab95bc5
Opcode Fuzzy Hash: 823d7091ee19ebb9faf859ec1e234e3bd195345dc27acc8d7059e212b59558ba
Instruction Fuzzy Hash: 9F312075E0020ACFCB05EFA8D594AEEBBB2FF48714F104525D515A7368EB309A85CFA1

Function 011A288D Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f4edb2a441970bdb47276ac9904238547bef24a0318ad6772a2548a1ec130d
Instruction ID: c07ad3a040f6158667d8762e3c49b192568a1a2d90f58d03d89c36caa767d179
Opcode Fuzzy Hash: 65f4edb2a441970bdb47276ac9904238547bef24a0318ad6772a2548a1ec130d
Instruction Fuzzy Hash: D7313A74E50218CFDB18DFA4E5946ADBBB2FF88340F24552AD905A7268EF349849CB20

Function 011A4B7F Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa9a51e70bee49d2879bd4fd30e8dd0c755545f6ace1af76a26d396a99a0b22c
Instruction ID: 959f8e3d796fe9143780b4b020caaa7c6e1ac3f94a6a68f45d06e914b24a3b58
Opcode Fuzzy Hash: aa9a51e70bee49d2879bd4fd30e8dd0c755545f6ace1af76a26d396a99a0b22c
Instruction Fuzzy Hash: AA2154316506025FCB19EB79E980A6EF7A2FFC4214B048A39D4258F368DF70AD4D8B94

Function 011A4B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e86cf5e3051a4da99a7bbc90f310b44f0ce2caec7e311383d2a23660c249da0f
Instruction ID: 48580e35233bf41b96e0fbf23ba56ec68fd9b36981fa80267ad462206467fd07
Opcode Fuzzy Hash: e86cf5e3051a4da99a7bbc90f310b44f0ce2caec7e311383d2a23660c249da0f
Instruction Fuzzy Hash: 2D2162312406025FCB19EB79E980A6EF7A6FBC4214B048A29D4258F368DF70AD4D8B94

Function 011A2908 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d9ce3f3b306536f34444f124cc7bfe1f5bb9b06ca24c0d4cc44d2960a4e8753
Instruction ID: 55dec48fd4de7766a957fade5e3801be6908321a33b3f1f573d212870fff6a1b
Opcode Fuzzy Hash: 4d9ce3f3b306536f34444f124cc7bfe1f5bb9b06ca24c0d4cc44d2960a4e8753
Instruction Fuzzy Hash: E721FF75D10118DFDB18DFA4D99059DBBB2FF88340F104129D91567368EB349845CF61

Function 011A6888 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0a3c1b9cb08ef9539bb4d9f60c411ab1ce3b3f8322977545b7652fc0a5fc1a
Instruction ID: e22326ba29f3c0da2a07ad7417effe84edab0508ee5ed3f5ab8aeb33edeaa0bb
Opcode Fuzzy Hash: 8d0a3c1b9cb08ef9539bb4d9f60c411ab1ce3b3f8322977545b7652fc0a5fc1a
Instruction Fuzzy Hash: 2221D375900206CFDB18DFA4CA487EEBFF1AF44314F988069C405A7252EB759A4ACB51

Function 011A5C61 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db94f7d41412d3a6aaac8777fc853de1bf954c360c300f27be585d40283fdfb9
Instruction ID: 00c463b875f9fe8e185b5801b42b5547d36c308ac1bb57dcba09a1f6e7803e0e
Opcode Fuzzy Hash: db94f7d41412d3a6aaac8777fc853de1bf954c360c300f27be585d40283fdfb9
Instruction Fuzzy Hash: A1217935A042188FDB54CBA9C588AEDBBF2AF4C310F6401A5E501FB365CB359D44CBA0

Function 011A296A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb824e5f8b30c2b33ae68a665bf0500b411e638dcebb08284a00c9ee9e65374d
Instruction ID: 2956f0a17c2021757cd7884a51a8b2a89c7d01c6fcfa83cd1d6e095d9d9392d7
Opcode Fuzzy Hash: bb824e5f8b30c2b33ae68a665bf0500b411e638dcebb08284a00c9ee9e65374d
Instruction Fuzzy Hash: F321D874E50218DFDF18DFA8D59099DBBB2FF88300F20412AD919A7368DB349949CF51

Function 011A66F9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa88a451c48a6bb99ed30e6bd1de3c8d1ed4e3bf5a2adbd584a80462cbbc04c1
Instruction ID: 05bd7eeac0f7ae54d864f80da981bb22b68f63d5dacf5fb4a80577abd14a2b99
Opcode Fuzzy Hash: aa88a451c48a6bb99ed30e6bd1de3c8d1ed4e3bf5a2adbd584a80462cbbc04c1
Instruction Fuzzy Hash: 1311C6313043508FC71A5B78A954499BFA2EFCA22130841BAE05ACB366CF759C4EC780

Function 011AC000 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adcf1098b5e99f2bb8ad50792158df00fcee5f4d8ba616ecc9ac46c4625e2bfe
Instruction ID: 2ba3c81bd98d1d4a9e02f30cac3fd00bdec94adc429feac75c19c6cf8ee74ecf
Opcode Fuzzy Hash: adcf1098b5e99f2bb8ad50792158df00fcee5f4d8ba616ecc9ac46c4625e2bfe
Instruction Fuzzy Hash: D411DE363502158FCB00EF2CE884A89BBF1FF85714B5085A9E405CB376CB72ED058B90

Function 011A5940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99b7a1bbf1e915a582b52c957e15fcddfebc3cf0ff5f7b983592cb0518597238
Instruction ID: 3666cc9b2d5478b0e9048d7adc4f86d82ecf8dd2a5e58da4037c70e5b4683f98
Opcode Fuzzy Hash: 99b7a1bbf1e915a582b52c957e15fcddfebc3cf0ff5f7b983592cb0518597238
Instruction Fuzzy Hash: 5F01A4763102208F8718AA6DE49491EB7A6FBE9666321453AEA06C7314CE31DC06C7A0

Function 011A32F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23e9959fafbe0328dadc0ef63efe48255f7d1dba05bfbb735f4bce7ed63e25cb
Instruction ID: c545076c6dd61dd8bd2e6e4ab12c21a748d10eb8ea46b26f2dff9d84a930a01d
Opcode Fuzzy Hash: 23e9959fafbe0328dadc0ef63efe48255f7d1dba05bfbb735f4bce7ed63e25cb
Instruction Fuzzy Hash: D0017538E60204CFCB18EFB4E46879D7BF6AB8C301F414A29D40297340DF755918CBA0

Function 011A32EF Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 972df7794910cafefa8266b8121f6acb2df0ff8adfebaa0e3da3ef9f57afd3ac
Instruction ID: 9e0671e9dd6bfeeb3380a30ca5b3ec6d329fb756d6f1cf62be23f451a734fdb8
Opcode Fuzzy Hash: 972df7794910cafefa8266b8121f6acb2df0ff8adfebaa0e3da3ef9f57afd3ac
Instruction Fuzzy Hash: 6D015238E60244CFCB28EFB4E4687AD7FB2AB88301F414A29D40297341DF751919CB60

Function 011A2A8B Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abfe10d2c2f721ce917e8522498cacf8d65debfc0008aebfb66f4e5f816cc93a
Instruction ID: 77ee983046d8f45cd292c774521607d6fd5d45153e48905fb8abb1c361337568
Opcode Fuzzy Hash: abfe10d2c2f721ce917e8522498cacf8d65debfc0008aebfb66f4e5f816cc93a
Instruction Fuzzy Hash: 7101FB756107108FC715AB38D54849ABBE2FF8561831489AAD15ADF724DF71EC098FC4

Function 011A6388 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b99d94fda4a3daf10480bc847b38142a1f7f7703b95e27b5241e264168db613
Instruction ID: 33ff7699602e1ef8e3eb0eeac32fff97018eb1dc7d0ddd539091071876f2deb0
Opcode Fuzzy Hash: 3b99d94fda4a3daf10480bc847b38142a1f7f7703b95e27b5241e264168db613
Instruction Fuzzy Hash: 1BF0C230D00289AFCF00EFB4D58059DBFB1EF96200B2081D9D449EB255DA310F49DB41

Function 011A593F Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a193f0a632492e42543b3259ce18318963e45f9b3ce2e0a103128a7148ceac50
Instruction ID: 31004ebf5602c121e02c7dfc9d8ce9c4dc2c1e8daa18bb9d66d7a8b6b704eabc
Opcode Fuzzy Hash: a193f0a632492e42543b3259ce18318963e45f9b3ce2e0a103128a7148ceac50
Instruction Fuzzy Hash: 1DF05E763002109FC7189B29E494D6EBBB6EBD9665325856AE906C7314CF318C06CB60

Function 011A41DF Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6044cb67306a68c924a49385b777715606e6355f021071efb9362a39927da24
Instruction ID: ffe552c68e8fe773a0e6bbde1c7a5d0f5b838dcd57f1a89a798b22df1c5b8541
Opcode Fuzzy Hash: c6044cb67306a68c924a49385b777715606e6355f021071efb9362a39927da24
Instruction Fuzzy Hash: E2E0E571B042116F8B1CA6B578909BFAB9BFBC8165754092DE019DB304CF221C0A8768

Function 011A41E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d50e322fab3808a1142797176b49e360f1ccd6ebfa178f9d5702dc42d0fb24eb
Instruction ID: 22cc6c0667ecfcd2db774d4bfc97927289498d4d4bd11fe0fcec38b2e5efee9d
Opcode Fuzzy Hash: d50e322fab3808a1142797176b49e360f1ccd6ebfa178f9d5702dc42d0fb24eb
Instruction Fuzzy Hash: 71E02B717042156F8B0CA6A67C9097FB69FFBC8565754082DE119DB304DF316C0947AD

Function 011A6398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce94ab888e2d6c957ff5b96d7c0b6c9f59b6f81dc931b31069f39a93f9569286
Instruction ID: 540f81beb4c3342b57922c119ef1f3c4975790dfc0509cb9f30dd2944b60bc87
Opcode Fuzzy Hash: ce94ab888e2d6c957ff5b96d7c0b6c9f59b6f81dc931b31069f39a93f9569286
Instruction Fuzzy Hash: 44F08C74E0020DEF8B04EFA8D98059DBBB1EF98204F2081A89809A7344EB305E099B95

Function 011A2D97 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64531012eacbdc1dcd694b9d8cf2a498bd2e869f02cd3e3519e397afca5aa49
Instruction ID: 26db3e5144023de0b1487ff1f33a9f507fff0015489d9bc243ff7f8ad59f10de
Opcode Fuzzy Hash: d64531012eacbdc1dcd694b9d8cf2a498bd2e869f02cd3e3519e397afca5aa49
Instruction Fuzzy Hash: 53F01575E140199FCB88EFBC84046DEBFF5EF89214B2140AAD519E7312EB708D118B91

Function 011A2DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00afc91139da2f742200a8457d80381eb1d8ae58447f538867be1afd7be1ed21
Instruction ID: 58d044be34a12a1afa0eae364f2c25f8a206a220f9da1a50c659390012902197
Opcode Fuzzy Hash: 00afc91139da2f742200a8457d80381eb1d8ae58447f538867be1afd7be1ed21
Instruction Fuzzy Hash: 70E0ED75E10118CF8B88EFBCD5056DEBBF5EF48210B5141AAD519E7311EB709D018B91

Function 011A374F Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066571865011b359fdcde745d33de15804f4eeaee5e251a11881aff5b17c5406
Instruction ID: 616b97a92e76f1faf9ac84a2163bde68aaa19fe58531ff65df3246b18ed4fa64
Opcode Fuzzy Hash: 066571865011b359fdcde745d33de15804f4eeaee5e251a11881aff5b17c5406
Instruction Fuzzy Hash: 05E0CD3A71051417873D557970445BE2F67ABC81657184075ED19C3318DF214C478791

Function 011A2003 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f871c0b236e9c4357aec1e239f4df885a5056d950362bfe18314497edf0b68f
Instruction ID: b9e74660f25224d03efdcef303759df919e85ed943c9d66a668a96167e1c0491
Opcode Fuzzy Hash: 8f871c0b236e9c4357aec1e239f4df885a5056d950362bfe18314497edf0b68f
Instruction Fuzzy Hash: 2AE08C35B802404FCB24577DA4189ED7BE6DFCA22131A09AAE04AC7321CE79CC028B60

Function 011A66C8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff396a9d13bb2bee89bddeb13684b80876bcae9f900f21e257d25a8cff5caf2
Instruction ID: 97aff13b5ab5fd61dbb2e075b9297ce3ac57bd722e3e82d748b081628720eb39
Opcode Fuzzy Hash: aff396a9d13bb2bee89bddeb13684b80876bcae9f900f21e257d25a8cff5caf2
Instruction Fuzzy Hash: 62D0A7327153604FC7451A6CB8103A977D1DFCA122F0903B7F505DB386DE684C0A5791

Function 011A6469 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbc1abceb009548c3a173bae77b46cad3db80cca894279dcbe6b2aea08429afd
Instruction ID: 6dcd093b811a718af6775a1e5b52a57e94c7b952b4508513f07762b01c9f7c5d
Opcode Fuzzy Hash: bbc1abceb009548c3a173bae77b46cad3db80cca894279dcbe6b2aea08429afd
Instruction Fuzzy Hash: 3FE05E757482408FC305DB38D0958A97B72EF9E350B1002E5E46ACB37ADE26DC87CB14

Function 011A6478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc31f81e4b8f7a2db98e217dac145ad024dd4f3f587dbb435fde1af1a338ee15
Instruction ID: 55f0e5cc70951d23cd84cbde89d4bdb8870a1df462a885f1e345353690bcb603
Opcode Fuzzy Hash: fc31f81e4b8f7a2db98e217dac145ad024dd4f3f587dbb435fde1af1a338ee15
Instruction Fuzzy Hash: 29C012753402044F8204DB5CD04081573EAAB8C71471001A4E519C7339CD21EC818628

Function 011A5647 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3331548292.00000000011A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e72fba5481fc7c4404a55708681bc8335424bb1bf2a9a4c22cbf1e483ad3cd07
Instruction ID: 681e302f150f5202289983cb36827a99088abb86e97d19546665c144240a6c50
Opcode Fuzzy Hash: e72fba5481fc7c4404a55708681bc8335424bb1bf2a9a4c22cbf1e483ad3cd07
Instruction Fuzzy Hash: 35A0026699541C01441454502C010367608D74665974406CAAC0D96661E953946E02C5

Analysis Process: GamePall.exePID: 5804, Parent PID: 5644COMMON

Executed Functions

Function 02EA4F58 Relevance: 11.9, Strings: 9, Instructions: 607COMMON

Download Yara Rule

Strings

(bq, xrefs: 02EA5655
(bq, xrefs: 02EA51CD
(bq, xrefs: 02EA5056
(bq, xrefs: 02EA55A3
(bq, xrefs: 02EA589B
(bq, xrefs: 02EA5082
(bq, xrefs: 02EA51F9
(bq, xrefs: 02EA586F
(bq, xrefs: 02EA55CF

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq$(bq$(bq$(bq$(bq$(bq$(bq
API String ID: 0-1872187367
Opcode ID: 40cdf96571d8de619d748d304e264c8089553f0525d0629f5590d26b7b522c0f
Instruction ID: 543d4dc158f85f31026d5c33b3a81f06bbc6dab0bb425d743a762c56f8ef651a
Opcode Fuzzy Hash: 40cdf96571d8de619d748d304e264c8089553f0525d0629f5590d26b7b522c0f
Instruction Fuzzy Hash: C7327E75E002148FDB04DF69D4A46AEBBF2BF89311F54D069E406AB3A4DF34AC46CB91

Function 02EA3860 Relevance: 4.4, Strings: 3, Instructions: 683COMMON

Download Yara Rule

Strings

(bq, xrefs: 02EA3BA1
(bq, xrefs: 02EA3DE5
(bq, xrefs: 02EA419C

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: 17c21c4114179e0944db610792803ce3200c5762ab76932111393d0e770fcc85
Instruction ID: 48594697b635ae3e1961e4ca83c385bed05550fe8a1b74a7dedc52ca833debcc
Opcode Fuzzy Hash: 17c21c4114179e0944db610792803ce3200c5762ab76932111393d0e770fcc85
Instruction Fuzzy Hash: 2D426F74B402149FDB05DBB9D964AAEBBB7EF88300F148069E406AB3A4DF35EC45CB51

Function 02EA1049 Relevance: .8, Instructions: 840COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdb0cfcc322bfc0f72037ebd7f858d708050012808f9c3e19d4cc5e29e81c0a
Instruction ID: ea8cb10203f0d4f5ed82623f95e0bb4c363d87ce08dcc2d96e99b3ab30b67b58
Opcode Fuzzy Hash: ffdb0cfcc322bfc0f72037ebd7f858d708050012808f9c3e19d4cc5e29e81c0a
Instruction Fuzzy Hash: 3582AC78640209DFDB06DBA5D754B6E7B77EB88300F208454E801377B8CA3AADD5DB26

Function 02EA35F0 Relevance: 3.9, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

(bq, xrefs: 02EA37B2
(bq, xrefs: 02EA36B6
(bq, xrefs: 02EA3786

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: d87b0d6c7379c0420f5424623df2f862e6c6ea4748b44ec052a971282472920c
Instruction ID: 77ce1b4026faaf327428aa2f991049142a54555108e6547801ac9081a9cc1dc1
Opcode Fuzzy Hash: d87b0d6c7379c0420f5424623df2f862e6c6ea4748b44ec052a971282472920c
Instruction Fuzzy Hash: 834124317001100BE718BF7A986423F6AE7FBD66607688979D406CB3A8DE34DC478796

Function 02EABEAF Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Te^q, xrefs: 02EABF75

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 121de527755ed5c16bf40f3abf9ba8676db66d41c0b92da71f7e04a3539a0348
Instruction ID: b8bdbb42b0f655410489eadcd5b1e38a27a5ea01a907d5349d12df30713dc9e6
Opcode Fuzzy Hash: 121de527755ed5c16bf40f3abf9ba8676db66d41c0b92da71f7e04a3539a0348
Instruction Fuzzy Hash: 91415A747006008FC744DF2EC998A6EBBF6BF99710B2585A9E406DB3B5CA70EC018B90

Function 02EABEC0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Te^q, xrefs: 02EABF75

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 5aca20fd6f44153c956131260ba96bc8ebeeb55b9ddd9c7defb6030527c6677a
Instruction ID: 23d73bab08212698844876a6c3cc73a199c8a0be874392ec875b783e8a0ea193
Opcode Fuzzy Hash: 5aca20fd6f44153c956131260ba96bc8ebeeb55b9ddd9c7defb6030527c6677a
Instruction Fuzzy Hash: 49316C347002048FC744DF3EC598A2EBBE6BF89B10B2584A9E506DB3B5CE71EC018B80

Function 02EA2B10 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

LR^q, xrefs: 02EA2B35

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: e96ea27ec59456f0d315d040a3d8d8b2c1a24eedd29e69677da62267f9009fc9
Instruction ID: 2fd924ddda321c2828a05168c73bbcef59a202d9229a9d4376982dbfd8227832
Opcode Fuzzy Hash: e96ea27ec59456f0d315d040a3d8d8b2c1a24eedd29e69677da62267f9009fc9
Instruction Fuzzy Hash: 3C316E317102158FD7499B3AC46465E37F2EBC9A18B208179D14ADF368DE35DC43CB8A

Function 02EA2B20 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

LR^q, xrefs: 02EA2B35

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 92030445ac0024843e481828375f34b123d94812fede712bde68170ce5a99058
Instruction ID: fd1bb20f4624fb9a89cb7ceabf58df4759e2b834736a75161fc062cb5e1750b0
Opcode Fuzzy Hash: 92030445ac0024843e481828375f34b123d94812fede712bde68170ce5a99058
Instruction Fuzzy Hash: 4C312C747102158FD749DB36C46491E37B2EBC9A187208179D14A9F3A8DE35DC43CB8A

Function 02EA4248 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

(bq, xrefs: 02EA4295

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 58dfe1bd1d013ae9fece7abfe22845ea1cd9adfd5aa11aa23b57ad197826fd88
Instruction ID: 7a1ebaccb11363c6df1c059d8a5fcca2bf90ea2062b500a78a1d6eecb9c42f6d
Opcode Fuzzy Hash: 58dfe1bd1d013ae9fece7abfe22845ea1cd9adfd5aa11aa23b57ad197826fd88
Instruction Fuzzy Hash: E70168327081900FD30AAB79542816E7FA3EFD261038844AEC446CF395CE749C4A83D5

Function 02EA37F0 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

(bq, xrefs: 02EA3820

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: ea8cf65b99a598bf146a936e7782d169c552323006673ab29832aa7d80fc952c
Instruction ID: 332047023550b88056b81056cea1f580237edbf991bc3edb10d7d39750dae1e8
Opcode Fuzzy Hash: ea8cf65b99a598bf146a936e7782d169c552323006673ab29832aa7d80fc952c
Instruction Fuzzy Hash: 37F09E327182505FDB056BBB581413F7BEBEBC6230718826AE91AC73D0DE758C0A83D1

