Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1467515
MD5:	794107dd168bd98d7c9f65a9f693a07e
SHA1:	b026ad1bbd93ba9f30776c823d3c9c954dd9f975
SHA256:	b87126fd409621a4d510dda005cd84e254d491274661cf22238b271412ff860b
Tags:	exe
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Too many similar processes found

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 3056 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 794107DD168BD98D7C9F65A9F693A07E)

explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

39FF.exe (PID: 1960 cmdline: C:\Users\user\AppData\Local\Temp\39FF.exe MD5: 60172CA946DE57C3529E9F05CC502870)

setup.exe (PID: 4228 cmdline: "C:\Users\user\AppData\Local\Temp\setup.exe" MD5: FF2293FBFF53F4BD2BFF91780FABFD60)

GamePall.exe (PID: 3664 cmdline: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2876 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3452 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 4012 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3648 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1976 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5304 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 4740 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6132 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6980 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5424 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 712 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6044 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5916 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1012 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1368 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5516 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1340 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 3308 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2752 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 7108 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5924 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 3860 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 4224 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5856 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1284 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2568 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3728 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 4816 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720079065909404 --launch-time-ticks=7150995116 --mojo-platform-channel-handle=4036 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6292 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720079065909404 --launch-time-ticks=7151287249 --mojo-platform-channel-handle=4128 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1876 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5456 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5360 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

gujascb (PID: 1292 cmdline: C:\Users\user\AppData\Roaming\gujascb MD5: 794107DD168BD98D7C9F65A9F693A07E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://evilos.cc/tmp/index.php", "http://gebeus.ru/tmp/index.php", "http://office-techs.biz/tmp/index.php", "http://cx5519.com/tmp/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2067888436.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2067888436.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000004.00000002.2290641536.0000000002DEE000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7098:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2067826028.0000000002D30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2067826028.0000000002D30000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000004.00000002.2290515587.0000000002D40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.2290515587.0000000002D40000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000004.00000002.2290464944.0000000002CE0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2067809785.0000000002D20000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2067955486.0000000002E3E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x76c8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000002.2290789668.0000000004981000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.2290789668.0000000004981000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\setup.exe, ProcessId: 4228, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GamePall

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\gujascb, CommandLine: C:\Users\user\AppData\Roaming\gujascb, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\gujascb, NewProcessName: C:\Users\user\AppData\Roaming\gujascb, OriginalFileName: C:\Users\user\AppData\Roaming\gujascb, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: C:\Users\user\AppData\Roaming\gujascb, ProcessId: 1292, ProcessName: gujascb

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://gebeus.ru/tmp/index.php	Avira URL Cloud: Label: malware
Source: http://cx5519.com/tmp/index.php	Avira URL Cloud: Label: malware
Source: http://evilos.cc/tmp/index.php	Avira URL Cloud: Label: malware
Source: http://office-techs.biz/tmp/index.php	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Avira: detection malicious, Label: HEUR/AGEN.1359405
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Avira: detection malicious, Label: HEUR/AGEN.1352426
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Avira: detection malicious, Label: HEUR/AGEN.1359405
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\huge[1].dat	Avira: detection malicious, Label: HEUR/AGEN.1359405

Found malware configuration

Source: 00000000.00000002.2067826028.0000000002D30000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://evilos.cc/tmp/index.php", "http://gebeus.ru/tmp/index.php", "http://office-techs.biz/tmp/index.php", "http://cx5519.com/tmp/index.php"]}

Multi AV Scanner detection for domain / URL

Source: http://gebeus.ru/tmp/index.php	Virustotal: Detection: 15%	Perma Link
Source: http://cx5519.com/tmp/index.php	Virustotal: Detection: 11%	Perma Link
Source: http://evilos.cc/tmp/index.php	Virustotal: Detection: 12%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\39FF.exe

ReversingLabs: Detection: 20%

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 40%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.1% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\gujascb	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\GamePall\Del.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GamePall

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdbSHA256f source: Newtonsoft.Json.dll.8.dr
Source:	Binary string: *?\|<>/":%s%s.dllC:\Users\user\AppData\Roaming\GamePall\GamePall.exeewall.dllll.pdbC:\Users\user\AppData\Roaming\GamePall\Uninstall.exeePallll source: setup.exe, 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb source: Newtonsoft.Json.dll.8.dr
Source:	Binary string: e:\work\newContent\secondBranch\new\GamePall\obj\Release\GamePall.pdb source: GamePall.exe, 00000009.00000000.3588915067.00000000007C2000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdb source: GamePall.exe, GamePall.exe, 00000010.00000002.3669434122.0000000005642000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\libEGL.dll.pdb source: libEGL.dll.8.dr
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdbLK source: GamePall.exe, 00000010.00000002.3666285286.00000000049F2000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdbSHA256 source: GamePall.exe, 00000010.00000002.3669434122.0000000005642000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdb source: GamePall.exe, GamePall.exe, 00000010.00000002.3666285286.00000000049F2000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: Xilium.CefGlue.pdb source: setup.exe, 00000008.00000002.3872814569.000000000064A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \swiftshaderXilium.CefGlue.pdb source: setup.exe, 00000008.00000002.3872814569.000000000064A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\libEGL.dll.pdb source: libEGL.dll.8.dr

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Directory queried: number of queries: 1148

Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 8_2_00405B4A CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	8_2_00405B4A
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 8_2_004066FF FindFirstFileA,FindClose,	8_2_004066FF
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 8_2_004027AA FindFirstFileA,	8_2_004027AA

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 137.74.196.132 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 77.221.157.163 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 127.0.0.127 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 78.89.199.216 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 188.114.96.3 80	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://evilos.cc/tmp/index.php
Source: Malware configuration extractor	URLs: http://gebeus.ru/tmp/index.php
Source: Malware configuration extractor	URLs: http://office-techs.biz/tmp/index.php
Source: Malware configuration extractor	URLs: http://cx5519.com/tmp/index.php

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 104.21.45.251 104.21.45.251

Source: Joe Sandbox View	ASN Name: OVHFR OVHFR
Source: Joe Sandbox View	ASN Name: INFOBOX-ASInfoboxruAutonomousSystemRU INFOBOX-ASInfoboxruAutonomousSystemRU
Source: Joe Sandbox View	ASN Name: WATANIYATELECOM-ASKW WATANIYATELECOM-ASKW
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: GamePall.exe, 00000012.00000002.3711043546.0000000002617000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.install-stat.debug.world/clients/activity
Source: GamePall.exe, 00000012.00000002.3711043546.0000000002617000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.install-stat.debug.world/clients/installs
Source: GamePall.exe, 0000001E.00000002.3925989764.0000000002F87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bageyou.xyz
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: explorer.exe, 00000002.00000000.2053230734.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2053230734.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: resources.pak.8.dr	String found in binary or memory: http://crbug.com/1352358
Source: resources.pak.8.dr	String found in binary or memory: http://crbug.com/275944
Source: resources.pak.8.dr	String found in binary or memory: http://crbug.com/378067
Source: resources.pak.8.dr	String found in binary or memory: http://crbug.com/437891.
Source: resources.pak.8.dr	String found in binary or memory: http://crbug.com/456214
Source: resources.pak.8.dr	String found in binary or memory: http://crbug.com/497301
Source: resources.pak.8.dr	String found in binary or memory: http://crbug.com/510270
Source: resources.pak.8.dr	String found in binary or memory: http://crbug.com/514696
Source: resources.pak.8.dr	String found in binary or memory: http://crbug.com/642141
Source: resources.pak.8.dr	String found in binary or memory: http://crbug.com/672186).
Source: resources.pak.8.dr	String found in binary or memory: http://crbug.com/717501
Source: resources.pak.8.dr	String found in binary or memory: http://crbug.com/775961
Source: resources.pak.8.dr	String found in binary or memory: http://crbug.com/819404
Source: resources.pak.8.dr	String found in binary or memory: http://crbug.com/839189
Source: resources.pak.8.dr	String found in binary or memory: http://crbug.com/957772
Source: explorer.exe, 00000002.00000000.2050076985.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: explorer.exe, 00000002.00000000.2053230734.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2053230734.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: explorer.exe, 00000002.00000000.2053230734.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2053230734.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: GamePall.exe	String found in binary or memory: http://logging.apache.org/log4ne
Source: GamePall.exe, 00000010.00000002.3666285286.00000000049F2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://logging.apache.org/log4net/release/faq.html#trouble-EventLog
Source: setup.exe, setup.exe, 00000008.00000000.3324712728.000000000040A000.00000008.00000001.01000000.0000000A.sdmp, setup.exe, 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, setup.exe, 00000008.00000003.3589000332.00000000006AA000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe.8.dr, 39FF.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: 39FF.exe, 00000007.00000000.2489064254.000000000040A000.00000008.00000001.01000000.00000006.sdmp, setup.exe, 00000008.00000000.3324712728.000000000040A000.00000008.00000001.01000000.0000000A.sdmp, setup.exe, 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, setup.exe, 00000008.00000003.3589000332.00000000006AA000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe.8.dr, 39FF.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000002.00000000.2053230734.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2053230734.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: explorer.exe, 00000002.00000000.2053230734.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000002.00000000.2052671949.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2052248639.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2052698125.0000000008890000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: GamePall.exe, GamePall.exe, 00000010.00000002.3666285286.00000000049F2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.apache.org/).
Source: GamePall.exe, GamePall.exe, 00000010.00000002.3666285286.00000000049F2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: GamePall.exe	String found in binary or memory: http://www.apache.org/licenses/LICEN
Source: GamePall.exe, 00000010.00000002.3666285286.00000000049F2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: icudtl.dat.8.dr	String found in binary or memory: http://www.unicode.org/copyright.html
Source: 39FF.exe, 00000007.00000003.2490885985.00000000030D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xiexie.wf/22_551/huge.dat
Source: explorer.exe, 00000002.00000000.2056111189.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000002.00000000.2051650589.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000002.00000000.2053230734.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000002.00000000.2051650589.0000000007637000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000002.00000000.2050678514.00000000035FA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.coml
Source: resources.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: ar.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=ar&category=theme81https://myactivity.google.com/myactivity/?u
Source: ar.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=arCtrl$1
Source: en-US.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u
Source: en-US.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=enCtrl$1
Source: fil.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=fil&category=theme81https://myactivity.google.com/myactivity/?
Source: fil.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=filCtrl$1
Source: hu.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=hu&category=theme81https://myactivity.google.com/myactivity/?u
Source: hu.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=huCtrl$1
Source: ko.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=ko&category=theme81https://myactivity.google.com/myactivity/?u
Source: ko.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=koCtrl$1
Source: lt.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=lt&category=theme81https://myactivity.google.com/myactivity/?u
Source: lt.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=ltCtrl$1
Source: ru.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=ru&category=theme81https://myactivity.google.com/myactivity/?u
Source: ru.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=ruCtrl$1
Source: uk.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=uk&category=theme81https://myactivity.google.com/myactivity/?u
Source: uk.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=ukCtrl$1
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CN&category=theme81https://myactivity.google.com/myactivity
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.8.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CNCtrl$1
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TW&category=theme81https://myactivity.google.com/myactivity
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TWCtrl$1
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	String found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: resources.pak.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: resources.pak.8.dr	String found in binary or memory: https://codereview.chromium.org/25305002).
Source: resources.pak.8.dr	String found in binary or memory: https://crbug.com/1201800
Source: resources.pak.8.dr	String found in binary or memory: https://crbug.com/1245093):
Source: resources.pak.8.dr	String found in binary or memory: https://crbug.com/1446731
Source: explorer.exe, 00000002.00000000.2053230734.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	String found in binary or memory: https://myactivity.google.com/
Source: explorer.exe, 00000002.00000000.2053230734.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: ru.pak.8.dr, ar.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr	String found in binary or memory: https://passwords.google.com
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, fil.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, ko.pak.8.dr	String found in binary or memory: https://passwords.google.comGoogle
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	String found in binary or memory: https://policies.google.com/
Source: explorer.exe, 00000002.00000000.2056111189.000000000C460000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, ar.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: GamePall.exe, GamePall.exe, 00000010.00000002.3666421353.0000000004A36000.00000002.00000001.01000000.0000000E.sdmp, GamePall.exe, 00000010.00000002.3666285286.00000000049F2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://svn.apache.org/repos/asf/logging/log4net/tags/2.0.8RC1
Source: explorer.exe, 00000002.00000000.2053230734.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/)s
Source: explorer.exe, 00000002.00000000.2053230734.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comon
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: resources.pak.8.dr	String found in binary or memory: https://www.google.com/
Source: setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, ar.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, ko.pak.8.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: ru.pak.8.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html&
Source: hu.pak.8.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html&S
Source: en-US.pak.8.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlH&elpManaged
Source: lt.pak.8.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlP&agalbaTvarko
Source: fil.pak.8.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlT&ulongPinapamahalaan
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: https://www.newtonsoft.com/json
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: Newtonsoft.Json.dll.8.dr	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.2067888436.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2067826028.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2290515587.0000000002D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2290789668.0000000004981000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Code function: 8_2_004055E7 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

8_2_004055E7

Source: GamePall.exe

Process created: 58

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2067888436.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.2290641536.0000000002DEE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2067826028.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.2290515587.0000000002D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.2290464944.0000000002CE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2067809785.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2067955486.0000000002E3E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000004.00000002.2290789668.0000000004981000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401538 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401538
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402FE9 RtlCreateUserThread,NtTerminateProcess,	0_2_00402FE9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004014DE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401496 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401496
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401543 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401543
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401565 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401565
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401579 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401579
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040157C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040157C
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_00401538 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401538
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_00402FE9 RtlCreateUserThread,NtTerminateProcess,	4_2_00402FE9
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_004014DE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_004014DE
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_00401496 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401496
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_00401543 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401543
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_00401565 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401565
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_00401579 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401579
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_0040157C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_0040157C

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Code function: 8_2_004034CC EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

8_2_004034CC

Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 8_2_00406A88	8_2_00406A88
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 9_2_01044F58	9_2_01044F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 11_2_01424F58	11_2_01424F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 11_2_01421049	11_2_01421049
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_02774F58	12_2_02774F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_02773860	12_2_02773860
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_02771049	12_2_02771049
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_03164F58	14_2_03164F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_03163860	14_2_03163860
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_03161049	14_2_03161049
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 16_2_00AF4F58	16_2_00AF4F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 17_2_00E64F58	17_2_00E64F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 17_2_00E63860	17_2_00E63860
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 17_2_00E61049	17_2_00E61049
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 18_2_00934F58	18_2_00934F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 30_2_01314F58	30_2_01314F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 30_2_01313860	30_2_01313860
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 30_2_01312410	30_2_01312410
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 30_2_01311049	30_2_01311049

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\huge[1].dat B9BC473FC866909F089E005BAF2537EE7FF2825668D40D67C960D5C2AFB34E9F
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\39FF.exe 42CEB2252FEC41FD0ACC6874B41C91E0BA07C367045D6A9A7850D59781C2584C

Source: file.exe, 00000000.00000002.2067744651.0000000002BE3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesAtlassing2 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamesAtlassing2 vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2067888436.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.2290641536.0000000002DEE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2067826028.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.2290515587.0000000002D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.2290464944.0000000002CE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2067809785.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2067955486.0000000002E3E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000004.00000002.2290789668.0000000004981000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: gujascb.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Ionic.Zip.dll.8.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformBlock'
Source: Ionic.Zip.dll.8.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Ionic.Zip.dll.8.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: GamePall.exe.8.dr, Program.cs

Base64 encoded string: 'pizR9uKkcZIkMW+F1cRjYV0LMt6eYXmLuiNCndESDPkTO3eY1Mjv7Hs2Qvo+t26G', 'ZTDMzZVpdA1FSa2RiY6ZCl2QGyLDtQ3OBRa/N40wO2xxcvcDsATtLRGwKtaEB36dqPJnDF8qXNs92JbMBlsOyg==', 'nYQvMVlU2Asj2rNkmi7xBNqGCkGzSnaP0raCPfB8A9hSwWFTIjPcsKgDrCVAEwSQ1lHf/WOhnKR59a5JjrkJVUOFvV43wO8MM1FKgjYuj7ZzvvuGve+okViUQx+oGN+llGnjS4Fm9o1MUn7p+qcPVIDZRcvMal1ARjQNk+bFvT5vC4J8slkhLZYtvBYmOybvSK90G7/f/U8GPBdM7WBmfFdHzzGxw6WFcHlkdySP8Nvmzff08RdOn8QOu8FlABEqqEjQ0W84v+/lU0lmhvzugpodd8fIp2kb2/twZPg9/Jsy5viOC65K8bs1ES63SA2d62f5cJYpFf1f0WBQbCBcSzfwiDlBCWVIW9vFXW1awyEMdm3q36+BViyETC5tnyHuoLRgf3bXoQAwqE0OIII5DROfW+LmqqHY82rVXHAqhVjdA2wZRWcSI1zxV7+qTfhmp9qbIQAWSuuXTzhbIvI3gjvtPCdz9uBv8rjyg1XZNxfdgYdtF+klyGgKdefnu5G2pgjfT3Kb/VbjgkFvLlqtWNr5K7iC080FVeHsZazMHUrrDtsmNdChtvnX8Zj77rIGVxi9RfvHhhIhBj+WSos+lJ2nuvQkUpqVEa1mrZSwPezG/uoh0qvs+BAHbNFNjv99WS6tgWIkvcQVCi2h3cfxTGQiZDetQZqB+N/mnvgC6WdrcRKGHBE4mp6bpgTY9+nt3lPiH6OZnlxC8rdHbuGtY6R/FgNFYkw49JWXYeZ1VV3KnjSrFMvDlkyMCAW1X9/1VoC+f73WVYMLwXafDKtGO2lfr9vwKms+8HoEgs7bj0aroIPdmLK/z/djAsFZO8Vp', 'T7BWwqrn4yISEECEAnARpwE8R+3lDHSc+RlcJT90an1SNsS27lGBQjOx4RmDHlrj7oJnnzx1IWXOkbTfLzBeCfU6UJhOIoQKhcWidAxAKIxvqZnoB6AujIU0F7dEj65vahyTdEvkIxzFaV2+akbl53KcDi5RPBOP16iXVi0WJdHV5AbSCI9WCEcSX/fUpmukBh4bjVF/T/P/B6TFVtNZintCOSO2Ha+2va2CJMOnJ020zYskwuvcH9d1rGD3Zf9RBC2obzrhRNK2LXTEIYnifs6L2UdqFhw5aANXILziQtzKvsTQKvc15hvHCCoeXJCyyK7/WgA/oRu7bdrTs2DwCQ==', 'ZY0WCEgzqiLEU8ZUVJwGTpbkuL9KoMwYVloBqJXjur8rfBZEXTysQNKRQ1H7/vn7o0wyHAux60SVy06r4v6So5WWxddei09LXvL6ZwK/tyY=', 's7iS2XfzyI+IBoARaZQlTINg1kEy7qT7EopaSHQzpqktZBtc7UiOYrPdv/6f4cNI', 'o2ZleBui4P9C2ZjnB98Vuesy1C+WucHiXjQJ8RANoX6TheGfnLYAWDsXRfSeNCDHWdkBP2RBrkWPBy/nuM2NFLMETMUsPFeG3JHWafvGKzaNEjYO3Up9m61SnaY5tINvLCYJ/TKITszJ9H1YSm2chnmQGLUzbz4pwvWvvKfH8m7z585W73/QZrtw3l/30vcZaVocgwemYusDJYsOTgeWc0okiDahD7qtJcBYZ0aOzxZZmHDMBYigkRVf8GTJ/xucA/i7EHBFpaWoLVZVcuGFMA==', 'T7BWwqrn4yISEECEAnARp+JyVgG3cZc2/9+3VbyOjc4PuRSCU7ZfXuXpIIH8uj2roUU+W7nSmXHqTuxLhe6DBfNVh8PFZrhNX/YhIexDxrk=', 'G4TxOgdwfNBdU+6bscw2hqt3kZYZMfoEuKZtmCxRLrF8xJCK1+L0ocd8eSQjty7d', 'PcG64iM3U1vDIVDm7HuwTSvKhuz45f/WPqYoWZvzLHcapbEfkynZkUjmDgg30eof', 'XGcq7Js3+2f2oGHGFzxJPiYsrodwK+bTw/0lKjiUd0tSWMHEjdVqzAclD1/nPksq3sGhVTN8oFeHMRE7wAt3mCLVCEXKF9JLnNeWw9vvCbs=', 'T7BWwqrn4yISEECEAnARp8UQ6kvfa8mDiwe39obQZ+Rxfj5bbo//kf+4mlTsZUEg0QM/4QBKb6sUDMsk9OTdYg==', 'T7BWwqrn4yISEECEAnARp/U1NCwfjpQ4K5UKuMbDqXSrjfU6Tf/pOCpHlHXtYnU5', 'Gg/rFkGmnFrfPAny9sQ3qerPGxlC7+cuu92x2tgXrCRkqABwTbbIR8+hJN0krbBD9OJX8s2JqeR+xICuD2u17N7KjlWCZwpg4+c7mG1xAahALfXXbu/EvJy+KsAzQlzR9bu8P4wbyuM6r6/7kdf+VQ==', 'Zh3o1d4Zr0FJ548CrzCJDMeQhe52nu1Hz4hkTFOalLT3pudJg4gGhcEax3IHwBI0R5vZR7J9mjUQ8R9MdKz/Fw==', 'Zh3o1d4Zr0FJ548CrzCJDMeQhe52nu1Hz4hkTFOalLTcCwJrbTmNGWmZutw1Di2FSZ+3JxFtC00BiemuQuq2+A=='

Source: classification engine

Classification label: mal100.troj.evad.winEXE@219/112@0/6

Source: C:\Users\user\AppData\Local\Temp\setup.exe

8_2_004034CC

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Code function: 8_2_00404897 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

8_2_00404897

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_02E456F6 CreateToolhelp32Snapshot,Module32First,

0_2_02E456F6

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Code function: 8_2_00402173 CoCreateInstance,MultiByteToWideChar,

8_2_00402173

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\gujascb

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Mutant created: \Sessions\1\BaseNamedObjects\C__Users_user_AppData_Roaming_GamePall_Logs_mainLog.txt
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Mutant created: \Sessions\1\BaseNamedObjects\C__Users_user_AppData_Roaming_GamePall_Logs_rendLog.txt

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\39FF.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: file.exe

Virustotal: Detection: 40%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\gujascb C:\Users\user\AppData\Roaming\gujascb
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\39FF.exe C:\Users\user\AppData\Local\Temp\39FF.exe
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Process created: C:\Users\user\AppData\Local\Temp\setup.exe "C:\Users\user\AppData\Local\Temp\setup.exe"
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3452 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3648 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3728 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720079065909404 --launch-time-ticks=7150995116 --mojo-platform-channel-handle=4036 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720079065909404 --launch-time-ticks=7151287249 --mojo-platform-channel-handle=4128 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\39FF.exe C:\Users\user\AppData\Local\Temp\39FF.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Process created: C:\Users\user\AppData\Local\Temp\setup.exe "C:\Users\user\AppData\Local\Temp\setup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3452 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3648 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3728 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720079065909404 --launch-time-ticks=7150995116 --mojo-platform-channel-handle=4036 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720079065909404 --launch-time-ticks=7151287249 --mojo-platform-channel-handle=4128 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfsrcsnk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cdprt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gujascb	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gujascb	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gujascb	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gujascb	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: chrome_elf.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mdmregistration.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mdmregistration.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: omadmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iri.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GamePall

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdbSHA256f source: Newtonsoft.Json.dll.8.dr
Source:	Binary string: *?\|<>/":%s%s.dllC:\Users\user\AppData\Roaming\GamePall\GamePall.exeewall.dllll.pdbC:\Users\user\AppData\Roaming\GamePall\Uninstall.exeePallll source: setup.exe, 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb source: Newtonsoft.Json.dll.8.dr
Source:	Binary string: e:\work\newContent\secondBranch\new\GamePall\obj\Release\GamePall.pdb source: GamePall.exe, 00000009.00000000.3588915067.00000000007C2000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdb source: GamePall.exe, GamePall.exe, 00000010.00000002.3669434122.0000000005642000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\libEGL.dll.pdb source: libEGL.dll.8.dr
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdbLK source: GamePall.exe, 00000010.00000002.3666285286.00000000049F2000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdbSHA256 source: GamePall.exe, 00000010.00000002.3669434122.0000000005642000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdb source: GamePall.exe, GamePall.exe, 00000010.00000002.3666285286.00000000049F2000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: Xilium.CefGlue.pdb source: setup.exe, 00000008.00000002.3872814569.000000000064A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \swiftshaderXilium.CefGlue.pdb source: setup.exe, 00000008.00000002.3872814569.000000000064A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\libEGL.dll.pdb source: libEGL.dll.8.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\gujascb	Unpacked PE file: 4.2.gujascb.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;

Source: Newtonsoft.Json.dll.8.dr

Static PE information: 0xF68F744F [Mon Jan 31 06:35:59 2101 UTC]

Source: chrome_elf.dll.8.dr	Static PE information: section name: .00cfg
Source: chrome_elf.dll.8.dr	Static PE information: section name: .crthunk
Source: chrome_elf.dll.8.dr	Static PE information: section name: CPADinfo
Source: chrome_elf.dll.8.dr	Static PE information: section name: malloc_h
Source: libEGL.dll.8.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.8.dr	Static PE information: section name: .00cfg
Source: libcef.dll.8.dr	Static PE information: section name: .00cfg
Source: libcef.dll.8.dr	Static PE information: section name: .rodata
Source: libcef.dll.8.dr	Static PE information: section name: CPADinfo
Source: libcef.dll.8.dr	Static PE information: section name: malloc_h

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401CD1 push ecx; ret	0_2_00401CD2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401C91 push 00000076h; iretd	0_2_00401C93
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E96 push B92A2F4Ch; retf	0_2_00402E9B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D21CF8 push 00000076h; iretd	0_2_02D21CFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D22EFD push B92A2F4Ch; retf	0_2_02D22F02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D21D38 push ecx; ret	0_2_02D21D39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02E3E6EC push eax; ret	0_2_02E3E6ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02E4D1C6 push FFFFFFFBh; iretd	0_2_02E4D1DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02E4B148 push edx; ret	0_2_02E4B149
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_00401CD1 push ecx; ret	4_2_00401CD2
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_00401C91 push 00000076h; iretd	4_2_00401C93
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_00402E96 push B92A2F4Ch; retf	4_2_00402E9B
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_02CE2EFD push B92A2F4Ch; retf	4_2_02CE2F02
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_02CE1CF8 push 00000076h; iretd	4_2_02CE1CFA
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_02CE1D38 push ecx; ret	4_2_02CE1D39
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_02DFCB96 push FFFFFFFBh; iretd	4_2_02DFCBAC
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_02DEE577 push eax; ret	4_2_02DEE58D
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_02DEE56C push eax; retf	4_2_02DEE56D
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_02DFAB18 push edx; ret	4_2_02DFAB19