Function 02EA1058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c77d49428276c6286bcdae06ce89e7c2ed94f2f5ca6e673798b9431b337e0c
Instruction ID: 652242b7d2135cf0820f1fa34696a6ea88f72348431dcec6b1279ad4d0cc6c3d
Opcode Fuzzy Hash: 42c77d49428276c6286bcdae06ce89e7c2ed94f2f5ca6e673798b9431b337e0c
Instruction Fuzzy Hash: 9182AC78640209DFDB06DBA5D754B6E7B77EB88300F208454E801337B8CA7AADD5DB26

Function 02EAB0B0 Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a3109125e8822e76fdf6cdc472299741281f609924ca0feb583e46622b6d0c7
Instruction ID: a10428273a2bd6ac83f0a0db20529b002ffae6b26d2b41042d5852828ad990a5
Opcode Fuzzy Hash: 9a3109125e8822e76fdf6cdc472299741281f609924ca0feb583e46622b6d0c7
Instruction Fuzzy Hash: 0B527834601204CFDB18EF25E26892D7BB2FB84709B55856DE8168F369DB75EC86CF40

Function 02EABB99 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba958e9df0a9299fd5c6a86129939de5b1dd0406277a4e68e914a4aa8bfb0ed
Instruction ID: 4b74732c115d3a11887578cff6ba799b73f34fc9b6559c2495448cb895f5ecf0
Opcode Fuzzy Hash: 3ba958e9df0a9299fd5c6a86129939de5b1dd0406277a4e68e914a4aa8bfb0ed
Instruction Fuzzy Hash: 84810670642208CFD750DB15E798959BBB2FB80708B51D568D9268F33AC738EC8ACF40

Function 02EA385A Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9811076aba2fc696e0906499b1ecc0937b841913454517849535b099ae2bdb22
Instruction ID: f96faa14962f23a454014fb9f2e56f20d4be978831dac052ff9cd074935beb29
Opcode Fuzzy Hash: 9811076aba2fc696e0906499b1ecc0937b841913454517849535b099ae2bdb22
Instruction Fuzzy Hash: EC612A74A51218EFDB04DFA9D9A4AAEBBB7FF88310F108065E805A7364DB35EC41CB50

Function 02EA5AA0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bca29d4851abe35018d821cb6548de99595f30dc507ed0a58c1e7289585247e
Instruction ID: 6914d7503b77676f37b3c7263a12196147cdbb4a6dd9d3e84416be3f289fc6f0
Opcode Fuzzy Hash: 1bca29d4851abe35018d821cb6548de99595f30dc507ed0a58c1e7289585247e
Instruction Fuzzy Hash: D8515E74B401068FCB04DF69C5A8AAEBBF6FF88314B518069E50ADB365DB31EC45CB60

Function 02EA2850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3934cc78d795dd30fb4c3b6511ad25cf0c32cd438802080e1daca8c210dfc106
Instruction ID: 0da3c06172829d13966c863ddb945dcb8bac2da669e1cc0b91006aa908dd1127
Opcode Fuzzy Hash: 3934cc78d795dd30fb4c3b6511ad25cf0c32cd438802080e1daca8c210dfc106
Instruction Fuzzy Hash: C141E774A50208CFDB14DFA5D5989EDBBB2FF88300F109529E916AB364DB35A885CF50

Function 02EA5A91 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e11fa483d204726f799b0b41513f2eff9d1a9917cae3301d0d7a2d5acbb9fd
Instruction ID: cf1b261529a091853b48b6e00b032e4a15230f658845992f0b5dea9326f1bf25
Opcode Fuzzy Hash: d9e11fa483d204726f799b0b41513f2eff9d1a9917cae3301d0d7a2d5acbb9fd
Instruction Fuzzy Hash: 80316A75B401069FCB04DF69C998EAABBF6FF88314B518069E509DB325DB70EC45CBA0

Function 02EA2842 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e06f35bccf893bd24e763b42b3da4062fbaf413be93878eeacbe3541099471f5
Instruction ID: a39b20e676a26bb2086123e33ea37a835d1a2989fb01f37808d1c2a2e6a980af
Opcode Fuzzy Hash: e06f35bccf893bd24e763b42b3da4062fbaf413be93878eeacbe3541099471f5
Instruction Fuzzy Hash: 33311B70D502089FEF14DFA5D5986EDBBB2FF88300F149529DA02AB264EF35A885CB50

Function 02EA5308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 641195aab55544f020a5015f4d55152ba64a871e630b22f085941ac78dca1371
Instruction ID: 3a2b61bb3788b55503a2e1698f496e67b50bacaccf60c22852457e557ca2a663
Opcode Fuzzy Hash: 641195aab55544f020a5015f4d55152ba64a871e630b22f085941ac78dca1371
Instruction Fuzzy Hash: 0A412774E50114DFCB04DFA5E5A49ADBBB2FF88305B609065E816AB3A0DB34AC82CF50

Function 02EAB0A0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bd7caa71d81c9d8b7f3c752ee1bd6be9500a54434554e6812d28f07b6a1b487
Instruction ID: f0992efe24355d76fd3beed7de18a2b620fae5a09371ea38139b376f6b50c20d
Opcode Fuzzy Hash: 6bd7caa71d81c9d8b7f3c752ee1bd6be9500a54434554e6812d28f07b6a1b487
Instruction Fuzzy Hash: 28312630A002088FCB14DB79D9946ADBBF6FFE5314F50852ED0169B3A4EF74AC098B90

Function 02EA2C48 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c6468829484f02a6a474d020c243c89de36cf67e23eb1f70abd0b54fd2b2a5e
Instruction ID: 96cf485cd3639938a1ee954a3dbee84e6b4de1c648b7c5e0dc6919cc30f013ce
Opcode Fuzzy Hash: 0c6468829484f02a6a474d020c243c89de36cf67e23eb1f70abd0b54fd2b2a5e
Instruction Fuzzy Hash: 074148749102098FDB40DFA5D695AEEBBB1FF48314F104126D911B73A4EB34AD85CFA1

Function 02EA2C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca30dddf63ad44db8fd87bf591379b853692493d1c59661d5854713038392513
Instruction ID: 59f31bb8b330df69367b41ac887f653e03108990c3d6b6b28ab672f939ac1098
Opcode Fuzzy Hash: ca30dddf63ad44db8fd87bf591379b853692493d1c59661d5854713038392513
Instruction Fuzzy Hash: 5B313974900209CFCB44DFA9D6949AEBBB2FF48314F104165D911B73A4EB34AD85CFA1

Function 02EA288D Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9476d54e552c27f1ab1dae514124750189c8a784c8435dff4329bd2a63ef8f39
Instruction ID: b3a1134838b32c00b6935ab362760242563bf44f376a68009beb69fcd69c7d6e
Opcode Fuzzy Hash: 9476d54e552c27f1ab1dae514124750189c8a784c8435dff4329bd2a63ef8f39
Instruction Fuzzy Hash: 3B31EB70E50208DFDF54DFA5D5986ECBBB2FF88304F14952AD906AB268DF35A885CB10

Function 02EA4B70 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fafbb4319a7def5e26063aed59d21b22ad6c246360aff40890fce90fdc930f8
Instruction ID: 2be506243ef599a2a49f8ffb8de37715c1507f56455ee0ef636f5822f66a54ca
Opcode Fuzzy Hash: 3fafbb4319a7def5e26063aed59d21b22ad6c246360aff40890fce90fdc930f8
Instruction Fuzzy Hash: 002108312006025FD704EB39ED846AEBBA2FBC1210B044E39D0158B768DF70FC8D8B98

Function 02EA4B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc7d00029e5cc1ed9aebb605a2e9fe852b16b4eaaad9fb67b6e91b5da51a168f
Instruction ID: 71f2343e1a0be9696786720174214118f388fce224fdfebc391bfa1fb291c0b2
Opcode Fuzzy Hash: fc7d00029e5cc1ed9aebb605a2e9fe852b16b4eaaad9fb67b6e91b5da51a168f
Instruction Fuzzy Hash: 712184302406025FDB14EB79E984A6EBBA6FBC4210B448A39D4158B778DF70FD8D4B94

Function 02EA2908 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ddc34a148979d6ae294e3f358da519b0e6c333f33f4ffd175ace96c5be6a45b
Instruction ID: f310c938412e84e50a9c8a227c210dc1c2528e49d0c4535aa7855c5808cffcdf
Opcode Fuzzy Hash: 6ddc34a148979d6ae294e3f358da519b0e6c333f33f4ffd175ace96c5be6a45b
Instruction Fuzzy Hash: 6D211930E502088FDF14DFA5D9949ECBBB2FF88300F00812AD915AB2A8DB74A885CF11

Function 02EA5C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9fcc9808c7b9ba1ef96a614d5b7b739da0602f037aeaa49bce46422183252c
Instruction ID: c323c6b6367e32e4ab2e577c48a77ddd5d290d8bfdc24fdc677d85b4438306f9
Opcode Fuzzy Hash: 5e9fcc9808c7b9ba1ef96a614d5b7b739da0602f037aeaa49bce46422183252c
Instruction Fuzzy Hash: 38215675E402188FDB10CBA9C598BDEBBF1AF4C314F6050A5E406BB361CB35AD84CBA0

Function 02EA6888 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a271f4f0e1193fc2f4f4e9b09c88ebe60f18119c797f5b2b83ab1070ceb642c0
Instruction ID: b47612a5b785f0b2b8072fcb981cbc641d93ee8cab8a30cd09246b998a75a798
Opcode Fuzzy Hash: a271f4f0e1193fc2f4f4e9b09c88ebe60f18119c797f5b2b83ab1070ceb642c0
Instruction Fuzzy Hash: 1521C071940205CFEF14DB64C9587EEBBF9BF06308F18D06AD005AB251DB75AA45CB61

Function 02EA296A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a538d56bedadcf98fc87419d8854ff3329489dc2b9a45777c095356113098071
Instruction ID: 4b304e1c3d5deeb7bdf92bdd437c30346148b29fbda0a445779c91ca305563ae
Opcode Fuzzy Hash: a538d56bedadcf98fc87419d8854ff3329489dc2b9a45777c095356113098071
Instruction Fuzzy Hash: AF21B274A402089FDF15DFA5DA949ACBBB2FF88300F10412AE915AB364DB34AD85CB11

Function 02EA5C5A Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22315aa4da3dcdd9b4496921c9e638eb4673b77db8c2f004c60a639ba1523bf8
Instruction ID: 5fc45e9b2ec13c8c12341e15d1811b6ec779bcd5d741dd30b031083228ceb080
Opcode Fuzzy Hash: 22315aa4da3dcdd9b4496921c9e638eb4673b77db8c2f004c60a639ba1523bf8
Instruction Fuzzy Hash: 2A115975E402188FDB10CBA9C598BDEBBF1AF48314F6454A5E402BB3A5DB35AD44CBA0

Function 02EA41A2 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ebb0f6ea4407bf9c85db69da67a9bc3da59a265def60770bbdbf696d90b69c8
Instruction ID: 2e22983fe2f332d09d75e919384f77eb0fcd740466fedaa96352483be4db253d
Opcode Fuzzy Hash: 6ebb0f6ea4407bf9c85db69da67a9bc3da59a265def60770bbdbf696d90b69c8
Instruction Fuzzy Hash: 5501242130D2815FD7066B766CA81EE3FBAFBD7121398049BD405DB386CE214C0A87AA

Function 02EA5911 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c7aaf9c68b68571101a8129499f546ab3f20360a84a412d64ddb29eeeee731a
Instruction ID: d92f846eac4b2f59a903778f42ff60cb5b5ce199c6487aacca7963820af9c4d3
Opcode Fuzzy Hash: 8c7aaf9c68b68571101a8129499f546ab3f20360a84a412d64ddb29eeeee731a
Instruction Fuzzy Hash: EB0126B33012509FC3009B2AE895A9A7FB9EF9A221318807FE844C7362CA34DC0587A1

Function 02EA32E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e0d57a11d11636a307d37b0e75a1dd974869d77efbf7b598ce79f57366fd9e7
Instruction ID: 44ee2b7570f781e7cf265bd584c52a6e32502f013748666a596f40071f8ad0bf
Opcode Fuzzy Hash: 9e0d57a11d11636a307d37b0e75a1dd974869d77efbf7b598ce79f57366fd9e7
Instruction Fuzzy Hash: FD118E75A201048FEB84DFB4E46E79E7FB6AB88311F00946AE902A7780DF346848DF51

Function 02EA5940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09aa3d32732567aebd8d2d8302fcebedbd39a55aaf894947f343fb543d36372f
Instruction ID: 2e1c1e8e67ab27388ed73d4a6f30da1478228bdb2c8ba30e18d9a5bb761a9c68
Opcode Fuzzy Hash: 09aa3d32732567aebd8d2d8302fcebedbd39a55aaf894947f343fb543d36372f
Instruction Fuzzy Hash: F501A4B63101108F87449F7AF49896EBBB6FBD9661350853FE605C7320CE31DC058BA0

Function 02EA2A80 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49aea23f762e52c8237d0a308970b6752706eab12ed42bf55f7054fa517b5021
Instruction ID: ad7f86541f6f511d5363beff0d5e2024d840230c35e6820d885b83efd67c23d7
Opcode Fuzzy Hash: 49aea23f762e52c8237d0a308970b6752706eab12ed42bf55f7054fa517b5021
Instruction Fuzzy Hash: 0F018BB56103008FC710AF39C44999BBBE1FB95614710896AD14ADFB24EF71EC058BC1

Function 02EA32F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a49715117a8df12cc83139916fdd69784f71763420c21aa2e389a86f75e2d111
Instruction ID: 5c5182cbbe8d2d7539245b6847ca9c112c1ee3bfb7dddd5667461ce19f30b0f7
Opcode Fuzzy Hash: a49715117a8df12cc83139916fdd69784f71763420c21aa2e389a86f75e2d111
Instruction Fuzzy Hash: B4014074A201048FEB44DFB5E56D79E7FB7AB88311F00846AE902A7780DF356808DF51

Function 02EA2A90 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 824e96cd6b2ef42812fa820cf129662cb6544fe72a26dd638365a0a0e4c7e553
Instruction ID: 9e026e7a91ccccde7ee046e63bca3bf8041ca95573f59afce183915c81849847
Opcode Fuzzy Hash: 824e96cd6b2ef42812fa820cf129662cb6544fe72a26dd638365a0a0e4c7e553
Instruction Fuzzy Hash: 46F0F6B56507008FCB10AF79C50985BBBE6FB9561431189AAD14ADF728EB71EC098BC0

Function 02EA4237 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de60b2cf6c2d4c71eb763cdab0da1e1a679de0a7a7d85e0e069a6bba7d1a8e5
Instruction ID: 6df0a5aa909de29473c40c41aa18dc30b072eef6626f96b262059497353e341c
Opcode Fuzzy Hash: 0de60b2cf6c2d4c71eb763cdab0da1e1a679de0a7a7d85e0e069a6bba7d1a8e5
Instruction Fuzzy Hash: D9F0A7332041001BE719AA29E8557FE7757EBC0620F48453AD8058BB44DE71AC4A46DA

Function 02EA6388 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4b7b3710f19f85180a27c76e65343a95b33b0bfa323b66ab925cc384bf3eb4
Instruction ID: 07171c9d15d1323172579726bbab4169f9e4ce154d3d710bad68bcb6ea99f6ee
Opcode Fuzzy Hash: 7a4b7b3710f19f85180a27c76e65343a95b33b0bfa323b66ab925cc384bf3eb4
Instruction Fuzzy Hash: 70F0B474D01209AFCF44EFB8E98679DBBF1EB55200F504169D404E7350DE715E459751

Function 02EA6398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732eb09f249110b24bee43c635a4c651fc30c5cc40f757863c5846a81357e978
Instruction ID: 037e910b3aebeceb98bf264ecfd33ed0bfc1b74de50d55d30e010fd6f05d34a7
Opcode Fuzzy Hash: 732eb09f249110b24bee43c635a4c651fc30c5cc40f757863c5846a81357e978
Instruction Fuzzy Hash: 47F08C70A40209AFCF40EFB8D98569DBBF1EB98200F5081A9D808A7354DE716E45DB51

Function 02EA2D92 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d3eb9b57329da3a1035ce76d4f8e002f6b55ce19ab61fb74d73311b1311f7cd
Instruction ID: e69a59fb4b701b6a9877b44195c43580a70ec75b73057dea6c44799b2d1d90c8
Opcode Fuzzy Hash: 0d3eb9b57329da3a1035ce76d4f8e002f6b55ce19ab61fb74d73311b1311f7cd
Instruction Fuzzy Hash: A5F08C72E100088F8B84EFBCD5452EDBBF0FB88315B6044BADA09E7710EB3089018B91

Function 02EA1FF8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c47a0fa3ef4a562714254b53ad229a0d92733ed014e478989b819becab6e6d1
Instruction ID: de75791a8c9374e47b262b7a6e8cd6df90910d642df279f4fd63230527b94017
Opcode Fuzzy Hash: 5c47a0fa3ef4a562714254b53ad229a0d92733ed014e478989b819becab6e6d1
Instruction Fuzzy Hash: 8EE026363101104FCB502679E44EADA7BEDEBC5121B100467F006CB720DD70CC0683A1

Function 02EA2DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6320364ec010c188b3cef00060e118b7471ac9f2787198ebeba78d271fb88bc9
Instruction ID: 65d36677f653c5da9a3d50265811d26b0eefb20478ea4e2edca7ec01d84ab40f
Opcode Fuzzy Hash: 6320364ec010c188b3cef00060e118b7471ac9f2787198ebeba78d271fb88bc9
Instruction Fuzzy Hash: CEE0E571E101188F8B84EFBDD5056DEBBF9EF49214B6180BAE619E7311EB709E018B91

Function 02EA37EE Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60c765918a5e307166d42f2f6c62d77e5f0f53c0c8850af9880eef0c584133a0
Instruction ID: 2ce6dd14e043da37377d7bac676651fbe08b7a2c46be90bbba740c7e4bd1219d
Opcode Fuzzy Hash: 60c765918a5e307166d42f2f6c62d77e5f0f53c0c8850af9880eef0c584133a0
Instruction Fuzzy Hash: 15D02B7771020057DB1446DAA9046B6639FDBC8235B084427FE08C3250EE759C065350

Function 02EA2008 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa183deb30050d0b4c0da4b40b523328afd98692b5cac0493bfb26221c47037a
Instruction ID: 7800548748c5efdfab2032160b102965d64e19c3ac81ff4897f64f914b506aca
Opcode Fuzzy Hash: aa183deb30050d0b4c0da4b40b523328afd98692b5cac0493bfb26221c47037a
Instruction Fuzzy Hash: 85D017357102149FCB546ABEE41D89ABBEEEFC962231104AAF50AC7320DE75DC0587A1

Function 02EA66C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fd5c8a62ff28b67401d61c6c312c24b935eb98453f2203d2f569917ba24299f
Instruction ID: a3917f2535f2601935113eed7a4eb2f8165ddb6a0ad4cc450977520e80aa4025
Opcode Fuzzy Hash: 3fd5c8a62ff28b67401d61c6c312c24b935eb98453f2203d2f569917ba24299f
Instruction Fuzzy Hash: F5D0A92230202023E600116CBC9ABDB26EEEFCAA22B5C013BF101E7308EDA08C0253A0

Function 02EA6469 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17af8a194b730634711ac8380eeace9e2796494963fb4e4b7b1daf94ff637e8
Instruction ID: 2084e784ea480dd3dfe43440caf8d3f75d5a3831aba9f8277d6104992aab82f8
Opcode Fuzzy Hash: f17af8a194b730634711ac8380eeace9e2796494963fb4e4b7b1daf94ff637e8
Instruction Fuzzy Hash: 06D05E752442004FC304972CD99699277FAEB8931175104A5E118CB376DD64EC828A59

Function 02EA6478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c7aeec35302ebc2dc4ec8411033eb2364e5f819569c42071390a65bfff188d8
Instruction ID: 44c90dcfd61b8a01e7f5daaf4e3fb77574cc147f10df9960c34c0d2a880a6315
Opcode Fuzzy Hash: 3c7aeec35302ebc2dc4ec8411033eb2364e5f819569c42071390a65bfff188d8
Instruction Fuzzy Hash: 8BC012343802044F8204DB5CD18581573EAFB8C71031004A4E519C7379CD60FC828A18

Function 02EA5640 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3340203465.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ea0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae0df64aa889688b2ede2ce22fe958d98e98cb0cb4f2eb5e3b6c010ae1105ae
Instruction ID: 5c189fa5d843a8641462a2a461437d93eb73e61e646bce0594c5aa8516a98d07
Opcode Fuzzy Hash: bae0df64aa889688b2ede2ce22fe958d98e98cb0cb4f2eb5e3b6c010ae1105ae
Instruction Fuzzy Hash: CEB02B3055420D5796020519EC0D5113B1DEB9001C7404195BC0804100AE23E4140080

Analysis Process: GamePall.exePID: 2188, Parent PID: 5644COMMON

Executed Functions

Function 027A4F58 Relevance: 11.9, Strings: 9, Instructions: 622COMMON

Download Yara Rule

Strings

(bq, xrefs: 027A51CD
(bq, xrefs: 027A5655
(bq, xrefs: 027A586F
(bq, xrefs: 027A5082
(bq, xrefs: 027A51F9
(bq, xrefs: 027A589B
(bq, xrefs: 027A55CF
(bq, xrefs: 027A55A3
(bq, xrefs: 027A5056

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq$(bq$(bq$(bq$(bq$(bq$(bq
API String ID: 0-1872187367
Opcode ID: bbc94c21d8731943c239025785222ac2cfb7cf44fc2879ea0f1014baee5ce848
Instruction ID: 0c7de76ad3f5f45f0ce60a1c82ea1936c230120b58f7fb131d703493fc6cc373
Opcode Fuzzy Hash: bbc94c21d8731943c239025785222ac2cfb7cf44fc2879ea0f1014baee5ce848
Instruction Fuzzy Hash: 8E327B30E002148FDB05EF69D4646AEBBF3EFC9311F248169E806AB395DB349D46CB91

Function 027A3860 Relevance: 4.4, Strings: 3, Instructions: 685COMMON

Download Yara Rule

Strings

(bq, xrefs: 027A3BA1
(bq, xrefs: 027A419C
(bq, xrefs: 027A3DE5

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: a08a0bfb99344e7a5e7ac2d4305b5e5217135f819414d460a24f30cc10d2c08c
Instruction ID: 02f95d8e3d95cb21b67aaf6722e8daf47ddcd4994e0b5fcc1eda61347e63c6d6
Opcode Fuzzy Hash: a08a0bfb99344e7a5e7ac2d4305b5e5217135f819414d460a24f30cc10d2c08c
Instruction Fuzzy Hash: FD425D34B402149FDB05EF79D864A6EBBB7EFC8310F148169E806A73A8DB35DC468B51

Function 027A3750 Relevance: 3.8, Strings: 3, Instructions: 88COMMON

Download Yara Rule

Strings

(bq, xrefs: 027A3820
(bq, xrefs: 027A37B2
(bq, xrefs: 027A3786

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: 05ea96586a1ee0c1acb2c91c57cbdb8bbc8c1d37b757ddea4b0401480f3bcfff
Instruction ID: 33f2117b2eb18b702f9b978a5e806d3fc8a7a7aacb581378a03d723f1a0d8a83
Opcode Fuzzy Hash: 05ea96586a1ee0c1acb2c91c57cbdb8bbc8c1d37b757ddea4b0401480f3bcfff
Instruction Fuzzy Hash: 3F212B25B051944FD71A7F3D581413F2BF7DBC6261358826AE806D77C5DE388D0B43A5

Function 027AB0B0 Relevance: 1.9, Strings: 1, Instructions: 680COMMON

Download Yara Rule

Strings

e1p^, xrefs: 027AB23E

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID: e1p^
API String ID: 0-2211693784
Opcode ID: b27740434584543141f2a3254db8536d773b31299de9bb54fe60d9faa85934cf
Instruction ID: 81218043055ea81545e87a60ca6e581ec30adf362384b6cc6231b3a8f75bf158
Opcode Fuzzy Hash: b27740434584543141f2a3254db8536d773b31299de9bb54fe60d9faa85934cf
Instruction Fuzzy Hash: 95523834A01201CFCB15EF38D9A856D7BB2FF84319B558669E4068B3A9DF75EC42CB41

Function 027ABEAF Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

Te^q, xrefs: 027ABF75

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: f52967fbd23272477f12b5b736534e5266b4e1c01fb3078c49795ccf789312d2
Instruction ID: 56edb47b3df4cec8112a92be390b41f3f33d7b2892ce3f359dba792e05d5fd27
Opcode Fuzzy Hash: f52967fbd23272477f12b5b736534e5266b4e1c01fb3078c49795ccf789312d2
Instruction Fuzzy Hash: AE416D347006048FC754DF2DC898A6EBBE6FF89710F2585A9E806DB3B6DA70DC058B91

Function 027A2B10 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

LR^q, xrefs: 027A2B35

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 030848910610e04480f4627f99e6fac30818c86f67683aed7db40e4a698cbbd4
Instruction ID: 6bd7529ae746a60cda1ea7e6f19e35ac9480695b495abb9c1d38d4fe868c18d1
Opcode Fuzzy Hash: 030848910610e04480f4627f99e6fac30818c86f67683aed7db40e4a698cbbd4
Instruction Fuzzy Hash: CE311C317112058FD709AB3AD454A5E33A3EFC9A19720816CE54ACF3A9DE35DC478B8A

Function 027ABEC0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Te^q, xrefs: 027ABF75

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: d64cd0b9c559707e685b959d92f9c00b469fb43bd785a8fa5f3809210e6b5016
Instruction ID: 61c63c15c37b9e78aa75aeed28123d4edd05605c2a04bc945f228148e6150ad0
Opcode Fuzzy Hash: d64cd0b9c559707e685b959d92f9c00b469fb43bd785a8fa5f3809210e6b5016
Instruction Fuzzy Hash: FA316E347006048FC744DF2DC498A2EBBE6FF89710B2585A8E806DB3B6CE71EC058B90

Function 027A2B20 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

LR^q, xrefs: 027A2B35

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 3c2c68f75859e0f4e7fb7a9702772760e4b67b74780775b68092f0744645cc3e
Instruction ID: 855f41e9ae8a32033d2d89d21aa023580c10f9eb7f7f3abb7b6eafbda1a0bd11
Opcode Fuzzy Hash: 3c2c68f75859e0f4e7fb7a9702772760e4b67b74780775b68092f0744645cc3e
Instruction Fuzzy Hash: 8F312E317102058FD709EB3AD454A5E33A3EFC9A19720816CE54A8F3A8DF35DC478B8A

Function 027A4248 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

(bq, xrefs: 027A4295

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 3f0c2bcff0b95c3ec485ab1d4084054797c3d1bc6aefcbfeda447e0f40f8d0b0
Instruction ID: 488e4be1879d7a9fea639709ccfe1d9f7a0537fb78431f55a3e8839c4d5d5923
Opcode Fuzzy Hash: 3f0c2bcff0b95c3ec485ab1d4084054797c3d1bc6aefcbfeda447e0f40f8d0b0
Instruction Fuzzy Hash: BE0168327082804FD30AAB7D682413E7B93EFC266134845AED841CF385CE65DD4AC7D5

Function 027A1049 Relevance: .8, Instructions: 840COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de5cd11b7951998520a7559b2f2e63ea57aecfab46b433d1f81c7d80da5ad8bd
Instruction ID: f49d2f72f8e24cba5500008be86a44d2765d1defaf6e147830c639dc3696d767
Opcode Fuzzy Hash: de5cd11b7951998520a7559b2f2e63ea57aecfab46b433d1f81c7d80da5ad8bd
Instruction Fuzzy Hash: 41828474640209DFDB06EBA4DA54B6E7B77EB88300F104814F801337ADCB76AD96DB66

Function 027A1058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38abe4fe3dca3c1fc7a8ec711cf2a845eee1731709ae52b97f4ff5ba54a26d7b
Instruction ID: 91fe3c2363eb3209aa8fe881d4a93724e32a3d19c0586dfa4706a5c08479c204
Opcode Fuzzy Hash: 38abe4fe3dca3c1fc7a8ec711cf2a845eee1731709ae52b97f4ff5ba54a26d7b
Instruction Fuzzy Hash: DC828474640209DFDB06EBA4DA54B6E7B77EB88300F104814F801337ADCB76AD96DB66

Function 027ABB99 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430effbd7cfb7e1799d4f3424e61207bd50ccbd0ac112f41b042696469c3a0fb
Instruction ID: 09217a68de109ef5cb59c59ea734ef261a925c88ad83122d780ba862d921e9b6
Opcode Fuzzy Hash: 430effbd7cfb7e1799d4f3424e61207bd50ccbd0ac112f41b042696469c3a0fb
Instruction Fuzzy Hash: 2D81E97850A105CFCB12EF28E999959BBB2FF84305F14D668E1058B3ADC775E88ACF40

Function 027A385B Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ab8c589df74d34f9ca17f597207881f88452a06c1f97e0ee46aa68de705949
Instruction ID: e68af26504e0f530c4a5260ab15aa5d2332f72a57382f6405145a13ebdf7619a
Opcode Fuzzy Hash: c7ab8c589df74d34f9ca17f597207881f88452a06c1f97e0ee46aa68de705949
Instruction Fuzzy Hash: 28611A74A11218EFDB05DFA8E994AAEBBB7FF88310F148159E805A7364DB35EC41CB50

Function 027A5AA0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b851fef448954896c6b98326c2d602e1ce4a4463f729c0da9d13d03c80024d3
Instruction ID: e84c64eae3e90c6bdbc8779a62efcaa2fbe3c6dea6a73d6da0470e3e68a5c9af
Opcode Fuzzy Hash: 1b851fef448954896c6b98326c2d602e1ce4a4463f729c0da9d13d03c80024d3
Instruction Fuzzy Hash: DD515D75B002068FCB04DF68D994A6EBBF6FF88315B514168E509EB365DB31EC05CBA1

Function 027A5240 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24383f27acadbbf99157a400f0ebbe7eee3b66b8675497850c9633bd203af77d
Instruction ID: dfd3a95f9723013e519c4ea0058cfab70b72f589001727e27f34e26e7cf7ef38
Opcode Fuzzy Hash: 24383f27acadbbf99157a400f0ebbe7eee3b66b8675497850c9633bd203af77d
Instruction Fuzzy Hash: 3E511D31E01218DFCB04DFA5D494AAEBBB3AFC8725F548169E805A7354DB749C42CF90

Function 027A2850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a486667050a1cd420473cde5f251798c23a39a5110adfe0f409ed2838ac16d
Instruction ID: 24effedebfce62d43a5ddb473bd298bb7867521973d56aaa65e7502f49e55296
Opcode Fuzzy Hash: c3a486667050a1cd420473cde5f251798c23a39a5110adfe0f409ed2838ac16d
Instruction Fuzzy Hash: 40412B70E00208DFDB04EFB5E994AEDBBB2FF88310F144229E805A7269DB759846CF10

Function 027A5A91 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08edf155390e863a35c8bfdb5205d7464da5c52b99c6ac1da6ad5f93414262f5
Instruction ID: ef38e6391af05e991a49f0d7c99033a2516186c4d7481b9ce6a4b0693ef3957c
Opcode Fuzzy Hash: 08edf155390e863a35c8bfdb5205d7464da5c52b99c6ac1da6ad5f93414262f5
Instruction Fuzzy Hash: 73317C75B006068FCB04DF68D994D6ABBF6FF88314B5181A9E509DB366DB30ED06CB60

Function 027AB0A0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61ef624bb733c063b8568be9a1300deb408002c61e9924db66e379e91aa6b00
Instruction ID: 264bd9fe096515282188776079060f0ff98d30ac863a1ebd5f00a5338bafa1f0
Opcode Fuzzy Hash: d61ef624bb733c063b8568be9a1300deb408002c61e9924db66e379e91aa6b00
Instruction Fuzzy Hash: CC310530A002048FCB05DB78EC9569DBBB6FFC5314F04866DE409DB3A5EFB5990A8B90

Function 027A2843 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ea85b29b80a6db106a88f22ef699b318ccbd00d6602105fab51c326f3f2b50
Instruction ID: f96ff1b62e3519926413455478ee06e9967d391c7e10038ffa92b013709c0890
Opcode Fuzzy Hash: e8ea85b29b80a6db106a88f22ef699b318ccbd00d6602105fab51c326f3f2b50
Instruction Fuzzy Hash: 93314F70E40208DFDB04EFB5E994ADDBBB2FF88310F144129D906A7269DB759946CB50

Function 027A5308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8764133825963cb312805ba291d9a3841c36a32d3961c3f0252e7c20577dab14
Instruction ID: ab4ff149d2f49339e1ed6de3fa84555267fa6cd04cd8204e902a52f3b86982b1
Opcode Fuzzy Hash: 8764133825963cb312805ba291d9a3841c36a32d3961c3f0252e7c20577dab14
Instruction Fuzzy Hash: 4D41E535E01114DFCB05EFA5E894AAEBBB3EF88715B508169F806A7364DB749C42CF50

Function 027A2C48 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7db4f74bb2277b8e99b0f6566f86c986b5b0bfc7635247de37f7257190bbe8
Instruction ID: f06b5529559135b96b6680cb27f8e50c40960c6ddb6abb19de73018cef553cfa
Opcode Fuzzy Hash: 7d7db4f74bb2277b8e99b0f6566f86c986b5b0bfc7635247de37f7257190bbe8
Instruction Fuzzy Hash: FA415E74900209CFCB05EFB8D994AEEBBB2FF48314F104169E805A7369DB759986CF91

Function 027A4B5E Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed95f4a5b3ff11563d4aa493418c23f3d82a7c3d94eaf1f3c2d5c154080f6ca2
Instruction ID: dc2d05c60cefd650537190e7e03ea0e6c0e443b97d2b303dc0f15963844cef3e
Opcode Fuzzy Hash: ed95f4a5b3ff11563d4aa493418c23f3d82a7c3d94eaf1f3c2d5c154080f6ca2
Instruction Fuzzy Hash: A821A3302042455FC706EF78E89095DFBA3EBC1350B048A39D4158B7A9DB70ED4E87A5

Function 027A2C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f5bc22068bbeb51b13410a7bbe979886d551f10965481cf0cbf0084c9e363e3
Instruction ID: 88a0edd084f3e1a63a74d843d78747fdd4c2b8ea76daf4762b7ffb30d08a07a7
Opcode Fuzzy Hash: 9f5bc22068bbeb51b13410a7bbe979886d551f10965481cf0cbf0084c9e363e3
Instruction Fuzzy Hash: 8E311D74900209CFCB05EFB4D994AEEBBB2FF48314F104129E905A7368DB759986CF91

Function 027A5698 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2b263229bf95bf2cfc984f5ccc5c3c2f5351dfd584a244e325fa8ccab62d6f
Instruction ID: 62e7b21fa79bc474dfe235e813c4c6b1fa074995ea79b3c28dfed890a71d9f90
Opcode Fuzzy Hash: eb2b263229bf95bf2cfc984f5ccc5c3c2f5351dfd584a244e325fa8ccab62d6f
Instruction Fuzzy Hash: 5D218B70B012048FCB18DF29D598A6EBBFAAFC8611B644069E806E7364CF70ED05CB50

Function 027A5C41 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09aa75982f1579b3a83966e54aad26977da5f9b20d8ffabfd6b16d86ade0c10c
Instruction ID: 2b9307e432e590c305cceceab81758fc91d43c1cfb8b876a9377da2c909daae0
Opcode Fuzzy Hash: 09aa75982f1579b3a83966e54aad26977da5f9b20d8ffabfd6b16d86ade0c10c
Instruction Fuzzy Hash: 9A21AFB1E042488FDB01CBA5C5A8ADCBFF1EF49310F2541A9D442BB366DB399D46CB60

Function 027A4B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4134f6a24c1385d6d5a3449c1b19e9f0c038b1905e2d2e47cda75b71b75beab
Instruction ID: d1155100d99d03c7075f3a00403d5a134ef967d7428181f935cfccad4e81c7da
Opcode Fuzzy Hash: a4134f6a24c1385d6d5a3449c1b19e9f0c038b1905e2d2e47cda75b71b75beab
Instruction Fuzzy Hash: 9A2165302402055FDB05EF7DE94096EF797EBC03507044A28D8158B369DF71ED4E8BA5

Function 027A6888 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47305c76136045339322316dd40e3f859550af351a2e14e356ba75f042fc48b5
Instruction ID: 71af1434f57954f8da83fe92f66556f2ace7de783c67c6f0337f3c72c7b54ac8
Opcode Fuzzy Hash: 47305c76136045339322316dd40e3f859550af351a2e14e356ba75f042fc48b5
Instruction Fuzzy Hash: 0221B171D00205CFEF18CBA4C9697EEBBFABF84314F198169C006B7251DB758A46CB51

Function 027A5C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb0b593b5b3aa781c633069b49461fcc523d94144b9b0f2bba2ba90a165355b
Instruction ID: 8de30215a750d761a4fd6781adf4de5a04c83e76d378acb4e6f323599f915b79
Opcode Fuzzy Hash: dbb0b593b5b3aa781c633069b49461fcc523d94144b9b0f2bba2ba90a165355b
Instruction Fuzzy Hash: ED215B75E002198FDB10CBA9C598BDDBBF1AF8C320F6001A5E505BB364CB759D44CBA0

Function 027A41A2 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2755b3564b50be155e914718a731c803d279e67365876bb4c18669a033cc2a29
Instruction ID: 3e12d5d89ece92ffd8d7e5f07a6413729bc6be6d6246084d5ab02a42775484d1
Opcode Fuzzy Hash: 2755b3564b50be155e914718a731c803d279e67365876bb4c18669a033cc2a29
Instruction Fuzzy Hash: 470145207092C41FD70A6B79586006E3FABDFC215131840ABD805DB393CE214D0BC375

Function 027A32E0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e32db2543fa78bc274b8a2313dc4028e2aac5157ebdebc2fd3ecd91ae2e5e8b7
Instruction ID: ce8a1fa79b6c788d538bab93d1ad48f94bdaecc74a9fdb7b16ce2390e5505466
Opcode Fuzzy Hash: e32db2543fa78bc274b8a2313dc4028e2aac5157ebdebc2fd3ecd91ae2e5e8b7
Instruction Fuzzy Hash: EC112A34A062889FDB05FFB4F95879EBBB3EBC8311F004429D80697282DB794806CB51

Function 027A5940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 675f40764de56b07473cb56a12ace7202a6ee78933387c5916250e196c5bf59f
Instruction ID: f6b7bf87c19eea9dd4b01ce478b5c93082e94d659ed87ade30aa4944520f2ff6
Opcode Fuzzy Hash: 675f40764de56b07473cb56a12ace7202a6ee78933387c5916250e196c5bf59f
Instruction Fuzzy Hash: 370181763412149B8704AA7DF49491AB7ABEBC96A6314857AFA05C7350CB31DC0687A0

Function 027A2A80 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb97b3fa5494811e17df938167611347772d9d6130b7f40266f1e7064adb4f8
Instruction ID: 623593ea7a9c93c6cc6157ff7ef00a78e4fad766a78e80b607db4cce6b2ece78
Opcode Fuzzy Hash: dfb97b3fa5494811e17df938167611347772d9d6130b7f40266f1e7064adb4f8
Instruction Fuzzy Hash: 48019A746103008FC712AF38C41985BBBE2EF816143258AAAD49ACF766DB30EC098BD1

Function 027A32F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88fedca86d60a0d4a60eaebd06366ae23491e4b1c4feedb8bf78679f50d52f61
Instruction ID: 12acd4039392b94e6d9f4ae100022891ddba3573370c32a40f2ada90b50ad458
Opcode Fuzzy Hash: 88fedca86d60a0d4a60eaebd06366ae23491e4b1c4feedb8bf78679f50d52f61
Instruction Fuzzy Hash: 68011734A062489FCB44EFB4F868B9EBBB3EBC8311F004429D802A7381DB795C05CB51

Function 027A2A90 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39582de737e840dcaafc9a0357e7faf9c07773efe239b1247167a4427f1b002c
Instruction ID: 6d8ff62f659714a1f02f74aff5caf482428e86d0689b105069864fe5d2d1946b
Opcode Fuzzy Hash: 39582de737e840dcaafc9a0357e7faf9c07773efe239b1247167a4427f1b002c
Instruction Fuzzy Hash: 0AF069716107048FC710AF3CC41885FBBE2EF8566431189A9E95ADF765EB31ED088BE0

Function 027A4237 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba1a45342046dd5300088fd5df480dde3b04c379df9bd686bbcb9af74d716e8
Instruction ID: f32251ca6e3faa1d4743816f6eb4385ba74a66f6ffe70bf80aac92d0dc6fa830
Opcode Fuzzy Hash: 9ba1a45342046dd5300088fd5df480dde3b04c379df9bd686bbcb9af74d716e8
Instruction Fuzzy Hash: BAF027322042400FC3169B79E9509AE7F63EFC1610B08457DD8458FB56CE719D8B87D6

Function 027A5610 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28b015d9498647c5abc2e3f4db9b9c3d932e8a9b345e70ba3c09f1945507ca2c
Instruction ID: 65c038d03e5011f295f8baf5784c46554da1ff4189789f3bae658ba06e308fae
Opcode Fuzzy Hash: 28b015d9498647c5abc2e3f4db9b9c3d932e8a9b345e70ba3c09f1945507ca2c
Instruction Fuzzy Hash: E8E08691A0A2415FE3030634ECE71C07F35EE6365831B81D6D488C6513E91E885B4751

Function 027A6388 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18ab486fe58660501fdf1a9d54d7268232ada1e488873d1ee1ef1fae4d15224
Instruction ID: 9c731eff6ed0b56c88829c4b043ac4d2bf60697134e79148f14750373b1aa8b8
Opcode Fuzzy Hash: b18ab486fe58660501fdf1a9d54d7268232ada1e488873d1ee1ef1fae4d15224
Instruction Fuzzy Hash: D3F0F674D04208AFDF04EFB8E95159CBBB2DF45200B1182A9D808A7281DA309F07DB51