Source: file.exe	Static PE information: section name: .text entropy: 7.7704450327476176
Source: gujascb.2.dr	Static PE information: section name: .text entropy: 7.7704450327476176
Source: Ionic.Zip.dll.8.dr	Static PE information: section name: .text entropy: 6.821349263259562

Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\libcef.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\log4net.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Del.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\huge[1].dat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\gujascb	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	File created: C:\Users\user\AppData\Local\Temp\nsi3790.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\nswE436.tmp\liteFirewall.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	File created: C:\Users\user\AppData\Local\Temp\setup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	File created: C:\Users\user\AppData\Local\Temp\nsi3790.tmp\blowfish.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\chrome_elf.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\39FF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	File created: C:\Users\user\AppData\Local\Temp\nsi3790.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll	Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\gujascb

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\setup.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GamePall			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GamePall			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\file.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\gujascb:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gujascb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gujascb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gujascb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gujascb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gujascb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gujascb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\file.exe	API/Special instruction interceptor: Address: 7FF8C88EE814
Source: C:\Users\user\Desktop\file.exe	API/Special instruction interceptor: Address: 7FF8C88ED584
Source: C:\Users\user\AppData\Roaming\gujascb	API/Special instruction interceptor: Address: 7FF8C88EE814
Source: C:\Users\user\AppData\Roaming\gujascb	API/Special instruction interceptor: Address: 7FF8C88ED584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe, 00000000.00000002.2067906236.0000000002E2E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK=N

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 28A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1420000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 5010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2540000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 27B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 25D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1040000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 29A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 49A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2F70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 31B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2FC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: AF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2470000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4470000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: E60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2930000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2840000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 930000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 25C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2380000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: C80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: A80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2730000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 24C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1000000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2C00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2BC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2D80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4D80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 870000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 22D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 20E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: AC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2510000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: C20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: A40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2610000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2520000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1080000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2C80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4C80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 25B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2760000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4860000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 870000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 24C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 22D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: E40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2C60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 29F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1310000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2F30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2D40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 7D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2490000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2210000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 29C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2B90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4B90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2A60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2CD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2AD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: DC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 29B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 49B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 890000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2570000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4570000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: FE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2D30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2C80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2CF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2E40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4E40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 9B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2380000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 9F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 10D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2DF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1240000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 394	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1201	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 891	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 364	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 3423	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 864	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 883	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\libcef.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi3790.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nswE436.tmp\liteFirewall.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\log4net.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi3790.tmp\blowfish.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Del.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\39FF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi3790.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

API coverage: 6.9 %

Source: C:\Windows\explorer.exe TID: 760	Thread sleep time: -120100s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5044	Thread sleep time: -89100s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5444	Thread sleep time: -36400s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5792	Thread sleep time: -33400s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 760	Thread sleep time: -342300s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe TID: 3180	Thread sleep time: -600000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 8_2_00405B4A CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	8_2_00405B4A
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 8_2_004066FF FindFirstFileA,FindClose,	8_2_004066FF
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 8_2_004027AA FindFirstFileA,	8_2_004027AA

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: explorer.exe, 00000002.00000000.2053230734.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000002.00000000.2051650589.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
Source: explorer.exe, 00000002.00000000.2053230734.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0r
Source: explorer.exe, 00000002.00000000.2053230734.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000002.00000000.2053230734.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: explorer.exe, 00000002.00000000.2053230734.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
Source: explorer.exe, 00000002.00000000.2053230734.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.2050678514.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: explorer.exe, 00000002.00000000.2053230734.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000002.00000000.2050678514.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 d9 2e dc 89 72 dX
Source: explorer.exe, 00000002.00000000.2050076985.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
Source: GamePall.exe, 00000009.00000002.3745169954.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
Source: explorer.exe, 00000002.00000000.2051650589.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
Source: explorer.exe, 00000002.00000000.2053230734.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000002.00000000.2050678514.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
Source: explorer.exe, 00000002.00000000.2050678514.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware,p
Source: explorer.exe, 00000002.00000000.2053230734.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
Source: explorer.exe, 00000002.00000000.2053230734.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0#{5-
Source: explorer.exe, 00000002.00000000.2050076985.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000002.00000000.2053230734.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.2051650589.000000000769A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Local\Temp\setup.exe

API call chain: ExitProcess graph end node

graph_8-3649

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\file.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\gujascb	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\gujascb	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D20D90 mov eax, dword ptr fs:[00000030h]	0_2_02D20D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D2092B mov eax, dword ptr fs:[00000030h]	0_2_02D2092B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02E44FD3 push dword ptr fs:[00000030h]	0_2_02E44FD3
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_02CE0D90 mov eax, dword ptr fs:[00000030h]	4_2_02CE0D90
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_02CE092B mov eax, dword ptr fs:[00000030h]	4_2_02CE092B
Source: C:\Users\user\AppData\Roaming\gujascb	Code function: 4_2_02DF49A3 push dword ptr fs:[00000030h]	4_2_02DF49A3

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: gujascb.2.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 137.74.196.132 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 77.221.157.163 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 127.0.0.127 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 78.89.199.216 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 188.114.96.3 80	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\file.exe	Thread created: C:\Windows\explorer.exe EIP: 33419D0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\gujascb	Thread created: unknown EIP: 30619D0			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\file.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gujascb	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gujascb	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3452 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3648 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3728 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720079065909404 --launch-time-ticks=7150995116 --mojo-platform-channel-handle=4036 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720079065909404 --launch-time-ticks=7151287249 --mojo-platform-channel-handle=4128 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (windows nt 6.1; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/126.0.0.0 safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3452 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:2
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-us --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (windows nt 6.1; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/126.0.0.0 safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3648 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-us --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (windows nt 6.1; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/126.0.0.0 safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3728 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (windows nt 6.1; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/126.0.0.0 safari/537.36" --user-data-dir="c:\users\user\appdata\local\cef\user data" --first-renderer-process --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720079065909404 --launch-time-ticks=7150995116 --mojo-platform-channel-handle=4036 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (windows nt 6.1; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/126.0.0.0 safari/537.36" --user-data-dir="c:\users\user\appdata\local\cef\user data" --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720079065909404 --launch-time-ticks=7151287249 --mojo-platform-channel-handle=4128 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (windows nt 6.1; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/126.0.0.0 safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3452 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-us --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (windows nt 6.1; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/126.0.0.0 safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3648 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-us --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (windows nt 6.1; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/126.0.0.0 safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3728 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (windows nt 6.1; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/126.0.0.0 safari/537.36" --user-data-dir="c:\users\user\appdata\local\cef\user data" --first-renderer-process --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720079065909404 --launch-time-ticks=7150995116 --mojo-platform-channel-handle=4036 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (windows nt 6.1; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/126.0.0.0 safari/537.36" --user-data-dir="c:\users\user\appdata\local\cef\user data" --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720079065909404 --launch-time-ticks=7151287249 --mojo-platform-channel-handle=4128 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1	Jump to behavior

Source: explorer.exe, 00000002.00000000.2053230734.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd=
Source: explorer.exe, 00000002.00000000.2050397651.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000002.00000000.2051362435.0000000004B00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2050397651.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000000.2050397651.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000002.00000000.2050397651.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000002.00000000.2050076985.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PProgman

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\setup.exe

8_2_004034CC

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.2067888436.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2067826028.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2290515587.0000000002D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2290789668.0000000004981000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Directory queried: number of queries: 1148

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.2067888436.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2067826028.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2290515587.0000000002D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2290789668.0000000004981000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	12 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	115 System Information Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Windows Service	21 Obfuscated Files or Information	Security Account Manager	511 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	312 Process Injection	12 Software Packing	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	3 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	141 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	312 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	41%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\39FF.exe	100%	Avira	HEUR/AGEN.1359405
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	100%	Avira	HEUR/AGEN.1352426
C:\Users\user\AppData\Local\Temp\setup.exe	100%	Avira	HEUR/AGEN.1359405
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\huge[1].dat	100%	Avira	HEUR/AGEN.1359405
C:\Users\user\AppData\Roaming\gujascb	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\GamePall\Del.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\huge[1].dat	3%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\39FF.exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi3790.tmp\INetC.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi3790.tmp\blowfish.dll	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi3790.tmp\nsProcess.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nswE436.tmp\liteFirewall.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\setup.exe	3%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\GamePall\Del.exe	7%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	3%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\chrome_elf.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\libcef.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\log4net.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://excel.office.com	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
http://www.apache.org/licenses/	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
https://api.msn.com/	0%	URL Reputation	safe
https://www.google.com/chrome/privacy/eula_text.html	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=ru&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICEN	0%	Avira URL Cloud	safe
https://support.google.com/chrome/answer/6098869	0%	Avira URL Cloud	safe
http://gebeus.ru/tmp/index.php	100%	Avira URL Cloud	malware
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	0%	Avira URL Cloud	safe
https://www.google.com/chrome/privacy/eula_text.html	1%	Virustotal		Browse
https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u	0%	Virustotal		Browse
https://support.google.com/chrome/answer/6098869	0%	Virustotal		Browse
http://crbug.com/510270	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICEN	0%	Virustotal		Browse
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	0%	Virustotal		Browse
https://chrome.google.com/webstore?hl=ru&category=theme81https://myactivity.google.com/myactivity/?u	0%	Virustotal		Browse
https://photos.google.com/settings?referrer=CHROME_NTP	0%	Virustotal		Browse
http://crbug.com/510270	0%	Virustotal		Browse
http://gebeus.ru/tmp/index.php	16%	Virustotal		Browse
http://crbug.com/378067	0%	Virustotal		Browse
http://crbug.com/378067	0%	Avira URL Cloud	safe
https://photos.google.com/settings?referrer=CHROME_NTP	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=koCtrl$1	0%	Avira URL Cloud	safe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=ltCtrl$1	0%	Avira URL Cloud	safe
http://cx5519.com/tmp/index.php	100%	Avira URL Cloud	malware
https://chrome.google.com/webstore?hl=ko&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
https://passwords.google.com	0%	Avira URL Cloud	safe
http://crbug.com/497301	0%	Avira URL Cloud	safe
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	0%	Avira URL Cloud	safe
https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22	0%	Avira URL Cloud	safe
http://cx5519.com/tmp/index.php	12%	Virustotal		Browse
http://crbug.com/497301	0%	Virustotal		Browse
http://bageyou.xyz	0%	Avira URL Cloud	safe
https://passwords.google.com	0%	Virustotal		Browse
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	0%	Virustotal		Browse
http://crbug.com/642141	0%	Avira URL Cloud	safe
http://logging.apache.org/log4ne	0%	Avira URL Cloud	safe
http://evilos.cc/tmp/index.php	100%	Avira URL Cloud	malware
https://support.google.com/chromebook?p=app_intent	0%	Avira URL Cloud	safe
http://crbug.com/642141	0%	Virustotal		Browse
http://crbug.com/717501	0%	Avira URL Cloud	safe
http://crbug.com/957772	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=arCtrl$1	0%	Avira URL Cloud	safe
http://crbug.com/717501	0%	Virustotal		Browse
http://evilos.cc/tmp/index.php	13%	Virustotal		Browse
https://support.google.com/chromebook?p=app_intent	0%	Virustotal		Browse
https://chrome.google.com/webstore?hl=huCtrl$1	0%	Avira URL Cloud	safe
http://bageyou.xyz	0%	Virustotal		Browse
http://crbug.com/839189	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
https://www.google.com/chrome/privacy/eula_text.html&	0%	Avira URL Cloud	safe
https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22	0%	Virustotal		Browse
https://chrome.google.com/webstore?hl=lt&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore	0%	Virustotal		Browse
http://crbug.com/957772	0%	Virustotal		Browse
http://xiexie.wf/22_551/huge.dat	0%	Avira URL Cloud	safe
http://crbug.com/819404	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=filCtrl$1	0%	Avira URL Cloud	safe
https://outlook.com	0%	Avira URL Cloud	safe
http://crbug.com/839189	0%	Virustotal		Browse
http://crbug.com/514696	0%	Avira URL Cloud	safe
http://xiexie.wf/22_551/huge.dat	0%	Virustotal		Browse
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	0%	Avira URL Cloud	safe
http://crbug.com/819404	0%	Virustotal		Browse
https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u	0%	Virustotal		Browse
http://crbug.com/514696	0%	Virustotal		Browse
https://www.google.com/chrome/privacy/eula_text.htmlT&ulongPinapamahalaan	0%	Avira URL Cloud	safe
https://crbug.com/1446731	0%	Avira URL Cloud	safe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	0%	Virustotal		Browse
https://chrome.google.com/webstore?hl=lt&category=theme81https://myactivity.google.com/myactivity/?u	0%	Virustotal		Browse
https://chrome.google.com/webstore?hl=ukCtrl$1	0%	Avira URL Cloud	safe
https://www.google.com/chrome/privacy/eula_text.html&	1%	Virustotal		Browse
http://api.install-stat.debug.world/clients/installs	0%	Avira URL Cloud	safe
https://www.newtonsoft.com/jsonschema	0%	Avira URL Cloud	safe
https://chromewebstore.google.com/	0%	Avira URL Cloud	safe
https://support.google.com/chrome/a/answer/9122284	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=fil&category=theme81https://myactivity.google.com/myactivity/?	0%	Avira URL Cloud	safe
https://www.google.com/chrome/privacy/eula_text.htmlT&ulongPinapamahalaan	1%	Virustotal		Browse
https://chrome.google.com/webstore?hl=uk&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
https://www.google.com/	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=zh-CN&category=theme81https://myactivity.google.com/myactivity	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=zh-CNCtrl$1	0%	Avira URL Cloud	safe
https://svn.apache.org/repos/asf/logging/log4net/tags/2.0.8RC1	0%	Avira URL Cloud	safe
https://outlook.com	0%	Virustotal		Browse
https://word.office.comon	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=ar&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
http://www.unicode.org/copyright.html	0%	Avira URL Cloud	safe
https://powerpoint.office.comcember	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=zh-TW&category=theme81https://myactivity.google.com/myactivity	0%	Avira URL Cloud	safe
https://crbug.com/1245093):	0%	Avira URL Cloud	safe
http://crbug.com/775961	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://gebeus.ru/tmp/index.php	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://cx5519.com/tmp/index.php	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://evilos.cc/tmp/index.php	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://office-techs.biz/tmp/index.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICEN	GamePall.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.google.com/chrome/answer/6098869	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/chrome/privacy/eula_text.html	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, ar.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, ko.pak.8.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=ru&category=theme81https://myactivity.google.com/myactivity/?u	ru.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	GamePall.exe, 00000010.00000002.3666285286.00000000049F2000.00000002.00000001.01000000.0000000E.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://excel.office.com	explorer.exe, 00000002.00000000.2053230734.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crbug.com/510270	resources.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crbug.com/378067	resources.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://photos.google.com/settings?referrer=CHROME_NTP	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=koCtrl$1	ko.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=ko&category=theme81https://myactivity.google.com/myactivity/?u	ko.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=ltCtrl$1	lt.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://passwords.google.com	ru.pak.8.dr, ar.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crbug.com/497301	resources.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000002.00000000.2056111189.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://bageyou.xyz	GamePall.exe, 0000001E.00000002.3925989764.0000000002F87000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crbug.com/642141	resources.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://logging.apache.org/log4ne	GamePall.exe	false	Avira URL Cloud: safe	unknown
https://support.google.com/chromebook?p=app_intent	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crbug.com/717501	resources.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crbug.com/957772	resources.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=arCtrl$1	ar.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=huCtrl$1	hu.pak.8.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/839189	resources.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore	resources.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u	en-US.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	39FF.exe, 00000007.00000000.2489064254.000000000040A000.00000008.00000001.01000000.00000006.sdmp, setup.exe, 00000008.00000000.3324712728.000000000040A000.00000008.00000001.01000000.0000000A.sdmp, setup.exe, 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, setup.exe, 00000008.00000003.3589000332.00000000006AA000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe.8.dr, 39FF.exe.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome/privacy/eula_text.html&	ru.pak.8.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=lt&category=theme81https://myactivity.google.com/myactivity/?u	lt.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://xiexie.wf/22_551/huge.dat	39FF.exe, 00000007.00000003.2490885985.00000000030D0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crbug.com/819404	resources.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=filCtrl$1	fil.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://outlook.com	explorer.exe, 00000002.00000000.2053230734.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crbug.com/514696	resources.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/chrome/privacy/eula_text.htmlT&ulongPinapamahalaan	fil.pak.8.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	setup.exe, setup.exe, 00000008.00000000.3324712728.000000000040A000.00000008.00000001.01000000.0000000A.sdmp, setup.exe, 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, setup.exe, 00000008.00000003.3589000332.00000000006AA000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe.8.dr, 39FF.exe.2.dr	false	URL Reputation: safe	unknown
https://crbug.com/1446731	resources.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=ukCtrl$1	uk.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000002.00000000.2051650589.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://api.install-stat.debug.world/clients/installs	GamePall.exe, 00000012.00000002.3711043546.0000000002617000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.newtonsoft.com/jsonschema	Newtonsoft.Json.dll.8.dr	false	Avira URL Cloud: safe	unknown
https://chromewebstore.google.com/	resources.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/a/answer/9122284	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, ar.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=fil&category=theme81https://myactivity.google.com/myactivity/?	fil.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=uk&category=theme81https://myactivity.google.com/myactivity/?u	uk.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/	resources.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=zh-CN&category=theme81https://myactivity.google.com/myactivity	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=zh-CNCtrl$1	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://svn.apache.org/repos/asf/logging/log4net/tags/2.0.8RC1	GamePall.exe, GamePall.exe, 00000010.00000002.3666421353.0000000004A36000.00000002.00000001.01000000.0000000E.sdmp, GamePall.exe, 00000010.00000002.3666285286.00000000049F2000.00000002.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.comon	explorer.exe, 00000002.00000000.2053230734.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=ar&category=theme81https://myactivity.google.com/myactivity/?u	ar.pak.8.dr	false	Avira URL Cloud: safe	unknown
http://www.unicode.org/copyright.html	icudtl.dat.8.dr	false	Avira URL Cloud: safe	unknown
https://powerpoint.office.comcember	explorer.exe, 00000002.00000000.2056111189.000000000C460000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=zh-TW&category=theme81https://myactivity.google.com/myactivity	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://crbug.com/1245093):	resources.pak.8.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/775961	resources.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/privacy/eula_text.htmlP&agalbaTvarko	lt.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://www.newtonsoft.com/json	Newtonsoft.Json.dll.8.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/1352358	resources.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://codereview.chromium.org/25305002).	resources.pak.8.dr	false	Avira URL Cloud: safe	unknown
http://schemas.micro	explorer.exe, 00000002.00000000.2052671949.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2052248639.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2052698125.0000000008890000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crbug.com/1201800	resources.pak.8.dr	false	Avira URL Cloud: safe	unknown
http://api.install-stat.debug.world/clients/activity	GamePall.exe, 00000012.00000002.3711043546.0000000002617000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=zh-TWCtrl$1	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/).	GamePall.exe, GamePall.exe, 00000010.00000002.3666285286.00000000049F2000.00000002.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
https://myactivity.google.com/	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/275944	resources.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/privacy/eula_text.html&S	hu.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/privacy/eula_text.htmlH&elpManaged	en-US.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://policies.google.com/	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://wns.windows.com/)s	explorer.exe, 00000002.00000000.2053230734.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	GamePall.exe, 00000010.00000002.3666285286.00000000049F2000.00000002.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherEnabled	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/category/extensions	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=hu&category=theme81https://myactivity.google.com/myactivity/?u	hu.pak.8.dr	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/	GamePall.exe, GamePall.exe, 00000010.00000002.3666285286.00000000049F2000.00000002.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=ruCtrl$1	ru.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://passwords.google.comGoogle	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, fil.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, ko.pak.8.dr	false	Avira URL Cloud: safe	unknown
http://james.newtonking.com/projects/json	Newtonsoft.Json.dll.8.dr	false	URL Reputation: safe	unknown
http://crbug.com/672186).	resources.pak.8.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/437891.	resources.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=enCtrl$1	en-US.pak.8.dr	false	Avira URL Cloud: safe	unknown
https://www.nuget.org/packages/Newtonsoft.Json.Bson	Newtonsoft.Json.dll.8.dr	false	Avira URL Cloud: safe	unknown
https://api.msn.com/	explorer.exe, 00000002.00000000.2053230734.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crbug.com/456214	resources.pak.8.dr	false	Avira URL Cloud: safe	unknown
http://crl.v	explorer.exe, 00000002.00000000.2050076985.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist	setup.exe, 00000008.00000002.3975925693.000000000276E000.00000004.00000020.00020000.00000000.sdmp, hu.pak.8.dr, ru.pak.8.dr, fil.pak.8.dr, ar.pak.8.dr, en-US.pak.8.dr, zh-CN.pak.8.dr, uk.pak.8.dr, lt.pak.8.dr, ko.pak.8.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
137.74.196.132	unknown	France	16276	OVHFR	true
77.221.157.163	unknown	Russian Federation	30968	INFOBOX-ASInfoboxruAutonomousSystemRU	true
78.89.199.216	unknown	Kuwait	29357	WATANIYATELECOM-ASKW	true
188.114.96.3	unknown	European Union	13335	CLOUDFLARENETUS	true
104.21.45.251	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.127

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467515
Start date and time:	2024-07-04 11:30:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@219/112@0/6
EGA Information:	Successful, ratio: 36.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 432 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Connection to analysis system has been lost, crash info: Unknown
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Execution Graph export aborted for target GamePall.exe, PID 1876 because it is empty
Execution Graph export aborted for target GamePall.exe, PID 2568 because it is empty
Execution Graph export aborted for target GamePall.exe, PID 2876 because it is empty
Execution Graph export aborted for target GamePall.exe, PID 4012 because it is empty
Execution Graph export aborted for target GamePall.exe, PID 4740 because it is empty
Execution Graph export aborted for target GamePall.exe, PID 5456 because it is empty
Execution Graph export aborted for target GamePall.exe, PID 6292 because it is empty
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
05:31:01	API Interceptor	341591x Sleep call for process: explorer.exe modified
05:33:35	API Interceptor	1x Sleep call for process: GamePall.exe modified
11:31:16	Task Scheduler	Run new task: Firefox Default Browser Agent B0F632735C927991 path: C:\Users\user\AppData\Roaming\gujascb
11:33:36	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run GamePall C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
11:33:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run GamePall C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
137.74.196.132	file.exe	Get hash	malicious	LummaC, SmokeLoader	Browse
137.74.196.132	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
77.221.157.163	file.exe	Get hash	malicious	LummaC, SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	5GOuTtZoQn.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
78.89.199.216	LavMqtzZNw.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	movlat.com/tmp/
	1Vkf7silOj.exe	Get hash	malicious	LummaC, Amadey, Mars Stealer, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse	movlat.com/tmp/
	OU4gKY1zMo.exe	Get hash	malicious	Amadey	Browse	jkshb.su/forum/index.php
	uBgwoHPWaf.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	dbfhns.in/tmp/index.php
188.114.96.3	http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	Get hash	malicious	HTMLPhisher	Browse	business.ifbsmetaiidentiityconfirms.com/favicon.ico
	BL Draft.exe	Get hash	malicious	FormBook	Browse	www.ediancai.cn/x7r2/
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/btd2ptah/download
	Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Get hash	malicious	FormBook	Browse	www.ad14.fun/oc7s/
	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	www.ad14.fun/oc7s/
	9098393827383039.exe	Get hash	malicious	FormBook	Browse	www.coinwab.com/kqqj/
	SOA 020724.exe	Get hash	malicious	FormBook	Browse	www.ad14.fun/az6h/?Vn=Ydx4qJJ0n&3jJlx=2tWzkzncG4ra8DBegJJBToW7oB13AdJXZ1KkbDLW+Ah9MGsNEQDOdLre6u2t4zOJ63yLnsPJ97sPnqMxsSzbOxuABFq0Im2Ecm9EQ8GOdhogxDCvRrrALITlDFg7ZHNgcXHQPxMcHnGf
	Adjunto confirmacion de pedido.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.coinwab.com/kqqj/
	aAEsSBx24sxHhRz.exe	Get hash	malicious	FormBook	Browse	www.camperelektrikde.shop/dy13/?GdIHAFZ=8bNdgr3QvPw6/pDIZNt+55DvjzemDI0RO+pYD3qlulbIe6f7Sn3K06Z4F4Tg3hK83Y0/&BhU=5jl0ddZhNnYlOrV0
	http://sp.26skins.com/steamstore/category/adventure_rpg/?snr=1_5_9__12	Get hash	malicious	Unknown	Browse	sp.26skins.com/favicon.ico
104.21.45.251	file.exe	Get hash	malicious	LummaC, SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	LXbM8RbhLa.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.2850.19434.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	OBbrO5rwew.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	SmokeLoader	Browse
	35bf9dfd223e02da2ee3d57ec493156787a3c2cecb8b655a583985a2f14cc6e3_dump.exe	Get hash	malicious	LummaC, SmokeLoader	Browse
	ZXQ3AcEN5Q.exe	Get hash	malicious	Unknown	Browse
	ZXQ3AcEN5Q.exe	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WATANIYATELECOM-ASKW	LavMqtzZNw.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	78.89.199.216
	OU4gKY1zMo.exe	Get hash	malicious	Amadey	Browse	78.89.199.216
	HZcInD4qL2.elf	Get hash	malicious	Unknown	Browse	178.53.5.3
	Mt5VyD087r.elf	Get hash	malicious	Mirai	Browse	188.71.222.168
	uBgwoHPWaf.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	78.89.199.216
	doyQfd5Npp.elf	Get hash	malicious	Mirai	Browse	78.89.161.224
	bot.arm.elf	Get hash	malicious	Mirai	Browse	78.89.100.253
	249pTre4Xi.elf	Get hash	malicious	Mirai	Browse	78.89.166.9
	Y98pGn3FUt.elf	Get hash	malicious	Mirai	Browse	188.71.222.147
	3FWcPHiVPC.elf	Get hash	malicious	Mirai	Browse	178.53.42.208
CLOUDFLARENETUS	Invoice - 13604562148823146027218688082530555300774892366170 - Pilatus-aircraft.pdf	Get hash	malicious	HTMLPhisher	Browse	104.21.40.60
	file.exe	Get hash	malicious	XenoRAT	Browse	172.67.149.76
	swift_copy.docx.doc	Get hash	malicious	Unknown	Browse	188.114.96.3
	swift_copy.docx.doc	Get hash	malicious	Unknown	Browse	188.114.97.3
	Vq3Ri8EP9z.exe	Get hash	malicious	LummaC	Browse	172.67.203.179
	https://login.ring-sport.ir/#DEME%20Group	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://offpardu.com/fr	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://webdatatrace.com	Get hash	malicious	Unknown	Browse	172.67.185.251
	Revised PO.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	update23.bat	Get hash	malicious	Braodo	Browse	172.65.251.78
OVHFR	VXBKak29Dz.elf	Get hash	malicious	Mirai	Browse	8.18.211.14
	file.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	137.74.196.132
	Encrypted Doc-[izO-3902181].pdf	Get hash	malicious	HTMLPhisher	Browse	149.56.200.84
	Encrypted Doc-[Ogi-5917842].pdf	Get hash	malicious	HTMLPhisher	Browse	149.56.200.84
	http://multichaindappsx.pages.dev/	Get hash	malicious	Unknown	Browse	5.135.209.100
	https://troy-acoustics.neetoform.com/25d7349ac44d8bc00661	Get hash	malicious	Phisher	Browse	167.114.173.136
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	137.74.196.132
	H50bdqfVH2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	51.195.62.41
	bv8iPF7cTY.exe	Get hash	malicious	AgentTesla	Browse	198.50.154.144
	VG0x1LZCFb.exe	Get hash	malicious	AgentTesla	Browse	51.255.149.48
INFOBOX-ASInfoboxruAutonomousSystemRU	file.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	77.221.157.163
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	77.221.157.163
	5GOuTtZoQn.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	77.221.157.163
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	77.221.157.163
	Eclf71HXa1.exe	Get hash	malicious	Unknown	Browse	77.221.149.185
	Eclf71HXa1.exe	Get hash	malicious	Unknown	Browse	77.221.149.185
	file.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse	77.221.149.185
	file.exe	Get hash	malicious	PureLog Stealer	Browse	77.221.140.76
	file.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	77.221.140.76
	file.exe	Get hash	malicious	PureLog Stealer	Browse	77.221.140.76

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\huge[1].dat	file.exe	Get hash	malicious	LummaC, SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	5GOuTtZoQn.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	JuHVfiAuLo.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	LXbM8RbhLa.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	EiPVv5yELP.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	6IMo1kM9CC.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.2850.19434.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
C:\Users\user\AppData\Local\Temp\39FF.exe	file.exe	Get hash	malicious	LummaC, SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	5GOuTtZoQn.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	JuHVfiAuLo.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	LXbM8RbhLa.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	EiPVv5yELP.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	6IMo1kM9CC.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.2850.19434.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\huge[1].dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\39FF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	107232830
Entropy (8bit):	7.999946456161068
Encrypted:	true
SSDEEP:	1572864:6F6Q78DDbO8pDfwpK5ZAQ5WKor2G5N6Y7ZxFo9jk7WUTLECglga1R7P435MZZDXA:jPNVfsQZoL5NJdo9jKWergS89P4qZZc
MD5:	FF2293FBFF53F4BD2BFF91780FABFD60
SHA1:	61A9EDCF46228DC907AD523AA6FD035CC26C9209
SHA-256:	B9BC473FC866909F089E005BAF2537EE7FF2825668D40D67C960D5C2AFB34E9F
SHA-512:	C31A0046BA580926097422DF34619B614AA0DEB6435EC5CE68A553846FAD15BC61908B8C8292D25EE061BA1974637A7B91D72F19CCCCC2C76B9AC737B1CB4A5E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 5GOuTtZoQn.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe, Detection: malicious, Browse Filename: JuHVfiAuLo.exe, Detection: malicious, Browse Filename: LXbM8RbhLa.exe, Detection: malicious, Browse Filename: EiPVv5yELP.exe, Detection: malicious, Browse Filename: 6IMo1kM9CC.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.2850.19434.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........................................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\39FF.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	modified
Size (bytes):	293869
Entropy (8bit):	5.61569579822855
Encrypted:	false
SSDEEP:	3072:lFi6z/VXzAf3ocMNqB3r1Josf+OMhERMlm+twHBumSYyDgIoIPM7l0UGHM7:lxFSIjs+OM2eLFmSFgIZk7+HM7
MD5:	60172CA946DE57C3529E9F05CC502870
SHA1:	DE8F59D6973A5811BB10A9A4410801FA63BC8B56
SHA-256:	42CEB2252FEC41FD0ACC6874B41C91E0BA07C367045D6A9A7850D59781C2584C
SHA-512:	15D37AF3CAB96FC9026A1898E09C775FE0D277098A3FE20C2E591272DE996A243850D43F3B48B4C037C5FED359E57795A7CF1652547D7AD8B16B186AB9508792
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 5GOuTtZoQn.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe, Detection: malicious, Browse Filename: JuHVfiAuLo.exe, Detection: malicious, Browse Filename: LXbM8RbhLa.exe, Detection: malicious, Browse Filename: EiPVv5yELP.exe, Detection: malicious, Browse Filename: 6IMo1kM9CC.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.2850.19434.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........`..X............................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...X....`......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi3790.tmp\INetC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\39FF.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.668346578219837
Encrypted:	false
SSDEEP:	384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
MD5:	92EC4DD8C0DDD8C4305AE1684AB65FB0
SHA1:	D850013D582A62E502942F0DD282CC0C29C4310E
SHA-256:	5520208A33E6409C129B4EA1270771F741D95AFE5B048C2A1E6A2CC2AD829934
SHA-512:	581351AEF694F2489E1A0977EBCA55C4D7268CA167127CEFB217ED0D2098136C7EB433058469449F75BE82B8E5D484C9E7B6CF0B32535063709272D7810EC651
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9<.EXR.EXR.EXR.b.).LXR.EXS..XR.b. .FXR.b.(.DXR.b...DXR.b.*.DXR.RichEXR.................PE..L....I6V...........!.....8...P......Q?.......P...................................................................... G..l....?..d.......(...............................................................................P............................text....7.......8.................. ..`.data...<<...P.......<..............@....rsrc...(............D..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi3790.tmp\blowfish.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\39FF.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.674611218414922
Encrypted:	false
SSDEEP:	384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
MD5:	5AFD4A9B7E69E7C6E312B2CE4040394A
SHA1:	FBD07ADB3F02F866DC3A327A86B0F319D4A94502
SHA-256:	053B4487D22AACF8274BAB448AE1D665FE7926102197B47BFBA6C7ED5493B3AE
SHA-512:	F78EFE9D1FA7D2FFC731D5F878F81E4DCBFAF0C561FDFBF4C133BA2CE1366C95C4672D67CAE6A8BD8FCC7D04861A9DA389D98361055AC46FC9793828D9776511
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................6..........dD.......P....@.....................................................................Y.......................................p...................................................................................CODE....\|4.......6.................. ..`DATA....8....P.......:..............@...BSS..........p.......L...................idata...............L..............@....edata..Y............P..............@..P.reloc..p............R..............@..P.rsrc................V..............@..P.....................X..............@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi3790.tmp\nsProcess.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\39FF.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	4.666004851298707
Encrypted:	false
SSDEEP:	48:iYXzAm8HGJLvwM8GJFd6I7W4JtT2bxNNAa4GsNf+CJ8aYqmtlKdgAtgma1QvtCSJ:lz2mJkpGR6GY74GQ1YqmstgGCtR
MD5:	FAA7F034B38E729A983965C04CC70FC1
SHA1:	DF8BDA55B498976EA47D25D8A77539B049DAB55E
SHA-256:	579A034FF5AB9B732A318B1636C2902840F604E8E664F5B93C07A99253B3C9CF
SHA-512:	7868F9B437FCF829AD993FF57995F58836AD578458994361C72AE1BF1DFB74022F9F9E948B48AFD3361ED3426C4F85B4BB0D595E38EE278FEE5C4425C4491DBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.I...I...I...n\|f.L...I...Q...@..K...@..H...@..H...RichI...........PE..L...`..N...........!......................... ...............................`.......................................#....... ..<....@.......................P..\|.................................................... ..`............................text............................... ..`.rdata....... ......................@..@.data... ....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsm803B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	358363995
Entropy (8bit):	6.972150585647623
Encrypted:	false
SSDEEP:	3145728:KTzytRGD/CYRNIPKYTFBhfmOS9KBaVzTx9OSsKV97nM:KnUs4tvaVzTD99M
MD5:	5F9D89B40243E83C0B48206CE4EB77D1
SHA1:	477A019AB11E5793168B3E41D83B80A8AC8F1D43
SHA-256:	2BF31800E731EF63E7E5BDEECD87B50B349EC8F5C9D752AACB807AC0E82E95B9
SHA-512:	5B812C2D341FE8A9296EF68E416E0EFA8185FB3ECCEC0917AB206CD7639E1810E6444538B61583E2260F1A46D4209E1995CFBF940A1D9836C4155ADF0504940B
Malicious:	false
Preview:	........,.......................H...........................................................................................................................................................................................................................................................e...i...............j.......................3.......................................................................................................................t....V..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nswE436.tmp\liteFirewall.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	6.389604568119155
Encrypted:	false
SSDEEP:	1536:Dli3i1jKfTV0LzYpAzMk2nACScLw5jPAT:j9KLQ+ScLw5jPAT
MD5:	165E1EF5C79475E8C33D19A870E672D4
SHA1:	965F02BFD103F094AC6B3EEF3ABE7FDCB8D9E2A5
SHA-256:	9DB9C58E44DFF2D985DC078FDBB7498DCC66C4CC4EB12F68DE6A98A5D665ABBD
SHA-512:	CD10EAF0928E5DF048BF0488D9DBFE9442E2E106396A0967462BEF440BF0B528CDF3AB06024FB6FDAF9F247E2B7F3CA0CEA78AFC0CE6943650EF9D6C91FEE52A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W=.e9n.e9n.e9n...n.e9n...n.e9n..Bn.e9n.e8n.e9n.7.n.e9n...n.e9n...n.e9n...n.e9nRich.e9n........PE..L...,.N...........!.........^.......%...............................................3..................................`...$'..d....`.......................p...................................... ...@...............h............................text...1........................... ..`.rdata..P/.......0..................@..@.data........0......................@....rsrc........`.......*..............@..@.reloc.......p.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\setup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\39FF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	107232830
Entropy (8bit):	7.999946456161068
Encrypted:	true
SSDEEP:	1572864:6F6Q78DDbO8pDfwpK5ZAQ5WKor2G5N6Y7ZxFo9jk7WUTLECglga1R7P435MZZDXA:jPNVfsQZoL5NJdo9jKWergS89P4qZZc
MD5:	FF2293FBFF53F4BD2BFF91780FABFD60
SHA1:	61A9EDCF46228DC907AD523AA6FD035CC26C9209
SHA-256:	B9BC473FC866909F089E005BAF2537EE7FF2825668D40D67C960D5C2AFB34E9F
SHA-512:	C31A0046BA580926097422DF34619B614AA0DEB6435EC5CE68A553846FAD15BC61908B8C8292D25EE061BA1974637A7B91D72F19CCCCC2C76B9AC737B1CB4A5E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........................................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_0

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_1

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012096502606932763
Encrypted:	false
SSDEEP:	3:MsEllllkXl:/M/6
MD5:	259E7ED5FB3C6C90533B963DA5B2FC1B
SHA1:	DF90EABDA434CA50828ABB039B4F80B7F051EC77
SHA-256:	35BB2F189C643DCF52ECF037603D104035ECDC490BF059B7736E58EF7D821A09
SHA-512:	9D401053AC21A73863B461B0361DF1A17850F42FD5FC7A77763A124AA33F2E9493FAD018C78CDFF63CA10F6710E53255CE891AD6EC56EC77D770C4630F274933
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_2

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_3

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	modified
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\index

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlH//:Ls3H
MD5:	B51046AFD1645EB3C361DD67B7B0E3A2
SHA1:	DEE547DE5BFD2189AFC87A7E99ACDD28F15DCDE0
SHA-256:	EFD87D5A97523A06EBB0C4317200D2D76A70671B62FE855F86F011092B0DDECE
SHA-512:	FFCE93E24A99C7760B3C77F8371020D5360635EEAFFD38C064F9C0824D3FCFD46E3CE7921F3C173869CD420BDADA7086C6C5A80B62866928ECFE481EE63C347D
Malicious:	false
Preview:	........................................OJ}..z/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\Del.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.622398838808078
Encrypted:	false
SSDEEP:	96:QPjzIyfbInD3W0IwrBmEH7UewW4ORIhmY5XO40uK8DDzNt:pQIS0IwrJbU7W4kIX5e4kgF
MD5:	97D4D47D539CB8171BE2AEFD64C6EBB1
SHA1:	44ABF82DD553CCE0C1F41B9B78D853075DDD1F16
SHA-256:	8D996D5F68BF2248F223C4F3549303BC6A8EC58CC97FCB63B7BB7D8068850273
SHA-512:	7D402847B093E208410C695095DE815A3F5D5DA81630FD51C88C009C48C269D0EA5016D626351BB9D38862163FAD930645072C50ACCCD743DC0E19531A592FDE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 7%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....&.].........."...0.............64... ...@....@.. ....................................@..................................3..O....@.......................`.......2............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H........#...............1...............................................0..-.......(....r...p(.....(.......(....,...(....(........0..T........~....(.....~....(.....(....s....%.o....%.o....%.o....%.o....%~....o....(....&..&..........PP.......0..6.......(....(......( ...r...p~....r...p(!.....("...,...(#......0..........r...p.~$.....o%.....,..~....o&......,..o'....ra..p.~$.....o%.....,..~....o(......,..o'....r...p.~$.....o%.....,..~....o(......,..o'......&..*....4.......#..

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_0

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_1

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012096502606932763
Encrypted:	false
SSDEEP:	3:MsEllllkXl:/M/6
MD5:	259E7ED5FB3C6C90533B963DA5B2FC1B
SHA1:	DF90EABDA434CA50828ABB039B4F80B7F051EC77
SHA-256:	35BB2F189C643DCF52ECF037603D104035ECDC490BF059B7736E58EF7D821A09
SHA-512:	9D401053AC21A73863B461B0361DF1A17850F42FD5FC7A77763A124AA33F2E9493FAD018C78CDFF63CA10F6710E53255CE891AD6EC56EC77D770C4630F274933
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_2

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_3

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\index

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl9l/:Ls3
MD5:	23FB9059F88519191EC1EDCCC84D782E
SHA1:	451C9A0BF32007002A49BC8A9133E8428AA1954E
SHA-256:	8354B7996CC22267BF3312123EA279310800870749F24983046F34CB09DC5497
SHA-512:	52F95C56633D7E9022C22F629932D2CE13A4F865120790C86E2A649421904625E5918BF64DB7C0DD6C4DF12495A5FF50EA903FE1DE317C67FC8E71C1DACD0F2E
Malicious:	false
Preview:	..........................................r..z/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	296448
Entropy (8bit):	5.660420770467009
Encrypted:	false
SSDEEP:	3072:xTpjI4TptgvmHMaellnhblkK0m2QEk0xjo4OVzdvayfvYn6A:ppbVtsg1e5b2Px2zdyyq
MD5:	7A3502C1119795D35569535DE243B6FE
SHA1:	DA0D16BC66614C7D273C47F321C5EE0652FB5575
SHA-256:	B18FEFB56ED7B89E45CEC8A5494FBEC81E36A5CB5538CCBB8DE41CCE960FAA30
SHA-512:	258B111AC256CD8145CBE212D59DFF5840D67E70EFFD7CDDC157B2A3461B398BBC3446004980131FAA6A8762C19305F56E7B793F045331B56B8BD17D85B884C4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....rf..............0.............>.... ........@.. ....................................@....................................O.......t............................................................................ ............... ..H............text...d.... ...................... ..`.rsrc...t...........................@..@.reloc..............................@..B................ .......H....... ...$...........D...p............................................(....s....Z..(....,...(....(.....(......(......(............~........0..W.......(....".....(......,..o....-...o.....+...( .....o....&..(!...-...........o"....."...BZ.......%..A.......0..Q.......(....(........,..o....-...o.....+...( .....o....&.._...(!...-...........o"..............!. A.......0..V.......(....(......,..o....-.~#.....o.....+...( ...."...B[..o....&..(!...-...........o"....*......

C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	462336
Entropy (8bit):	6.803831500359682
Encrypted:	false
SSDEEP:	6144:leSYvQAd10GtSV41OJDsTDDVUMle6ZjxLV/rHo0Oaaz2R9IY:oJBdBS4msNUCe65frHMnz2R9
MD5:	6DED8FCBF5F1D9E422B327CA51625E24
SHA1:	8A1140CEBC39F6994EEF7E8DE4627FB7B72A2DD9
SHA-256:	3B3E541682E48F3FD2872F85A06278DA2F3E7877EE956DA89B90D732A1EAA0BD
SHA-512:	BDA3A65133B7B1E2765C7D07C7DA5103292B3C4C2F0673640428B3E7E8637B11539F06C330AB5D0BA6E2274BD2DCD2C50312BE6579E75C4008FF5AE7DAE34CE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=N...........!................N#... ...@....@.. ..............................T.....@.................................."..O....@..P....................`......."............................................... ............... ..H............text...T.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................0#......H.......0U..l...........P%.../..P ......................................6..`N.?O...%.C.k_..d...I......5a.......9x......R...gg8...JM...`.[. .o..eE1$_.M.h.q.oz..1..........@....s.c/J..wk.D.....t..&...(.......0..2........r...p(....}.......}"....(........(.........(......r...p(....}.......}"....(........(......0..j.........o....-..s#...+..}......(......(......}.....(....s....}......}......}......(......%-.&r...p}......j(#...rr!..p.{.....{.....B...(....*..0..A........{..

C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	574376
Entropy (8bit):	5.8881470355864725
Encrypted:	false
SSDEEP:	12288:ZzfhypmNGgHA37YyUD1AboTf3xnpJbC8VGSBJjRuz7:ZoI1AbQf3xnpJbC8VLBJjRuz7
MD5:	8F81C9520104B730C25D90A9DD511148
SHA1:	7CF46CB81C3B51965C1F78762840EB5797594778
SHA-256:	F1F01B3474B92D6E1C3D6ADFAE74EE0EA0EBA6E9935565FE2317686D80A2E886
SHA-512:	B4A66389BF06A6611DF47E81B818CC2FCD0A854324A2564A4438866953F148950F59CD4C07C9D40CC3A9043B5CE12B150C8A56CCCDF98D5E3F0225EDF8C516F3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ot............" ..0.............6.... ........... ....................................@....................................O.......................................T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........f...P............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{E....3...{D......(....,...{D.....{F.......-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..

C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	561424
Entropy (8bit):	4.606896607960262
Encrypted:	false
SSDEEP:	6144:XqqUmk/Rik2rH6dl0/IaHNpOVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QyMYFLse:DUK
MD5:	928ED37DB61C1E98A2831C8C01F6157C
SHA1:	98103C2133EBDA28BE78BFE3E2D81D41924A23EE
SHA-256:	39F6A4DB1BE658D6BAFF643FA05AAE7809139D9665475BFCA10D37DCA3384F21
SHA-512:	F59387BFA914C7DB234161E31AD6075031ACA17AAEF4B8D4F4B95C78C7A6A8D0E64211566CA2FD4549B9DA45231F57A4191FBCD3809404653F86EE2ABD4937A4
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Newtonsoft.Json</name>.. </assembly>.. <members>.. <member name="T:Newtonsoft.Json.Bson.BsonObjectId">.. <summary>.. Represents a BSON Oid (object id)... </summary>.. </member>.. <member name="P:Newtonsoft.Json.Bson.BsonObjectId.Value">.. <summary>.. Gets or sets the value of the Oid... </summary>.. <value>The value of the Oid.</value>.. </member>.. <member name="M:Newtonsoft.Json.Bson.BsonObjectId.#ctor(System.Byte[])">.. <summary>.. Initializes a new instance of the <see cref="T:Newtonsoft.Json.Bson.BsonObjectId"/> class... </summary>.. <param name="value">The Oid value.</param>.. </member>.. <member name="T:Newtonsoft.Json.Bson.BsonReader">.. <summary>.. Represents a reader that provides fast, non-cached, forward-only access to s

C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	215862
Entropy (8bit):	5.849338245796311
Encrypted:	false
SSDEEP:	3072:rFi6z/VXzAf3oc8+vat7fvYnDAdOVz5kNx:rxFSI+y1qk6zuNx
MD5:	9D21A25AA1B5985A2C8CBCE7F7007295
SHA1:	86EBF56352B4DBB831FAE0CCA180B4ADD951240D
SHA-256:	E41F984C39183BA4FD1578134D71E203F4A7A8C23F278924562876326FC40EE2
SHA-512:	EE4A1AC97968F2DDA3C54A49AC33D3FCE28C4DAE72032D9FDD1F8D8BA41B07A1D78D15E11586DA54AD5E0F2BD4A48C79A0CBAC84DE3D957B2AC6C1B5F41A33BB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........................................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	875520
Entropy (8bit):	5.621956468920589
Encrypted:	false
SSDEEP:	12288:jsRfnBqqvFXWesd2HiZ9fyn+5FHrvUR1Qnzx7LuQ:jsRITeWAQ5vtu
MD5:	B03C7F6072A0CB1A1D6A92EE7B82705A
SHA1:	6675839C5E266075E7E1812AD8E856A2468274DD
SHA-256:	F561713347544E9D06D30F02A3DFCEC5FE593B38894593AEEDF5700666B35027
SHA-512:	19D6792EB9BA8584B94D0D59E07CE9D1C9C4DA5516490F4ABCE5AE0D7D55B357BDA45B2093B3E9EB9D6858061E9D3F530A6655C4779A50C911501AE23925C566
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..R...........p... ........... ....................................@..................................p..O.......x............................o..T............................................ ............... ..H............text....P... ...R.................. ..`.rsrc...x............T..............@..@.reloc...............Z..............@..B.................p......H....... .................................................................(......(......(....^.(.......=...%...}....:.(......}....:.(......}....^.(.......>...%...}....:.(......}.....(.............0..,.......(....o.......3......... ....3.(....-.....0..L.......~..... . ..(......(....-..(....r...p( ...,.......&...~....(!...,..("..............+1...........4.......~.....~......(.....~....,..(#...-.(....-..(....+.r...ps$...z(..........b.r...p(%...~.....(....&*.r

C:\Users\user\AppData\Roaming\GamePall\cef.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1946739
Entropy (8bit):	7.989700491058983
Encrypted:	false
SSDEEP:	49152:fpXzD2VLpS71ycdao6LreGCL/0jJZWOiBiXkbEia9T:xjyFgZ0Lr2/0jJU5BiIEN
MD5:	96AD47D78A70B33158961585D9154ECC
SHA1:	149BF6F6905A76B0CC9E9ACA580357BD6C3497A2
SHA-256:	C861117D1F1DBF02867B46FA87CB8C65C3213D196029EE81A02B617D131236E2
SHA-512:	6A971F742B5754EEF39C6C2C64DB13DFDCB74D8CB23833404E9EF5AD89E142278E5DF789F508DB561C5E957013AE0C60D002CDFA93BCD87CA4967D610DF1579B
Malicious:	false
Preview:	........V...f.....g.7........................!.....%....o8...).>...).F...).H...).X...).a...)i...).k...).q...)Lt...).v...)Tw...).x...).}...).....)I....)i....)....).....).....)L....)....)....)t....).....).....).....)s....).... )....!)....")....#)....$)}...%)+...&)h#..').'..().-..)).>..).A..+).C..,).Q..-)CU...).]..<).d..=).l..>)i...?)G...@)H...A)r...B)....C)z...T)....U)....V)+...W)....X)....Y)....Z)....[)#...\)}...]).!..^)R1.._).2..`).;..a).=..b)mE..c)QG..d).H..e)qL..f).U..g).]..h).b..i))d..j).e..k).g..l)Pi..m).p..n).z..s).z...).....)b....).....)'....).....)....)....).....).....)....).....)s....)F....)j....)....).....)....)....)....)h....)H....)....).....).....)k....).....)L....)q....)2....).....).....).....).....).....)N....)\|....).....).....).....).!...).)...).6...).C...)RE...).L...).N...).O...).U...)bV...).W...).^...)o_...)(g...)Si...).v...).....)0....)/....).....),....)..........F....]....3....v........v...................$... ....!8..."....#....$....%*..

C:\Users\user\AppData\Roaming\GamePall\cef_100_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	214119
Entropy (8bit):	7.955451054538398
Encrypted:	false
SSDEEP:	6144:m5S+8U5mtp0ra7rFrJzw95T9OHCZg0Gb0OveGe04mExhLY:mWU5OGUFoqoORehrQ
MD5:	391F512173ECEC14EB5CE31299858DE1
SHA1:	3A5A41A190C1FB682F9D9C84F500FF50308617FC
SHA-256:	E0F5C754C969CCA0AC4594A6F3F2C23D080A09EEA992AF29E19F4291FD1E0B06
SHA-512:	44D7B9BCB3544C3F5550150EF3522BF6A0B36900695E6A13E44F5616E16A058548189D4FEA4A22248B1CB2B273B0EAA7D559EB2D8F013BED520E4097BD45D800
Malicious:	false
Preview:	........................#.b...&.....:.g....7.....7.....7.....7\|(...7.-...7t5...7.6...7.9...7s:...7hB...7.E...7.G...7.K...7qN...7.Q...7yR...7.S...7.W...7.\...7.b...7.i...7.k...76m...7Vq...7.r...7.v...7.y...7.{...7.~...7Z....75....7;....7W....7.....7c....7u....7b....7.....7.....7.....7Q....7*....7\....8."...8,)..<FqG..=F7I..>F.L..?F$O..@F.P..AFaQ..BFnT..CF.W..DF.Y..EFJ\..FF.^..MF(b..NF.c..QF.e..RF.f..YFZg..ZF.p..[F.x..\F.{..]F.{...L.\|...L.....L....Ni....N.....NJ....N2....N+....N^....No....N9....NK....N....N1....N$....N....Nh....N.....N.....U.....U.....U.....U.....U.....U[....U.&...Uh(...U?/...U.4...U.:...U.@...U.B...U,G...U.K...U)N...U.R...UF\...U.`...U.b...U.j...U]s...UEt...U.u...U.w...U.z...Uh{...U.}...U#....U.....U^....U.....U\|....U.....U.....U.....U.....U.....U.....U.....U.....U.....U]....U?....U.....U9....U....U.....Um....U<....U!....U.....U.....U....Uq....U3....U!....U.....U....U.....Uu....UJ....U.....U.....U.....U.....U`....U'....U.....U.....Ul....U%....U7....U.....U.....UW.