Function 027A593E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f98a62a1caa286dea3e55f45b3276167dcf51ec21fe5bc40d1d046c682c9dc6
Instruction ID: 83f54be31594e242861fa894093d7bc6f2380218cacc8966831d20e79fdd71b4
Opcode Fuzzy Hash: 0f98a62a1caa286dea3e55f45b3276167dcf51ec21fe5bc40d1d046c682c9dc6
Instruction Fuzzy Hash: 6EF05E763012109F8705EF29E49495AB7ABEBC96A5315817AF909C7354DB71DC02C7A0

Function 027A41E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d9cbdbed791c2b2407fa0901db010f395bf2879175bc766da335c1fac9f88f9
Instruction ID: 3f8e66247f3819cecb4061147201d14117a22971022e736df95b504522a83f83
Opcode Fuzzy Hash: 6d9cbdbed791c2b2407fa0901db010f395bf2879175bc766da335c1fac9f88f9
Instruction Fuzzy Hash: F0E0EC717042082F5B086AAD785197FB69FEBC51517540429F809D7380DF216D054775

Function 027A6398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed421a0238f169faef363103099b11317307f8dbbf8bea7e7bbd6656319b8d80
Instruction ID: e4bcbd76e59502a3c2834a99a91795e3512c783aa57ae92cd41e5c214eba798b
Opcode Fuzzy Hash: ed421a0238f169faef363103099b11317307f8dbbf8bea7e7bbd6656319b8d80
Instruction Fuzzy Hash: E9F08230E4020CEF8B04EFBCE95159DBBB6DB84200F5046A8A808A7380DA316F05DB51

Function 027A2D9B Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e8f322111c0fe2c0c9838aadf164fc5bce693e4299695dcfcb74a6f8a831248
Instruction ID: 481aeb073692328656f9457715227d8ae1652a7828fde95bb0f081d23dcccfa2
Opcode Fuzzy Hash: 7e8f322111c0fe2c0c9838aadf164fc5bce693e4299695dcfcb74a6f8a831248
Instruction Fuzzy Hash: 96F03071E100188F8B84EFBCD4055DD7BF5EF48210B104066D519E7341EB708E028B91

Function 027A1FF8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c734ffcee174b838d61a43b23aaa9442588db6d23e3a77d4c4e68d2a57aede
Instruction ID: c6102a056429694d0d98b4be1732868226c4b83527136324f1f4ce7cfcde71d2
Opcode Fuzzy Hash: a8c734ffcee174b838d61a43b23aaa9442588db6d23e3a77d4c4e68d2a57aede
Instruction Fuzzy Hash: DCE09A357092944FC7225BBAA4288993FE6DF8B52530A04EEE08ACB322CD65CC07C751

Function 027A2DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d974c9c76f57c415c7819149c37c55355a1f82c3d7463217add9d899b5ad9ae
Instruction ID: f17e1b587314ac3c94ee30e0e4e334dfaa20e103a9fd7b33c62d2fbc7d626cb4
Opcode Fuzzy Hash: 7d974c9c76f57c415c7819149c37c55355a1f82c3d7463217add9d899b5ad9ae
Instruction Fuzzy Hash: 78E06D71E101188F8B84EFBDC4056DEBBF5EF48310B1040AAD919E7301EB709E018BA1

Function 027A374E Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a2a74deb11505bc2691e79893f761b7c521ece5c2cba054c963337d2c89132
Instruction ID: ef4bed6b088f33355cdd84fe49298a3f5eb1104152882a3aefa932e223fd2365
Opcode Fuzzy Hash: 39a2a74deb11505bc2691e79893f761b7c521ece5c2cba054c963337d2c89132
Instruction Fuzzy Hash: 57E0C236B011141783299A26B4546BA27A7DBC86B17188035ED0DC330CEF608C4743D1

Function 027A2008 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96280447774c143b00769dce2ea10c68d0a7c043483c3c848cec1407ecd0ad62
Instruction ID: c32104fbfe7b8973c48139bc91a95d29f7223b2933f7b5adb1f3b9902a8359e5
Opcode Fuzzy Hash: 96280447774c143b00769dce2ea10c68d0a7c043483c3c848cec1407ecd0ad62
Instruction Fuzzy Hash: 79D017367012189FCB146ABEE41885A77EAEFC966234104AAE50AC7324DEB9DC0187A1

Function 027A66C8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87d63d7c7d77dc1506f94f5e651ea5308808ccca9e139c7e1c979b2b6c9d2ed9
Instruction ID: afcb1c0ffa4be153a1d08a7d8d50019c649ee815f9bf93421b76012d8033776e
Opcode Fuzzy Hash: 87d63d7c7d77dc1506f94f5e651ea5308808ccca9e139c7e1c979b2b6c9d2ed9
Instruction Fuzzy Hash: 57D0A736F455641FD746263C34110F867D3DECA55130A006BF649FB397CD198D074391

Function 027A6469 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4cf4e19a79da88a28698da78bfd9b0886060377a9d5cbb8ead9f4feb48b5596
Instruction ID: 5f0ba74cb7dd33a11b76619c7c83c827ac1140c57adb2fba0049c0fa4f745663
Opcode Fuzzy Hash: b4cf4e19a79da88a28698da78bfd9b0886060377a9d5cbb8ead9f4feb48b5596
Instruction Fuzzy Hash: 26D0A7B67882004FD308EB68E8824607BB7EB8D71470504B5E62DCF379CD20DC838755

Function 027A6478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5947a92b2a3a271231314b3a166528f49926da4182e4319308b16632d91b331
Instruction ID: a93c9b69c231ea9e9c16c7d7a099ee1953f3e7b17781d06c95d6130873da4fea
Opcode Fuzzy Hash: b5947a92b2a3a271231314b3a166528f49926da4182e4319308b16632d91b331
Instruction Fuzzy Hash: FFC012753842044F8208EB5CD44081577EAEB8C71431000A4F519C7339CE21FC828658

Function 027A5640 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3347091226.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_27a0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f260312e4fb357450f877e355e5aba0ac8da12b05b97556ad8cf8e074ab88430
Instruction ID: 37148ed5cc9756fae83548dd5649d124f5f64987c473027488bc69f5cbfc224d
Opcode Fuzzy Hash: f260312e4fb357450f877e355e5aba0ac8da12b05b97556ad8cf8e074ab88430
Instruction Fuzzy Hash: 09B02B3090020D5786000529BC0C511371EEB905293400294AC0800100EE23C8100084

Analysis Process: GamePall.exePID: 6120, Parent PID: 5644COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	32
Total number of Limit Nodes:	2

Executed Functions

Function 00AAD3E0 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00AAD46E
GetCurrentThread.KERNEL32 ref: 00AAD4AB
GetCurrentProcess.KERNEL32 ref: 00AAD4E8
GetCurrentThreadId.KERNEL32 ref: 00AAD541

Memory Dump Source

Source File: 00000010.00000002.3975451228.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_aa0000_GamePall.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: eb0250c71e49b4c7a6b272087d048eb1bc5e29d79633965b643975acf8adda15
Instruction ID: d1eb5b30b2c58316d801b137eab5074f4a434b97466f5fd826adb0ce656db02c
Opcode Fuzzy Hash: eb0250c71e49b4c7a6b272087d048eb1bc5e29d79633965b643975acf8adda15
Instruction Fuzzy Hash: 3B5177B09003498FCB14CFA9D588BDEBBF1EF49304F208459E489A73A1C774A949CF65

Function 00AAD3F0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00AAD46E
GetCurrentThread.KERNEL32 ref: 00AAD4AB
GetCurrentProcess.KERNEL32 ref: 00AAD4E8
GetCurrentThreadId.KERNEL32 ref: 00AAD541

Memory Dump Source

Source File: 00000010.00000002.3975451228.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_aa0000_GamePall.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 747c78b90d1fdc5bb7123d5021c665474716e6c1a5dc40c918f43b61c169e9e6
Instruction ID: 601bf6a2056be4709e77f4aca95c8b06d48571b1548e9300e1329f83f42f479b
Opcode Fuzzy Hash: 747c78b90d1fdc5bb7123d5021c665474716e6c1a5dc40c918f43b61c169e9e6
Instruction Fuzzy Hash: FC5125B0A003098FDB14DFAAD548BDEBBF1FB49314F208459E459A73A0D774A944CF69

Function 00AAD630 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00AAD6BF

Memory Dump Source

Source File: 00000010.00000002.3975451228.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_aa0000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 804c5f4aea94930dc5b36d09e9cc8ce22c46994c4a7eb34a11fbfa7017c0f89f
Instruction ID: fc36403c6ee279a73208cce40910bbadd32eb8f2be0d5db2d6d00d0e36612105
Opcode Fuzzy Hash: 804c5f4aea94930dc5b36d09e9cc8ce22c46994c4a7eb34a11fbfa7017c0f89f
Instruction Fuzzy Hash: 082114B5D002489FDB10CFAAD484AEEFFF4EB48320F14801AE858A7350D378A955CF64

Function 00AAD638 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00AAD6BF

Memory Dump Source

Source File: 00000010.00000002.3975451228.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_aa0000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 36b34c68c210bf7182c1ae31ab66bb2830cd732b5b78b615d4645f9158ab7484
Instruction ID: b59b49f7a062dca3e61a89bf160f5d2de6211241a653a632ba484594bc6fcbb7
Opcode Fuzzy Hash: 36b34c68c210bf7182c1ae31ab66bb2830cd732b5b78b615d4645f9158ab7484
Instruction Fuzzy Hash: 2121E4B5D002189FDB10CF9AD584ADEBFF4EB48324F14841AE958A3350D374A954CFA4

Function 00AAD1C8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 00AAE090

Memory Dump Source

Source File: 00000010.00000002.3975451228.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_aa0000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 92ada5351e963a00213663d1f3ec729ce072735e01c1e172d4e944a652af67a1
Instruction ID: 6e1ada6a9af6b62e0c8b810f37d28e96cf74ab65762fbeeedac6fbe97c96cb88
Opcode Fuzzy Hash: 92ada5351e963a00213663d1f3ec729ce072735e01c1e172d4e944a652af67a1
Instruction Fuzzy Hash: 88218C759003488FCB10DF9AC444BDEBFF4EF49320F10846AE558A7251D378A944CFA5

Function 00AAE020 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 00AAE090

Memory Dump Source

Source File: 00000010.00000002.3975451228.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_aa0000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: ea33c124e2ff792fddfa0aa3b231560432da42435326ea44cebe421204f0ac5c
Instruction ID: 6d144fda87177110e895a242643fdb7e5d7575b15aa349376834251ffe1d511c
Opcode Fuzzy Hash: ea33c124e2ff792fddfa0aa3b231560432da42435326ea44cebe421204f0ac5c
Instruction Fuzzy Hash: 9F1146B5900249CFDB20CF9AD844BDEBFF4FB48320F208429E558A7651D379A945CFA4

Function 00AAD1D4 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 00AAE090

Memory Dump Source

Source File: 00000010.00000002.3975451228.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_aa0000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 83ed30b7692485792eb245d0da048995a3b86d0091bfa696d47be292b86309f1
Instruction ID: c3412c174208c8a197057fbdb80da011458e2c664da2173d697f1e454ffb3c27
Opcode Fuzzy Hash: 83ed30b7692485792eb245d0da048995a3b86d0091bfa696d47be292b86309f1
Instruction Fuzzy Hash: D61146B5900649DFCB20DF9AC844BDEBFF4EB48320F208429E558A7251D379A944CFA4

Analysis Process: GamePall.exePID: 6404, Parent PID: 5644COMMON

Executed Functions

Function 02FC4F58 Relevance: 11.9, Strings: 9, Instructions: 611COMMON

Download Yara Rule

Strings

(bq, xrefs: 02FC55A3
(bq, xrefs: 02FC51F9
(bq, xrefs: 02FC55CF
(bq, xrefs: 02FC5082
(bq, xrefs: 02FC51CD
(bq, xrefs: 02FC586F
(bq, xrefs: 02FC589B
(bq, xrefs: 02FC5655
(bq, xrefs: 02FC5056

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq$(bq$(bq$(bq$(bq$(bq$(bq
API String ID: 0-1872187367
Opcode ID: ca7455f292880675bc668f3639f804c0ed29bca9843ffaa4fd8f331ba3ad430e
Instruction ID: 77e726f931eb8fe2dd8a528c84e09a4991f6a7afd676f4373c30be18f64e6fd2
Opcode Fuzzy Hash: ca7455f292880675bc668f3639f804c0ed29bca9843ffaa4fd8f331ba3ad430e
Instruction Fuzzy Hash: 9A327D30B002168FDB14DF69D954AAEBBF2AF89751F64806DD506EB390DF34AC42CB91

Function 02FC3860 Relevance: 4.4, Strings: 3, Instructions: 680COMMON

Download Yara Rule

Strings

(bq, xrefs: 02FC3BA1
(bq, xrefs: 02FC3DE5
(bq, xrefs: 02FC419C

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: 82bc19f2af5e3c269a58ee624556f91a2baf90b055b2836c5896aabd6e0152ef
Instruction ID: 8f5c4c360984a769f42399bf85f30bf869aaff301ccacd0165c4cc291ab02f94
Opcode Fuzzy Hash: 82bc19f2af5e3c269a58ee624556f91a2baf90b055b2836c5896aabd6e0152ef
Instruction Fuzzy Hash: 7E42A034B00215DFCB05DB69D994AAE7BBBEF88340F20846DE506A73A4DE35DC46CB51

Function 02FC1049 Relevance: .8, Instructions: 845COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850673a504fbf88350394e6c1661c0024615eb328f0382bda7fd4eb280350e2f
Instruction ID: 6be76da41b01e758962e252e7a08e24913dfba4564025393f4cd74e6564c4eb0
Opcode Fuzzy Hash: 850673a504fbf88350394e6c1661c0024615eb328f0382bda7fd4eb280350e2f
Instruction Fuzzy Hash: 7382D075640309DFDB06DBA5D654BAE7B7BEB88300F204454E801337A8CA3AADD5DF26

Function 02FC35F0 Relevance: 3.9, Strings: 3, Instructions: 161COMMON

Download Yara Rule

Strings

(bq, xrefs: 02FC36B6
(bq, xrefs: 02FC3786
(bq, xrefs: 02FC37B2

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: dcb16ffe6eac89ea882bcd1e9dccb3d1533a28e6474bfe5c111ec145dbf88188
Instruction ID: 87443f9d852905153ceeac3d64cfee6c4c5812f3ac11701907b0f9b608ec8923
Opcode Fuzzy Hash: dcb16ffe6eac89ea882bcd1e9dccb3d1533a28e6474bfe5c111ec145dbf88188
Instruction Fuzzy Hash: 8041F431B041154FE71CBA399C5063E2AEBEBD56A07688ABCD506CB394DE34DC078796

Function 02FCBEAF Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Te^q, xrefs: 02FCBF75

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 843ea6c41392be50b1aa18246cda132b32db42fa73ab1483c0d5f3f01f63319a
Instruction ID: 5cc662f5d514b133e3e3bba1fb068c96673da68e9a211b481aff66989ba4e693
Opcode Fuzzy Hash: 843ea6c41392be50b1aa18246cda132b32db42fa73ab1483c0d5f3f01f63319a
Instruction Fuzzy Hash: C8416B347002118FC758DF29C998A6EBBE6BF89710B2585A9E406DB3B5CA71DC018B90

Function 02FC2B10 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

LR^q, xrefs: 02FC2B35

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: b4a64fcde8e06ac8cda101a4b438ea7e0b19017d4d71e40a5706cc2505916ee0
Instruction ID: daeccd9adb57a69a66e67f80b184fd20dc913919b7c475f3330ac57eced9186c
Opcode Fuzzy Hash: b4a64fcde8e06ac8cda101a4b438ea7e0b19017d4d71e40a5706cc2505916ee0
Instruction Fuzzy Hash: 68312831720205CFD7099B3AC45496E37A6EBC9A0872080BDD54A8F3A4DE359C438B8A

Function 02FCBEC0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Te^q, xrefs: 02FCBF75

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 2f865d07de78d47d692aa6c4bb510b385c63b6151017df0b9823f8a9ef4c677c
Instruction ID: 26ad463a60bb5bcb2bb79cfabb0db5f4fea84f0cf448c93797044dd7e845c7c7
Opcode Fuzzy Hash: 2f865d07de78d47d692aa6c4bb510b385c63b6151017df0b9823f8a9ef4c677c
Instruction Fuzzy Hash: 66315E347002158FC754DF2DC998A2EBBE6FF89710B2585A8E506DB3B5CA71EC018B90

Function 02FC2B20 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

LR^q, xrefs: 02FC2B35

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 843cd566ac0250594d7cccada19482d96cf688c00978b7b273b3608efddab373
Instruction ID: 000c4712070005cfcd3aab0ed26e67085f106d5e74e212d4ad1866af9d515b63
Opcode Fuzzy Hash: 843cd566ac0250594d7cccada19482d96cf688c00978b7b273b3608efddab373
Instruction Fuzzy Hash: 1A311875720215CFD7099B3AC45496E37A7EBC9A1872081BDD14A8F3A4DE39DC438B8A

Function 02FC4248 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

(bq, xrefs: 02FC4295

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: c8b4661efd77ca2f3cdfc4a6d4ac279a62ce46f41c2a8718284811371bd99912
Instruction ID: 0a07d6e37898a668ada08da4255195de4f89ced5a1657c098e19dccd13b9877e
Opcode Fuzzy Hash: c8b4661efd77ca2f3cdfc4a6d4ac279a62ce46f41c2a8718284811371bd99912
Instruction Fuzzy Hash: DD019C327081904FD30AAB7D582417E3FA3EFD265135845AEC446CF345CE249C4AC7D5

Function 02FC37F0 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

(bq, xrefs: 02FC3820

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: a8b2cb80e19c38f7eae1ccbba620e99755cd9b4651fb16e4aae477e2a47d9a2b
Instruction ID: f232c745ec111763e9afe9b4a7b244a3cc3ce03eeec1637c1198c77168d54ed6
Opcode Fuzzy Hash: a8b2cb80e19c38f7eae1ccbba620e99755cd9b4651fb16e4aae477e2a47d9a2b
Instruction Fuzzy Hash: B1F059327042605BE7096B7A581493E3AEBDBC5220728826DEA06C73C0DD658C068391

Function 02FC1058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b75e0411349286da19caa486af97f6d508016821bcb499624f3d75044b1f39c
Instruction ID: 2801a9d2d9b2b2940904aaa70a708a964d1a9b046e5ab2a6f073dd210c33ffc8
Opcode Fuzzy Hash: 1b75e0411349286da19caa486af97f6d508016821bcb499624f3d75044b1f39c
Instruction Fuzzy Hash: 7D82D075640309DFDB06DBA5D654BAE7B7BEB88300F204454E801337A8CA3AADD5DF26

Function 02FCB0B0 Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025090a6f69c4766dd7cb313e15160e357ae4dd3b8c30ef8084c986fe4c82c1a
Instruction ID: 426746af83281056e040b3843c2993c662f53fe5a65014f0f3f94e189dbaf342
Opcode Fuzzy Hash: 025090a6f69c4766dd7cb313e15160e357ae4dd3b8c30ef8084c986fe4c82c1a
Instruction Fuzzy Hash: 78528738A10305CFCB19EF25D6489A97BB6FF88349B64846CD91A8B365DB35DC86CF40

Function 02FCBB9F Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf860bce83033623eeffb707446f84a2b0c96bfbfa32a5f731dc540c0b1d4ab
Instruction ID: bbe393588999b683b8fde307f6818b9a18d54238bc8a8f9aa57b89267377fc2f
Opcode Fuzzy Hash: dcf860bce83033623eeffb707446f84a2b0c96bfbfa32a5f731dc540c0b1d4ab
Instruction Fuzzy Hash: BA814C7495230ACFC301DF15E689D99BBB6FB40385B64D569CA258B329C778EC8ACF40

Function 02FC385B Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e6592d5ef914669ded57f1899d8f24c068d7df78a3b58e7365760f3496ebca
Instruction ID: 840c50017c6a081418653b97e102ea823668c0dfce852f8ba0e3da3a9ee37258
Opcode Fuzzy Hash: b2e6592d5ef914669ded57f1899d8f24c068d7df78a3b58e7365760f3496ebca
Instruction Fuzzy Hash: F351F974A11219EFCB05DFA9E994A9DBBB7FF88350F208068E905A7364DB35EC41CB50

Function 02FC5AA0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd67757f7b3c90dfb81942fd79c191d0d95cbfae6c6c7edaeeb58550758830d3
Instruction ID: c55ccc3db031063658643286bec616b06a397f88c352e2e4fcab412c379a69a4
Opcode Fuzzy Hash: fd67757f7b3c90dfb81942fd79c191d0d95cbfae6c6c7edaeeb58550758830d3
Instruction Fuzzy Hash: A2512D75B002068FCB04DF69D99496EBBF6EF88314B6141ACE50AEB361DB30EC45CB60

Function 02FC5240 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbfc104069adda1af03d8dfc15b16adf7e5582c45fef02821a8959518f4e9b11
Instruction ID: 33b1931e168810a0ae4957c65a41e593cd383e827e2413e1ce41e2f86839f657
Opcode Fuzzy Hash: dbfc104069adda1af03d8dfc15b16adf7e5582c45fef02821a8959518f4e9b11
Instruction Fuzzy Hash: 2A514835E00219DBCB04DFA5D684AEDBBB2EF88355F648469E905B7354DB34AC41CB90