C:\Users\user\AppData\Roaming\GamePall\cef_200_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	290001
Entropy (8bit):	7.9670215100557735
Encrypted:	false
SSDEEP:	6144:tS+8U5mtp0ra7rFriDQYaF+9bQHgs4jTlmOHCZVWGMRe8InVXYopym74:CU5OGUFrfs4gs4jTQ6ebVIo374
MD5:	BF59A047984EAFC79E40B0011ED4116D
SHA1:	DF747125F31F3FF7E3DFE5849F701C3483B32C5E
SHA-256:	CD9BE67AA0527F16E309189FA2369E1A2596D0601A7D55C405F8A619F4D095E9
SHA-512:	85A545758E8C89EF47BF11B553C57D23ED7DA6AE89A8BCCB262F509AABE61A1121C3F87EC9200791F2670225BAEECC3C92AED6AFDA86C08CA0FD611DA2E595D2
Malicious:	false
Preview:	........................#.....&.....:......7.....7.....7.....7.+...7.1...7.8...7.9...7)<...7.=...7xE...7.H...7.J...7'N...7.Q...7.T...7.U...7.W...7.Z...7._...7.e...7.l...7.n...7Fp...7ft...7.v...7)y...7.\|...7.~...7.....7j....7E....7K....7g....7.....7s....7.....7r....7.....7.....7.....7a....7:....7l"...8.%...8<,..<F.J..=F.N..>FtV..?F9\..@Fw_..AFr`..BF0g..CFll..DF\|o..EF.v..FF){..MF....NF...QFf...RF....YF`...ZF...[F....\F....]F....L....L.....L.....N.....N.....N.....N.....N.....N.....N.#...N.&...N.'...N.)...N....N.+...Nv,...N.-...N;r...N.\|...Um....U.....UM....UV....U.....U....UC....U.....U....UM....U.....U.....Um....U.....U.....U.....U.....UQ....U.....U7....U.....U.....Uk....U.....U.....U.....U.....U.....U.....U.....U.....U.....U{....U.....U.....U.....U~&...U.)...U.Q...U.Q...U.V...U.[...U.\...U._...U.`...U?a...U.a...Uic...U.d...U\f...U.g...U.i...U1l...U.p...U.u...U.}...U.....U.....U^....U.....U.....Ux....U....U.....Uy....U6....U.....U....UR....Uq....U.....U.....U_....U.....U.....U..

C:\Users\user\AppData\Roaming\GamePall\cef_extensions.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1305142
Entropy (8bit):	7.99463351416358
Encrypted:	true
SSDEEP:	24576:8AkckSbnVLjWG13xdT0b+SLzRYt2k+lbG9EjJNH/osm22O+EcRfPLP:88zVXWG1hdAKSxY4k5EFNHgvPPLP
MD5:	20DDA02AF522924E45223D7262D0E1ED
SHA1:	378E88033A7083AAC24E6CD2144F7BC706F00837
SHA-256:	8448C2BA10A3D7DC8CA3FB24F580BF99D91F746107B1A06E74932749CC1CAB01
SHA-512:	E71320B2AA0CB52938206EC00187D78274646C4C7D3579B33A0163262C063B7813FE7ACD0D2E5807082ADE772069AA577FED7F594964790C2F7C061CE38467B6
Malicious:	false
Preview:	........i...f+....i+....l+....m+{...n+q...o+7(..p+.1..q+X3..r+~5..s+aI..t+.]..u+.f..v+Ui..w+'k..x+.l..y+.q..z+.s..{+O{..\|+...}+=...~+.....+....+-....+.....+.....+.....+.....+.....+.....+.....+.....+.....+%....+.....+&(...+.Q...+.Y...+Xe...+Bj...+cv...+.}...+....+H....+....+Q....+l....+I....+.....+ ....+T....+!....+m....+.....+.....+U....+.....+.....+.....+l....+~....+.....+=....+w....+.....+-"...+.(...+.0...+.2...+.4...+.G...+uS...+.....+9....+y....+.....+.....+N....+....+0....+.....+.....+.....+_....+.....+.....+.....+.....+.....+.....+.....+.....+S....7`....7R...(7/...)7.....L.m...LO....L.....Mk....M.....M.....M>....M.....M.....Mq....M.....M.....M\....M.....M.....M.....M.....M.....M.....M.....M.....M.....MO....M.....M.....M.!...M.(...Mf5...M.;...M&E...M.P...M.T...M<]...M.`...M.j.. M.k..!M2v.."M.w..#M.z..$M....%M...&M...'M#...(M@...)M....*M(...+MY...,Mu...-M$....M..../MV...0M;...1Mx...2M....3M....4Mi...5M....6M....7MP...8M"...DM....EM.....Mi....M.~...M.~...Mb....M_....M....M.

C:\Users\user\AppData\Roaming\GamePall\cef_sandbox.lib

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	87182312
Entropy (8bit):	5.477474753748716
Encrypted:	false
SSDEEP:	196608:v0b1XAJ5V8XYcrfCNJsTtU0ZhdYHbgMnn6d25JOcLRiLnIrBcnK0EAeg1GF:78JaNJyZhdE6383rWEAR8
MD5:	FFD456A85E341D430AFA0C07C1068538
SHA1:	59394310B45F7B2B2882D55ADD9310C692C7144F
SHA-256:	F188B96639B5157E64222BB8483D76CD21A99141FC2614EF275E20639C739264
SHA-512:	EB4CB388383CB37B1D89531D560169985A80DF9335F005AFBBFDE56F9031821A933D735138B1086CF81D006E480FF14711A8A95B3DB8A0FD4037AA6EFD926B50
Malicious:	false
Preview:	!<arch>./ 1696073295 0 1940897 `...Y..:.t.:.>.:...:...:...:...:...;/..;/..;/..;/..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..@...@...@...@...@...A...A...A...A...A...A...A...A...A...A...A...A...Co..Co..Co..Co..Co..Co..Co..Co..Co..Co..E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...G..G..G..G..G..G..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=.

C:\Users\user\AppData\Roaming\GamePall\chrome_100_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	656926
Entropy (8bit):	7.964275415195004
Encrypted:	false
SSDEEP:	12288:fI3Hdjzgsz5B0GDJQrnKs8SNP+QSsSilRBdNze0Vc+gIXgt4z8oO0TehEr7:g397zEEmPLSOdNze05gUgmz8oO0TOW
MD5:	3404DD2B0E63D9418F755430336C7164
SHA1:	0D7D8540FDC056BB741D9BAF2DC7A931C517C471
SHA-256:	0D3FCA7584613EB1A38BAF971A7DD94F70803FC130135885EC675E83D16A4889
SHA-512:	685D63633DB8A57D84225C2B92C92016E1CE98BA2BF8D3DDACE2EB120B3BCF84C718787D59DB6EC61F34CF91CB651500B4E4FF0AC37AEB89561CDCC586946C80
Malicious:	false
Preview:	..........+...........................&..........;.....;N....;.....;"....;.....;.....;N....;.....;.....;s....;....;.....;.....;....;4....;.....;.....;0....;.....;c....;7....;.....;.....;.....;.....;?....;:....;G....;.....;n....;x....;.....;.....;.....;#....;.....;.....;B....;.....;.....;.....;N....;.....;.....;+....;.....;% ...;c!...;.!...;."...;E+...;t4...;qH...;I\...;.]...;.^...;>a...;.c...;.g...;.o...;pw...;.\|...;h....;.....;.....;....;.....;....;o....;.....;.....;.....;....;y....;.....;.....;3....;9....;h....;.....;.....;.....;F....;."...;.+...;.0...;.8...;?:...;'X...;.q...;.....;....;.....;t....;.....;.....;.....;./...;.X...; m...;....;.....;.....;.....;+....;.....<O....<.....<.....<=....<2$...<y+...<.3...<.<...<aA...<.L...<.W...<.[...<._...<.d...<Dv...<t....<!....<....<....<.....<.....<.....<V....<.....<.#...<.8...<\|F...<hP...<bW.. <i^..!<ts.."<(...#<{...)<`...<c...+<d...,<"...;<x...<<k...=<....><-...?<....@<....A<'...B<g...C<....D<U...E<....F<....G<....J<....K<....L<v%

C:\Users\user\AppData\Roaming\GamePall\chrome_200_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1017158
Entropy (8bit):	7.951759131641406
Encrypted:	false
SSDEEP:	24576:m3Tl5zLmmibkFR8+mZRUumegvQtc05UwvdAbatzk6edhOLoe9:m3Tl53mNbkFRJmHURhQW05JvdlzkjrOH
MD5:	3FBF52922588A52245DC927BCC36DBB3
SHA1:	EF3C463C707A919876BF17C3E1CD05C0D2C28CA9
SHA-256:	C6FE346106C5E4950161ED72EB0A81FE3537A94E4A59461AAF54E750D1904F76
SHA-512:	682EB6D61B564C878FDB971A6439FCDA9F1E108BD021A32E8990B68B1338986A4866A0965DEA62567501C8826D43CEBF2B7C8BE8323DE415A75E8D89A9D592E7
Malicious:	false
Preview:	..........+.....................b................;.....;&....;.....;.....;.....;.....;b....;....;8....;.....;.....;o....;....;<....;.....;.....;l....;....;/....;.....;[....;Q....;.....;j....;.....;.....;L'...;.E...;lZ...;.o...;.q...;.r...;.s...;.{...;.{...;.~...;"....;.....;U....;.....;.....;.....;....;d....;.....;.....;i....;.....;f....;....;0....;.....;.....;.(...;+...;.+...;A....;54...;.9...;,O...;.`...;.n...;.~...;.....;.....;M....;....;;....;q....;Z....;.....;.....;.-...;\=...;.P...;.d...;@\|...;.....;Y....;#....;_....;/....;.....;.#...;.;...;.J...;gc...;cf...;W....;....;W....;.....;.....;.....;7....;.-...;.I...;Y\...;W....;....;.....;S....;.....;t....;.....;.....<W....<.&...<9<...<iG...<jQ...<.X...</a...<gi...<.n...<Pz...<.....<f....<.....<I....<.....<.....<.....<4C...<4d...<....<....<.....<.....<.....<D8...<.e...<_....<....<.... <I...!<...."<.E..#<.E..)<.G..<%j..+<N...,<....;<....<<v...=<....><....?<....@<y...A<....B<....C<....D<....E<"F..F<.J..G<.O..J<.X..K<.e..L<.r

C:\Users\user\AppData\Roaming\GamePall\chrome_elf.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1174528
Entropy (8bit):	6.475826085865088
Encrypted:	false
SSDEEP:	24576:I3lp87thPKuxyj+tWF8lCwOvzr90p5OM3:FauY+tWF8b5OM3
MD5:	207AC4BE98A6A5A72BE027E0A9904462
SHA1:	D58D2C70EA0656D81C627D424F8F4EFCCEF57C86
SHA-256:	2BA904DA93ACC4766639E7018AC93CC32AA685DB475F3A59B464C6BC8B981457
SHA-512:	BFB6C58774829DB3D5FADC92CB51477FF4EAC8FB934DB6583A312BB1157468F6DD3A4A3AFAF25A687B74890DC8A69857A12D0B38B18D83E82836E92E02046FF3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....v...p......P.....................................................@A........................vT......AX..<.......x...........................<<.......................;......(...............<[.......O.......................text....u.......v.................. ..`.rdata..\............z..............@..@.data...H...........................@....00cfg...............F..............@..@.crthunk.............H..............@..@.tls.................J..............@...CPADinfo(............L..............@...malloc_h.............N.............. ..`.rsrc...x............P..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2106216
Entropy (8bit):	6.4563314852745375
Encrypted:	false
SSDEEP:	49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
MD5:	1C9B45E87528B8BB8CFA884EA0099A85
SHA1:	98BE17E1D324790A5B206E1EA1CC4E64FBE21240
SHA-256:	2F23182EC6F4889397AC4BF03D62536136C5BDBA825C7D2C4EF08C827F3A8A1C
SHA-512:	B76D780810E8617B80331B4AD56E9C753652AF2E55B66795F7A7D67D6AFCEC5EF00D120D9B2C64126309076D8169239A721AE8B34784B639B3A3E2BF50D6EE34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.h...;...;...;..];...;...;...;.._;...;..h;0..;..i;'..;..X;...;..l;D..;?M.;...;..Y;...;..^;...;Rich...;........PE..L...92.K...........!.........d...............................................p .....O. ...@.........................@.......@...P..................... .h............................................i..@............................................text...S........................... ..`.data....~.......B..................@....rsrc................(..............@..@.reloc..D............,..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4127200
Entropy (8bit):	6.577665867424953
Encrypted:	false
SSDEEP:	49152:OS7PQ+besnXqRtHKzhwSsz6Ku1FVVOsLQuouM0MeAD36FqxLfeIgSNwLTzHiU2Ir:O4PhqqFVUsLQl6FqVCLTzHxJIMd
MD5:	3B4647BCB9FEB591C2C05D1A606ED988
SHA1:	B42C59F96FB069FD49009DFD94550A7764E6C97C
SHA-256:	35773C397036B368C1E75D4E0D62C36D98139EBE74E42C1FF7BE71C6B5A19FD7
SHA-512:	00CD443B36F53985212AC43B44F56C18BF70E25119BBF9C59D05E2358FF45254B957F1EC63FC70FB57B1726FD8F76CCFAD8103C67454B817A4F183F9122E3F50
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!7P.OdP.OdP.Od..NeR.OdP.Nd..OdY..dU.Od.Jem.Od.KeQ.Od...dQ.Od..Leo.Od..Je..Od..OeQ.Od..Ge..Od..Kec.Od...dQ.Od..MeQ.OdRichP.Od................PE..L..................!.....2<..*...............P<...............................?.......?...@A.........................<<.u.....=.P.....=.@.............>..%....=.........T....................u..........@.............=..............................text...e0<......2<................. ..`.data...`"...P<......6<.............@....idata........=.......<.............@..@.rsrc...@.....=.......<.............@..@.reloc........=.......<.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\devtools_resources.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	2205743
Entropy (8bit):	7.923318114432295
Encrypted:	false
SSDEEP:	49152:qHlbrhXKMVp/DVegxF2Xe1WFG4F3KMWB7rwz3yY+23:qFnhXKwggr0cWEgaMi7rwrw23
MD5:	54D4E14BFF05C268248CAB2EEDFB61DD
SHA1:	33AF472176F6E5FB821FFE23C9FBCCC7C735B5B9
SHA-256:	2CAC401BFFA9FD4DFFE11E05EE18FC5CA7A30EC5BF7EF6A3EA8518A4F3344790
SHA-512:	5A6893E7EA30EAA0EFF44687B0D15366A8224E476E4AE8FE0D5C7EF2B3C62E6B0184F73EAD36C4E4E08D6936524CEF8429660B3EC29453EED128E3C5368CE78C
Malicious:	false
Preview:	........K....[.....[.....[.....[Y....[.....[.....[.....[.....[P ...[.!...[."...[.#...[.$...[.%...[.%...[T&...[0'...[/(...[.(...[.(...[....[.+...[{,...[1-...[.-...[3....[b/...[.0...[.1...[.2...[.3...[,4...[.4...[P5...[.5...[#6...[!8...[.8...[.9...[.9...[::...[q;...[Y=...[.=...[ ?...[.@...[0A...[iB...[?D...[.E...[pE...[UF...[.G...[.H...[)I...[.I...[.M...[.M...[DN...[.N...[FO...[.O...[.Q...[oV...[uW...[cX...[[\...[.]...[Ea...[bc...[.c...[ d...[.d...[oe...[.f...[.h...[.i...[Xj...[.k...[.l...[An...[.o...[.p...[.....[....[.....[.....[.....[.....[[!...[.%...[d....[x1...[.4...[.4...[.9...[.C...[.Q...[KS...[#V...[=]...\.b...\.z...\Q}...\.....\.....\....\`....\.^...\7b...\uy...\g....\.....\.....\=....\....\....\....\'....\.....\....\.... \....!\...."\....$\....%\....&\....)\....\....+\.Q..,\.S..-\.U...\..../\w...0\....1\8...2\....3\....4\....5\....6\....7\.T..8\.z..9\6...:\....;\c...<\)&..=\...>\>5..?\JU..@\.r..A\....B\9...C\....D\S...E\....F\\y..G\Y...H\%...I\....J\M...K\.a..L\.j..M\.n

C:\Users\user\AppData\Roaming\GamePall\icudtl.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	10717392
Entropy (8bit):	6.282534560973548
Encrypted:	false
SSDEEP:	196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
MD5:	E0F1AD85C0933ECCE2E003A2C59AE726
SHA1:	A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
SHA-256:	F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
SHA-512:	714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW..K..P...L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

C:\Users\user\AppData\Roaming\GamePall\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	377856
Entropy (8bit):	6.602916265542373
Encrypted:	false
SSDEEP:	6144:oJ4tr7XVkL/2qBCOeRMIKVpqtXmzKwdo23zqyU73omBT095OiZH:2NfBCOeR/KVpqtio23zqyOsOo
MD5:	8BC03B20348D4FEBE6AEDAA32AFBBF47
SHA1:	B1843C83808D9C8FBA32181CD3A033C66648C685
SHA-256:	CBEE7AC19C7DCCCA15581BD5C6AD037A35820DDFE7C64E50792292F3F2E391E6
SHA-512:	3F9EEC2C75D2A2684C5B278A47FB0E78B57F4F11591FAC4F61DE929F716BBAA8F7DF05E10390408AD6628538611541548C26869822372E9C38D2C9C43881651E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....`...`............................................... ............@A........................8,..h....:..(.......x........................>..........................D........p..............(<..`............................text....^.......`.................. ..`.rdata..L....p.......d..............@..@.data....4...p.......`..............@....00cfg...............\|..............@..@.tls.................~..............@....rsrc...x...........................@..@.reloc...>.......>..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6635008
Entropy (8bit):	6.832077162910607
Encrypted:	false
SSDEEP:	196608:HrmMLEFtac5bM68f8Oi3WjH13GzSW3430aTwQCe:a+ktad68f8Oi3oH13GztokaTwbe
MD5:	63988D35D7AB96823B5403BE3C110F7F
SHA1:	8CC4D3F4D2F1A2285535706961A26D02595AF55C
SHA-256:	E03606B05EEAED4D567EA0412350721C0D566B3096B18C23BD0B3FCDE239E45A
SHA-512:	D5F5ACA00BE9E875FCD61531CC7F04F520FB12999E36E4FE06BEAAE491B47D2E9FE182015DB1CBFBB8E78CF679F2EB49E20ECDF1B16D1D42058D6F2D91BC3359
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!......L...........@.......................................e...........@A.........................].......^.d.....a.......................a.."...U]......................T].....X.L.............H.^.@.....].@....................text.....L.......L................. ..`.rdata...I....L..J....L.............@..@.data...X....._.......^.............@....00cfg........a.......a.............@..@.tls..........a.......a.............@....rsrc.........a.......a.............@..@.reloc..."....a..$....a.............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\libcef.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176517632
Entropy (8bit):	7.025874989859836
Encrypted:	false
SSDEEP:	1572864:VSuR7JVHywK/Sf1rWID4Pu2v8zgguHWJEqM90Hw4DclJkBLrWXmfnehuWNIPKtlL:MCYRNIPKYTFBhfmOS9KBaVz
MD5:	F5259CC7721CA2BCC8AC97B76B1D3C7A
SHA1:	C2FC0C8396D8CD6764809A2A592972E2EBCA64BA
SHA-256:	3FE6A262EF01CB8FD4DC2D4373DE0F1F0A89EE51953452ED4557CB55F1DA9AB4
SHA-512:	2D01B1F2B24717EFF37965BBC32D167434A65F3DFFF74342D2E2FA8FBB0E97C3F61FDF673A13AD63031D630D9CE46A6F9F0C4F89EBD30C31F3EA55817B9D1331
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.........N.......k....................................................@A........................#..........h....0J.(C....................L.\|.\.P................................?..............`.......LY..@....................text............................... ..`.rdata...%2..0...&2.................@..@.data...dr+..`.......>..............@....00cfg........I.......&.............@..@.rodata.@.....I.......&............. ..`.tls..........J.......&.............@...CPADinfo(.....J.......&.............@...malloc_h..... J.......&............. ..`.rsrc...(C...0J..D....&.............@..@.reloc..\|.\...L..0\..B).............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\libcef.lib

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	40258
Entropy (8bit):	4.547436244061504
Encrypted:	false
SSDEEP:
MD5:	310744A0E10BD9C2C6F50C525E4447F9
SHA1:	9BA62D6AC2CB8EFF46C9B21051677FC1DC66D718
SHA-256:	E9C55CFF925E26812139CDCAD6612E0D69E317CB7BB1435C9EB5113D338ACCE7
SHA-512:	6DF9E3F9AFD7CDEC750B006987E5AEC445E163DD0B9CF1A9EA53F78DB2EE5FD654E3B4F82BCA3E1F4BEDB189F5DFA51189C820905676AD048DBE2E0AD405BF5B
Malicious:	false
Preview:	!<arch>./ 0 0 0 0 14390 `.......8z..:&..:...;...;...<&..<&..<...<...=...=...=...=...>...>...>...>...>...>...?f..?f..?...?...@B..@B..@...@...A$..A$..A...A...B"..B"..B...B...C...C...C...C...D...D...D...D...D...D...E...E...E...E...Fn..Fn..F...F...GZ..GZ..G...G...HJ..HJ..H...H...I$..I$..I...I...J...J...J...J...K ..K ..K...K...L...L...L...L...M...M...M...M...N...N...N\|..N\|..N...N...Od..Od..O...O...P`..P`..P...P...QP..QP..Q...Q...RT..RT..R...R...S@..S@..S...S...T...T...T...T...U...U...Un..Un..U...U...VP..VP..V...V...W,..W,..W...W...X...X...X...X...X...X...Y\..Y\..Y...Y...ZB..ZB..Z...Z...[,..[,..[...[...\...\...\...\...\...\...]b..]b..]...]...^N..^N..^...^..._6.._6.._..._...`$..`$..`...`...a...a...a...a...b...b...b...b...c...c...c...c...c...c...dj..dj..d...d...e^..e^..e...e...fV..fV..f...f...g8..g8..g...g...h..h..h...h...i"..i"..i...i...j...j...j...j...k...k...k...k...l...l...l...l...l...l...mh..mh..m...m...nN..nN..n...n...o2..o2..o...o...p...p...p.

C:\Users\user\AppData\Roaming\GamePall\locales\af.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	470498
Entropy (8bit):	5.409080468053459
Encrypted:	false
SSDEEP:
MD5:	64F46DC20A140F2FA3D4677E7CD85DD1
SHA1:	5A4102E3E34C1360F833507A48E61DFD31707377
SHA-256:	BA5CA0A98E873799A20FD0DF39FDB55AAB140E3CC6021E0B597C04CCE534246D
SHA-512:	F7D789427316595764C99B00AF0EF1861204F74B33F9FAB0450F670CB56290C92BFB06EF7D1D3B3BF0B6ACDC6295E77F842C49579BD9973E3D5805920CDB2527
Malicious:	false
Preview:	........$$..e.>...h.F...i.N...j.Z...k.i...l.t...n.\|...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................&...........5.....<.....C.....D.....E.....J.....W.....f.....w.................x.................A.......................S.........................................%.....{.......................V.......................J.......................Y.......................e.......................a.......................l...................................O.....f.......................).....z.......................6.....u.......................Q.......................E.....w.................!.....I.....R.............................l.......................f.................+.............................f.......................D.......................<......................._.......................2.....~.................2.....v.................X...........$.....8.................P.....r...........6.....j.....}.................1.....?...................

C:\Users\user\AppData\Roaming\GamePall\locales\am.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	763010
Entropy (8bit):	4.909167677028143
Encrypted:	false
SSDEEP:
MD5:	3B0D0F3EC195A0796A6E2FAB0C282BFB
SHA1:	6FCFCD102DE06A0095584A0186BD307AA49E49BD
SHA-256:	F9F620F599BC00E84A9826948C3DA985AC9ADB7A6FFB4C6E4FBEFEAF6A94CF85
SHA-512:	CA9217F22C52EF44E4F25142D1AD5DD9D16E4CCC3B6641609E1F4C2650944E35BA4CAB59CA5CD9EA6FEFD6BE1D3E8227FC0E3E6BDEDD14B059CA2C72D096D836
Malicious:	false
Preview:	........>${.e.r...h.z...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.(...\|.....}.@.....H.....M.....U.....].....e.....l.....s.....z.....{.....\|...............................................F.....f.....'...........V...........Y.............................5.................F.................!.................d.....z...............................................C...........\.................z...........h...........3...........$.....C.................e.................i.................,.......................X.............................h.......................!.....\|...........$.............................1.....}.........................................Z.................\|...........'.....N...........F.................;.............................G.................v............ ....4 ..... ....X!.....!.....!....x"....."....Z#.....#....M$.....%.....%.....%.....&....+'.....'.....'.....(....D).....).....)....2....................+....",.....,

C:\Users\user\AppData\Roaming\GamePall\locales\ar.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	838413
Entropy (8bit):	4.920788245468804
Encrypted:	false
SSDEEP:
MD5:	C70B71B05A8CA5B8243C951B96D67453
SHA1:	DEED73A89F0B3EDAB8FF74117CC6B31CB4F426E8
SHA-256:	5E0D4BC0893A334B6FFF610F66E4A00920530D73EC3257EB9D37A96EBD555C13
SHA-512:	E000FD3592AC5FE700C4CE117868915C066AC66D5954A1DE4F5AFF0F4559C93F7DFF47623F1837CE827FFF94E91ECD89A974037BE9CCCC8E672E229A1E8115E9
Malicious:	false
Preview:	.........#..e.....h.....i.....j.....k.....l.!...n.)...o.....p.;...q.A...r.M...s.^...t.g...v.\|...w.....y.....z.....\|.....}.........................................................................-.....d.................n...........A...........u.......................O.......................D.................Y...........3.....J...........=.....g.....~.....&.................O.......................B.....!...........u...........5...........).....W.................3.....N.....U.....B...........!.........../.....Y........... .......................g...........).....I.................#.....A...........@.................6........... .....D...........I.................%.............................=.................?...................................G...................................).....t............ ..... ..... ..... ....o!.....!....6"....\"....."....S#.....#.....#.....$.....%....V&.....&....5'.....'.....(....J(.....(....X).....).....).........z..............t+.....,....{,.....,....--

C:\Users\user\AppData\Roaming\GamePall\locales\bg.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	869469
Entropy (8bit):	4.677916300869337
Encrypted:	false
SSDEEP:
MD5:	12A9400F521EC1D3975257B2061F5790
SHA1:	100EA691E0C53B240C72EAEC15C84A686E808067
SHA-256:	B7FD85B33B69D7B50F6C3FDC4D48070E8D853C255F2711EEDAA40D1BA835F993
SHA-512:	31EAA1CBF13BC711750B257C6B75813ACC8E4E04E9262815E399A88B96BA7B5BE64CE2450638B5521D5CB36750C64848944168C3234D2CE15A7E3E844A1E1667
Malicious:	false
Preview:	........%$..e.@...h.H...i.P...j.\...k.k...l.v...n.~...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}................... .....(.....0.....7.....>.....E.....F.....G.....L.....n...................................I...........Q...........q.......................T.................E.......................7.....~...........<.................:.....&...........F.................X...........$.................Z...........X...........m.................C.........................................{...........:.....a...................................8................._...........O.....}...................................$.....h.........................................2.............................3 ....e .....!.....!.....!.....".....".....#....W#.....#....{$....-%.....%.....%.....&....k'.....'....T(.....).....).....).....).....*....`+.....+.....+.....,....p-.....-....&....../...../.....0.....0.....1....o2.....2....73.....4.....4.....4....-5.....5....X6.....6.....6.....7.....8.....9

C:\Users\user\AppData\Roaming\GamePall\locales\bn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1118348
Entropy (8bit):	4.2989199535081895
Encrypted:	false
SSDEEP:
MD5:	89A24AF99D5592AB8964B701F13E1706
SHA1:	2177122C6DCC20E1D07EF43AF5A112E8E5C6B95B
SHA-256:	5BDBBCD0D07B6AE3A7F96F07871EE541F4111D90D73FD6E112C5ABE040025C96
SHA-512:	60F6CD73BF35886EF54FA6200F86BCED78DD11F612C8071F63EB31108F109C166D45609879E8E5107024A025BAFCFCF1C80051B6D8FF650D92DCF17136384EB1
Malicious:	false
Preview:	........($..e.F...h.N...i._...j.k...k.z...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......#.....(.....0.....8.....=.....E.....L.....S.....Z.....[.....\.....a.............................=.....G...........?.....4...........................................................B.....}.....>...........k...........X...........].............................q.....W...................................W...........S...........e.............................I.....m.....e..........._.....(.................9...........q.................p...........5.....X.....8...........Q...........M...........I.....u.....-...........!.....G............ ..... ..... .....!....P".....".....".....#.....%.....%.....&.....'.....'....^(.....(....;).....).........6.....+.....+....1,....],....E-................-/...../....x0.....0.....0.....1.....2.....2.....3...."4.....4....x5.....5.....6....78....*9....]9.....:.....;....;<.....<.....=....?>.....>.....>.....?....y@.....@.... A....&B.....B

C:\Users\user\AppData\Roaming\GamePall\locales\ca.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	537139
Entropy (8bit):	5.397688491907634
Encrypted:	false
SSDEEP:
MD5:	37B54705BD9620E69E7E9305CDFAC7AB
SHA1:	D9059289D5A4CAB287F1F877470605ED6BBDA2C8
SHA-256:	98B2B599C57675EFC1456B38B23CE5657B142E0547F89AB1530870652C8EB4BA
SHA-512:	42D667FEB59BB5FA619AC43DC94629ED1157CBE602643FB21378A2C524EF1F6E32098E7C62D3F3DE35D9FEDEF6607FE034908601AE3C49156CD0916E2514D2F9
Malicious:	false
Preview:	........%$..e.@...h.H...i.P...j.\...k.k...l.v...n.~...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}................... .....(.....0.....7.....>.....E.....F.....G.....I.....c.....\|................._...........[.....z...........O.................D...........(.....G.................B....._.................A.....T.................8.....I...........3.....u...........(.......................p.................,.......................1.................T.....o.............................v.......................b.......................@.......................@.......................O.......................<.............................`.......................P.........................................M.......................H......................._.........................................n.......................Q.......................[.............................1.................>.........................................6.............................\|...........".....>.

C:\Users\user\AppData\Roaming\GamePall\locales\cs.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	545011
Entropy (8bit):	5.844949195905198
Encrypted:	false
SSDEEP:
MD5:	65A2C2A73232AB1073E44E0FB6310A5F
SHA1:	F3158AA527538819C93F57E2C778198A94416C98
SHA-256:	E9A1610AFFCA9F69CD651C8D2EDD71B5A0F82CB3910A8A9D783F68E701DB5BB0
SHA-512:	20ED527F3BBBA2CECE03D7B251B19D6DCC9D345B5425291D8139FCDD5646EC34D585891160CC4BD96C668D18FFFFDD56F4D159880CFC0D538749F429F7F65512
Malicious:	false
Preview:	.........$..e.....h.&...i.....j.:...k.I...l.T...n.\...o.a...p.n...q.t...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................#.....$.....%.....'.....7.....I.....[.....p.............................\|.................%...........(.........................................3......................./.......................2.......................z...........I.....k...........R.......................v................./.......................z...........=.....W.................&.....=....................... .....o.......................^.......................r.......................m.......................b.......................z.................0...........%.....i.......................3.....G.......................(.......................1.................R................./.....J.....^...........A.....q.................`.................,...................................V.....w...........Z.......................O.....t.................b.......

C:\Users\user\AppData\Roaming\GamePall\locales\da.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	496165
Entropy (8bit):	5.446061543230436
Encrypted:	false
SSDEEP:
MD5:	A44EC6AAA456A6129FD820CA75E968BE
SHA1:	9B5B17AFD57ADB8513D2DA9A72223E8A003975A5
SHA-256:	F01F9C3E4E6204425F2969F77BF6241D1111CE86CDD169BDF27E5D2D4B86C91A
SHA-512:	947DB81EA64009CC301CD2DCE06384202E56446F6D75E62390334B91D09B564CB0681E06BF7A945033BD6C28C2171346A91EE16693262C4E373A31B51AD42A9E
Malicious:	false
Preview:	........,$..e.N...h.V...i.g...j.s...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}."........../.....7.....?.....G.....N.....U.....\.....].....^.....`.....n.....~.........................................Q..................................q.................].......................P.....w.................8.....b.....p...........9.....h.................n.................7.......................^............................. .....p...................................q.......................X.......................1...............................................".............................{.......................Z.......................C.....p.....~...........y.................4.............................l.......................I.....f.....v...........^.................................................................F.......................B...................................O.....~...........J.....z.................$.....@.....M.................F.

C:\Users\user\AppData\Roaming\GamePall\locales\de.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	534726
Entropy (8bit):	5.49306456316532
Encrypted:	false
SSDEEP:
MD5:	49CA708EBB7A4913C36F7461F094886B
SHA1:	13A6B5E8DC8B4DF7A976A0859684DC0AA70F1B12
SHA-256:	8AE7D6B77C51A4FE67459860ABDAE463F10766FAF2BA54F2BB85FD9E859D2324
SHA-512:	6908F96BFDF7499B33E76697AA96103E89ACB3E25EDBD6156B610564AF14D4ED474C547A760503490B6327A801478E223039836BEEF2B938AF76827A15C0F751
Malicious:	false
Preview:	.........#..e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.%...y.+...z.:...\|.@...}.R.....Z....._.....g.....o.....w.....~.................................................................X.................E...................................^.....x...........n................./.......................Z...................................U.....w.............................h...........&.....7...........9.....w........... ................. ..........._.................D.......................U.......................h...................................a.....x...........f.........................................F.......................u...........).....;...........j.................A.......................;.......................9.......................t...........,.....`...........-.....K.....b...........G.....s.................}.................T...........,.....6...........S................./.......................K.......................t...........*.

C:\Users\user\AppData\Roaming\GamePall\locales\el.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	950999
Entropy (8bit):	4.76377388695373
Encrypted:	false
SSDEEP:
MD5:	9CBC320E39CFF7C29F61BD367C0BF3BB
SHA1:	2AF07EFFF54A0CF916CF1C0A657F7B7ADF2029FF
SHA-256:	E8837DEFA908EB2FD8B4EB6344412C93403A4258F75EC63A69547EB06A8E53B3
SHA-512:	F7D84185F4520E7AAF3F3CACF38B53E9638BB7D5023FA244020EC8D141FFD5C10B198FF089824D69671FE8350F931B0BB19B6CAF14AF47B0838953367A146DD0
Malicious:	false
Preview:	........)$..e.H...h.P...i.X...j.b...k.q...l.\|...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................&...........6.....=.....D.....K.....L.....M.....O.....v.......................5...................................V.................h...........F.....i...........~...........{...........a...........'.................&.......................M.....U.....O............................./.....J.....1..........._...........{.....6................. .............................g.......................<.................J...........8.....t.....O.....).......................U............................................................ ..... .....!.....!.....".....#.....$.....$.....$.....%....\|&.....&.....'.....'....;(....t(.....(....M).....)....;....h....U+.....,.....,.....,.....-....8.....t...........f/....(0.....0.....0.....1....S2.....2.....3....64....Q5.....6....@6....A7....(8.....8.....8.....9.....:....o;.....;....[<....%=.....=.....=.....>.....?....6@

C:\Users\user\AppData\Roaming\GamePall\locales\en-GB.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	430665
Entropy (8bit):	5.517246002357965
Encrypted:	false
SSDEEP:
MD5:	0F1E2BC597771A8DB11D1D3AC59B84F3
SHA1:	C1F782C550AC733852C6BED9AD62AB79FC004049
SHA-256:	E4798E5FF84069C3BFD7D64734CCD9FF5C8A606315B44A714ACDCABDDAF3CA6E
SHA-512:	07E9B98357C880995576059AD4E91E0F145DC0F2FFF2DFDAD8649FA42EB46FA86F7F093503C41019EAD4550784E26C553D171518355FBBF995E38B1F6D7ABFF0
Malicious:	false
Preview:	.........$ .e.(...h.0...i.>...j.J...k.Y...l.d...n.l...o.q...p.~...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................%.....,.....3.....4.....5.....:.....G.....V.....f.....w...........J.......................H.....y.................I.......................@.....o.......................?.....M............................._.......................B.......................8.............................[............................V.....a................l............................. .....^.............................A.....b.....n.................H.....[.......................+.....t.......................5.....y.......................:.....c.....n...........'.....d.....y.................).....?.............................G.............................].......................4.....O.....^.................6.....F.................#.....;.................V.....d...........$.....[.....x.................F.....U.............................k.............

C:\Users\user\AppData\Roaming\GamePall\locales\en-US.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	434598
Entropy (8bit):	5.509004494756697
Encrypted:	false
SSDEEP:
MD5:	FEAB603B4C7520CCFA84D48B243B1EC0
SHA1:	E04138F1C2928D8EECE6037025B4DA2995F13CB4
SHA-256:	C5B8FBDBB26F390A921DCACC546715F5CC5021CD7C132FD77D8A1562758F21F4
SHA-512:	E6B3970A46D87BFD59E23743B624DA8116D0E1A9912D014557C38FD2664F513E56317AFA536DF52E7E703863FBD92136BE57EE759A2FFC2958AB028F6287E8B7
Malicious:	false
Preview:	.........$..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.,...y.2...z.A...\|.G...}.Y.....a.....f.....n.....v.....~.................................................................G.......................\.......................Q.......................T......................./.....t.......................7.....^.....k.................".....9.................!.....9.............................i.......................7.......................!.............................K.....f.....u.............................Y.............................k.......................G.....t.......................7.....B.............................J.......................$.....~.......................^.............................=.....R.............................q.......................X.............................X.......................7.....o.................X.......................k.......................a.......................!.....C.....S.................,.

C:\Users\user\AppData\Roaming\GamePall\locales\es-419.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	524728
Entropy (8bit):	5.377464936206393
Encrypted:	false
SSDEEP:
MD5:	32A59B6D9C8CA99FBD77CAA2F586509A
SHA1:	7E8356D940D4D4CC2E673460483656915AA59893
SHA-256:	AA4A5AA83DD5F8476867005844F54664DB1F5464A855EF47EC3A821DAF08E8F2
SHA-512:	860BA06228BBA31EEC7EB8BD437DDB6E93BABD0129033FB6EFF168F2FB01B54E2B93D2AB50A5D4F5D2FB7B04A5D0DD5541999D708CC2613B74AADD17B3E98735
Malicious:	false
Preview:	........5$..e.`...h.h...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.,.....4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....j.....\|.......................J...........>.....Y...........1.....v..........."...................................L.....g.................4.....G.................,.....=...........7.....}...........6...................................6.....I.................\.....s..........._.................Z...........2.....Y.......................:.......................".......................0.................R.....e...........).....g.....s.................P.....[.................4.....>.................L.....\...........O.................!.....v.................+.....x.................i.................:.................2.......................!.......................0.................I.....c...........x.............................B.....p...........V.......................G.....j.....}...........n.............

C:\Users\user\AppData\Roaming\GamePall\locales\es.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	523181
Entropy (8bit):	5.356449408331279
Encrypted:	false
SSDEEP:
MD5:	3D1720FE1D801D54420438A54CBE1547
SHA1:	8B1B0735AE0E473858C59C54111697609831D65A
SHA-256:	AE32D66C0329104B9624BA0811FE79149D1680D28299440EC85835DBA41C7BD2
SHA-512:	C033BBB5261EC114DCB076EDB5E4B3293F37D60C813674A947F996606A6289204C04D2E4315356D92EEEB43FF41D534997DBEBBF960B17F2F24AA731AFE4B7E1
Malicious:	false
Preview:	........5$..e.`...h.h...i.p...j.\|...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.+.....3.....8.....@.....H.....P.....W.....^.....e.....f.....g.....i.....\|.......................O...........G.....b...........D.................0........... .....:.................Y.....t.........../.....^.....n...........0.....X.....i...........c.................W...................................I.....Z................f.....{...........o.................g...........+.....P.................8.....N.................".....1......................@.................?.....R.................;.....G.................%.....0.............................y...................................D.....^.................@.....].................5.....T...........;.....`.....s...........h.................M.......................A.......................W.............................&.................)...................................A.....U................. .....3.................D.

C:\Users\user\AppData\Roaming\GamePall\locales\et.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	475733
Entropy (8bit):	5.456553040437113
Encrypted:	false
SSDEEP:
MD5:	C00D66D3FD4FD9D777949E2F115F11FB
SHA1:	A8EAAD96CABCDFB7987AF56CB53FA5E16143EC48
SHA-256:	26C438935E3F666329EE8D1DABA66B39179BCF26EBAC902F9B957A784BDC9B4A
SHA-512:	E7E8C083B556DD05874AC669B58A4D1CD05D1E1B771EB4C32942869E387C6FA2B317B5F489138BD90135117DAEB051D96A7823B531DF0303BD4245A036F25A20
Malicious:	false
Preview:	........@$y.e.v...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...\|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................S...........J.....e...........4.....d.....w...........Y.......................u.......................m.......................\.......................[.........................................7.......................;.......................K.......................x...........;.....R.................9.....T................. .....,.............................w...........#......................./.....=.................'...../.................".....1.................$.....,.................O.....g.................4.....J.................,.....O.................4.....A.................=.....i.................&.....7.................#.....;.................?.....Z...........U.................C...................................@.....M...........................................

C:\Users\user\AppData\Roaming\GamePall\locales\fa.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	773397
Entropy (8bit):	5.04618630633187
Encrypted:	false
SSDEEP:
MD5:	C998140F7970B81117B073A87430A748
SHA1:	8A6662C3AABDAC68083A4D00862205689008110C
SHA-256:	182F18E4EFCA13CA59AFD1DF2A49B09733449D42526EE4700B11A9C5E6AAC357
SHA-512:	5A947A44F674F9556FDD44D2E4FF8CF0E0AAC4475FFA12480CA1BD07CFE7514961B7CACE6760189432B4B4BEB5EA5816701158EB3CB827A806F3063853C46D5E
Malicious:	false
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.#...s.4...t.=...v.R...w._...y.e...z.t...\|.z...}...............................................................................-.....T.....9.......................^...........u..........._.............................H.................a...........S.....f...................................?.................j..........._.............................'...........f.......................I.......................v.............................Q.....u...........}.................S...........).....@...........x.................m...........M.....d...........p.................H.................:...........`.................`...........l...............................................s...........C...........0.....P.......................;...........1 ....V ....q ....+!.....!....'"....I"....."....\|#.....#.....#.....$.....%.....&.....&....j'.....(....l(.....(....W).....)....M....p.....*....n+.....+.....+....d,.....-....P-....x-

C:\Users\user\AppData\Roaming\GamePall\locales\fi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	483378
Entropy (8bit):	5.428549632880935
Encrypted:	false
SSDEEP:
MD5:	1CFD31A6B740D95E4D5D53432743EBF1
SHA1:	20CEEEA204150BD2F7AAE5866C09A3B0AE72D4C5
SHA-256:	F821E06B4BACD9E7660A2D6912A049591FFD56C6D2A0A29B914648589B17B615
SHA-512:	C483B7347F91BE8EE515DCF352A1D7502B9A159EDE35EACCEBAA763B93A625BCE2D0C7D598C2A6111092257D6DAC7A167102E956697210D4694B9812D70C8A94
Malicious:	false
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.:...w.G...y.M...z.\...\|.b...}.t.....\|.....................................................................................................^.....q...........7.....j.....}...........Z.......................~.......................s.......................D.....d.....t........... .....F.....`...........C.......................Q.....}.................S.......................T.........................................E.............................k......................./.....P.....\.................).....3.............................p.......................L.......................0.......................%.......................B.............................g.......................e.......................d.......................M.....d.....s...........*.....T.....f...........".....[.....u...........x.................I.......................Y.......................4.....v.......................S.....~.

C:\Users\user\AppData\Roaming\GamePall\locales\fil.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	546749
Entropy (8bit):	5.197094281578282
Encrypted:	false
SSDEEP:
MD5:	6EDA0CD3C7D513AAB9856EC504C7D16F
SHA1:	BA24C4B994E7866F2C012CCEC6C22DFC1A4FCFF6
SHA-256:	3CD2BC9E887663C5E093E0334BC60CF684655A815E3DE7AD9A34BAD5EBB858B1
SHA-512:	47000F5EA882CB9EDDCF4FB42ED229423EE55AA18B4A4353D7EF85ADFA7E1B0BBB33C2469887224D7146B3E33FB2296749CD053D68D7DAF26980BC710A27C63E
Malicious:	false
Preview:	.........$..e.@...h.H...i.^...j.j...k.y...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......!.....&...........6.....>.....E.....L.....S.....T.....U.....Z.....g.....\|.................K...........:.....X...........O.................Q...........>.....e...........Z.......................~.................%.......................h.................H...........^.................M.................!.................H.....b...........].................V...........B.....d...........#.....N.....k.................A.....N.................,.....;.................S.....i...........5.....k.....z...........=.....o.....}...........>.....o.....}...........@.....r...................................R.......................L.......................<.......................e.................U.................F.....`...........>.....q.........................................%.................4.................4.................J.....b.................B.....X...........N.......

C:\Users\user\AppData\Roaming\GamePall\locales\fr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	568277
Entropy (8bit):	5.380723339968972
Encrypted:	false
SSDEEP:
MD5:	D185162DF4CAC9DCE7D70926099D1CF1
SHA1:	46594ADB3FC06A090675CA48FFA943E299874BBD
SHA-256:	E40C07183A32B75930242F166C5AAE28F4CD769BB2268391BEAA241814E7D45A
SHA-512:	987D9CC6AD5F2ED6A87537FDADF105F6EB31A97B11156E70814FE021047E5D8D08398F008812038DF3CCDCB6254BF5B744D9982FE04F79D407AC2F53BB046E25
Malicious:	false
Preview:	.........$..e. ...h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}..................................... .....'.........../.....0.....2.....B.....P.....b.....q.................6.....X...........?.................'.................(.................W.................4.....`.....p...........D.........................................{...........(.....L...........*.....i.....{...........S.........................................}...........i.................N.......................H.....r.................N.......................f.......................}.......................x.......................e.......................d.................+.................&.......................8.....~.......................k.................0...........;.......................f.........................................d.................6...........4................."...................................R.....k.................G.....[...........G.......

C:\Users\user\AppData\Roaming\GamePall\locales\gu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1103776
Entropy (8bit):	4.336526106451521
Encrypted:	false
SSDEEP:
MD5:	44F704DB17F0203FA5195DC4572C946C
SHA1:	205CBCC20ADCCCF40E80AA53272FBA8CD07389CA
SHA-256:	4B073F08F0C8C035974B5EC43AA500F8BDD50E6CFE91A2FB972A39E0F15ECEDD
SHA-512:	3CFD4501556845141EE9B461C831CA59779AD99F0E83E8D03433DE78D774378E87DE752DD9711C112A0C584259AD1DA6DC891D92F3F447F63A4D84263CD5BFCE
Malicious:	false
Preview:	........4$..e.^...h.f...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.#...\|.)...}.;.....C.....H.....P.....X.....`.....g.....n.....u.....v.....w.....\|.......................&.....b....._.....0.....l....._..... ...............................................a.......................G.................r...........\.....\|....._...........z.......................V...........n.....B...................................7.....4...../.......................".......................4.....p...........P...........E.....m.......................................................................'...........}.......................C.................j .....!....u!.....!.....".....#....\$.....$....K%.....%....R&....{&.....'.....'.....'.....'.....(....b).....).....*....'+.....+....t,.....,.....-....9.....\|............/....W0.....0.....0.....1.....2....33....f3.....4.....5.....6.....6.....7.....8....<9.....9....\|:....H;.....;.....;.....<....s=.....=.....=.....?.....?.....@

C:\Users\user\AppData\Roaming\GamePall\locales\he.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	681555
Entropy (8bit):	4.658620623200349
Encrypted:	false
SSDEEP:
MD5:	E75086A24ECAA25CD18D547AB041C65A
SHA1:	C88CE46E6321E4A21032308DFD72C272FB267DBD
SHA-256:	55BE8A5ED9FB9C129AC45B7FC99574B9907350AFD024BAA5D07525F43E995F6B
SHA-512:	01D7FDD90B8D0D3779B8442250E2AA767481B2E581F880BF9C3DCBB15FCE52E477B1881F3704FBCB3172DB77DB10241BCB24851BFE30066D1E9B66244B3C6877
Malicious:	false
Preview:	.........$..e.....h.....i.....j.'...k.6...l.A...n.I...o.N...p.[...q.a...r.m...s.~...t.....v.....w.....y.....z.....\|.....}.........................................................................+.....D.....].....z.....?...........~...........).............................O.................T...........#.....E...........:.......................w.................W................./...........F.................V...........5.....T...........K.................3.............................o...................................E.........../.....a.....t.............................z...........,.....?...........5.....v.................q.................5.......................r.................1...........X.................I.......................y.................$.................k...........).................!.......................#.................7.....P...........e.......................e.............................w...........W ..... ....$!....K!.....!....7"....g"....."....@#.....#....-$

C:\Users\user\AppData\Roaming\GamePall\locales\hi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1167065
Entropy (8bit):	4.308980564019689
Encrypted:	false
SSDEEP:
MD5:	1FF8A0B82218A956D2701A5E4BFA84EF
SHA1:	56BB8218963E14ADCC435F2455891F3A0453D053
SHA-256:	62E7C3ABC317931723BE11ADD3712DD15EAAB0A35A4D8E7DB0B6347104EC5733
SHA-512:	3330D983401953AA5ED4856A8D10FFCBEEFC2A4E594CF850566A0AD38837BC1164870BB1270B6BBE5D7DD6FB1ECA29CDE85869A5C51808B901CDC282E04764E4
Malicious:	false
Preview:	.........#..e.....h.....i.....j.....k.....l.%...n.-...o.2...p.?...q.E...r.Q...s.b...t.k...v.....w.....y.....z.....\|.....}...............................................................................?.....j.............................................../.....j.........................................N.....}.....P...........^...........F...........A.....d.....K...........N.............................L.....&...........V...........f...................................L.....~.................{.................A.................y..........}...........;........................................[.................,.....K...................................j ..... ..... .....!....J".....".....".....#.....$....T%.....%....@&.....&....8'....d'.....'.....(.....(.....(.....)....6..........*.....+.....,.....-....c-......................%/.....0.....0.....1.....1.....2....i3.....4....B4.....5.....6.....7.....7.....9.....9....S:.....:.....;.....<....F=.....=.....>....N?.....?.....@.....@.....A....LB

C:\Users\user\AppData\Roaming\GamePall\locales\hr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	526575
Entropy (8bit):	5.518614920030561
Encrypted:	false
SSDEEP:
MD5:	0BD2F9847C151F9A6FC0D59A0074770C
SHA1:	EA5313A194E9D99489E9F1D7B4DFC0BC986C8E17
SHA-256:	5F2F1AA2E2EC78F375084A9C35275E84692EE68A1E87BBEF5A12A2C0FCF7F37A
SHA-512:	0032C0B41FDF769DAA1AF23C443D4195B127DF9EA8621174F1AABDBAFAE4954383095FA1EEAD14FC458188B8837BBE9AECA0D5338E4D47F10D976FBED8609496
Malicious:	false
Preview:	........F$s.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.)...y./...z.>...\|.D...}.V.....^.....c.....k.....s.....{.................................................................k...........Y.....z...........F.....~...................................e.......................y.......................m.......................l................. .................q................._.........................................A.............................4.......................j.......................D.....f.....w.................*.....:.................4.....I.................&.....5.................8.....M................. .....0.........................................S.....n.................0.....M.......................3....................... .................E.....v...........!.....F.....\...........).....[.....t...........U.................M...........(.....:...........".....`.................G.....v.................$.....B.....T...........0.....n.

C:\Users\user\AppData\Roaming\GamePall\locales\hu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	566819
Entropy (8bit):	5.6387082185760935
Encrypted:	false
SSDEEP:
MD5:	4C27A1C79AB9A058C0A7DFFD22134AFD
SHA1:	5F0A1B34E808B91ADB1E431E462D9FCF82F4FFF2
SHA-256:	AD98C0A367B51EB217E69D66FA6A946946E85EC8452FC5A7AE0F179F35BE28C3
SHA-512:	0F066DB5905EB24B6CB4FBC7C81F017B43AFB7A6E975886644D871E979406B990509905D100653496EE2D20969A77434B702FF1EA5D348274AE54EA597A91D5E
Malicious:	false
Preview:	.........$..e.....h.....i.!...j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................+.....A.....V.....j.................9.....W...........N.............................................".....X.....q...........K.....r.................Y.................?................."...........I.................7.......................k...........'.....7...........:................./.................:.................Z.....w...........O.....v.................f.................5.................(...........2.....u...................................M.................0...........6.....x...................................m.................)................. .....I.................O.....g...........c.................O.......................E.......................r...........'.....H...........v.............................l...........7.........................................5...........& ....q

C:\Users\user\AppData\Roaming\GamePall\locales\id.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	466959
Entropy (8bit):	5.379636778781472
Encrypted:	false
SSDEEP:
MD5:	1466C484179769A2263542E943742E59
SHA1:	18E45A08661FD6D34BADE01CDB1E1D5184BA2B67
SHA-256:	C331293D16B16B08DEF73BE73437845D58C593941320C547A377DB423749AEBB
SHA-512:	ABC54D5CAAA663578F064E43CC0465BEB97EFC46991936708EBF3FCD64BD007E47072AB4834A5361B21F064BB0F6527E247BC2C2F0DFB8336F50C2FF3E15A59C
Malicious:	false
Preview:	........ $..e.6...h.>...i.O...j.[...k.j...l.u...n.}...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................'...../.....6.....=.....D.....E.....F.....H.....V.....c.....s.................k................. .....l.......................l.................-.......................0.............................R.....s.................I.....x.................T.......................@.....j.....w.................L.....Y.................Z.....m...........H.......................%.....@.....Q.............................c.......................<.......................#.....t.......................L.....x.................%.....R.....^.................>.....K.................5.....G.............................J.......................".....h.......................L.....}.................#.....=.....K.................+.....:.................2.....K...........C.......................u.................,.....\|.......................C.....b.....r...........1.....h.