Function 02FC5A91 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac1567ba70ab05654c62f025ab18bdf10dd5328d97743ed58f78c7fdb81b8d86
Instruction ID: 8c2af80e8c7c7e5debacdc16e027899c0e286c036fc0f1e89426f4ce9a4ce123
Opcode Fuzzy Hash: ac1567ba70ab05654c62f025ab18bdf10dd5328d97743ed58f78c7fdb81b8d86
Instruction Fuzzy Hash: 17414F75B002068FC704DF69DA94D6ABBF6EF88314B6141ADE509EB361DB70EC45CB60

Function 02FC2850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02e0e7bb6aef6df085866f920cd04a9573b3317f5618bb89c48078fe3c65d102
Instruction ID: 91ae3eee6b26f45fb8f55b72e1ba83bcf9386e1ef26845895c571096aa8ccdf2
Opcode Fuzzy Hash: 02e0e7bb6aef6df085866f920cd04a9573b3317f5618bb89c48078fe3c65d102
Instruction Fuzzy Hash: 6E410534A10209DFDB14DFA5D9849DDBFB6FF88340F20452DDA05A7264EB34A885DF50

Function 02FC2C48 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f6d7c5d4389541d6072e1f6527af7df10b4004a3721ace24a198f664ca208c1
Instruction ID: 8223317530510da1a4b2334616b5fca1af13ec506476d7d3b69f4f8f30557884
Opcode Fuzzy Hash: 5f6d7c5d4389541d6072e1f6527af7df10b4004a3721ace24a198f664ca208c1
Instruction Fuzzy Hash: BD418B7490030ACFCB01CFA5E9855EDBBB6FB48314F204169D905A7390EB34AD86CF91

Function 02FC2843 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a83bee95bef26adda85774c32b07de1411957533f65fb32121297fe425f155
Instruction ID: ce2960b323b466f9531e320432957b414025986de7bcf11536a03179a44b939d
Opcode Fuzzy Hash: 67a83bee95bef26adda85774c32b07de1411957533f65fb32121297fe425f155
Instruction Fuzzy Hash: DA312930E10209DFDB14DFA5D584AEDBFB6FF88340F20452DDA01A7264EB359885DB50

Function 02FC5308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d95157e68a5c098b9f1d5774380a47f13619b0067108468d145b7cf7f89560e8
Instruction ID: b314c4ec31960133c6adb235c19f1a06a1cfb63a8e7c991a9b8c9c1beaaa634c
Opcode Fuzzy Hash: d95157e68a5c098b9f1d5774380a47f13619b0067108468d145b7cf7f89560e8
Instruction Fuzzy Hash: C0412B74A10215DFCB04DF65E9949ADBBB3FF88345F608469E906A7360DB34AC42CF50

Function 02FC4B50 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54d7c16ed67a7a7a866d4a829ebddc4c49d7fd2d4b74565a6f5a789db328d6be
Instruction ID: 39a66ef917006998bc11fbe322d76f1b21445059a474adb05159578641625364
Opcode Fuzzy Hash: 54d7c16ed67a7a7a866d4a829ebddc4c49d7fd2d4b74565a6f5a789db328d6be
Instruction Fuzzy Hash: F92104302043425FC71AEB38ED9465EBFA7EFC0210B448A6DD01A8F765DB60AD8D87A5

Function 02FC2C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0035073128b0d454a2a6acba8de9987771bc236516665cd656879f3c6a05491f
Instruction ID: 700feb13e47f15c9e3d0aad910ef6d674a154ea4afba916172c5904777c492be
Opcode Fuzzy Hash: 0035073128b0d454a2a6acba8de9987771bc236516665cd656879f3c6a05491f
Instruction Fuzzy Hash: DF31377491030ACFCB04DFA9E5859EEBBB6FB48310F104129D915A73A4EB34AD85CF91

Function 02FCB0AB Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9e5519b53b8599fc9de5a1a73d1f32a4577c51c3c1a169c0119f1bee4df7a7
Instruction ID: 567fe1b19ddedb3c33cf8298071243b8010d8e50a80e1948c85d71977bafc001
Opcode Fuzzy Hash: ad9e5519b53b8599fc9de5a1a73d1f32a4577c51c3c1a169c0119f1bee4df7a7
Instruction Fuzzy Hash: 1B21D230A002198FCB04DB79D98569DBBF6FF84354F50863DD11A9B394DF719C498B90

Function 02FC288D Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a9b19952449511afe770790bebd8be5697dd764587da2c48647df6fbc170b9
Instruction ID: c2b8e32b0f7eb3fd5942c5e1fc2b52c88e8fcada2616d66fc37d9e57f5aa41fe
Opcode Fuzzy Hash: c5a9b19952449511afe770790bebd8be5697dd764587da2c48647df6fbc170b9
Instruction Fuzzy Hash: B131F930E10209DFDB14DFA5E5946ECBFB6FF88341F24812DD906A7264DB349885DB10

Function 02FC5C43 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1a59eaaa3c7d23bd9aaba2f6c0d61f521c46782d509651b14708269e89e0f3
Instruction ID: 5da24bc76795862c925bcd099e7f41b8d771ca38fc674ea53497b0edb33ed99f
Opcode Fuzzy Hash: 2b1a59eaaa3c7d23bd9aaba2f6c0d61f521c46782d509651b14708269e89e0f3
Instruction Fuzzy Hash: 1321A230A042898FDB01CBB9C688BCDBFF1AF49350F6940A9D541FB262CB75AD44CB60

Function 02FC4B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f481b7c903e27ddd2735d65135df713bd2b35e5818916910cf941c74bbdc51e9
Instruction ID: bfc5a11c0f1b4dc680e6f5cdb3f157002ecbc5d7cfb1f79e39f55062db44a27b
Opcode Fuzzy Hash: f481b7c903e27ddd2735d65135df713bd2b35e5818916910cf941c74bbdc51e9
Instruction Fuzzy Hash: ED2145312002015FD719EB79E984A5EBBA7FBC4210B448A3CD4198F764DF70AD898B95

Function 02FC4237 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ee429261353e54a4b33e665769eb34b8cd7e930209d4233153006804327f21d
Instruction ID: 7481ff1f60445639c17bbfe4326a4873984ba79a21f6e525ae3a691fed4d900a
Opcode Fuzzy Hash: 6ee429261353e54a4b33e665769eb34b8cd7e930209d4233153006804327f21d
Instruction Fuzzy Hash: 481188327042015FD71DAB79AC605BE7B97FBC0660758493DE909DB304CF306C0A87A9

Function 02FC6888 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1586b9cfd1a1b43974634995afa2376beebe008659a96d2adc772a8734e679e
Instruction ID: 5e929820e85034acd3b776ef078c1fd2901e9012edd250982d574bee23b003bd
Opcode Fuzzy Hash: b1586b9cfd1a1b43974634995afa2376beebe008659a96d2adc772a8734e679e
Instruction Fuzzy Hash: FD21C571D08206CFEB18DBA0CA18BEDBBF5AF85745F20806DD205E7151CB759A45CB51

Function 02FC2908 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d09be25a58c40e55eef86c02196d20ff90bb8271d670b937117bcf69cfda889
Instruction ID: 8426a1740fe8e4e06293f87d3127696fc1e3ecc5f0ccfdd460f2e4e0d9e2b53e
Opcode Fuzzy Hash: 9d09be25a58c40e55eef86c02196d20ff90bb8271d670b937117bcf69cfda889
Instruction Fuzzy Hash: 87212834E10209DFDB14DFA5DA909ECBBB6FF88340F10812ED915A7268EB349885DF21

Function 02FC5C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e1004dd786b71b451eee23c345fb9360a29b8fcde35bac6dc6ac5095039e9c
Instruction ID: d4abe13cf6d03c620a18f6a4442ad8371c7ccb20b7831531132fbd772f579093
Opcode Fuzzy Hash: 84e1004dd786b71b451eee23c345fb9360a29b8fcde35bac6dc6ac5095039e9c
Instruction Fuzzy Hash: 0F212935E002198FDB10CBA9D688BDDBBF1AF4C310F6400A9E505BB360DB75AD44CBA0

Function 02FC2A80 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17da58d0b3c7096c156429f642254d28dc2af5afc669f104c83432482494a528
Instruction ID: 3704d29162fb6d74fa04ca3bf83585763ab99efcf5c60199318975e91ce8b162
Opcode Fuzzy Hash: 17da58d0b3c7096c156429f642254d28dc2af5afc669f104c83432482494a528
Instruction Fuzzy Hash: 5311E3706047468FC322EF79C90859ABBE2FF4565431089AECA85CF326DB31D8068FD2

Function 02FC296A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b442e7d6c889937009d71ecd29aeaa91bc3a977bcaf8ff401063f04ea0c9d34
Instruction ID: c035d7a38ecf5a3e1234b76385f8cdd657e2a43b22c49837b9d8ae7c9f638b58
Opcode Fuzzy Hash: 6b442e7d6c889937009d71ecd29aeaa91bc3a977bcaf8ff401063f04ea0c9d34
Instruction Fuzzy Hash: EE21E334A10208DFDB14DFA4DA8099CBBB6FF88300F204129E915A7364DB34AD85DB11

Function 02FC41A2 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8838f35c64d6de3a39cd29c40d649bcf664db11cefefd89971bcd01f4b94b1e0
Instruction ID: c3236f92e27ba2c7f11968b2270e96e75a6373c956fc559214f3c4158cdb0364
Opcode Fuzzy Hash: 8838f35c64d6de3a39cd29c40d649bcf664db11cefefd89971bcd01f4b94b1e0
Instruction Fuzzy Hash: AE01452170C2915FD30A6B796C6416E3FBBEF922107A8049ED009E7342CE205D06C76A

Function 02FC32E0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f69d57c754e2de7657aeed56f38773f267aca6269c9a509ac38ee3a91757805
Instruction ID: 653a276a5229f38ecae7ec4616e94fbf231d46acc27e26dbe51c728b523a76f7
Opcode Fuzzy Hash: 0f69d57c754e2de7657aeed56f38773f267aca6269c9a509ac38ee3a91757805
Instruction Fuzzy Hash: 2111B235A24244CFCF44DBB8E91979D7FB2EB89351F1084ADEA129B380DF351805DB52

Function 02FC5911 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 805e104b5b173d15c0483bd191c9d8cd9fa6a38e8541b18d31e090878580e1ab
Instruction ID: 2f99afcd491d1c5cdd4d820faee12e5923dfb258f5ba93b30407c0fdab76ba9e
Opcode Fuzzy Hash: 805e104b5b173d15c0483bd191c9d8cd9fa6a38e8541b18d31e090878580e1ab
Instruction Fuzzy Hash: 8901F9727052409FC3159E35EC64959BF79DF876A032480EFE504C7352DA319C01D7B1

Function 02FC5940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 581c4fa0890efc8b585a00e65d4d8e79e80c34c9fb6d42b1e59aca96963fbdc8
Instruction ID: ea791db177e8f5ccf69dde381e963da35eebad7e13446144e1782f23774c094e
Opcode Fuzzy Hash: 581c4fa0890efc8b585a00e65d4d8e79e80c34c9fb6d42b1e59aca96963fbdc8
Instruction Fuzzy Hash: 9701A4763102209F8714AE69E49886DBBABFBD9761350857EEA09C7300CE31DC01D7A4

Function 02FC32F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc42fdca38bfd49a7d13d0490985edcd6906414f697efd9442454fd3bf4e63b
Instruction ID: 3f730950d1a7d3f0d86c5dbf8ef9aa505f65b353da4077be77f966777288d388
Opcode Fuzzy Hash: 9cc42fdca38bfd49a7d13d0490985edcd6906414f697efd9442454fd3bf4e63b
Instruction Fuzzy Hash: 08014C35A20204CBCB44EBB5E95979E7FB6EB88301F00846DEA0697380DF395844EF51

Function 02FC2A90 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c5bcb854ba9b76b6b75b54516f3698b152833d67a0bb0d378b2cfdcc2a0dc0
Instruction ID: 5cbe42257fbb4a6bfc740f941bd1081dc80fa89d059b5ec0dde53c315a00dddd
Opcode Fuzzy Hash: f9c5bcb854ba9b76b6b75b54516f3698b152833d67a0bb0d378b2cfdcc2a0dc0
Instruction Fuzzy Hash: A5F046756107108FC714AB39C50884BBBE2FB8462431089ADD54ACF324EF31EC088BD4

Function 02FC6388 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4170c6229c986175ae718a7c9a62548f5549d2e30331ea51430d84400f1a3fa2
Instruction ID: 2569911c6d2d91a1772b5c22b833c1b8d0311e9cd6d8e14a08f3fc84ebdc2735
Opcode Fuzzy Hash: 4170c6229c986175ae718a7c9a62548f5549d2e30331ea51430d84400f1a3fa2
Instruction Fuzzy Hash: B3F01D74A00209BFCB54EBA4D94569EBBB5EB55200F6041AC9808A7340EA315E45EB55

Function 02FC1FF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d335826abe044a42567a3a6def46cf9381f20f7375127aa781dd4ce57bf66f
Instruction ID: 2dca792ec89d04fb9b116b1eb46cc77a94d0507cc455b537b7a482ae5ab7266d
Opcode Fuzzy Hash: a1d335826abe044a42567a3a6def46cf9381f20f7375127aa781dd4ce57bf66f
Instruction Fuzzy Hash: 73E022323006404FCB065B3898188A97FE6DF9662130604EFF906C7326DD71CC06C752

Function 02FC6398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e8bce93b059a2df3620021fc8aabfd8a3d1b1157d357e81025c721253b221f
Instruction ID: 762d978e31e1db0464e3d169e48089e2f24eb236a2367e3db76c67c6d7ac0e27
Opcode Fuzzy Hash: 52e8bce93b059a2df3620021fc8aabfd8a3d1b1157d357e81025c721253b221f
Instruction Fuzzy Hash: 1DF08230A0020DEF8B04EFB8D94155DBFB6EB94200F5041BC9808A7340DA305E45EB55

Function 02FC2D93 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eade5cd1ae8a033255ea2d055f64752011261bb8798c8973ffa6a7bb85d0e6d9
Instruction ID: 53b7ed4d4c1ff7be0ee2a17a6f962227d277233a414e4a00b09928f00637d989
Opcode Fuzzy Hash: eade5cd1ae8a033255ea2d055f64752011261bb8798c8973ffa6a7bb85d0e6d9
Instruction Fuzzy Hash: 92F01C75E140188F8B94EFBCD5456EDBBF5EB4C314B1184BADA19E7301EB708E019B91

Function 02FC2DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c26e1ea066f7d07514371c3c7d9495e190f0db2049da24f84a84886ec0ae93
Instruction ID: 79cc16c53dfb7266f25cf92f2ccefdbb7743a66f5e447b75f52077fe72049e0a
Opcode Fuzzy Hash: e8c26e1ea066f7d07514371c3c7d9495e190f0db2049da24f84a84886ec0ae93
Instruction Fuzzy Hash: 02E0C971E101198F8B84EFAC95056DEBBF5EB48210B6140AAD619E7310EB709E018B91

Function 02FC66C8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27d48ad5b117bd1545daf9cc555a3e6ab00ec3f3502086942b184246c58095d7
Instruction ID: 3029e89239e281ce21875fad56c59894e1bc2d2059c64ffdf2337ada71989703
Opcode Fuzzy Hash: 27d48ad5b117bd1545daf9cc555a3e6ab00ec3f3502086942b184246c58095d7
Instruction Fuzzy Hash: 7BD0C222B092E00B922A211C2D84059AEBDC9D6AA135902FFF505DB306CD500801A396

Function 02FC2008 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a763716258db98e1265aa20efb7d707ebdafb2631a8df33ceca95f9c1da605f0
Instruction ID: 569b6e197d11e848d5775d69c772591bfd5a0161aac72a7cf24558c14189782c
Opcode Fuzzy Hash: a763716258db98e1265aa20efb7d707ebdafb2631a8df33ceca95f9c1da605f0
Instruction Fuzzy Hash: E2D017357102149FCB146ABEE41885A7BEAEFC962230144AAF50BC7320DE75DC0187A1

Function 02FC37EF Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af1f4be918634890d71e04f50e86a87df9760a55b260a7b56353a9d0c0b0681d
Instruction ID: ac2dcd0b927e68ef286f2e87fe1ad96f511b1f91c88803e7077e3e23c6c44bcf
Opcode Fuzzy Hash: af1f4be918634890d71e04f50e86a87df9760a55b260a7b56353a9d0c0b0681d
Instruction Fuzzy Hash: 0ED02B7771021097DB044599A904AB6239FDBC8221B18842AFA09C3240EE618C011340

Function 02FC6469 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcee998fa7dfa7ecc5300ab97510ac2648014e21862b17b2e741ebea587b2315
Instruction ID: 57cc49fbcf4db4ca183a84c17aabd4ce4180e08723e009982ef24799c833fdc9
Opcode Fuzzy Hash: dcee998fa7dfa7ecc5300ab97510ac2648014e21862b17b2e741ebea587b2315
Instruction Fuzzy Hash: AAD05EB67483449FC304CBA8E58181A77FAEF8D361B1004BDE518C737ADA24DC82C71A

Function 02FC6478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a1a5880e483060e41c01b354eb4f34dc5a87233be86e049ba9c321c046bd5d
Instruction ID: 5d64cefff54e1c5cfce5c80c84f5a229a0cf3e597fe4026d467f5649f5f751ef
Opcode Fuzzy Hash: 55a1a5880e483060e41c01b354eb4f34dc5a87233be86e049ba9c321c046bd5d
Instruction Fuzzy Hash: 68C012743403048F8204DB5CE08182577EAEB8C71071004B8E519C7379CD20EC818619

Function 02FC5640 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3359079344.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2fc0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eff743f3c0d56204950b69d5bbe68bb12375bf7cca09e254a0312a4c6f82a9dd
Instruction ID: d2d215e43df632682f8396d2c7e957db5f11a8a130dfb54cb45b558dc9839cbe
Opcode Fuzzy Hash: eff743f3c0d56204950b69d5bbe68bb12375bf7cca09e254a0312a4c6f82a9dd
Instruction Fuzzy Hash: 86B02B3091020E5786001555EC0D4213F1DFB40159390419CFD0840101BF23D4501480

Analysis Process: GamePall.exePID: 6492, Parent PID: 5644COMMON

Executed Functions

Function 02455240 Relevance: 6.7, Strings: 5, Instructions: 425COMMON

Download Yara Rule

Strings

(bq, xrefs: 024555CF
(bq, xrefs: 02455655
(bq, xrefs: 0245589B
(bq, xrefs: 0245586F
(bq, xrefs: 024555A3

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq$(bq$(bq
API String ID: 0-2298650571
Opcode ID: 2edc9f710db1ce4c358186eafd9e91a4d001cfc8e0acf00b788317fd503e9fa5
Instruction ID: a02d42cd73d53b1fb5453c5f23e6a81ec39dd0d6854fc1069de7db3e12a5e6d1
Opcode Fuzzy Hash: 2edc9f710db1ce4c358186eafd9e91a4d001cfc8e0acf00b788317fd503e9fa5
Instruction Fuzzy Hash: A0F17F74B00228DFDB04DF69D4546AEBBF2EF89315F54806AE806AB365DF349C46CB90

Function 02453750 Relevance: 3.8, Strings: 3, Instructions: 88COMMON

Download Yara Rule

Strings

(bq, xrefs: 02453786
(bq, xrefs: 02453820
(bq, xrefs: 024537B2

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: b8d3c6a53bd7ec3963b28381c4c81781de99f923fb5921ee6c609d4af76a2de7
Instruction ID: b4ec05e107e75d29199cf56aa23446c624cb4996295d0a0f38007a3c443c9056
Opcode Fuzzy Hash: b8d3c6a53bd7ec3963b28381c4c81781de99f923fb5921ee6c609d4af76a2de7
Instruction Fuzzy Hash: 61214B35B052A44FD7196B3E541013F2BE7DBC62A1318456AEC0AD77C2DE388D0743A6

Function 0245B0B0 Relevance: 1.9, Strings: 1, Instructions: 680COMMON

Download Yara Rule

Strings

efp^, xrefs: 0245B23E

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID: efp^
API String ID: 0-3928030445
Opcode ID: ed033c7b42ede492e6847e894164449ff8c8b12df6916d0c5c9e6ce9882d9b2b
Instruction ID: fb492b1a70fd7b440c7f56fa4939df3b310ace05974aa31bbc7133f91cf9aa99
Opcode Fuzzy Hash: ed033c7b42ede492e6847e894164449ff8c8b12df6916d0c5c9e6ce9882d9b2b
Instruction Fuzzy Hash: 19526934A01610CFC719EF34D568A2D7BB2FB84349B619469D81A9B3AEDB35EC41CF41