C:\Users\user\AppData\Roaming\GamePall\locales\it.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	522800
Entropy (8bit):	5.284113957149261
Encrypted:	false
SSDEEP:
MD5:	7767A70358D0AE6D408FF979DF9B2CD4
SHA1:	9C57A5B068DC12AAF1591778DEF5D3696377EDAB
SHA-256:	672908E77E9EACA793654C8E630442099DE3BE772FD3230A9C4045CAFBCC0B1E
SHA-512:	913AA8C49D04CD84706D08A88453D1ED36FDE6A00F7C1DF63DECEA99316A8A234924457C0C50937329B3979E437B1C2D7796E63ADF209505E212FDCEAE3BFDB5
Malicious:	false
Preview:	........-$..e.P...h.X...i.i...j.u...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.$.....,.....1.....9.....A.....I.....P.....W.....^....._.....`.....b.....u.......................E...........3.....O.................V.....g..........._.................o...........#.....L.............................k.......................n.................2..................................w.................5.......................R...................................c................./.....[.....y.................=.....K.............................x..............................................`.......................4.............................^.........................................B.............................F.....\.....r........... .....L.....a...........=.......................b.......................8.....c.....v...........[.................c...........S.....j...........d.................[.................).....v.......................X.............

C:\Users\user\AppData\Roaming\GamePall\locales\ja.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	634636
Entropy (8bit):	5.718480148171718
Encrypted:	false
SSDEEP:
MD5:	4A4AF69546DCF65F2D722A574E221BEA
SHA1:	EE51613F111CF5B06F5605B629952EFFE0350870
SHA-256:	7AD195AF107F2A394BAB527C3E84E08F3B7748076F23459F084CF0E05DD29655
SHA-512:	0E93F6B22F7C9176EFC9D49901BFBD281FA5AC3632780DFA76CE597CADD8C1CF570A9163A86BC320BBFBD354F48288DBEC5E36A6088999B00A3561D302A96D03
Malicious:	false
Preview:	........n#K.e.....h.....i.....j.....k.....l.....m.....o.%...p.2...q.8...v.D...w.Q...y.W...z.f...\|.l...}.~...............................................................................................6.....W...........}.................l........... .....8...........c.......................B.................W.......................x...................................7.....V...........e.................=.......................].......................{...........#.....2...........y.................`...................................<.....W...........j.................y...........e...................................h...........(.....:...........%.....a.....p...........{.................}...........m..................................._...................................Z.....x.............................o...................................:.....U................d.....z....."................?...........X.................`.................@.................g............ ..... ..... .....

C:\Users\user\AppData\Roaming\GamePall\locales\kn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1256908
Entropy (8bit):	4.247594585839553
Encrypted:	false
SSDEEP:
MD5:	6A41A5AB03A22BDAEC7985B9A75EC11A
SHA1:	6BB02DF557BD6522E02FE026C0243BEB9332B2E5
SHA-256:	E22873652AC7D9D18E47DAE838D121B5644EDA4C67F7B0BC110733BF7E931FEA
SHA-512:	BCA661D802D29463A847AC77EB8D5DFA41C31455E7314049CA26555957DCA3BE33701C074F7ED26D2C375A0A9C5F8A93461007B8D74F5ED3BD27C02E5DB170A5
Malicious:	false
Preview:	........O$j.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...\|.V...}.h.....p.....u.....}.................................................................W...........".....V.....W...................................n...........b............................._.......................<.....)...........s.......................).............................1.....7...................................[......................................................................u...........f...........K.....^........................ ..... .....!..../"....i"....=#.....#....r$.....$....I%.....%....l&.....&....p'....((.....(.....(.....)....N...............,.....-.....-................./.....0....W0.....0....z1.....1.....1.....2....Y3.....3.....4....@5.....6.....6.....7.....8.....8.....9....V9.....:....R;.....;....1<.....=....B>.....?....]?.....@....DB....BC....wC.....D.....E.....F....$G....\H....AI.....I....4J.....K.....K.....L....PL.....M....lN.....O

C:\Users\user\AppData\Roaming\GamePall\locales\ko.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	532715
Entropy (8bit):	6.0824169765918725
Encrypted:	false
SSDEEP:
MD5:	5FD9942F57FFC499481947DB0C3FDFA7
SHA1:	4D60AB21305902877467FF6151C1B7AB12553AAE
SHA-256:	09E279860E20E9E559945940E29446CAD4273D05C5F3F15D0BAD664A1D5749F2
SHA-512:	97953E580588C07769F1BD0002E2DF648FFCE5B246D2359E4475EDCFA1CD6E7286BAF168A115D7A65686B2151C313B6FD0C271E40B1F9DD4132F2F39904FE8D4
Malicious:	false
Preview:	........O#j.e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....y.#...z.2...\|.8...}.J.....R.....W....._.....j.....r.................................................................].................5.................O.....b...........F.......................p.................'.......................,.......................;.......................L.......................e.......................Y.......................X...................................Q.....h.................>.....U................. .....0.........................................-.....I.................A.....Q.................L....._.................K.....[.................J.....Z...........O.......................Z.....{.................U.....}.................`.................%.......................J.............................h.......................\.................+.......................m.........................................'.............................x.........................

C:\Users\user\AppData\Roaming\GamePall\locales\lt.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	573015
Entropy (8bit):	5.63016577624216
Encrypted:	false
SSDEEP:
MD5:	8745B87D09D9ECC1112C60F5DD934034
SHA1:	2F411E4EEF0E656CAC0C755FECE1AD2531CB689E
SHA-256:	D546C994C81510122E7B2359DA50F694E1F0CA4081830404E16187A5CF4D4E0D
SHA-512:	27B658C153A01AABB9595C5B1059567E535EDFC8F8187B89316D2C85694DE32696D209CFDD2A32C4826DFB1E50AC692937156563EE190E68DB358C40F9AAE15F
Malicious:	false
Preview:	........+$..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}. .....(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....^.....l.....y.................4...........".....=...........S.................M...........'.....A...........8.....p...................................A...................................B.....g...........z.................R...................................;.....K...........c.................T...........2.....P...........2.....Y.....t...........W.........................................E...................................D.....S...........Q.........................................S.............................B.................&.......................t...........1.....Y...........K.................+.........................................'...........N.................A.................,...........q.................d...........&.....F...........x.................(.......................H ..... .....!

C:\Users\user\AppData\Roaming\GamePall\locales\lv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	570683
Entropy (8bit):	5.624052036286866
Encrypted:	false
SSDEEP:
MD5:	E16B0B814074ACBD3A72AF677AC7BE84
SHA1:	10744490B3E40BEB939B3FDCA411075A85A34794
SHA-256:	46B5C09AA744AF0F660C79B0CDBDE8C8DBDD40A0BA1A23AAF28D37ECC4211DC5
SHA-512:	70EA9DFAC667C0992AE0E95815A47EB8E779BAAE1215E733AFE84EEE26D3BA754AD838C12E9AEE3114D7BBE11CD21B31C550F5CAFE6C5E838B69E54C6174EF18
Malicious:	false
Preview:	........O$j.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...\|.V...}.h.....p.....u.....}...................................................................................Z.................G.................%...........Z.................F.................6.................Q.....\...........Q.........................................\|.....#.....t...................................W.................0...........T.................B...........8.....Y...........$.....J.....`...........-.....V.....h...........;.....b.....v.............................G.......................r.........../.....>...........'.....Z.....k...........c.................@...........3.....K.................).....>...........=.....t.................c.................(.................2.......................8...........<.....q.........................................:.................8...................................N.....^...........0.....K.....m............ .....

C:\Users\user\AppData\Roaming\GamePall\locales\ml.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1307271
Entropy (8bit):	4.279854356980692
Encrypted:	false
SSDEEP:
MD5:	309E068B4E15157486D095301370B234
SHA1:	D962CDAF9361767045A928966F4323EAD22D9B37
SHA-256:	4F2C19B7E94B695C5C5CAB95DEE6E49AE53C3337C351B5C665BCB6BA4E6AE909
SHA-512:	6B1333946C7950D97D2DF29D063DB39A0EC5C0EEAA1ECA40743E4A6A0E4C972D897D3FF2BA837B53E31B8003F2C5C4BACCB7A4AB4B50C6CB47DF39AD7B8E05E7
Malicious:	false
Preview:	........N$k.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.,...w.9...y.?...z.N...\|.T...}.f.....n.....s.....{...........................................................$.....d.................Z.....C.......................W...........%.....r.....a.......................}.................n...........................................................I.................m.......................l.......................5.....y.............................^.............................j.......................\|............ ..... .....!.....!....".....#.....#....V$.....$....n%.....&.....&.....&.....'....n(.....(.....)..........*....W+.....+....c,....+-.....-.....-...........0.....0.....1.....1.....2....!3....Y3.....4.....4.....5....T5....06.....6.....7.....7.....9.....9.....:.....;.....;.....<.....=....Z=....\|>....s?.....@....T@.....A....UB.....C....SC.....D.....E....yF.....F.....G.....H.....I.....I....-K....(L.....L.....M.....N.....N....eO.....O.....P.....Q.....R

C:\Users\user\AppData\Roaming\GamePall\locales\mr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1075591
Entropy (8bit):	4.313573412022857
Encrypted:	false
SSDEEP:
MD5:	69C36C23D6D9841F4362FF3A0F86CFDF
SHA1:	C4C1F632EB8373107AEEBD6C26ECF036AEDA2B6B
SHA-256:	6A794C2B08F8B046BE771DF33719536BDAF2371E3825D49A0E556958B781832D
SHA-512:	8C1329BDB371677BC0A9D727A38591EDF32025BAE1E7EFE402D01C6A8BB5F647D827C59A18F40455D5C9C0482798525C98C3F1C8AC568AA886D7C1ED07D1580E
Malicious:	false
Preview:	.........$..e.....h.....i."...j.....k.=...l.H...n.P...o.U...p.b...q.h...r.t...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................@.....b.................%.....]...........W.................J.............................:.....@.....=...................................&.................&.....F.....P.......................h...........o...............................................c...................................R..........._.................i...............................................J.................. .....!.....!....(".....#.....#....O$....{$....B%.....&....c&.....&....F'.....(...._(.....(....R).........y.....*.....+.....-.....-................./...../...../.....0....61....l1.....1....Z2.... 3.....3.....3.....4.....5.....6.....6.....7.....8.....9....E9....u:....n;.....;....@<.....=....O>.....?....5?.....@.....A.....B.....B....MD....WE.....E....eF....nG....LH.....H.....H.....I.....J.....J.....K....5L....)M.....M

C:\Users\user\AppData\Roaming\GamePall\locales\ms.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	489457
Entropy (8bit):	5.250540323172458
Encrypted:	false
SSDEEP:
MD5:	A1253E64F8910162B15B56883798E3C0
SHA1:	68D402D94D2145704DC3760914BF616CC71FC65D
SHA-256:	E033BFAD6CD73EA7B001DFAF44B7102E3BBE2A1C418F005C149E4FB2565DB19F
SHA-512:	ABD63713093049ECC8E24FD8145EAE065340058A3C38758A59EE8796FBED7E6CFBC54982D650889F1CEB54797060C7DDA12EEE2A963B14C5E907A110C2057DBE
Malicious:	false
Preview:	........T$e.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...\|.W...}.i.....q.....v.....~........................................................................................._.....{...........:.....n.....~...........\.................#.......................=.......................1.......................3.......................Y.................*.....z.......................W.......................E.......................b.........../.....A.............................N.......................$.....x.......................r.......................z.......................p.......................^.......................Q.......................r.................!.....s.......................S.....w.................6....._.....p.................T.....w.......................#.......................$.................2.....K...........B.......................s.................,.............................P.....r.................0.....].

C:\Users\user\AppData\Roaming\GamePall\locales\nb.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	476208
Entropy (8bit):	5.4272499712806965
Encrypted:	false
SSDEEP:
MD5:	622ED80836E0EF3F949ED8A379CBE6DF
SHA1:	9A94CD80E747B88582470EF49B7337B9E5DE6C28
SHA-256:	560B2F09C1B6E6BB7E6A5A5F9BF85A88BD2ACA054B7D4A5955D9C91B6D7CA67C
SHA-512:	950627E74180E1451BB35AE4A7416AC14D42D67BBBB59DC51D7B69E4CEB61715F8F9B0EB9D7F35FCEFD4D43FABE5CE2103F1AF3709CAE6733C25AC19E6339A83
Malicious:	false
Preview:	........2$..e.Z...h.b...i.y...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....o.....p.....r.....}.......................N...........A.....V.................X.....k...........z.................K.......................L.......................:.......................;.......................g................./...........<.........................................R.................1...........Q.......................\.....u.................1.....V.....f.................9.....I.................H.....\.................J.....Z...........".....T.....d.................@.....P.................<.....J...........4.....y.................B.....h.....{...........&.....E.....^.................-.....?...........,.....k.................V.....\|.................b.......................i.................&.......................s...........9.....b...........*.....V.....i.................".....0.................).

C:\Users\user\AppData\Roaming\GamePall\locales\nl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	491139
Entropy (8bit):	5.362822162782947
Encrypted:	false
SSDEEP:
MD5:	C8378A81039DB6943F97286CC8C629F1
SHA1:	758D9AB331C394709F097361612C6D44BDE4E8FE
SHA-256:	318FB294CE025BDA7636B062CA7B6A1FB1E30C485D01856159CB5DB928782818
SHA-512:	6687FFE4DE0D5A2314743EB3134096292724163D4E0332D2F47922B4807B0CDE7C20E2D57D2662E403D801BC7A20BC247F5D0EDD787AB650E5766B49AF7D3C63
Malicious:	false
Preview:	.........$..e....h.2...i.C...j.O...k.^...l.i...n.q...o.v...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................#..........1.....8.....9.....:.....<.....H.....X.....i.....{.............................X.......................\|...........4.....J.................M.....d.................8.....G.......................).................8.....Y...........1.....h.................F.....{.................U.........................................\.................4.............................Y.......................-.....~.......................}.......................v.......................V.......................5.....a.....n...........*.....^.....m...........I.......................X.......................>....._.....v...........,.....T.....f...........8.....o.................=.....[.....o...........3.....e.....v...........H.....................................................E.....j...........5.....f.....{.................B.....R.................B.

C:\Users\user\AppData\Roaming\GamePall\locales\pl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	550453
Entropy (8bit):	5.757462673735937
Encrypted:	false
SSDEEP:
MD5:	80C5893068C1D6CE9AEF23525ECAD83C
SHA1:	A2A7ADEE70503771483A2500786BF0D707B3DF6B
SHA-256:	0069648995532EFD5E8D01CC6F7DD75BD6D072E86C3AE06791088A1A9B6DACC4
SHA-512:	3D1C41A851E1CF7247539B196AD7D8EE909B4F47C3CFB5BA5166D82CDA1C38049B81A109C23FA6D887490E42EE587CC2A6BD96A3EA890267C089AC74710C755F
Malicious:	false
Preview:	........6$..e.b...h.j...i.{...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....o.....p.....r.............................X...........S.....o...........=.....w...................................i...............................................z.................$.................1.....W...........M.................*.......................@.......................l...........0.....L...........].................9.....v.......................E.....h.....x.................,.....:.................<.....P.................>.....P.................6.....F.......................-.........................................e.....}.................4.....K.......................;.................+.....@.................a.................+.....I.....`.................9.....U...........2.....}...................................w...........'.....R.................9.....J.............................v.............

C:\Users\user\AppData\Roaming\GamePall\locales\pt-BR.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	516256
Entropy (8bit):	5.426294949123783
Encrypted:	false
SSDEEP:
MD5:	3BA426E91C34E1C33F13912974835F7D
SHA1:	467A1B05BAD23252A08EE22E6B9EBB4404F6A0F0
SHA-256:	CB66D88D3B3938FE1E42C50ECB85CEDB0D57E0F0AB2FA2A5FC0E4CDEA640E2B7
SHA-512:	824A4301DC4D935FF34CE88FAA0354440FC1A3A8E79B0F4B0B2DCC8F12542ECEF65828FB930EDF5B35BF16863296BBAE39E9306962B4D3CFA9F6495AC05BDEF4
Malicious:	false
Preview:	........9$..e.h...h.p...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.$...\|.*...}.<.....D.....I.....Q.....Y.....a.....h.....o.....v.....w.....x.....}.............................d...........L.....h.........../.....h.....x.............................w.................(.....y.......................^...................................:.....j..........._.................:......................._...................................K.....d...........p.................5.............................q.......................n.......................w.......................p.......................O.....}.................).....W.....a.................V.....g...........b................. .....j.......................;.....a.................=.....U...........N.................2.....W.....p...........8.....p.................S.................@.................0...........1.....{.................X.......................0.....V.....k...........C...................

C:\Users\user\AppData\Roaming\GamePall\locales\pt-PT.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	518861
Entropy (8bit):	5.4029194034596575
Encrypted:	false
SSDEEP:
MD5:	4D7D724BE592BD0280ED28388EAA8D43
SHA1:	8E3C46B77639EB480A90AD27383FBB14C4176960
SHA-256:	4724D82866C0A693C2B02D1FFA67D880B59CDB0D3334317B34EC0C91C3D3E2A2
SHA-512:	D05388F66C50E039F7D3393515740F6B2593F9C0EF8651F9CDE910C5FF06656E0D22FDB066B22665289EE495837EA16CC085ECB3F85B0F6FB498AECDAA19ADF7
Malicious:	false
Preview:	........I$p.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v."...w./...y.5...z.D...\|.J...}.\.....d.....i.....q.....y.......................................................................u...........Z.....u...........@.................).................$.................S.....w.................D.....T.................(.....:...........(.....j.................x.................H.......................g...................................9.....N...........D.......................p.......................^.......................a.......................q.......................r.......................U.............................[.....e.................P.....a...........?.......................O.....y.............................?.................0.....J...........#.....p.................9.....c.....u...........#.....Y.....n.........../.....}...............................................G.....k...........N.......................B.....g.....\|...........J.......

C:\Users\user\AppData\Roaming\GamePall\locales\ro.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	537125
Entropy (8bit):	5.4566742297332596
Encrypted:	false
SSDEEP:
MD5:	4F1C0A8632218F6FEF6BAB0917BEB84F
SHA1:	05E497C8525CB1ADE6A0DAEFE09370EC45176E35
SHA-256:	9C19835F237B1427000D72C93703311CFCBEFF6C2B709474B16DB93E629BC928
SHA-512:	A7CDF94F79CD888BB81FD167F6B09BF1BEF2C749218869E5A12A0A3B2C2506D1A63F64B63D8E48EA49375636041C639082563BF9D526FE44003FC5A5E8D50E9D
Malicious:	false
Preview:	........0$..e.V...h.^...i.o...j.y...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....f.....u.......................3.................+.................%.....9...........@.................1.......................Q.......................4.......................C...................................>.....b...........@.......................d.........................................p...........@.....n.................+.....H.............................h.......................M.......................J.......................7.............................].......................E.....t...................................?.............................W.....w.................\.................).......................f.......................W.........................................'...........$.....y...................................f.......................j.......................l...........+.

C:\Users\user\AppData\Roaming\GamePall\locales\ru.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	878725
Entropy (8bit):	4.848685093578222
Encrypted:	false
SSDEEP:
MD5:	3A3D0D865A78399306924D3ED058274E
SHA1:	AA1A42DB6021666B2297A65094D29978792CE29B
SHA-256:	EAB4C32FEBE084CC7A3A272CDA008B69D6617ED6D042376B0316BE185B9E66FE
SHA-512:	ACA8C87D0B2BB35A325726F7774F8A0232B99C8EFE0F948AB68210958E23B95E9D9026A9430D96FC2D5CEBA94815F4217896EF877C9A6E1D0E56F73533FB1D12
Malicious:	false
Preview:	.........#/.e.....h.....i.#...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................9.....V.....n...........V.......................g...........i...........l.....).................g...........,.....f.......................@.................6.....M......................./....."...........l..........._...........D.....y..... .................&.......................5.....9.....3.............................B.................r.................D...................................=.....b.........................................E.....\...........Y.................'...................................D.....n...........j.................9.......................a...........i...........v...........t...........a........................ ....,!....l!.....!....j"....."....R#....\|#....O$.....%.....%.....%.....&....x'.....(....Q(.....(....z).....).....)....]..........+....$+.....+.....,.....-

C:\Users\user\AppData\Roaming\GamePall\locales\sk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	553886
Entropy (8bit):	5.812150703289796
Encrypted:	false
SSDEEP:
MD5:	A9656846F66A36BB399B65F7B702B47D
SHA1:	4B2D6B391C7C2B376534C0AF9AA6779755B4B74E
SHA-256:	02B65F48375911C821786D91698E31D908A4C0F5F4F1460DE29980A71124480E
SHA-512:	7E23CAA89FF80BF799AC5353CEAF344CBED0393F23D15FCBE8DC24EE55757F417CEA3BFC30889FD2CB41951F9FA5629C2E64B46DD9617D4A85EFEF0A255246F6
Malicious:	false
Preview:	........5$..e.`...h.h...i.\|...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.%...}.7.....?.....D.....L.....T.....\.....c.....j.....q.....r.....s.....u.............................h...............................................[.........../.....I.................S.....j...........9.....h.....{...........4.....].....q...........J.................?.............................%.....`.....y...........\................./.............................%.....v.................G.....g.....\|...........=.....c.....u...........6.....].....o...........O.........................................".......................3.......................R.............................-.....x.................0.....K....._.................0.....E.................G.....W...........T.................).....w.................-.......................M.............................O.................J.........................................'.........................................E.

C:\Users\user\AppData\Roaming\GamePall\locales\sl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	532410
Entropy (8bit):	5.486224954097277
Encrypted:	false
SSDEEP:
MD5:	BE49BB186EF62F55E27FF6B5FD5933F4
SHA1:	84CFD05C52A09B4E6FA62ADCAF71585538CF688E
SHA-256:	833F2E1B13381AA874E90B747931945B1637E53F2396A7409CCDA0A19CBE7A84
SHA-512:	1808631559D3C28589D3F5A4B95554CEBC342DE3D71B05DDC213F34851BF802967BFFAC3D7668C487265EE245D1E26EFCE5D317EDBFBBEEB4BC2C9F122980585
Malicious:	false
Preview:	.........$..e.....h.6...i.G...j.Q...k.`...l.k...n.s...o.x...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................%.....,.....3.....:.....;.....<.....>.....P.....^.....n...................................y.................&...........2.....}.................h.......................g.......................Z.......................v.................O...................................3.....I.................T.....h...........b.................S...........$.....J.......................(.............................n.......................z...........$.....8.................2.....C...........).....j.................;.....i.....\|...........?.....q.................[.......................g.......................L.....j.................G.......................~.................I.......................B.......................b.............................^.............................o.........................................j.......................x.......

C:\Users\user\AppData\Roaming\GamePall\locales\sr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	818089
Entropy (8bit):	4.779985663253385
Encrypted:	false
SSDEEP:
MD5:	AFA2DFBA3BD71FE0307BFFB647CDCD98
SHA1:	CD7A5C54246E891981AEEEAA88D39EC9E3F2C594
SHA-256:	1375353837629A20102C69BF62701EE5401BED84D3DC4845BED5EE43E4D322CF
SHA-512:	CE8BBBDDC33CB6B8DF4AEE127A8987E6D8C1D0761AC5BD25D685310BAA2D377F239BDF06F2C04B54295CF8FD440697A69A040644D5A7C0395C4F71A0252B8E87
Malicious:	false
Preview:	........=$\|.e.p...h.x...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.,...\|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~.........................................).................W...........O...........\...........z.....E...................................3...........b.................a.................5.......................1.....1...........v...........\|...........{...........`...........Y.....~.....d...................................S........... .......................{...........(.....K...........H.................c...........d...........3.................)...........B.................D.................(...........W.......................E.................~...........'.....O...........^.................~ .....!....]!....z!....J"....."....=#.....#....0$.....$.....$.....%.....%....P&.....&.....&.....'....1(.....(.....(.....).....*....5+....S+....A,.....,....Z-.....-....^...........=/....^/...../....Y0.....0.....0.....1....'2.....2

C:\Users\user\AppData\Roaming\GamePall\locales\sv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	479512
Entropy (8bit):	5.541069475898216
Encrypted:	false
SSDEEP:
MD5:	09592A0D35100CD9707C278C9FFC7618
SHA1:	B23EEF11D7521721A7D6742202209E4FE0539566
SHA-256:	9C080A2F6D4EDF0E2E94F78550B9DB59ADF5B1B9166DE2BAE496E6ABB6733304
SHA-512:	E0760B3F227A3E7EAEB4816B8E02BEE51C62730D24403724D66B36BCCBC0BDCD56DF9EAB28B073AB727EE12C8856A858E52A9803E1A1C9164FCD3CF2F716D8AF
Malicious:	false
Preview:	.........$..e.....h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...q._...r.k...s.\|...t.....v.....w.....y.....z.....\|.....}.........................................................................#.....5.....I.....]...........b.................).......................e...........2.....K.................T.....p...........&.....U.....e...........%.....V.....f...........J.........................................O.......................Y..................................._.....u.............................n.......................J.......................'...............................................(.............................z.......................j.......................h.......................\|.................$.....w.......................M.....k.......................?.....Q...........).....f.................J.....i.................;.....c.....x...........1.....l...................................q.................?.................;.....N.............................p.............

C:\Users\user\AppData\Roaming\GamePall\locales\sw.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	504856
Entropy (8bit):	5.34516819438501
Encrypted:	false
SSDEEP:
MD5:	9E038A0D222055FED6F1883992DCA5A8
SHA1:	8FA17648492D7F093F89E8E98BF29C3725E3B4B5
SHA-256:	DDCA575D659545D80E715EB4176BBBBFBD3F75E24B223537B53740B0DCB282BD
SHA-512:	FB70F97E08191DFEB18E8F1A09A3AB61687E326265B1349AB2EFF5055F57E177A496BF0EA3592B61C71FE1F73C9143CA1495B05226F36EB481024827CAE6DCC4
Malicious:	false
Preview:	........4$..e.^...h.f...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.,.....4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....m.............................?.................$.................2.....D...........7.......................P.......................A.....l.....{...........&.....U.....c...........0.....d..................................._.......................m.......................n.............................*.......................J.....r.......................>.....G.........................................A.....O.................4.....F.................G.....R.................).....6.................).....2.................\.....u...........(.....T.....p...........2.....c.................D.......................l.................B.............................j.................+.......................j...........?.....S...........5.....x...................................P.......................r...........%.

C:\Users\user\AppData\Roaming\GamePall\locales\ta.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1298313
Entropy (8bit):	4.058495187693592
Encrypted:	false
SSDEEP:
MD5:	36104CB0D5E26E0BBB313E529C14F4B4
SHA1:	69A509DEE8419DA719DCF6DE78BFE0A6737508C5
SHA-256:	DC28C869A143424F71EDCFDB08B56DA31C2EC96E9D608535FFA7DC0B0842B7D8
SHA-512:	D46ED1AA19EB298BC4C3D61EFC28D80753D6B551F01808E6158A0869FAAE8755DF61D4B4BAFF1310DD09FCFC385ABA67E1AA7D61BBE399DF7BB2D483EBE0FEFF
Malicious:	false
Preview:	.........$..e.(...h.0...i.A...j.M...k.\...l.g...n.o...o.t...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................!.....(...../.....6.....7.....8.....=.....k.................:...........5...........$.....v...........`...........(...........Z.................%.............................O...........j.....L.........................................m...........u...................................;.....c...........7.................................................................8 ..... ....m!....I".....".....".....#.....$.....%....9%....d&....n'.....(....L(....C)....4..........*.....+.....,....3-....a-....Z.....J/...../...../.....0.....1....Z2.....2.....3....:5.....6....Z6....U7....=8.....8.....8.....9.....:.....:....F;.....<.....=.....=.....>....E?....S@.....@....[A....3B.....B....IC.....C.....D.....E....[F.....F....+H....>I.....J....pJ....\L....FN.....O.....O....DQ....QR.....S....{S.....T.....V.....V....'W....+X.....Y.....Y.....Y.....[....9\.....\

C:\Users\user\AppData\Roaming\GamePall\locales\te.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1199612
Entropy (8bit):	4.314031920337284
Encrypted:	false
SSDEEP:
MD5:	98714389748A98ECC536CD2F17859BDF
SHA1:	07761AA31588F30C2CED4A1E31FE99DDC43A5E8D
SHA-256:	8A81B1A5457407E49D6372677938E7A2D28DFCA69F555FEDC8A2C9C09C333A65
SHA-512:	38CC4F064BD874EEC9DBFAB4C2A83A487FBCD89CEFB40BE4213C42231BC48AF9255341C9D325EE059BC50EE533898C5FA22CD3B3927A8E045049DEF3C5DFB2C6
Malicious:	false
Preview:	........N$k.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t. ...v.5...w.B...y.H...z.W...\|.]...}.o.....w.....\|.......................................................................X...........J...........\|...............................................f.........................................~.............................Y.............................A.............................d.....X.........../.....k.....b...........5...............................................'.......................L.....u ....:!.....!.....!.....".....#....$....k$.....%.....&....6'.....'.....(.....)........._*.....+....P,.....,.....-....'...........m/...../.....0.....1...."2....f2.....3.....4....R5.....5.....6....G7.....7.....7.....8....I9.....9.....9....{:....0;.....;....)<.....=.....>.....?.....?.....@....bA.....A.....B....JC....(D.....D.....D....DF.....F.....G.....G.....I....@K....qL.....L....4N....EO.....O....pP.....Q.....R....?S.....S.....T....^U.....U.....V....`W....[X.....Y

C:\Users\user\AppData\Roaming\GamePall\locales\th.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1008989
Entropy (8bit):	4.356501290091745
Encrypted:	false
SSDEEP:
MD5:	56F29DE3465795E781A52FCF736BBE08
SHA1:	EAA406E5ED938468760A29D18C8C3F16CF142472
SHA-256:	529C561747BF8B6206BE4F8BCF287A1D15E1B14A33113242DDAD5E035CA37BE6
SHA-512:	519B5B3CC7032B2AF856456EEC25019B3A6A7F2A6DB7A0318CF87C41E08C6F6BFA73E239939B0DA16972C1D357FF06177765D875E19742D23E99A95FD4AC5416
Malicious:	false
Preview:	........i#P.e.....h.....i.....j.....k.....l.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...\|.v...}.....................................................................................'.....{.......................^...........e...........f.................s...........I...........]...........P...........r.................{...........D.....]...........;...........$.................,.....}.....K...........v...........e...........r...........m.....................................................E.......................P.......................:.......................B.......................b.......................s.......................X.......................S..................!.....".....".....".....#....0$....\|$.....$....j%.....%....5&....l&.....'....z'.....'....!(....A).....)...............+.....,....H,....x,....M-.....-....6.....l.....k/...../....o0.....0.....1.....2....>3...._3.....4.....5....c6.....6.....7....n8.....8.....9.....9....f:.....:.....:.....;.....<....D=

C:\Users\user\AppData\Roaming\GamePall\locales\tr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	515329
Entropy (8bit):	5.616482888977033
Encrypted:	false
SSDEEP:
MD5:	46CA9EE922C3C175DE466066F40B29CE
SHA1:	5563E236A15CD9CC44AE859165DF1E4E722936C7
SHA-256:	BD8B1441FD2057F0B61512CC0AA23DFD2619560CF886B4D453FA7472E7153A3F
SHA-512:	45AA2D6896568751C2F986ABD281EA07CB731880DF8F28F2F0AEFD95736F41B1E005D8DFB6F0AEF0CED6CEF94154D34FD0DA2CB7F0B0C66D9C085F5C47F32605
Malicious:	false
Preview:	........c$V.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...\|.\|...}...........................................................................................)...........L.................+.......................e........... .....;.................7.....J.......................)......................................... .....B...........5.....x.................Z.......................Q.....{.................w.................Q.................!.......................'.......................&....................... ................."...../.................5.....F.................9.....F.................2.....>.................7.....D...........I.......................v.......................i.......................P.......................q.................-.....z.......................m.................,.............................*.................B................."...........(.....n.................N.....~.................l.......

C:\Users\user\AppData\Roaming\GamePall\locales\uk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	876131
Entropy (8bit):	4.88404350774067
Encrypted:	false
SSDEEP:
MD5:	1365ABDD1EFB44720EA3975E4A472530
SHA1:	8421FC4905C592EB1269C5D524AA46866D617D3C
SHA-256:	29AB0F7EE69FB7A1E1E54DD2A3746D2CFEAAA71AE5971EE30AA8E2E0F6556FA5
SHA-512:	2E806A9BEA864E689BBD1D78B800DFDBC6E4109320F9A4790E52010BFDEC20C7644655A6FE3BABDE0B84D9580208CB78EF1FA0DB3476F8676C17A13D130296C7
Malicious:	false
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.'...s.8...t.A...v.V...w.c...y.i...z.x...\|.~...}.....................................................................................1.....s.....W.......................r...........x...........m.....!.......................<.............................n...........,.................-...........\|.............................=.....y.....+...........%.....K...................................w.............................N...................................r.................O...........N.................^...........\...............................................h...............................................R.....m.....f.....6.............................W.....y...........O.....x...........K...........j...........z .....!.....!.....".....".....#....R#.....#....&$.....$.....$.....%.....%....s&.....&.... '.....(.....(....~).....).....*....Q+.....+.....,.....,....Z-.....-.....-....[............/....4/.....0.....0....$1

C:\Users\user\AppData\Roaming\GamePall\locales\ur.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	765853
Entropy (8bit):	5.17061834928747
Encrypted:	false
SSDEEP:
MD5:	3FED15E64BEAFBA75DE61B08A45AE106
SHA1:	E24953271D8C0254AD011D3A65B2C2FA57903681
SHA-256:	B6E250C3F4FBAC3AF5FB8BB1C61CACAD8685D7F2A97063DE23BC22E91B7F2E27
SHA-512:	3948D080135AFEB240815D43F7B5B8D407BA2830FF701D9B8343F2A72E610827EDAAB643444CDCEB86812ADFC9FB3FBA3AAD6DB7488843C2A04E92A3E63FE40D
Malicious:	false
Preview:	........1$..e.X...h.`...i.h...j.t...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.#.....+.....0.....8.....@.....H.....O.....V.....].....^....._.....d.....\|.............................n.....................................................).....^.......................<...........G.................J.................9...........E.................~...........{...........\...........L.....k.......................,.................9.....e.....C.......................>...................................8.....Z...........C.................;.................-...........L.................N.................1...........-.....y.........................................s............................p........... .......................i...........).....J.......................L...........M ..... ..... ....Y!.....!....4"....Z"....,#.....#....&$....W$....'%.....%....^&.....&....f'.....(.....(.....(.....)....3..............]+.....+.....,....F,.....,....z-.....-

C:\Users\user\AppData\Roaming\GamePall\locales\vi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	609259
Entropy (8bit):	5.796202390024141
Encrypted:	false
SSDEEP:
MD5:	CD741C24AF7597E0DC11069D3AC324E0
SHA1:	2A883DFBCF48D5093D70D4B77BBFFFA521287334
SHA-256:	13E982DC4B2B1AEE093E96BA27E02258C2B815CBB062006A4396BB3A3E6A84B1
SHA-512:	6D27998E25B57FF0CE08C3590B69031038CBA390E68333A83514022B2C56B689AF8AD9715302824027864B5320852E9AB77D74E3B8A90DC66DF59F48CEB528C9
Malicious:	false
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r....s.;...t.D...v.Y...w.f...y.l...z.{...\|.....}...........................................................................................;.......................-...........A.................[...........O.....u...........v.................6.......................+.......................}...........G.....y.....9...........K.....y.............................z...........?.....V...................................T.................X.......................r...................................9.....J...........H.......................}.................'.......................<.......................O.............................Z................._..................................)........... .....V.....v.......................j...........N.................3...................................O.....v................./.....C.......................@...........) ....^ ....w ..... ....J!....}!.....!..../".....".....#....8#

C:\Users\user\AppData\Roaming\GamePall\locales\zh-CN.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	441207
Entropy (8bit):	6.685712707138377
Encrypted:	false
SSDEEP:
MD5:	99E6ACFB46923C4F8B29058E9EE6166B
SHA1:	AF06C42E5F3578ADBC4F0BD7262DC6775FDD351F
SHA-256:	9D8498875263B19552A982D1850F2F942FF44AF4E323BC5A3A67C34413994D95
SHA-512:	4FDF5186FC2FC68210C2BE91F5B821F0979CA67D6C9B8915C14E7A20D3CE2548EB2660D5F9F398CF6C585A5C0725FA34FD3670F416F7C8A4F009C729BCF02988
Malicious:	false
Preview:	.........#..e.T...h.\...i.d...j.g...k.v...l.}...m.....o.....p.....q.....r.....s.....t.....v.....w.....\|.....}...............................(.....-.....5.....<.....C.....E.....J.....S....._.....q.................v.................1......................./.......................:.......................>.............................c.......................D.....j................._.......................n.......................T.....}.................@.....o.................V.......................5.....O.....i................."...........x.......................U.......................].......................=.......................".....s.......................L.....u.................g.......................W.....w.................3.....X.....o...........&.....J.....\.................=.....].............................y.......................y...................................N.....`...........,.....d.....y...........).....O.....^.............................\|.......................x.

C:\Users\user\AppData\Roaming\GamePall\locales\zh-TW.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	439630
Entropy (8bit):	6.6906570508767995
Encrypted:	false
SSDEEP:
MD5:	BB7C995F257B9125457381BB01856D72
SHA1:	21C55FF5CBC4F223C23D5A2FBCC9E051DB78A44C
SHA-256:	F2299E03E99B0E9A9CACE3B1C72E6C8C5FE089487CA1C82F2AAF4273B62E37A2
SHA-512:	5247C5DA6F00DF6241500524DDB162041A03649FA0AFCC11AD40E820814958768A2E11CE34E1250FDBF42B2459F8C06B00AE7442B537F0731A62C6724FC8D890
Malicious:	false
Preview:	.........#,.e.....h.....i.)...j.-...k.<...l.G...n.O...o.T...p.\...q.b...r.n...s.....t.....v.....w.....y.....z.....\|.....}...................................................................%.....4.....C...........3.....q.................+.....T.....`........... .....R.....d.................M.....b.................3.....?.............................g.......................[.......................S.......................;.......................*.......................@.......................F.............................D.....d.....p.................2.....A.............................q.......................T.......................<.............................i.......................f.......................A.....[.....o.................!.............................u.......................^.............................h.......................P.........................................H.......................Z.......................$.....e.....z.................1.....X.....j...........#.

C:\Users\user\AppData\Roaming\GamePall\log4net.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	275968
Entropy (8bit):	5.778490068583466
Encrypted:	false
SSDEEP:
MD5:	7EA1429E71D83A1CCAA0942C4D7F1C41
SHA1:	4CE6ACF4D735354B98F416B3D94D89AF0611E563
SHA-256:	EDEC54DA1901E649588E8CB52B001AB2AEC76ED0430824457A904FCC0ABD4299
SHA-512:	91C90845A12A377B617140B67639CFA71A0648300336D5EDD422AFC362E65C6CCD3A4FF4936D4262B0EAF7BAE2B9624BCD3C7EEC79F7E7CA18ABE1EC62C4C869
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.X...........!.....,..........~K... ...`....... ..............................H.....@.................................$K..W....`...............................I............................................... ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B................`K......H...........<x...............-..P .......................................i.)V.#c....e../.`...V....j>....?.LbrzKV.x.}...........[.f)..dD`..66.61[.z....W^....>F..r...#. ..g...T...P....Ss)ii.a.v.(0.....(1...o2...s....}.......0..7........{....-%~....r...p.{....r9..p(3...(.....(.......(4.............//........{...."..}......{........0..4..........%...(5....-.~....r?..p(....+...}.......,..(6............')........{......{...."..}.......{...."..}....*.0..........

C:\Users\user\AppData\Roaming\GamePall\log4net.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1547797
Entropy (8bit):	4.370092880615517
Encrypted:	false
SSDEEP:
MD5:	32AB4E0A9A82245EE3B474EF811F558F
SHA1:	9F2C4C9EEB5720D765F2321ACD0FF9F8DD11E6A4
SHA-256:	9BBF4D15F8FB11F7D2C032BD920D2A33B2C2CB8EF62E7E023049AF6132F5D6C1
SHA-512:	A0574A170F69F9926C32BAF6119A16A381FEC9E881B304082859EE7CFF463570C78984EE14369C59CDB19E532B3ABF193D02B462F1B40D07214B6244150CD63F
Malicious:	false
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>log4net</name>.. </assembly>.. <members>.. <member name="T:log4net.Appender.AdoNetAppender">.. <summary>.. Appender that logs to a database... </summary>.. <remarks>.. <para>.. <see cref="T:log4net.Appender.AdoNetAppender"/> appends logging events to a table within a.. database. The appender can be configured to specify the connection .. string by setting the <see cref="P:log4net.Appender.AdoNetAppender.ConnectionString"/> property. .. The connection type (provider) can be specified by setting the <see cref="P:log4net.Appender.AdoNetAppender.ConnectionType"/>.. property. For more information on database connection strings for.. your specific database see <a href="http://www.connectionstrings.com/">http://www.connectionstrings.com/</a>... </para>.. <para>.. Record

C:\Users\user\AppData\Roaming\GamePall\natives_blob.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	342741
Entropy (8bit):	5.496697631795104
Encrypted:	false
SSDEEP:
MD5:	A58DB728B50E6B82CBDCAA0DB61D36B1
SHA1:	7CD76526CB29A0FF5350A2B52D48D1886360458B
SHA-256:	BA2F2AC6AE9BC67399728F25772A0EB3E840695395CC747ADF4B2F8B5D6D9A46
SHA-512:	0DB9AFBDADA44364521D89BAB6055458125F4F3C8C1B09048EAFA4055A194231CCFFD82FCDADA9360AB2B19F472B893330EBFCB027391E7A0C2B1100FC51E673
Malicious:	false
Preview:	..mirrors....(function(a,b){."use strict";.var c=a.Array;.var d=a.isNaN;.var e=a.JSON.stringify;.var f;.var g;.var h=b.ImportNow("promise_state_symbol");.var i=b.ImportNow("promise_result_symbol");.var j;.var k;.b.Import(function(l){.f=l.MapEntries;.g=l.MapIteratorNext;.j=l.SetIteratorNext;.k=l.SetValues;.});.var m={.UNDEFINED_TYPE:'undefined',.NULL_TYPE:'null',.BOOLEAN_TYPE:'boolean',.NUMBER_TYPE:'number',.STRING_TYPE:'string',.SYMBOL_TYPE:'symbol',.OBJECT_TYPE:'object',.FUNCTION_TYPE:'function',.REGEXP_TYPE:'regexp',.ERROR_TYPE:'error',.PROPERTY_TYPE:'property',.INTERNAL_PROPERTY_TYPE:'internalProperty',.FRAME_TYPE:'frame',.SCRIPT_TYPE:'script',.CONTEXT_TYPE:'context',.SCOPE_TYPE:'scope',.PROMISE_TYPE:'promise',.MAP_TYPE:'map',.SET_TYPE:'set',.ITERATOR_TYPE:'iterator',.GENERATOR_TYPE:'generator',.}.var n=0;.var o=-1;.var p=[];.var q=true;.function MirrorCacheIsEmpty(){.return n==0&&p.length==0;.}.function ToggleMirrorCache(r){.q=r;.ClearMirrorCache();.}.function ClearMirrorCache(r){.

C:\Users\user\AppData\Roaming\GamePall\resources.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	8226870
Entropy (8bit):	7.996842728494533
Encrypted:	true
SSDEEP:
MD5:	F7EC58AEA756F3FD8A055AC582103A78
SHA1:	086B63691F5E5375A537E99E062345F56512A22C
SHA-256:	517418184EA974C33FFE67B03732D19B1234DCB9E5C1C2E9E94ED41B3BC1D064
SHA-512:	C620C6E16BBCEE9BC607E6CA75D602C756276AC69E5F3761D82DE7728164133656A71A69043EB1A86CE3051FDE4327A47EFD41D1FF47C8385699CA67C423AD7B
Malicious:	false
Preview:	............f.6:..{..D..\|..G..~. K.....]....._....=.....c...........9.....B.............................F.....K/.....2....54....r5.....6.....?.....@....jB.....C....hD.....E.....H....nj.....k.....r....@~...."..........W.....................;..../;'...2;P...7;....8;....C;....D;U...E;....F;....G;A,..H;.;..I;gK..J;.Z..K;.h..L;.}..M;y...N;{...O;z...P;....Q;8...R;....S;....T;C'..U;.=..V;.W..W;.m..X;....Y;....Z;D...[;....\;....];.....<.....<x....<.....<-....<\....<.....<.....<.....<.....<*(...< /...<+3...<.3..I=.3..J=.7..K=.9..R= >..S=.G..T=}V..[=;w..\=.x..]=.}..^=R..._=....`=....a=....b=....c=....e=:...f=.....=....=.....=....=`....=p....=.....=.....=.....=.....=.....=K....=.....=t....=.....=.....=.....=\....=Z....=.....=T....=[....=x....=.....=.....=D....=.....=.....=.....=l....=F....=.'...=j)...>.+...>l,...>_0...>.2...>.6...>.8..N>.\..O>~^..P>._..Q>%d..R>.k..S>.l..T>Tn..U>.p..b>.u..c>/y..d>.\|..B@....C@....D@o...E@....F@W...L@Z...M@(...N@...O@....D.....D ....D ....D;....D.....D....D..

C:\Users\user\AppData\Roaming\GamePall\snapshot_blob.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	276319
Entropy (8bit):	4.242318669799302
Encrypted:	false
SSDEEP:
MD5:	8234983533FA47D2A1D7710FF8274299
SHA1:	E4C5793B6FE6A6C6C9D8E3921B3BC341AE3448D8
SHA-256:	F95553D8066144CBB8A05EED1735C94A4B97A2E44E49F624C2302990A13017C9
SHA-512:	1E7E201B0FF9AFA7821B5FFD0A36548A49CD4DBBABA5858E13DA35058670A5053723DD3544B2FD85C619F2B8FC9E5DB48DF977BB293E7BA7DE6F22CC8DAB28CA
Malicious:	false
Preview:	.........X./j1N.11.8.172.9.......................................................@...y...........@..`....`....`....`b...`....`............B..............b........."..............B..............b...(Jb...)L.....@..F^.1..5.`.....(Jb...-P.....@..F^..`.....H...IDa........Db............D`.....-.D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\start.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.8731406795131327
Encrypted:	false
SSDEEP:
MD5:	2C66F3C2190A84FAFD4449DAF6440EAC
SHA1:	7B9E4C94329FE26C34E63AB8336227FD5EB553E9
SHA-256:	58EB97E30289A3FCAE270DBCC01258A862936350CB0EF781AE76D6A9444C0155
SHA-512:	62713209575426CE503605C6F451E9DFB025BE0295F0A453614862CE390F5987F0E16BAE6B37B4B1A7330A7CB5AA31249F8CF58DE37B8B701C16881E4E4E61C1
Malicious:	false
Preview:	start GamePall.exe OuWe5kl

C:\Users\user\AppData\Roaming\GamePall\swiftshader\Xilium.CefGlue.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	MSVC program database ver 7.00, 512*4023 bytes
Category:	dropped
Size (bytes):	2059776
Entropy (8bit):	4.067542396670122
Encrypted:	false
SSDEEP:
MD5:	70F9EAEA8A2A604E59F72EDE66F83AB4
SHA1:	0AB9EA1BFFDFF471EC22AB289C7FBC5E0CDF48BF
SHA-256:	38A07BA75CC2BBDF715CA87D380A4E5A0DCFAF9C30C5ECD30F6107871D51825B
SHA-512:	47DE4DAD93385A4907FADE307040FE026ED66989C0C9915AFC96CB2BC93DE5E106DC1274E4AD2382021C758C60FEDE06D68998CF3591E23E2951778CE09D6D4C
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS................J..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346624
Entropy (8bit):	6.54104466243173
Encrypted:	false
SSDEEP:
MD5:	7A53AD3E5D2E65C982450E7B7453DE8A
SHA1:	99F27E54F1F61207C02110CAC476405557A8AD54
SHA-256:	24FDDD6A367792A9D86D9060FC9AA459B5FB0F67804CB7D139A100D86BBDAFF8
SHA-512:	2B5E5DB46FDC787CB46CDAEBFFC01586E248FBB864677B27AF03CDC33E956DEF51B3F836597E7092C4175CF605C44728C6F96B74BB2C9870E9715D4AF4C531A1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......_.........."!.........T............................................................@A....................................P....p...........................3..4.......................8........G...............................................text............................... ..`.rdata..............................@..@.data....4..........................@....00cfg.......@......................@..@.tls.........P......................@....voltbl......`...........................rsrc........p......................@..@.reloc...3.......4..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2445312
Entropy (8bit):	6.750207745422387
Encrypted:	false
SSDEEP:
MD5:	334C3157E63A34B22CCE25A44A04835F
SHA1:	C6B05BD55BE9FED3B0C5077C5649E2A41C10DC08
SHA-256:	3E307570B574469EC8BCF1CE6D5291DF8D627CA3812F05AACFEBBD3F00B17F89
SHA-512:	11F538ADD05515861891892EBB90163B6540B72FEB380D64B4A0AA56C6415E3B71374557BF50D0B936712B1006F2B94D59BEBFBF18CBF93BB883D9055CAAEEE9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......_.........."!.....4 .................................................p*...........@A..........................#.. ....$.d....P)......................`).......#.......................#......."...............$.P............................text.../2 ......4 ................. ..`.rdata..\....P ......8 .............@..@.data...L....@$...... $.............@....00cfg....... )......>$.............@..@.tls.........0)......@$.............@....voltbl.M....@)......B$..................rsrc........P)......D$.............@..@.reloc.......`)......H$.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	631017
Entropy (8bit):	5.144793130466209
Encrypted:	false
SSDEEP:
MD5:	0794DF29DF8DFC3ECE5C443F864F5AEB
SHA1:	BFD4A9A34BEB9751BC4203FB9A9172F1F05E5B16
SHA-256:	3EE2237E9B14871165B051CCF892C8375E45B5F12841E02F4B9D37F5D5A03283
SHA-512:	0D34E36F7455B977F086F04840FBA679284A619A7164A56B5C7FC2ADCB23A231B67A62101540EB07CF5C8192790266B08D2CC232D291621C331FE77C1F5E52C0
Malicious:	false
Preview:	..........d..<..11.8.172.9......................................................@...]!...S..y...-[..........`....`....`T...`b...`....`............B..............b........."..............B..............b...(Jb...)L.....@..F^.1..5.`.....(Jb...-P.....@..F^..`.....H...IDa........Db............D`.....-.D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4400640
Entropy (8bit):	6.667314807988382
Encrypted:	false
SSDEEP:
MD5:	7F913E31D00082338F073EF60D67B335
SHA1:	AC831B45F2A32E23BA9046044508E47E04CDA3A4
SHA-256:	B60E9818C4EA9396D0D2D2A4AC79C7DC40D0DFF6BB8BC734D0AB14ADC30FBF30
SHA-512:	E1AC79C775CF9137283CD2C1AE1A45EC597E0351CDB9C11D483E2E1F8B00CC2BBC5807A50DED13A3A5E76F06C1A565EFF1233F4EC727B0C5F7AA3BEAEA906750
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....$5.........P.-......................................PD...........@A........................8=?.~....\?.P.... B......................0B.X.....?.....................H.?......@5.............._?..............................text...T#5......$5................. ..`.rdata...a...@5..b...(5.............@..@.data...@N....?..x....?.............@....00cfg........B.......A.............@..@.tls....5.....B.......A.............@....rsrc........ B.......A.............@..@.reloc..X....0B.......A.............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	826368
Entropy (8bit):	6.78646032943732
Encrypted:	false
SSDEEP:
MD5:	A031EB19C61942A26EF74500AD4B42DF
SHA1:	FDC6EA473234F153639E963E8EFB8D028DA1BE20
SHA-256:	207706A3A3FAA8500F88CB034B26413074EFC67221A07C5F70558F3C40985A91
SHA-512:	80F843E47FC2B41B17EF6EA1BB2BB04119B2417311599EC52120D9F9DF316B4D7B1DAF97EE5CDF2AE78CDB9475E5C65255A7F2AB2A9231804F6A82C83303FD19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....\|..........@.....................................................@A...........................<!..$...P....p..............................l..............................................P................................text....z.......\|.................. ..`.rdata..tr.......t..................@..@.data....7..........................@....00cfg.......P......................@..@.tls.........`......................@....rsrc........p......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	211456
Entropy (8bit):	6.566524833521835
Encrypted:	false
SSDEEP:
MD5:	6D7FD214164C858BBCF4AA050C114E8C
SHA1:	B8868DA6BB9A79EE7C9901A9BFAC580D5BAFCC96
SHA-256:	3F58FB22BD1A1159C351D125BEE122A16BB97BABB5FCA67FDBD9AAAED3B302E6
SHA-512:	0F8F2523C3A616AC7C72A1239B7E353F6A684FF75DA79D1CAF9B98A47FF6FE06329165825704C67C04E92073BA2C17D0FF339C57731DDF0F1489C2E97D1D0A14
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^..._...^..._q..^..._..^..._..^..._..^..._..^k.._...^..._...^...^...^k.._...^k.._...^n..^...^k.._...^Rich...^........................PE..L...Ua.X.........."!.........(......c........0............................................@.................................x...<....@.......................P..T"......8...............................@............0..0............................text............................... ..`.rdata..`....0....... ..............@..@.data...............................@....gfids.......0......................@..@.rsrc........@......................@..@.reloc..T"...P...$..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\gujascb

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	190464
Entropy (8bit):	6.194916928085878
Encrypted:	false
SSDEEP:
MD5:	794107DD168BD98D7C9F65A9F693A07E
SHA1:	B026AD1BBD93BA9F30776C823D3C9C954DD9F975
SHA-256:	B87126FD409621A4D510DDA005CD84E254D491274661CF22238B271412FF860B
SHA-512:	3327CE8A2D78704C5A4638F72482203C141DF5820E68E9DF82313520235A6EF7AD7BD8301BDEFA29F1457A456D9E7F8AE122317FFF8514D36496CEF648ED90F7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.9%.nWv.nWv.nWvw..v.nWvw..v.nWvw..vPnWv...v.nWv.nVv.nWvw..v.nWvw..v.nWvw..v.nWvRich.nWv........PE..L....R.d......................\|......"............@..........................p~......@......................................<...x....0~..>.......................................................... ...@............................................text............................... ..`.rdata..J1.......2..................@..@.data.....\|.. ......................@....rsrc....>...0~..@..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\gujascb:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.194916928085878
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	190'464 bytes
MD5:	794107dd168bd98d7c9f65a9f693a07e
SHA1:	b026ad1bbd93ba9f30776c823d3c9c954dd9f975
SHA256:	b87126fd409621a4d510dda005cd84e254d491274661cf22238b271412ff860b
SHA512:	3327ce8a2d78704c5a4638f72482203c141df5820e68e9df82313520235a6ef7ad7bd8301bdefa29f1457a456d9e7f8ae122317fff8514d36496cef648ed90f7
SSDEEP:	3072:5wvqgs5T+ozfo2Razv19yju8nOnK39XNge8bJ6FY71:5wXeT+a3RazG60VNge8bGY
TLSH:	EA14D01176E18076E1B389315DB0D6B25D7F7C736B7581ABE38C1A2E2EA16C046F8363
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.9%.nWv.nWv.nWvw..v.nWvw..v.nWvw..vPnWv...v.nWv.nVv.nWvw..v.nWvw..v.nWvw..v.nWvRich.nWv........PE..L....R.d...................