Function 0245385B Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

(bq, xrefs: 02453BA1

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 40d60f1749a35978f006cd0dae9408ccef76b2b34db376c3c41d1b6a3d1aae5e
Instruction ID: 3c0ff8b5a6ed92fda0cfafba8612ca01e9235bbaac56cefed353860e8380f934
Opcode Fuzzy Hash: 40d60f1749a35978f006cd0dae9408ccef76b2b34db376c3c41d1b6a3d1aae5e
Instruction Fuzzy Hash: BB913C34B00218EFDB05EFA9D954AAEBBB7EF88350F148069E805A7369DB35DC41CB50

Function 0245BEAF Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0245BF75

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 8d483468d213da4c4048ac913235a77f7f375d8d21eba403aa4ce5fddc6d33bd
Instruction ID: 3aeab0ac3f40261df2a813c0e89ab6edc40968116589b3a16fbb1813713a8f74
Opcode Fuzzy Hash: 8d483468d213da4c4048ac913235a77f7f375d8d21eba403aa4ce5fddc6d33bd
Instruction Fuzzy Hash: 50416F347006148FC744DF2DC498A2EBBE6FF89710F2584A9E906DB3B6DA70EC058B91

Function 02452B13 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

LR^q, xrefs: 02452B35

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 892887e16e2f0c46723843d2c0141168f46ff1461ecde01d9ade7a643f4f2ac4
Instruction ID: 0abc3a7acaf007c7343279e56d8386438d4c31fc1ec4504e884cfaa8bc169a8a
Opcode Fuzzy Hash: 892887e16e2f0c46723843d2c0141168f46ff1461ecde01d9ade7a643f4f2ac4
Instruction Fuzzy Hash: 94313A317102018FDB09EB3AD46052E33B3EBC9A487208069D54ACF3A9DF35DC478B8A

Function 0245BEC0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0245BF75

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: bb09a44be600490b4778d7476a669fbaa0c3c286fc13bc497f09c2943bd55ece
Instruction ID: bbfc2ff3a38c387baf0d39000b044162ed9fc4a1a7347cfc3ba20dfd8dffc639
Opcode Fuzzy Hash: bb09a44be600490b4778d7476a669fbaa0c3c286fc13bc497f09c2943bd55ece
Instruction Fuzzy Hash: B43160347006148FC744DF2DC498A2EBBE6FF88710B2584A9E806DB3B5CE71EC058B90

Function 02454243 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

(bq, xrefs: 02454295

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 6d4ad164f7193ac892b21403d317ca633629246f7d8e6e2b529380c464906ac6
Instruction ID: 9aa298a57d656c5887b379b40a3a8a380b9918243bf7b4f7a02ea35d2ea82960
Opcode Fuzzy Hash: 6d4ad164f7193ac892b21403d317ca633629246f7d8e6e2b529380c464906ac6
Instruction Fuzzy Hash: A80149327081904FD30A6B7D681417E6B63DFC265174844AED845CF396CE249D8B87D5

Function 02451053 Relevance: .8, Instructions: 837COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaec62831751cb19587d6e77d0dd178e5afcc5be9dbfa71cb87ba4995a37d45c
Instruction ID: 44ba50b1294845e2444f2ad0d6d00e70bb5dc1352877f0c5bb5692d79c193549
Opcode Fuzzy Hash: aaec62831751cb19587d6e77d0dd178e5afcc5be9dbfa71cb87ba4995a37d45c
Instruction Fuzzy Hash: D982C478640209DFDB06EBA4D664B6E7B77EB88340F105814E801377ACCB36AD95DB35

Function 02451058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c7202c7fd64c6e95f97caa3b1fba17fc2a9a2aecf417a19060cc76feef9895
Instruction ID: c0687daa7f939084a2ee03c060dd165e510bfd6e98d223ad303bea4a4dee0f6f
Opcode Fuzzy Hash: f9c7202c7fd64c6e95f97caa3b1fba17fc2a9a2aecf417a19060cc76feef9895
Instruction Fuzzy Hash: 1A82C478640209DFDB06EBA4D664B6E7B77EB88340F105814E801377ACCB36AD95DB35

Function 0245BB99 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a9ad6ac9f6ab3a9bea09a75d16c320cf249fce80c480845915dfac93936307
Instruction ID: e2a7c3ab6e6d12813fceb51e7ba7615d1b9ae03f038231786fea9b302fb871c9
Opcode Fuzzy Hash: 35a9ad6ac9f6ab3a9bea09a75d16c320cf249fce80c480845915dfac93936307
Instruction Fuzzy Hash: 34812978A02205CFC712EF14EAA991ABBB2FB44344B65E569D5058F33ECB70E849DF50

Function 02455A91 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a2e36d4ef2758fee895897dbf36a53971799215f6b13c17f79397ca62e71aa2
Instruction ID: d7dc805c389c942b6d1ab838383603c6b8f3a2d2cce02b49b2203e5f62ef9b9a
Opcode Fuzzy Hash: 9a2e36d4ef2758fee895897dbf36a53971799215f6b13c17f79397ca62e71aa2
Instruction Fuzzy Hash: 6C514FB5B002158FCB04DF69D598A7EBBF6EF88314B514069E90ADB366DB30EC05CB60

Function 0245523B Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1877cd9e6c25c6a09c396ef858b842e06512b2df8bddb53e5275e3d872d9cead
Instruction ID: e7c0fcce0a52bdebb8372369596a8e4bdd03940926d72a60819c9e9fda7cdc5d
Opcode Fuzzy Hash: 1877cd9e6c25c6a09c396ef858b842e06512b2df8bddb53e5275e3d872d9cead
Instruction Fuzzy Hash: 41513E35A00228DFDB04DFA5D484ABEB7F2BF88315F54816AE846AB365DB749C42CF50

Function 02452850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 855537c971dbb57ba90e4d895d53de03bbcfc87dd605aee7bbf6cc8589292443
Instruction ID: 0e7b6c54dad61b11f27e355cfb313a9d5a627f25eeffb25cc639dabb3ea1920e
Opcode Fuzzy Hash: 855537c971dbb57ba90e4d895d53de03bbcfc87dd605aee7bbf6cc8589292443
Instruction Fuzzy Hash: AB410874A00208CFDB14DFA5D984AADBBB2FF88344F14512AD805AB369EB759C45CF50

Function 02452843 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef9de60d73c8fe3cb29f96f9257cbe6607de5b4d1d4f3580e07bf2244cbb63be
Instruction ID: 49f218612c2ec8442531a16b61520c1d4c63d00b46e8179e9b2a3c377143fd09
Opcode Fuzzy Hash: ef9de60d73c8fe3cb29f96f9257cbe6607de5b4d1d4f3580e07bf2244cbb63be
Instruction Fuzzy Hash: F0315EB0E10208CFEB14DFB5D5846EDBBB2FF88344F14512AD801AB369EB759986CB50

Function 02455308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2502b33d4663a9611fcdfff0fd7d1f5892bac9d554efc06a2edfd4bc1b0d1e97
Instruction ID: 22b926ea7b17471ae33318bfbdcada9f3cf47e19e88bdb6eb4bda674be8f9203
Opcode Fuzzy Hash: 2502b33d4663a9611fcdfff0fd7d1f5892bac9d554efc06a2edfd4bc1b0d1e97
Instruction Fuzzy Hash: 1D411C34A002289FCB04EF65E4949ADBBB3FF88355F54906AEC46A7369DB349C42CF50

Function 02452C4B Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd05541267efbd31b0b508c244500317e9fcbe75d8fbd7deb2e31f360d06331
Instruction ID: 6d346bd87fc1b0041c8797b23fd4aa412e74ee2d7f661ccd16707b32bbc2ba0f
Opcode Fuzzy Hash: bbd05541267efbd31b0b508c244500317e9fcbe75d8fbd7deb2e31f360d06331
Instruction Fuzzy Hash: 4C413B7490020ACFDB05EFA8D5945EEBBB2FF48318F105126D806A7369DB30AD45CF91

Function 0245B0A0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0d4447d41608e2bd4ae7f226f807d5ee2b3bcd26fd68b0b5f836c6c8d56547
Instruction ID: 3bf421dcb0e28d95cc52325aa639e45f7e4bd9ed43450f3f1e6e92b898bef778
Opcode Fuzzy Hash: dd0d4447d41608e2bd4ae7f226f807d5ee2b3bcd26fd68b0b5f836c6c8d56547
Instruction Fuzzy Hash: 2E310830A003149FDB05EB78D84469DB7A6FF85354F10492AD8169B3A9DF70ED098B90

Function 02452C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 804ef72d05efb4ef254b75a2418530dbea5c13ead7a83b7a2730b7da6a64ee3a
Instruction ID: 06c4d39a756129cf5a627fd7ad70c6aa8e9245eb985bf5114c30228e625a6816
Opcode Fuzzy Hash: 804ef72d05efb4ef254b75a2418530dbea5c13ead7a83b7a2730b7da6a64ee3a
Instruction Fuzzy Hash: FE311A7490020ACFDB04EFA4D594AEEBBF6FB48358F105125D805A7368DB30A945CF90

Function 02454B7B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 004082a017ff3417d46dba3f1ad4f7c3093b96e18c2f55672c6d39a1bd3f8088
Instruction ID: 9fa7ae35aa30cb0526604a680471779e7530481e5a55cc9a2bfe35da135c37c3
Opcode Fuzzy Hash: 004082a017ff3417d46dba3f1ad4f7c3093b96e18c2f55672c6d39a1bd3f8088
Instruction Fuzzy Hash: 762153312002055FDB05EF7DE981A6EF7A7EB80254B048A38D8158B7A9DF70FD4D4BA5

Function 02454B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f967b8545a527dfb6010dcf0df232ba7ede3962d7996bef0e7fcf98ba11d7dd
Instruction ID: 3f8e7524dd8acbadc60f9a7374fa380316c2ca17f74bd51faed715e3febbdedf
Opcode Fuzzy Hash: 3f967b8545a527dfb6010dcf0df232ba7ede3962d7996bef0e7fcf98ba11d7dd
Instruction Fuzzy Hash: 892150302002055FDB05EB7DE980A6EF7A6EB80254B048A38D8158B3A9DF70FD4D4BA4

Function 02455C42 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce76d07e78655a33fc68644708840e00b3b375bcf6d4b24caa3f09bdd5ea95a7
Instruction ID: 2e2f5ca221020edb6cf5f5200ca1920728a9da2c8f026e1595d413f70bc2d7e9
Opcode Fuzzy Hash: ce76d07e78655a33fc68644708840e00b3b375bcf6d4b24caa3f09bdd5ea95a7
Instruction Fuzzy Hash: F721F271E042588FDB11CBA5C584BEDBFF1AF49310F2540AAD841BB3A2DB399D45CB60

Function 02455C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c1f296f1c89015ed55eec2b886fc2db889d4028e0a163f5f7a55552edb5b503
Instruction ID: 38310c2dabe8947a8716a07386c704f939446a36f0e98c898b1281ffb92088f4
Opcode Fuzzy Hash: 9c1f296f1c89015ed55eec2b886fc2db889d4028e0a163f5f7a55552edb5b503
Instruction Fuzzy Hash: 2D213B35A002188FDB14DBA9D588BEDBBF5AF4C310F6440A6E805BB361DB759D44CBA0

Function 02456888 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd0733928e54156b0477f9b7bfd353efa8203471a943e91a1194f005732b644
Instruction ID: 59ea77cfab2e8cbf9f7b6efe12251640daac862bdbdd0ab2b673e6de1721b355
Opcode Fuzzy Hash: 5fd0733928e54156b0477f9b7bfd353efa8203471a943e91a1194f005732b644
Instruction Fuzzy Hash: D811DF71D00215CFDB14CBA4CA087EEBBF6BF44305F92806AC886A7252DB758E46CB51

Function 02455911 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb356acb1132e777471edc9e01810a4ee6b8b9abe4e43ab137ed56982b34b8ec
Instruction ID: 94a1c7e262818c689f930c267e570e6850002a8711d485d3c502f4350ca3d75f
Opcode Fuzzy Hash: fb356acb1132e777471edc9e01810a4ee6b8b9abe4e43ab137ed56982b34b8ec
Instruction Fuzzy Hash: 0001D6B77053005FC3059B35E894AAABFB6EB9A351729407BDA49CB352DA34CC06C7A0

Function 024532E3 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0386814606c5073539769e8ba7d3458a956c15ad20961a67a79878de7fbcd15
Instruction ID: 399356973ae94ee0f2172a15ebbf90e8edbb9918cf6412a83110e0d758a81faa
Opcode Fuzzy Hash: d0386814606c5073539769e8ba7d3458a956c15ad20961a67a79878de7fbcd15
Instruction Fuzzy Hash: DC115B38A002848FDB04FFB6E4597AD7BB2EBC8301F00442AD9029B285DB7D5C0ADF50

Function 02455940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75cf0fe5d909c750f1e8e2f86d4a50b8536961f316d45ad4224a3204318cf80f
Instruction ID: 4124f83f6d510ebe9e85784f3c1553fc33bda5779d7e421677c7fd557e4a7a54
Opcode Fuzzy Hash: 75cf0fe5d909c750f1e8e2f86d4a50b8536961f316d45ad4224a3204318cf80f
Instruction Fuzzy Hash: 7101A4763002108F8704AF6EE49496EB7AAEBC97A6314453AEA06C7344DF31DC0587A0

Function 02452A83 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d87863d87af950b6a28bbed2962e753264a6f332ab89967be7fa328296c0a8a
Instruction ID: afd1ac83bf501d02637f55bdac27fcb737b33ea698f20ae9fbac85c5b24a4d26
Opcode Fuzzy Hash: 8d87863d87af950b6a28bbed2962e753264a6f332ab89967be7fa328296c0a8a
Instruction Fuzzy Hash: 2C018475A107004FC711EF38C40545BBBE1EF8161431189AED54ADF366DB71EC098BE1

Function 024532F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d60656564ffedd298df34bc39a3e3ef17b6d0489578e02e8940e0e8cd59e8cb
Instruction ID: 72aa0d784f59c828bd3beb337babbad74cef50b9794f0a42898fc90f54615016
Opcode Fuzzy Hash: 3d60656564ffedd298df34bc39a3e3ef17b6d0489578e02e8940e0e8cd59e8cb
Instruction Fuzzy Hash: D201E938A102449BDB04EBB6E458BAE7BF2EBC8311F00442ADD029B385DF795C05DB60

Function 024541D3 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcd681351d581ced739bf2d9964d39429a44436859c00df128ea0f13147d50f4
Instruction ID: 9e6d27499aba2039f8268af91ab33cbe85f0a258bbf05785f4caabff937e027d
Opcode Fuzzy Hash: dcd681351d581ced739bf2d9964d39429a44436859c00df128ea0f13147d50f4
Instruction Fuzzy Hash: 61F09EB16083042FD704AB7AB89247E6F5BEBC5150744042DE808DB382CF215D0B4375

Function 02456388 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07bc4cb9c9053e941b78b574185a8b7a78b65b08c6c4f0dd6270987d2090cf6b
Instruction ID: cfd8b20074f11a9c70eb30ed9bab5bda9fd2c59d72dfcb96b1eae54fe7cb293f
Opcode Fuzzy Hash: 07bc4cb9c9053e941b78b574185a8b7a78b65b08c6c4f0dd6270987d2090cf6b
Instruction Fuzzy Hash: BEF09674D00349AFCF00EFB8E94159CBBB2DF55204F114199D809AB282D7305F4ADB51

Function 024541E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e244932518f151cb5e61d13e85db751f0fa835fcb2653e323f3491b5144f261e
Instruction ID: 89ff7ff1e84dc780c2e9619f76833eea9f824a612f13ff054fb3a400f179ab2a
Opcode Fuzzy Hash: e244932518f151cb5e61d13e85db751f0fa835fcb2653e323f3491b5144f261e
Instruction Fuzzy Hash: E3E0EC717042042F57186A6E685157FA69BE7C51517540429F909D7380DF216D054775

Function 02452D93 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a721aeffdbec2c40dd3def85765edb1d8709ac3596ca12d29dd2f6386e89903
Instruction ID: 9d94fe2e817d2727ecf7b93b4f9a3f7a93d60b7336a805b05a808608ddb05852
Opcode Fuzzy Hash: 8a721aeffdbec2c40dd3def85765edb1d8709ac3596ca12d29dd2f6386e89903
Instruction Fuzzy Hash: 6EF082B2F100198F8741FF68C8421DD7BF2EB48241B514476D519E7255EB708D079BD1

Function 02456398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dc818ca2a3c481bb25e60cb99912241c59f78ed6d2d79a5bc1f8e313643b56e
Instruction ID: 54bf455996ffcb3a42d897bd691ca33cad59ea795c6f6427225c45edf72f005c
Opcode Fuzzy Hash: 0dc818ca2a3c481bb25e60cb99912241c59f78ed6d2d79a5bc1f8e313643b56e
Instruction Fuzzy Hash: A1F08274A0030DEF8F00FFB8D5415ADBBF6DF44204F1041A8A809A7384DB306F448B51

Function 02452DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31a514f24e1825731e6cfb82c3c845273a3e57bd19469ac5f252e75d4779dd4a
Instruction ID: db69e42ef7e4d7460b4a3a5562bb597ad6fecb8aa75114b40e73d7aafab950bc
Opcode Fuzzy Hash: 31a514f24e1825731e6cfb82c3c845273a3e57bd19469ac5f252e75d4779dd4a
Instruction Fuzzy Hash: C8E0ED71E101188F8B84EFBDD5056EEBBF5EF48311B1140AADA19E7311EB709E158BA1

Function 0245374E Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe206a449ebd70f9e81326687bf71887c89c46ff19a07c3877188e2258596ba
Instruction ID: debed62ed0cfda4b6ee914ce78de628b393a4f6dde8b00125f3519d96d606f43
Opcode Fuzzy Hash: abe206a449ebd70f9e81326687bf71887c89c46ff19a07c3877188e2258596ba
Instruction Fuzzy Hash: CAE0C277F015241783285A26E00417B6BAB9BC97A5B188476DD0DC3308EF208C0743D1

Function 02452003 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c56540c1c9e2cd18b088e794873f574b4e541d88d4f3c69601ce4729c3c722a
Instruction ID: b503080682f191dc8fd0adc372050caf86669f7649990a3bb4ec220a7c42a27b
Opcode Fuzzy Hash: 1c56540c1c9e2cd18b088e794873f574b4e541d88d4f3c69601ce4729c3c722a
Instruction Fuzzy Hash: D9E012357011105FCB146B7EE45899E7BEADFCA525341046AE54ACB361DE75CC0287A1

Function 024566C8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 943d92e7cba041b962adba5bee2370baa566881f1ef4c053372f89b0e3ed81dd
Instruction ID: 7ad659ad7e2f3b7a2bba8fd545c0d09772201e964b9baa3f689b4bed2331fa8d
Opcode Fuzzy Hash: 943d92e7cba041b962adba5bee2370baa566881f1ef4c053372f89b0e3ed81dd
Instruction Fuzzy Hash: 41D0A96AB000201BD604261CB0002FC23C7CBC8AA2B0A012BFB08EB3D2CE288D078399

Function 02456469 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a07ef2d17036e670beb9bee61a6ca3376aabc7f40ea65d47e27f6155069aeda
Instruction ID: 81ab58e1113e798216fc4e93248b84884463d808c49b05f7a50de07ae4e3745f
Opcode Fuzzy Hash: 6a07ef2d17036e670beb9bee61a6ca3376aabc7f40ea65d47e27f6155069aeda
Instruction Fuzzy Hash: F0D05EB66442044FC3049B28E4904247BB6AB89214B1100A5E219CF37ADA24DC428719

Function 02456478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0990f83e7b56de637dd273f5096d850ed433e8a1f555334a67c710c09377061
Instruction ID: 1060e1cc3358e859d066a4cd503d14cdbb96949ae817dd6684a09ecd76f76f16
Opcode Fuzzy Hash: c0990f83e7b56de637dd273f5096d850ed433e8a1f555334a67c710c09377061
Instruction Fuzzy Hash: 7FC012753402044F8304EB6CD04082573EAAB8C71471000A4E519C733DCE20FC818618

Function 02455640 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3335021714.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90d46e7f4ff51d141e753eb8ec93ab67e21b1d6e7446f4ba883d4154abf4749d
Instruction ID: e6ecfb1879fb40a21e12bac91c679da1c4f947d136a57527bce621011614099f
Opcode Fuzzy Hash: 90d46e7f4ff51d141e753eb8ec93ab67e21b1d6e7446f4ba883d4154abf4749d
Instruction Fuzzy Hash: 1EB02B341003095B86001616AC085223B1DEB504183800195BC0C04201AF23C8100080

Analysis Process: GamePall.exePID: 6716, Parent PID: 5644COMMON

Executed Functions

Function 00A24F58 Relevance: 7.9, Strings: 6, Instructions: 388COMMON

Download Yara Rule

Strings

(bq, xrefs: 00A25082
(bq, xrefs: 00A255CF
(bq, xrefs: 00A251F9
(bq, xrefs: 00A255A3
(bq, xrefs: 00A251CD
(bq, xrefs: 00A25056

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq$(bq$(bq$(bq
API String ID: 0-3607145362
Opcode ID: a4f0a6da3a7b2b7e6d03beea96f34e8a24765873a937bdc495c01947d42d111b
Instruction ID: ff3f7944e20ee29e14db877fef5d234e151f50bf977c6e5aba15825f4bafcb1b
Opcode Fuzzy Hash: a4f0a6da3a7b2b7e6d03beea96f34e8a24765873a937bdc495c01947d42d111b
Instruction Fuzzy Hash: 9AE18034E006289FCB09EF79D5546AEBBF2BF89311F24C169D805AB394DB349D42CB91