File Icon


Icon Hash:	63796de971436e0f

Static PE Info

General

Entrypoint:	0x402288
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64AB52FE [Mon Jul 10 00:38:22 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	4e95ddf93ca5962bf8da1a69883e9333

Entrypoint Preview

Instruction
call 00007F8348F306B7h
jmp 00007F8348F2E20Eh
push edi
mov eax, esi
and eax, 0Fh
test eax, eax
jne 00007F8348F2E447h
mov edx, ecx
and ecx, 7Fh
shr edx, 07h
je 00007F8348F2E3E7h
jmp 00007F8348F2E388h
lea ebx, dword ptr [ebx+00000000h]
movdqa xmm0, dqword ptr [esi]
movdqa xmm1, dqword ptr [esi+10h]
movdqa xmm2, dqword ptr [esi+20h]
movdqa xmm3, dqword ptr [esi+30h]
movdqa dqword ptr [edi], xmm0
movdqa dqword ptr [edi+10h], xmm1
movdqa dqword ptr [edi+20h], xmm2
movdqa dqword ptr [edi+30h], xmm3
movdqa xmm4, dqword ptr [esi+40h]
movdqa xmm5, dqword ptr [esi+50h]
movdqa xmm6, dqword ptr [esi+60h]
movdqa xmm7, dqword ptr [esi+70h]
movdqa dqword ptr [edi+40h], xmm4
movdqa dqword ptr [edi+50h], xmm5
movdqa dqword ptr [edi+60h], xmm6
movdqa dqword ptr [edi+70h], xmm7
lea esi, dword ptr [esi+00000080h]
lea edi, dword ptr [edi+00000080h]
dec edx
jne 00007F8348F2E325h
test ecx, ecx
je 00007F8348F2E3CBh
mov edx, ecx
shr edx, 04h
test edx, edx
je 00007F8348F2E399h
lea ebx, dword ptr [ebx+00000000h]
movdqa xmm0, dqword ptr [esi]
movdqa dqword ptr [edi], xmm0
lea esi, dword ptr [esi+10h]
lea edi, dword ptr [edi+10h]
dec edx
jne 00007F8348F2E371h
and ecx, 0Fh
je 00007F8348F2E3A6h
mov eax, ecx
shr ecx, 02h
je 00007F8348F2E38Fh
mov edx, dword ptr [esi]
mov dword ptr [edi], edx
lea esi, dword ptr [esi+04h]
lea edi, dword ptr [edi+04h]
dec ecx
jne 00007F8348F2E375h
mov ecx, eax
and ecx, 00000000h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2083c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x27e3000	0x3e88	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x208b4	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x20320	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1c0ee	0x1c200	95173f9bf8be45f5f8892717d7ef6b2d	False	0.8915017361111112	data	7.7704450327476176	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1e000	0x314a	0x3200	99596c7b9f1f5c27036a41c953693174	False	0.35875	data	4.955082435710902	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x22000	0x27c0384	0xb000	b9cf4ce9a54ea1cbfd6380c031a88496	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x27e3000	0x3e88	0x4000	0c09bbdfbb31ab036890011c921ea75f	False	0.44281005859375	data	3.99692314262114	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x27e31f0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Japanese	Japan	0.5362903225806451
RT_ICON	0x27e38b8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Japanese	Japan	0.4183609958506224
RT_ICON	0x27e5e60	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Japanese	Japan	0.45567375886524825
RT_STRING	0x27e6590	0x582	data	Japanese	Japan	0.4475177304964539
RT_STRING	0x27e6b18	0x108	data	Japanese	Japan	0.5795454545454546
RT_STRING	0x27e6c20	0x262	data	Japanese	Japan	0.48032786885245904
RT_GROUP_ICON	0x27e62c8	0x30	data	Japanese	Japan	0.9375
RT_VERSION	0x27e62f8	0x298	OpenPGP Public Key			0.5210843373493976

Imports

DLL	Import
KERNEL32.dll	IsBadStringPtrW, GetConsoleAliasesLengthW, CommConfigDialogA, SetEndOfFile, FindResourceW, InterlockedDecrement, CreateDirectoryW, WriteConsoleInputA, TlsSetValue, GlobalFindAtomA, LoadLibraryW, ReplaceFileA, GlobalUnlock, SetLastError, GetProcAddress, SetFileAttributesA, LoadLibraryA, FindResourceA, AddVectoredExceptionHandler, GlobalGetAtomNameW, OpenJobObjectW, EnumResourceTypesW, GetOEMCP, OpenFileMappingW, TerminateJobObject, GetWindowsDirectoryW, HeapSize, HeapReAlloc, RtlUnwind, CreateFileA, LocalAlloc, GetDateFormatW, Sleep, EnterCriticalSection, MultiByteToWideChar, GetCommandLineA, HeapSetInformation, GetStartupInfoW, IsProcessorFeaturePresent, HeapAlloc, GetLastError, HeapFree, GetCPInfo, InterlockedIncrement, GetACP, IsValidCodePage, EncodePointer, TlsAlloc, TlsGetValue, DecodePointer, TlsFree, GetModuleHandleW, GetCurrentThreadId, SetUnhandledExceptionFilter, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameW, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, HeapCreate, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, UnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, LCMapStringW, GetStringTypeW, LeaveCriticalSection, RaiseException
USER32.dll	GetKeyboardLayoutNameA, SetMessageExtraInfo, GetCaretPos, InsertMenuItemW, GetClassInfoW, CharUpperBuffW, DdeKeepStringHandle
GDI32.dll	GetTextMetricsA, GetCharWidthW
ole32.dll	CoSuspendClassObjects, CoMarshalHresult
WINHTTP.dll	WinHttpCheckPlatform, WinHttpWriteData

Possible Origin

Language of compilation system	Country where language is spoken	Map
Japanese	Japan

Target ID:	0
Start time:	05:30:52
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	190'464 bytes
MD5 hash:	794107DD168BD98D7C9F65A9F693A07E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.2067888436.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.2067888436.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.2067826028.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.2067826028.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2067809785.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2067955486.0000000002E3E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:30:58
Start date:	04/07/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	05:31:16
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\gujascb
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\gujascb
Imagebase:	0x400000
File size:	190'464 bytes
MD5 hash:	794107DD168BD98D7C9F65A9F693A07E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.2290641536.0000000002DEE000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.2290515587.0000000002D40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.2290515587.0000000002D40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000004.00000002.2290464944.0000000002CE0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.2290789668.0000000004981000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.2290789668.0000000004981000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:31:42
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Local\Temp\39FF.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\39FF.exe
Imagebase:	0x400000
File size:	293'869 bytes
MD5 hash:	60172CA946DE57C3529E9F05CC502870
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 21%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	05:33:06
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Local\Temp\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\setup.exe"
Imagebase:	0x400000
File size:	107'232'830 bytes
MD5 hash:	FF2293FBFF53F4BD2BFF91780FABFD60
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:33:32
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Imagebase:	0x7c0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:33:36
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3452 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
Imagebase:	0xc80000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:33:36
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3648 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Imagebase:	0x410000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:33:36
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x7c0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	05:33:36
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3728 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Imagebase:	0xd00000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:33:37
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720079065909404 --launch-time-ticks=7150995116 --mojo-platform-channel-handle=4036 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Imagebase:	0x250000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:33:37
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720079065909404 --launch-time-ticks=7151287249 --mojo-platform-channel-handle=4128 --field-trial-handle=3468,i,8064171168065034689,17696587829763198886,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Imagebase:	0x130000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:33:37
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x5c0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:33:37
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x1d0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:33:38
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x420000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:33:39
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x2e0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	05:33:40
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x8d0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	05:33:40
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xbf0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	05:33:40
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x40000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	05:33:41
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x110000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	05:33:41
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x310000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:33:42
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xa40000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	05:33:42
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x570000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	05:33:42
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x260000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	05:33:43
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x850000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	05:33:44
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xcd0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:33:44
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x20000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	05:33:44
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x850000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	05:33:44
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x930000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	05:33:45
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x7a0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	05:33:45
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x280000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	05:33:45
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x9d0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	05:33:45
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xb70000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	05:33:45
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x150000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	05:33:46
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xa70000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	29.3%
Signature Coverage:	64.6%
Total number of Nodes:	99
Total number of Limit Nodes:	2

Executed Functions

Function 00401496 Relevance: 10.7, APIs: 7, Instructions: 247
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.2066714089.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 5edb7204c22a8cfb94061bf161a88c3eca98da374ec15d8cd8ba2bf42dcd3747
Instruction ID: 8e4940cc2d5d294876689a6a874cb0cc3c399929e81e9dec1e5d288c8cd9e9dd
Opcode Fuzzy Hash: 5edb7204c22a8cfb94061bf161a88c3eca98da374ec15d8cd8ba2bf42dcd3747
Instruction Fuzzy Hash: F481B375500244BBEB209F91CC44FAB7BB8FF85704F10412AF952BA2F1E7749901CB69

Function 00401538 Relevance: 10.7, APIs: 7, Instructions: 207
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.2066714089.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 4af5c640631db37ac51d1c1afd1ab74928840835cbc445bb96c3204467379d38
Instruction ID: 71a4d0092025beca94809e07d65936591d52f1bb8effc294688e3fcd05e54c36
Opcode Fuzzy Hash: 4af5c640631db37ac51d1c1afd1ab74928840835cbc445bb96c3204467379d38
Instruction Fuzzy Hash: E0615171900204FBEB209F95CC89FAF7BB8FF85700F10412AF912BA2E5D6759905DB65

Function 004014DE Relevance: 10.7, APIs: 7, Instructions: 204
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.2066714089.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: c3f6308678fe624b1287adcb7156a2cf5c07ee8b7810a15753646c5694e98bc6
Instruction ID: 6a824664258ffec6fdf95c516407446232c8a84219ad61b9fd4b8efeb52f3576
Opcode Fuzzy Hash: c3f6308678fe624b1287adcb7156a2cf5c07ee8b7810a15753646c5694e98bc6
Instruction Fuzzy Hash: 9B615C75900245BFEB219F91CC88FEBBBB8FF85710F10016AF951BA2A5E7749901CB24

Function 00401543 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.2066714089.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f4faf4f0efc4cc5c307795d20c298965336779ff7452863f8b2b81be2522acaa
Instruction ID: 1fc6fb52bb36dddf8f971a96ecfe927bdbae9887f6286775c14151e9c1d92244
Opcode Fuzzy Hash: f4faf4f0efc4cc5c307795d20c298965336779ff7452863f8b2b81be2522acaa
Instruction Fuzzy Hash: 13512B71900245BBEB209F91CC88FAF7BB8EF85B00F14416AF912BA2E5D6749945CB64

Function 00401565 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.2066714089.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 40d7219ce39e026dd98d18ec02294656054e4da488103e740ba1602fb3a5db7c
Instruction ID: d88667ffe02cbbb2798d41d5ad0cf6527765788d972b82ac88077c7d238bff09
Opcode Fuzzy Hash: 40d7219ce39e026dd98d18ec02294656054e4da488103e740ba1602fb3a5db7c
Instruction Fuzzy Hash: 54511A71900205BFEF209F91CC89FAFBBB8FF85B10F104259F911AA2A5D7759941CB64

Function 00401579 Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.2066714089.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 44bf211d5ecd49b3cfb3996dc98baa0f9fc545abe5e070ef87effc0df1f686f8
Instruction ID: 7169477154cf1621f4f222e223ad54e678f31395e99d0ffd613e12cb64d905d3
Opcode Fuzzy Hash: 44bf211d5ecd49b3cfb3996dc98baa0f9fc545abe5e070ef87effc0df1f686f8
Instruction Fuzzy Hash: 2B511A75900245BBEF209F91CC88FEF7BB8FF85B10F104119F911BA2A5D6759941CB64

Function 0040157C Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.2066714089.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c4110b1088d5ef41785dfe7ea8eaa09ab46741a105747cbb29c974859abd6495
Instruction ID: 14f4b29c405daff92d21e2b3eea283823ae405efc36948ac0d92101f557811aa
Opcode Fuzzy Hash: c4110b1088d5ef41785dfe7ea8eaa09ab46741a105747cbb29c974859abd6495
Instruction Fuzzy Hash: DE51F9B5900245BBEF209F91CC88FEFBBB8FF85B10F104259F911AA2A5D6709944CB64

Function 00402FE9 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040311D
NtTerminateProcess.NTDLL ref: 00403136

Memory Dump Source

Source File: 00000000.00000002.2066714089.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 3e1675bac70c022a4e457ffe6b5fa54937b73e0116388ba90aec32851b4d9964
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: A1412431228E088FD768EF5CA885762B7D5F798311F6643AAE809D7389EA34DC1183C5

Function 02E456F6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02E4571E
Module32First.KERNEL32(00000000,00000224), ref: 02E4573E

Memory Dump Source

Source File: 00000000.00000002.2067955486.0000000002E3E000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E3E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e3e000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 0db0faf9164e3725ccbaca00ba4bcfe03214a5cd53d89cb9728259fc60e30df1
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 3CF06D32240710ABD7303AB9A88CF6E76E8AF59629F505638E682D11C0DFB0E8458A61

Function 02D2003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02D2024D

Strings

kernel32.dll, xrefs: 02D2008F, 02D20095
cess, xrefs: 02D2018D

Memory Dump Source

Source File: 00000000.00000002.2067809785.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: c4b03325472ff636c60c80a339d20913dbb2316f2b68f3f12d700b0ff39e12ce
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 2C525A74A01229DFDB64CF58C984BA8BBB1BF19309F1480D9E54DAB351DB30AE89DF14

Function 02D20E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02D20223,?,?), ref: 02D20E19
SetErrorMode.KERNELBASE(00000000,?,?,02D20223,?,?), ref: 02D20E1E

Memory Dump Source

Source File: 00000000.00000002.2067809785.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 0ebd9cbcc65d6fff2cee901cd3f49162a2ad40f12e8d4fbcaf4dd37bca0f864f
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: BCD0123114512877D7002A94DC09BCD7B1CDF05B67F008011FB0DD9180C770994046E5

Function 00401918 Relevance: 1.3, APIs: 1, Instructions: 57
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.2066714089.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: be810bd81fc1513bf14dac74237aa616a3cfbc48422f9378a192f31e1e69cca3
Instruction ID: 41df8370e0b5f9a47a14a91e784646d83bdfa422f97ac69dcfec837627d5bcb0
Opcode Fuzzy Hash: be810bd81fc1513bf14dac74237aa616a3cfbc48422f9378a192f31e1e69cca3
Instruction Fuzzy Hash: 6D018CF520C148E7EB016A948DB1EBA36299B45324F300233B647B91F4C57C8A03E76F

Function 00401924 Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.2066714089.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 3ad2d4b3403b833ed421c634174be831538fe621ff724946387ec8f91c54f5fa
Instruction ID: 34fc3aff5e218d4630d956a4f9c4c41b7245144a44faa4fd8074b33eba8f9d72
Opcode Fuzzy Hash: 3ad2d4b3403b833ed421c634174be831538fe621ff724946387ec8f91c54f5fa
Instruction Fuzzy Hash: 43017CF5208145E7EB015A948DB0EBA26299B45314F300237B617BA1F4C57D8602E76F

Function 02E453B5 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02E45406

Memory Dump Source

Source File: 00000000.00000002.2067955486.0000000002E3E000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E3E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e3e000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ebbf3f37434e52c236e88aa9c0f7f36ef09cb568a0f2e68bcaf135969a9c439c
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 16113979A40208EFDB01DF98C985E98BBF5AF08351F45C0A4F948AB361D771EA90DF80

Function 00401941 Relevance: 1.3, APIs: 1, Instructions: 44sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.2066714089.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 6acc595331c6a8be6e6657ef398eef7c869974a8ecae4d1fde63dfd35a725e44
Instruction ID: 53d82b158b021bc4b6cde56962adc0b8c8d23177238c0d6ee964112a53f005ae
Opcode Fuzzy Hash: 6acc595331c6a8be6e6657ef398eef7c869974a8ecae4d1fde63dfd35a725e44
Instruction Fuzzy Hash: 38F0AFB6308249F7DB01AA908DB1EBA36299B54315F300633B617B91F5C57C8A12E76F

Function 00401954 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.2066714089.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 0dfbee2e4a1c62836b2bd3ba6284fddb5b43d5507a7098400a51ac80bc720613
Instruction ID: f7568a5a22988f4b084f7ac8228f9b89e575eda69d31bfffabc36cd9cbe45c64
Opcode Fuzzy Hash: 0dfbee2e4a1c62836b2bd3ba6284fddb5b43d5507a7098400a51ac80bc720613
Instruction Fuzzy Hash: BDF0C2B6208144F7DB019AA18DB1FBA36299B44314F300233BA17B90F5C67C8612E76F

Function 0040194C Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.2066714089.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: f575feb9a37452ed4573e207967fb92b714552aa85f9b6ebf0a13cec3e485039
Instruction ID: 9d6088553fbd849a34ffa1589a5f9bffd683413c7e042594889390f4c4f3f426
Opcode Fuzzy Hash: f575feb9a37452ed4573e207967fb92b714552aa85f9b6ebf0a13cec3e485039
Instruction Fuzzy Hash: 08F0C2B2208144F7DB019A958DA0FBA36299B44314F300633B617B91F5C57C8A02E72F

Non-executed Functions

Function 02D2092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 02D20966
., xrefs: 02D2095F
GetProcAddress., xrefs: 02D209DC, 02D209DF, 02D209E4

Memory Dump Source

Source File: 00000000.00000002.2067809785.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 038ab6f28042717a672f9a5b454857f441dbe6b28788011cd9e3f070fca54bb1
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: FD314AB6905619DFDB10CF99C880AADBBF9FF68329F14404AD441B7310D771EA49CBA4

Function 02E44FD3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2067955486.0000000002E3E000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E3E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e3e000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 3b0613872b4bea932af187613a82365ff5f45e275bd1033609913a11f661ee83
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 3611C276380100AFD700DF55EC80FA673EAEB98324B598055ED04CB302DA75EC01CBA0

Function 02D20D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2067809785.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 7a75fc0f9b50b0fca8cb8150f97b5fa840e8c9a67b271d19633f222a3c739f19
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: E7012B766116108FDF21CF20C804BAA33F5FBA521BF0540B4D506D7341E370AC45CB80

Analysis Process: gujascbPID: 1292, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	29.3%
Signature Coverage:	0%
Total number of Nodes:	99
Total number of Limit Nodes:	2

Executed Functions

Function 00401496 Relevance: 10.7, APIs: 7, Instructions: 247
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000004.00000002.2288653206.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_gujascb.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 5edb7204c22a8cfb94061bf161a88c3eca98da374ec15d8cd8ba2bf42dcd3747
Instruction ID: 8e4940cc2d5d294876689a6a874cb0cc3c399929e81e9dec1e5d288c8cd9e9dd
Opcode Fuzzy Hash: 5edb7204c22a8cfb94061bf161a88c3eca98da374ec15d8cd8ba2bf42dcd3747
Instruction Fuzzy Hash: F481B375500244BBEB209F91CC44FAB7BB8FF85704F10412AF952BA2F1E7749901CB69

Function 00401538 Relevance: 10.7, APIs: 7, Instructions: 207
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000004.00000002.2288653206.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_gujascb.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 4af5c640631db37ac51d1c1afd1ab74928840835cbc445bb96c3204467379d38
Instruction ID: 71a4d0092025beca94809e07d65936591d52f1bb8effc294688e3fcd05e54c36
Opcode Fuzzy Hash: 4af5c640631db37ac51d1c1afd1ab74928840835cbc445bb96c3204467379d38
Instruction Fuzzy Hash: E0615171900204FBEB209F95CC89FAF7BB8FF85700F10412AF912BA2E5D6759905DB65

Function 004014DE Relevance: 10.7, APIs: 7, Instructions: 204
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000004.00000002.2288653206.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_gujascb.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: c3f6308678fe624b1287adcb7156a2cf5c07ee8b7810a15753646c5694e98bc6
Instruction ID: 6a824664258ffec6fdf95c516407446232c8a84219ad61b9fd4b8efeb52f3576
Opcode Fuzzy Hash: c3f6308678fe624b1287adcb7156a2cf5c07ee8b7810a15753646c5694e98bc6
Instruction Fuzzy Hash: 9B615C75900245BFEB219F91CC88FEBBBB8FF85710F10016AF951BA2A5E7749901CB24

Function 00401543 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000004.00000002.2288653206.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_gujascb.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f4faf4f0efc4cc5c307795d20c298965336779ff7452863f8b2b81be2522acaa
Instruction ID: 1fc6fb52bb36dddf8f971a96ecfe927bdbae9887f6286775c14151e9c1d92244
Opcode Fuzzy Hash: f4faf4f0efc4cc5c307795d20c298965336779ff7452863f8b2b81be2522acaa
Instruction Fuzzy Hash: 13512B71900245BBEB209F91CC88FAF7BB8EF85B00F14416AF912BA2E5D6749945CB64

Function 00401565 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000004.00000002.2288653206.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_gujascb.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 40d7219ce39e026dd98d18ec02294656054e4da488103e740ba1602fb3a5db7c
Instruction ID: d88667ffe02cbbb2798d41d5ad0cf6527765788d972b82ac88077c7d238bff09
Opcode Fuzzy Hash: 40d7219ce39e026dd98d18ec02294656054e4da488103e740ba1602fb3a5db7c
Instruction Fuzzy Hash: 54511A71900205BFEF209F91CC89FAFBBB8FF85B10F104259F911AA2A5D7759941CB64

Function 00401579 Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000004.00000002.2288653206.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_gujascb.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 44bf211d5ecd49b3cfb3996dc98baa0f9fc545abe5e070ef87effc0df1f686f8
Instruction ID: 7169477154cf1621f4f222e223ad54e678f31395e99d0ffd613e12cb64d905d3
Opcode Fuzzy Hash: 44bf211d5ecd49b3cfb3996dc98baa0f9fc545abe5e070ef87effc0df1f686f8
Instruction Fuzzy Hash: 2B511A75900245BBEF209F91CC88FEF7BB8FF85B10F104119F911BA2A5D6759941CB64

Function 0040157C Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000004.00000002.2288653206.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_gujascb.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c4110b1088d5ef41785dfe7ea8eaa09ab46741a105747cbb29c974859abd6495
Instruction ID: 14f4b29c405daff92d21e2b3eea283823ae405efc36948ac0d92101f557811aa
Opcode Fuzzy Hash: c4110b1088d5ef41785dfe7ea8eaa09ab46741a105747cbb29c974859abd6495
Instruction Fuzzy Hash: DE51F9B5900245BBEF209F91CC88FEFBBB8FF85B10F104259F911AA2A5D6709944CB64

Function 00402FE9 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040311D
NtTerminateProcess.NTDLL ref: 00403136

Memory Dump Source

Source File: 00000004.00000002.2288653206.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_gujascb.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 3e1675bac70c022a4e457ffe6b5fa54937b73e0116388ba90aec32851b4d9964
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: A1412431228E088FD768EF5CA885762B7D5F798311F6643AAE809D7389EA34DC1183C5

Function 02CE003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02CE024D

Strings

kernel32.dll, xrefs: 02CE008F, 02CE0095
cess, xrefs: 02CE018D

Memory Dump Source

Source File: 00000004.00000002.2290464944.0000000002CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ce0000_gujascb.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: c9fd7629531b0e834b00d410ffd4eee258d88d5d82d9ad73013546e145500c74
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: CE527974A01229DFDB64CF58C985BACBBB1BF09304F1480D9E84EAB351DB70AA85CF54

Function 02DF50C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02DF50EE
Module32First.KERNEL32(00000000,00000224), ref: 02DF510E

Memory Dump Source

Source File: 00000004.00000002.2290641536.0000000002DEE000.00000040.00000020.00020000.00000000.sdmp, Offset: 02DEE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2dee000_gujascb.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: c66f231279884572bb003d6a8d5b9123c4d30cd7ba6b5ac2152c7692c48c12af
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: A7F0C2322003106BD7603BB4A88CB6E76ECAF49329F650228E742915C0CB70EC458A65

Function 02CE0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02CE0223,?,?), ref: 02CE0E19
SetErrorMode.KERNELBASE(00000000,?,?,02CE0223,?,?), ref: 02CE0E1E

Memory Dump Source

Source File: 00000004.00000002.2290464944.0000000002CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ce0000_gujascb.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: ed402eac725a6efecc6c490c452888529daa3c5931e45c1b33a655eb888dd983
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 2AD0123114512877DB003A94DC09BCD7B1CDF05B66F008021FB0DE9080C7B0964046E5

Function 00401918 Relevance: 1.3, APIs: 1, Instructions: 57
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000004.00000002.2288653206.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_gujascb.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: be810bd81fc1513bf14dac74237aa616a3cfbc48422f9378a192f31e1e69cca3
Instruction ID: 41df8370e0b5f9a47a14a91e784646d83bdfa422f97ac69dcfec837627d5bcb0
Opcode Fuzzy Hash: be810bd81fc1513bf14dac74237aa616a3cfbc48422f9378a192f31e1e69cca3
Instruction Fuzzy Hash: 6D018CF520C148E7EB016A948DB1EBA36299B45324F300233B647B91F4C57C8A03E76F

Function 00401924 Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000004.00000002.2