Function 00A25640 Relevance: 4.0, Strings: 3, Instructions: 206COMMON

Download Yara Rule

Strings

(bq, xrefs: 00A25655
(bq, xrefs: 00A2586F
(bq, xrefs: 00A2589B

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: 18a1141cfa0fcc7add1783f03cc8e3679c3be9bacc9d4cbeb31b9529c20c3f11
Instruction ID: 244e4a2f7c71e2e634df0b0fad0ceb3d8822c616d909f20e21bfd69763601bb6
Opcode Fuzzy Hash: 18a1141cfa0fcc7add1783f03cc8e3679c3be9bacc9d4cbeb31b9529c20c3f11
Instruction Fuzzy Hash: 7F716A34B005149FC704EF79E958A6EBBF6BF89701B248069E806E7361DF709D06DB51

Function 00A23750 Relevance: 3.8, Strings: 3, Instructions: 88COMMON

Download Yara Rule

Strings

(bq, xrefs: 00A237B2
(bq, xrefs: 00A23820
(bq, xrefs: 00A23786

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: 8840c0adb6928f4d1feced2ca0d92901172cc152d9c0084aa90d6e0b32e7f919
Instruction ID: f1cc205a4b2e77c48d071ad9191b7c1c1d4fd1081c74f43326d80fe268fbe7cf
Opcode Fuzzy Hash: 8840c0adb6928f4d1feced2ca0d92901172cc152d9c0084aa90d6e0b32e7f919
Instruction Fuzzy Hash: F7213836B091A44FD7197B79981013F3BE79BD73113288269E80AC7781DE288D078392

Function 00A23BE0 Relevance: 3.0, Strings: 2, Instructions: 460COMMON

Download Yara Rule

Strings

(bq, xrefs: 00A2419C
(bq, xrefs: 00A23DE5

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: 93b0cc10cec5bc34a14fe725c1671542b77d537236e9a55f2dafcca814a52ac5
Instruction ID: f02c7aa21d18b11a611465e451b14166c3b7d73b6a8007c33be58e4b7c1b9cb9
Opcode Fuzzy Hash: 93b0cc10cec5bc34a14fe725c1671542b77d537236e9a55f2dafcca814a52ac5
Instruction Fuzzy Hash: BBF18E31B002149FDB09AF79D95466E7BF7AFC9300F248429E506AB3A8DE35EC46CB51

Function 00A2B0B0 Relevance: 1.9, Strings: 1, Instructions: 680COMMON

Download Yara Rule

Strings

er^, xrefs: 00A2B23E

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID: er^
API String ID: 0-2610762354
Opcode ID: 7d98f87f3ff315847247acc45868681b571eba3dabf05fafdb5a55691b3fefe8
Instruction ID: aea1c951224c3cab51c1b539f5ee3570d3feb15ef4d8f974e1aadf695fa19fff
Opcode Fuzzy Hash: 7d98f87f3ff315847247acc45868681b571eba3dabf05fafdb5a55691b3fefe8
Instruction Fuzzy Hash: 3C526834A11610CFC71AEF38E558A6D7BB2FB85305B658479D80A8B369DB35EC82CF50

Function 00A2385A Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

(bq, xrefs: 00A23BA1

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 6746c2752430c6400fbdd8c6b6da0ecb46f317a47b123b535823aa4342e83b54
Instruction ID: 334b513205ff6f455a3516defad3ab31a11c5b521d14b2e9f5ee958259892671
Opcode Fuzzy Hash: 6746c2752430c6400fbdd8c6b6da0ecb46f317a47b123b535823aa4342e83b54
Instruction Fuzzy Hash: CBA15035B00218AFDF05DFA8E954AAE7BF6AF89300F244525E905A7368DB35ED41CB90

Function 00A2BEAF Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00A2BF75

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 3dc01902e7748993daf57d175b454c9ab9617a4fcba6e2fd351d971c9197481d
Instruction ID: d1ace559ba56902f1bbb98f8a28c178ed14fe2433d32fcdabf4d3e0292ff0f18
Opcode Fuzzy Hash: 3dc01902e7748993daf57d175b454c9ab9617a4fcba6e2fd351d971c9197481d
Instruction Fuzzy Hash: 29416D347002109FC744EF3DC598A2EBBE6BF89710B2585A9E506DB3B6DA70EC058B90

Function 00A2BEC0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00A2BF75

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: b8879caf42119c24b400f98b0d97e61b90c18d841bbd573469b3a57f84f5ef90
Instruction ID: 14863450d0eeeca0e65b491b7869149c7b23a9b812e8cdb44a81375abbada3bb
Opcode Fuzzy Hash: b8879caf42119c24b400f98b0d97e61b90c18d841bbd573469b3a57f84f5ef90
Instruction Fuzzy Hash: 15314F347005149FC744EF3DC598A2EBBE6BF89B10B6585A8E506DB3B5CE71EC018B90

Function 00A22B10 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00A22B35

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: b45a95c06ae1c9cf7f2d34f70aca3dd901db015e0aba994477f08a34d42837fa
Instruction ID: 497cdb87dcce3ac0c4d268ef8f9d219cd808ac27e8db6829c1858e9f9b9f624a
Opcode Fuzzy Hash: b45a95c06ae1c9cf7f2d34f70aca3dd901db015e0aba994477f08a34d42837fa
Instruction Fuzzy Hash: 58310F317106058FD709EB3AD45561E33E2EBC9B15B208578D14A8F368DE35DC43CB8A

Function 00A24237 Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

(bq, xrefs: 00A24295

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 1acb248d3d661e7bc7a498450fcc60465900696b4f75efbfd64bd1f1e810f693
Instruction ID: 8c765156d23d2472f0e85a1d44c7eb37424c76933d61dca5f4fe1df51dccdd7b
Opcode Fuzzy Hash: 1acb248d3d661e7bc7a498450fcc60465900696b4f75efbfd64bd1f1e810f693
Instruction Fuzzy Hash: F0018E32B041905FC31A6B3964253BE3B63DFD2711B5445AED885CB741DE288D4BC7C5

Function 00A21049 Relevance: .8, Instructions: 838COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f944aa36bf21f8e8c3ae67de281d9bfb6ac7c1e4bef3a9bce0bf5e0eb13a80ff
Instruction ID: 11c3e2e1f1c9d6441505becdb2de29fb3e50b7a5385352fc2b2665c1b949f8a7
Opcode Fuzzy Hash: f944aa36bf21f8e8c3ae67de281d9bfb6ac7c1e4bef3a9bce0bf5e0eb13a80ff
Instruction Fuzzy Hash: 2082C178640609DFDB06EBA4D654B6E7BB6EB89300F205814A801337ACCB36BD95DF35

Function 00A21058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187863a4b39a1c60c30efb556bcf64e33dbe3359df03e34ce44f080f4d9ea52f
Instruction ID: 14e03f8f11e1323afba6c6d0c9c84f4fc29a93ffcb492b98c71cde7e5e77e030
Opcode Fuzzy Hash: 187863a4b39a1c60c30efb556bcf64e33dbe3359df03e34ce44f080f4d9ea52f
Instruction Fuzzy Hash: F382C078640609DFDB06EBA4D654B6E7BB6EB89300F205814A801337ACCB36BD95DF35

Function 00A2BB99 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fae1b68de1ac8ab5159161f2a2154673ae09311f05e47c8f1732bdb2152c453
Instruction ID: 17af5a394cd83dbc427e9269c36bc63b11309d62c3c86fbd1919297a63193e10
Opcode Fuzzy Hash: 1fae1b68de1ac8ab5159161f2a2154673ae09311f05e47c8f1732bdb2152c453
Instruction Fuzzy Hash: F781F538912A05CFC716EF2CE68A959BBB2FB41304B25E569D1058B32DC771F849DF60

Function 00A25A91 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ca79c2f83a055a891ecf969c7ad883dcf856e7154ed2bb255e99f3ceb7cbaa3
Instruction ID: bb58d5c289c43c9ca4e0677ea12565d4a4305e1c7d6bb968d87d51962cfe5986
Opcode Fuzzy Hash: 8ca79c2f83a055a891ecf969c7ad883dcf856e7154ed2bb255e99f3ceb7cbaa3
Instruction Fuzzy Hash: 40510774B006158FCB04EF78D59496ABBF5FF88310B1181A9E50ADB366DB30EC05CB60

Function 00A25240 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cac0a5ade75d95fb8c6ab6abf10899a8b3ef75ccf637057e7355d398d52e19a
Instruction ID: 0560298ede1348498d1b21bbb81b6da69f52db52e2ba181a046eee9f05d06da0
Opcode Fuzzy Hash: 9cac0a5ade75d95fb8c6ab6abf10899a8b3ef75ccf637057e7355d398d52e19a
Instruction Fuzzy Hash: B4510035E00628DFCB14DF69E594AADB7F2BF88311F249575E405AB294DB34AC41CF90

Function 00A22850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 684bf3a2857d4f02b3245c83e28f011ed8e4aef2d0ec6a81f42bccaf60dee4d8
Instruction ID: d5dc7949332f44d1efe5ef9e67f02f6f1323c3cdd6f1936aeb860f35c17380bd
Opcode Fuzzy Hash: 684bf3a2857d4f02b3245c83e28f011ed8e4aef2d0ec6a81f42bccaf60dee4d8
Instruction Fuzzy Hash: 3841E934940208DFDB14EFA8E9946ADBBF2FF88300F245629D801A7368DB359885CF51

Function 00A22842 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d131637dc3160ba5ba83abcfb6fad3aa7b29009f00a609af0737d1ef3e0038
Instruction ID: 53b970c7cf125e11293d72444cbbaf14db67c0b5b0284dc3891a96e04830c13f
Opcode Fuzzy Hash: f7d131637dc3160ba5ba83abcfb6fad3aa7b29009f00a609af0737d1ef3e0038
Instruction Fuzzy Hash: 02313E70D40208EFDB14EFB8E9846EDBBB2FF88340F145629D501A7268EB349985CF51

Function 00A25308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4038b1fd84b835e88c434440d11207274d9f573796dc18c33973c0a813b086de
Instruction ID: ab91bda41f387ec9e6d9585188378665c676640bc09a2932a900a94c7c1cec65
Opcode Fuzzy Hash: 4038b1fd84b835e88c434440d11207274d9f573796dc18c33973c0a813b086de
Instruction Fuzzy Hash: 7C41FD35E00528DFCB04EFA9E5949ADB7F2BF88311F249065E805A7364DB34AC42CF50

Function 00A22C48 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975692c16701da5676a8fce015b480f23188b4eb9e7d8c03e3bf25d410a4d630
Instruction ID: 02438437fac7f3b8eb8a3d085940ea4f46c915454490e3f6566666e563475bd9
Opcode Fuzzy Hash: 975692c16701da5676a8fce015b480f23188b4eb9e7d8c03e3bf25d410a4d630
Instruction Fuzzy Hash: A7413D74A00209DFDB05EFA8E9846EEBBF1FF48314F106525D505A7368DB30A995CF91

Function 00A24B50 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c564c9acce93f8df972b4d6cbec2863e81520640cef440bc41a5794beccd0c15
Instruction ID: be8bab5c42a62a5f94c7950a66e55c0ff4a1dc2d4ed02bee013b66f017351ecf
Opcode Fuzzy Hash: c564c9acce93f8df972b4d6cbec2863e81520640cef440bc41a5794beccd0c15
Instruction Fuzzy Hash: D721D3306046415FC715FF78E891A6EBBA2EBC1300B048A69D4068B369DF70ED4E8B95

Function 00A2B0A0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bf8efe06101ab0ec808e27631d1fde28b869b4368bcc5548c85ecd7fa9d3506
Instruction ID: 3485d42ce921e09c7e7b2ff033ce813ab2f1cc168c0355e914bcc2bfcb0aef65
Opcode Fuzzy Hash: 6bf8efe06101ab0ec808e27631d1fde28b869b4368bcc5548c85ecd7fa9d3506
Instruction Fuzzy Hash: 0931D1306102059FCB14EB79D8546ADBBA2EFC4314F50867DC01A9B3A9DF70AD0A8B90

Function 00A22C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c321646f5de644b9e667809e5888c33318a391ece797e2e0c23deb97173066c4
Instruction ID: 62930abeec3780351cbe285d1772f7e52b52f0d6cb583dd14944d6206a35676b
Opcode Fuzzy Hash: c321646f5de644b9e667809e5888c33318a391ece797e2e0c23deb97173066c4
Instruction Fuzzy Hash: EA310A74A00209DFDB04EFA8E5856AEBBF1FF88314F106525D505A7368DB30A995CF91

Function 00A24B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f087ded91e1a1c78535ff002160ed8fbfef3e15c5b0a74d5dea314b2ec72b984
Instruction ID: a2c1d476f4ef48ca42f4c368cb5896fed37022105f27ad4a188aa8370d4c1a7c
Opcode Fuzzy Hash: f087ded91e1a1c78535ff002160ed8fbfef3e15c5b0a74d5dea314b2ec72b984
Instruction Fuzzy Hash: 3D2151302406015FC719FF79E940A6EB7A6EBC4710B048A39D4158B769DF70FD8E8BA5

Function 00A25C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dacf1f1c6c168786c3e120bc21257b2c78585346938f15bbe87b64aa879b8f73
Instruction ID: 3616f7c013faeedd53519447df5d2303c27cccaa25b79478f20cacb667213e26
Opcode Fuzzy Hash: dacf1f1c6c168786c3e120bc21257b2c78585346938f15bbe87b64aa879b8f73
Instruction Fuzzy Hash: 14210635E002288FDB14DBA9D588ADDBBF5BF8C310F2440A5E505BB361DB75AD84CBA0

Function 00A26888 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e0df1222f7f0cf570ebe875df117a99204d44d8e30e408fee726e64b0d1ad27
Instruction ID: e57afc65460a66a6b70e91f2ab6a7a4d7f5edc81f1c1da48867bf3cb5b9bdef5
Opcode Fuzzy Hash: 6e0df1222f7f0cf570ebe875df117a99204d44d8e30e408fee726e64b0d1ad27
Instruction Fuzzy Hash: 19218C31901219CFDB10DBA8DA09BAEBBF1BF44304F14847AD405A7252DB759E85CB91

Function 00A25C5A Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f638a401d04d8e0bbd3fb8f898173de20e97d8547b8e327c29826f7eafdd87
Instruction ID: be51ce80d4f756d90dd1a18d3b424f6c76140a288394f68d0e295a068c7db242
Opcode Fuzzy Hash: 08f638a401d04d8e0bbd3fb8f898173de20e97d8547b8e327c29826f7eafdd87
Instruction Fuzzy Hash: A2210835E402688FDB14CBA9D998BDDBBF1BF48314F2441A5D401BB361DB759D84CB60

Function 00A241A2 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3bd92fc286810c5ebd4786c5c5b3919057f98a9aa46c8481ebed8810b08090
Instruction ID: 1a3a57594efab8aef40c916089e86341a3e8dfc8f04cce908e957ba98a9402bd
Opcode Fuzzy Hash: 7c3bd92fc286810c5ebd4786c5c5b3919057f98a9aa46c8481ebed8810b08090
Instruction Fuzzy Hash: 4C012431B082802FC70A7F7598712AE3FB6EFC6211764449BE805DB342CE254D0BC76A

Function 00A232E0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b52517ddc21b02255a4d396d815439c469809cea7a37c69125c5b76ea22abe7
Instruction ID: ec162285a0e1e549e9a592c6df2cd847835949b9515fdf3b82e67de7b01c8bf0
Opcode Fuzzy Hash: 9b52517ddc21b02255a4d396d815439c469809cea7a37c69125c5b76ea22abe7
Instruction Fuzzy Hash: F1116134E40144AFDB08EFB8ED597AD7BF2AB8C301F405929D40297385DB391865CB51

Function 00A25940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07b8bcc97bfaa1047d99ff38e22b27b3ead305bf058ada9caff7c5bd9b155985
Instruction ID: 38d6f78265c306c88ce58ac8aa28fc8f3457205d849cea42c12577c7b66646e7
Opcode Fuzzy Hash: 07b8bcc97bfaa1047d99ff38e22b27b3ead305bf058ada9caff7c5bd9b155985
Instruction Fuzzy Hash: 090181767001209B8704AF79E894D1EB7A6EBC9761320863AE605C7350CA31DC02C7B0

Function 00A232F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1ee6bd2ab49e362a04bcdedf186aa50f8762cadf21f44f83111fa341f0ac3f
Instruction ID: a0535f67af5e53bc414adb0b81fbbfe5d1c46c38c877c3fb23596119463465d8
Opcode Fuzzy Hash: fd1ee6bd2ab49e362a04bcdedf186aa50f8762cadf21f44f83111fa341f0ac3f
Instruction Fuzzy Hash: D1015E34E40248AFDB08EFB8E9587AE7BF2AB8C301F406929D40297384DF355865CB61

Function 00A22A80 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 420369ff438a20856908eddd42f78221e43ec9086c260167cd2951a40a49aadd
Instruction ID: 4a2a556b8f5849606506643a64624368921424155cb0f618f790bc0e36017726
Opcode Fuzzy Hash: 420369ff438a20856908eddd42f78221e43ec9086c260167cd2951a40a49aadd
Instruction Fuzzy Hash: E7018F756106008FC711AF38D505A5BB7E1FF84714710C9A9D54ADF725EB70EC088BC1

Function 00A241E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bb022de6c87b27f8e10ad2748525de89b32905a1313e823b43b885d94cb9ea5
Instruction ID: a9a8c07893a61f3d2671fbcac59d43da849c51fdf66edd95e72a7dc6f3dc01ab
Opcode Fuzzy Hash: 2bb022de6c87b27f8e10ad2748525de89b32905a1313e823b43b885d94cb9ea5
Instruction Fuzzy Hash: F8E0ED31B042042F870CBABAAC51A7F769AEBC8A60754492AF009D7300DE256D0647B9

Function 00A26388 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88adc83f3b222e749536421e5d086f9546adb1d5d15944add1af70e67b42d426
Instruction ID: 9c6ae21a10eae194a59eef1923280298f37053335ad47045c72291eb89457052
Opcode Fuzzy Hash: 88adc83f3b222e749536421e5d086f9546adb1d5d15944add1af70e67b42d426
Instruction Fuzzy Hash: 58F09034A04248AFCB41FFB8EA5559DBFF2DF8A200B1082E9D548E7352D6311F45EB51

Function 00A2593E Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54d0f43c2748d801b89e15fe7852705f3e86236867662dcd94468cc75e310d7b
Instruction ID: c9636a4008009783cd98fdcb41e3a8e8274b9119a8d9ac16c63d6e8da53fe085
Opcode Fuzzy Hash: 54d0f43c2748d801b89e15fe7852705f3e86236867662dcd94468cc75e310d7b
Instruction Fuzzy Hash: 77F082763001109F8304EF79E898D1EB7A6EBC9761325856AE505D7364CA30DC02DBB0

Function 00A26398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d80fbc4a15fa30d390eb12d4f4b12acd8f168d9c6f36973b8da72fe016a7f0c0
Instruction ID: 41bfee893e49bc41d44a29d4ca148def118376a15e3a4f2daecd99f64aa4de12
Opcode Fuzzy Hash: d80fbc4a15fa30d390eb12d4f4b12acd8f168d9c6f36973b8da72fe016a7f0c0
Instruction Fuzzy Hash: 8DF01234E00209AF8B40FFB8E94555DBBB5DB85200F1086A89508A7355DA306F45DB95

Function 00A22DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5a97c14bfa8ba9795497037925317e8592ae8d17437754457b8d3715a1b8101
Instruction ID: 3a46bfc23e2f68f1fcdbd111c4d95d64cfbabe7560c3551a113773072202d1b3
Opcode Fuzzy Hash: b5a97c14bfa8ba9795497037925317e8592ae8d17437754457b8d3715a1b8101
Instruction Fuzzy Hash: D1E0ED71E101189F8B94EFBCD5056DEBBF5EF48310B6181BAD519E7311EB709E018B91

Function 00A21FF8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d1a0e145f8a132a549e2e12b31634aa21992d48b00fd40ced013f75296a148
Instruction ID: 93c646b4a198076be7fc07875d687fa37446f63b2c03623747621d39984ff133
Opcode Fuzzy Hash: e8d1a0e145f8a132a549e2e12b31634aa21992d48b00fd40ced013f75296a148
Instruction Fuzzy Hash: 4BE0D876B401406FCB340779D4685ED3BD5DFD5211B4104AAE946C7361DD31CC16C751

Function 00A2374E Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02abe5e397a974a8714ca170586fe37beb0336860bc5044ac83a97725f04c964
Instruction ID: 7f2021fd8facd52aa7b364665caec09aac109305168df6965cecc1b7b9982506
Opcode Fuzzy Hash: 02abe5e397a974a8714ca170586fe37beb0336860bc5044ac83a97725f04c964
Instruction Fuzzy Hash: 9FD0C27B710134478B259729B90457B22A79BCA32131C4036DD09C3318EE348D06A2D1

Function 00A266C8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78a8091c9a852bc2544e5f75c8a2d96619f26987da4097c8a49072d6ceb2a2b7
Instruction ID: 129c4bf42da79809d199f57351d9e80f284fe9551c445cc3fa8e7651f3fd3909
Opcode Fuzzy Hash: 78a8091c9a852bc2544e5f75c8a2d96619f26987da4097c8a49072d6ceb2a2b7
Instruction Fuzzy Hash: F8D05E227092905B83462A7C74600A96B91DECA15130902BBF245D7306DD1A8D476351

Function 00A26469 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c0c9272c6022dad519eba1c4c58c0cd3ac61f083a16a7337761dc5f94871b1
Instruction ID: 6336264549ab6e999b4b9368484ea5d379e67bb5e7e9b0119752e55bfdfb625f
Opcode Fuzzy Hash: 98c0c9272c6022dad519eba1c4c58c0cd3ac61f083a16a7337761dc5f94871b1
Instruction Fuzzy Hash: B4D05EB97482448FC3069B64D2948153FA2BB9D21030505E5E189CB379D922DC828B04

Function 00A25631 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6559f850a31e956fc945ca12a8e6d78dd8551f4aae763d3d54472dd95a793224
Instruction ID: 8081106cc717373dbd341eb37dcf4cdb7cecec3c9169dea3c2912185a9a0e078
Opcode Fuzzy Hash: 6559f850a31e956fc945ca12a8e6d78dd8551f4aae763d3d54472dd95a793224
Instruction Fuzzy Hash: 26D0A72050C7C21FC31307346C151217F356E8311839802D7D88885113D6238C759310

Function 00A26478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3344215538.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_a20000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4306abf1901849c4a5a88b99f97c898e1bfb9adb162dcddfb3e00d97f6407f
Instruction ID: e1d2e0f580e18c4483dd771077a24579a9a359911a92a92fe819becc3236e1c4
Opcode Fuzzy Hash: fe4306abf1901849c4a5a88b99f97c898e1bfb9adb162dcddfb3e00d97f6407f
Instruction Fuzzy Hash: 38C012743402084F8304EB6CD14081577EABB8C71031001A4E519C733DCD20FC818A18

Analysis Process: GamePall.exePID: 6904, Parent PID: 6120COMMON

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	31
Total number of Limit Nodes:	0

Executed Functions

Function 00A7D130 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00A7D5FE,?,?,?,?,?), ref: 00A7D6BF

Memory Dump Source

Source File: 00000015.00000002.3769343683.0000000000A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_a70000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: eb81f7a764d9c4aee61a548e8d1c80c8a7e4a3ca8019867f6123f0bd50afc524
Instruction ID: 7104a5e26d9c5ce3850efe210cfc7e9953a5974e1b229577e957eb38c8134d15
Opcode Fuzzy Hash: eb81f7a764d9c4aee61a548e8d1c80c8a7e4a3ca8019867f6123f0bd50afc524
Instruction Fuzzy Hash: E521E4B5910248AFDB10CF9AD984ADEBFF8EF48324F14841AE958A7310D374A950DFA4

Function 00A7D630 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00A7D5FE,?,?,?,?,?), ref: 00A7D6BF

Memory Dump Source

Source File: 00000015.00000002.3769343683.0000000000A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_a70000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 66c38736d01825fc05927b031781abad97e69f17524b74495b85015c214c01c9
Instruction ID: c59e0796815f3b3fc24844d8d6dee575c679df32e793d00b70824d1db8b2fbc6
Opcode Fuzzy Hash: 66c38736d01825fc05927b031781abad97e69f17524b74495b85015c214c01c9
Instruction Fuzzy Hash: 3321E4B5D002089FDB10CF99D984ADEBBF4FF48314F14841AE958A3710D374A954CF64

Function 00A7D1D7 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 00A7E090

Memory Dump Source

Source File: 00000015.00000002.3769343683.0000000000A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_a70000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: e7d39d60017ecca4caddd9c11d42158602052d731864267486aa941a863d048c
Instruction ID: a381ea2ec19615b35826c1fa361caa7f7f095b22eb7ecaaf8f7ef016312b21a5
Opcode Fuzzy Hash: e7d39d60017ecca4caddd9c11d42158602052d731864267486aa941a863d048c
Instruction Fuzzy Hash: F62179B68042499FDB10CF9AC848BDEFFF4EB49320F10C4A9D458A7251D374A945DFA5

Function 00A7D1E4 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 00A7E090

Memory Dump Source

Source File: 00000015.00000002.3769343683.0000000000A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_a70000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 1a200e6b07b809f2731d94ac8e15ac4688739325405bfdf5a5d248675ae5134b
Instruction ID: bcbc09a9ec7f5b4703772157ec82b9a4a14a40c9d799c41bc490026589e2fdef
Opcode Fuzzy Hash: 1a200e6b07b809f2731d94ac8e15ac4688739325405bfdf5a5d248675ae5134b
Instruction Fuzzy Hash: 2B1134B59006499FDB20DF9AC844BDEBFF8EB48320F20C469E558A7250D3B5A944DFA4

Function 00A7E020 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 00A7E090

Memory Dump Source

Source File: 00000015.00000002.3769343683.0000000000A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_a70000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 917093adb0b60e6a85ad67f490b6e8a573526624d20ea01aae172fe9e427debf
Instruction ID: 8c65f782490c84dcaf192406e4c6190530a4ead7770fd207326803a678a45be2
Opcode Fuzzy Hash: 917093adb0b60e6a85ad67f490b6e8a573526624d20ea01aae172fe9e427debf
Instruction Fuzzy Hash: 401146B68002498FDB10CF99C844BDEBFF4BB48320F20846AE558A7250C379AA44DFA4

Analysis Process: GamePall.exePID: 5844, Parent PID: 6120COMMON

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	36
Total number of Limit Nodes:	0

Executed Functions

Function 00A2D130 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00A2D5FE,?,?,?,?,?), ref: 00A2D6BF

Memory Dump Source

Source File: 00000016.00000002.3921910884.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_a20000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3986ab77904dde99f5bf0957d1b751c2243085716deb44f340bc617a3d57bb2c
Instruction ID: 042bc57052968bae810e893cb7fe70e3cfe4077a22b851def8b531da8d9a9359
Opcode Fuzzy Hash: 3986ab77904dde99f5bf0957d1b751c2243085716deb44f340bc617a3d57bb2c
Instruction Fuzzy Hash: 9F21E6B5900258DFDB10CF9AD584AEEFFF4EB48314F14842AE918A7311D374A950CFA4

Function 00A2D630 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00A2D5FE,?,?,?,?,?), ref: 00A2D6BF

Memory Dump Source

Source File: 00000016.00000002.3921910884.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_a20000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0ed1de1b4c6b5dbe88698b52abb5b6f714ef9fcba7c0f29ef1bea26120d66ab6
Instruction ID: 3fa85be9214aa4f11f1f6ec718bb2c7c268d388ffeaa913ae1b7a043cd0cff58
Opcode Fuzzy Hash: 0ed1de1b4c6b5dbe88698b52abb5b6f714ef9fcba7c0f29ef1bea26120d66ab6
Instruction Fuzzy Hash: DA21E4B5D002589FDB10CFAAD584ADEFFF4EB48320F14842AE958A7311D378A955CFA4

Function 00A2D1E4 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 00A2E090

Memory Dump Source

Source File: 00000016.00000002.3921910884.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_a20000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 174d2cd340d618c51c0825a8e480beb663bac01ea63b69cecdd90f4c78930652
Instruction ID: dbad02ff7595326cf5612e3d882a13a94c3b660bc6bc6fa73aab6019732d4e42
Opcode Fuzzy Hash: 174d2cd340d618c51c0825a8e480beb663bac01ea63b69cecdd90f4c78930652
Instruction Fuzzy Hash: 66113775900659DFCB20DF9AD844BDEBFF4EB48320F208429E558A7250D375A984CFA4

Function 00A2E020 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 00A2E090

Memory Dump Source

Source File: 00000016.00000002.3921910884.0000000000A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_a20000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: c214e584ef062f9aa5e1a3ff675346795e455ec86b8a498a49137a2a7b887565
Instruction ID: c6de12764c5fe420587e1b00c4a0d9c0833e8985fdedb995b573a22fbe675e8f
Opcode Fuzzy Hash: c214e584ef062f9aa5e1a3ff675346795e455ec86b8a498a49137a2a7b887565
Instruction Fuzzy Hash: DC1137B6800259CFDB10DF9AD844BDEFBF4EB48320F208429E558A7250D375A985CFA4

Analysis Process: GamePall.exePID: 600, Parent PID: 6120COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	32
Total number of Limit Nodes:	0

Executed Functions

Function 00D2D1D7 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 00D2E090

Memory Dump Source

Source File: 00000017.00000002.3912502144.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_d20000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: f3121e921af5806f5882d91da9c5e25853a4c1a1de6d0b8d2333c111733213da
Instruction ID: 2caa99c72f18f268af83f75b62922a9c2559286fb720ab8892b24cc2fe81eedf
Opcode Fuzzy Hash: f3121e921af5806f5882d91da9c5e25853a4c1a1de6d0b8d2333c111733213da
Instruction Fuzzy Hash: 8421BBB28042599FCB20CF9AD844BDEFFF4FB18324F208469D458A3211D374A585CFA4

Function 00D2D130 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00D2D5FE,?,?,?,?,?), ref: 00D2D6BF

Memory Dump Source

Source File: 00000017.00000002.3912502144.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_d20000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7564bc949157497d710f9ea3fec646711ccb78352a171a3c0475c8ed70ea0b98
Instruction ID: b24de1562ca237f8b1716b7a7eddd72d8b0478573b27cef01022252c34158a4b
Opcode Fuzzy Hash: 7564bc949157497d710f9ea3fec646711ccb78352a171a3c0475c8ed70ea0b98
Instruction Fuzzy Hash: 5C2114B590021CAFDB10CF9AD484AEEBFF9EB58324F14841AE918A3310D374A940CFA4

Function 00D2D630 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00D2D5FE,?,?,?,?,?), ref: 00D2D6BF

Memory Dump Source

Source File: 00000017.00000002.3912502144.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_d20000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d51ea412b59fc500fd35999e6967a963841793849d1009e13d7666cd428be641
Instruction ID: d44a1f640f1f125e4c973689dc0962880a6cad3c615fcaf4d1ec2fb4d7b84cc3
Opcode Fuzzy Hash: d51ea412b59fc500fd35999e6967a963841793849d1009e13d7666cd428be641
Instruction Fuzzy Hash: 602114B5900218AFDB10CF9AD484ADEBFF4EB48324F14842AE918A7310D378A944CFA4

Function 00D2D1E4 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 00D2E090

Memory Dump Source

Source File: 00000017.00000002.3912502144.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_d20000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: d00f8693fcb1db554a9667c0be8969ccd68a218d9db725e07bc3d0fee55a3d38
Instruction ID: 241966a64381d19087c14fe276eb96abaa473c2cc22aa185c6dc415b403e77c0
Opcode Fuzzy Hash: d00f8693fcb1db554a9667c0be8969ccd68a218d9db725e07bc3d0fee55a3d38
Instruction Fuzzy Hash: B01146B1900659DFCB20DF9AD944BDEBFF4EB48324F208429E558A7350D375A944CFA4

Function 00D2E020 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 00D2E090

Memory Dump Source

Source File: 00000017.00000002.3912502144.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_d20000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 20e6f2a1b34a0ff3e19bdc61d4efe1ad9c1551e91391982ae41c3423f255ae1a
Instruction ID: 83776076ddfcde7c74ab11939ce0b460989afa8007c9181fdacd5ad6abf87d21
Opcode Fuzzy Hash: 20e6f2a1b34a0ff3e19bdc61d4efe1ad9c1551e91391982ae41c3423f255ae1a
Instruction Fuzzy Hash: 331134B2900259DFDB20DF9AD484BDEBFF4EB58324F208429E558A7350D375A945CFA0

Analysis Process: GamePall.exePID: 2476, Parent PID: 6120COMMON

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	14
Total number of Limit Nodes:	2

Executed Functions

Function 0145D3E0 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0145D46E
GetCurrentThread.KERNEL32 ref: 0145D4AB
GetCurrentProcess.KERNEL32 ref: 0145D4E8
GetCurrentThreadId.KERNEL32 ref: 0145D541

Memory Dump Source

Source File: 00000019.00000002.4203466299.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1450000_GamePall.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 53668c98791ea4b0d88d819964ed9065714b9b5ce07ae955ce7a4fd9a811c229
Instruction ID: c8d5b8236a256604963f54e9bbb5784478377e14dc0bf0d12dbe5767ee44f627
Opcode Fuzzy Hash: 53668c98791ea4b0d88d819964ed9065714b9b5ce07ae955ce7a4fd9a811c229
Instruction Fuzzy Hash: 755155B09002498FDB54DFAAC548BDEBBF1EF89304F20C46AE448A7361D734A985CF65

Function 0145D3F0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0145D46E
GetCurrentThread.KERNEL32 ref: 0145D4AB
GetCurrentProcess.KERNEL32 ref: 0145D4E8
GetCurrentThreadId.KERNEL32 ref: 0145D541

Memory Dump Source

Source File: 00000019.00000002.4203466299.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1450000_GamePall.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ad3217c3dd3407fea7dddcf36b3cd7ce14a77be6a05e8cebd9f37fc19209af5b
Instruction ID: 2d50ad8cd81330069144634c1aa92daf2197494b17e6018e5118d2aacca5a2d7
Opcode Fuzzy Hash: ad3217c3dd3407fea7dddcf36b3cd7ce14a77be6a05e8cebd9f37fc19209af5b
Instruction Fuzzy Hash: 645143B09002098FDB54DFAAC548B9EBBF1AF88304F20C469E459A7361D734A984CF65

Function 0145D630 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0145D6BF

Memory Dump Source

Source File: 00000019.00000002.4203466299.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1450000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a68cb4344bd9eb3728a791be09c46f5731fcc0c1dd4af7c151f2f24ba4c94117
Instruction ID: 09ab18b36b45b2bf5d8dc6fcd315161ff65a8735dbf0b8b7facb51da539cee71
Opcode Fuzzy Hash: a68cb4344bd9eb3728a791be09c46f5731fcc0c1dd4af7c151f2f24ba4c94117
Instruction Fuzzy Hash: A02105B5D002489FDB10CFA9D584ADEBFF4EF48320F14801AE958A3311D378A955CF64

Function 0145D638 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0145D6BF

Memory Dump Source

Source File: 00000019.00000002.4203466299.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1450000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1b89e175e25c13647d7e50c08c668b4b6d3a051581086763803b8515d7e68fb1
Instruction ID: ffaf58dfef5a85bca26ad0897f8ce282f5cc5824fb08a19d0768e0632d9d4b45
Opcode Fuzzy Hash: 1b89e175e25c13647d7e50c08c668b4b6d3a051581086763803b8515d7e68fb1
Instruction Fuzzy Hash: C921E3B59002189FDB10CFAAD584ADEBFF4EF48320F14841AE958A3321D374A940CFA4

Function 0145D1D8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 0145E090

Memory Dump Source

Source File: 00000019.00000002.4203466299.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1450000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: d487c25ff3e0835acd8e57c3659b90a437f90acc254021a9fcda7d4afa4620d8
Instruction ID: 36e5859cfbe9b941bd61a4258c0d10def5315aa62c52fc4d99c7b9bad051fda8
Opcode Fuzzy Hash: d487c25ff3e0835acd8e57c3659b90a437f90acc254021a9fcda7d4afa4620d8
Instruction Fuzzy Hash: 432138B18046598FDB20DF9AC484BDEFFF4EF49320F10846AD598A7252D375A544CFA4

Function 0145E020 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 0145E090

Memory Dump Source

Source File: 00000019.00000002.4203466299.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1450000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 73e92942690762e34e7aa0711f9550a3032e0b8ec7214c9c75544a0377e26617
Instruction ID: 56cf5f8b921953ec11114d09f20ada30bff341efc1e79fc6106541ddbfc08302
Opcode Fuzzy Hash: 73e92942690762e34e7aa0711f9550a3032e0b8ec7214c9c75544a0377e26617
Instruction Fuzzy Hash: 031126B18002198FDB20CF9AD844BDEFBF4AB48320F248429E958A3251D339A544CFA5

Function 0145D1E4 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 0145E090

Memory Dump Source

Source File: 00000019.00000002.4203466299.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_1450000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: d97397158eb7d589cb5fdcebf7f00c6a6041fe0d1222298a7ab0abd4598495a2
Instruction ID: 8d785bfcb89d4f584af4a4b41592a6cf9cd78c7e22070eb573749fe0b588e303
Opcode Fuzzy Hash: d97397158eb7d589cb5fdcebf7f00c6a6041fe0d1222298a7ab0abd4598495a2
Instruction Fuzzy Hash: 8D1137B19006599FDB20DF9AC844BDEFFF4FB48320F10846AE958A7251D375A944CFA4

Analysis Process: GamePall.exePID: 4496, Parent PID: 6120COMMON

Execution Graph

Execution Coverage:	12.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	14
Total number of Limit Nodes:	0

Executed Functions

Function 014FD130 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,014FD5FE,?,?,?,?,?), ref: 014FD6BF

Memory Dump Source

Source File: 0000001A.00000002.3767601010.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_14f0000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1d62f4901bcd1116e7cf0b8627bfc9ee8e7b227692269fdf5c83cf2caa2212d6
Instruction ID: a8501adcb68033e052ce6af2502f252d3a7e6743d71b4ca3b48725c8468b9070
Opcode Fuzzy Hash: 1d62f4901bcd1116e7cf0b8627bfc9ee8e7b227692269fdf5c83cf2caa2212d6
Instruction Fuzzy Hash: 7921E5B5D002089FDB10CF9AD584ADEBFF4EB48310F14841AE919A7310D374A950CFA4

Function 014FD630 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,014FD5FE,?,?,?,?,?), ref: 014FD6BF

Memory Dump Source

Source File: 0000001A.00000002.3767601010.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_14f0000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 34fd1f26f127104b7f7db1a128200f13f5272ba89038f01c976e62231e4858d1
Instruction ID: 3628a8759af98fa9f29076e1fea81045a9316c12cda560779e9e5af2312472b3
Opcode Fuzzy Hash: 34fd1f26f127104b7f7db1a128200f13f5272ba89038f01c976e62231e4858d1
Instruction Fuzzy Hash: DD21E6B5D002189FDB10CF9AD984ADEBFF8EF48324F14841AE959A7310D374A954CFA5

Function 014FD223 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 014FE090

Memory Dump Source

Source File: 0000001A.00000002.3767601010.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_14f0000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 61a08745ea5f2acb78ca8e5ec0a8c04d6ed306496847dbe9e567a35b61888702
Instruction ID: 98b9f33879d0badb6a18a4b0b36eb33cb7f7f0790525a588538083915349fb47
Opcode Fuzzy Hash: 61a08745ea5f2acb78ca8e5ec0a8c04d6ed306496847dbe9e567a35b61888702
Instruction Fuzzy Hash: E8214AB2C002199FDB10CF9AD845BDEBBF4EB48320F10842AE658A7361D375A944CBA1

Function 014FE020 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 014FE090

Memory Dump Source

Source File: 0000001A.00000002.3767601010.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_14f0000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 7d3b9fa8a4d81dfc32bfe522131c2e0e5bbec48d594f2c81fc6cd673b574439a
Instruction ID: f54b57876d35ecf7ff5c16aa61a065cd3d16285ef25a2f156bef9b015e620ca7
Opcode Fuzzy Hash: 7d3b9fa8a4d81dfc32bfe522131c2e0e5bbec48d594f2c81fc6cd673b574439a
Instruction Fuzzy Hash: CE1137B18002199FDB10CF9AC884BDEBFF4EB48320F108429E558A7350D375A544CFA5

Function 014FD1E4 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 014FE090

Memory Dump Source

Source File: 0000001A.00000002.3767601010.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_14f0000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: c24b760b3ef7e582b1ded93f0fe5fc35cc6471d0cd00ead60cf8ac525c79ec87
Instruction ID: 5b5b05659f964c5c093aac7d6341a2d3ed171f7f13b37db5926c055e8a8184fc
Opcode Fuzzy Hash: c24b760b3ef7e582b1ded93f0fe5fc35cc6471d0cd00ead60cf8ac525c79ec87
Instruction Fuzzy Hash: 1C1134B1900659DFDB20DF9AC844BDEBFF4EB48320F10842AE658A7361D375A944CFA5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat

C:\Users\user\AppData\Local\Temp\1E47.exe

C:\Users\user\AppData\Local\Temp\5239.exe

C:\Users\user\AppData\Local\Temp\nsh4B73.tmp\INetC.dll

C:\Users\user\AppData\Local\Temp\nsh4B73.tmp\blowfish.dll

C:\Users\user\AppData\Local\Temp\nsh4B73.tmp\nsProcess.dll

C:\Users\user\AppData\Local\Temp\nshF9DF.tmp\liteFirewall.dll

C:\Users\user\AppData\Local\Temp\nsp8FF8.tmp

C:\Users\user\AppData\Local\Temp\setup.exe

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_0

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre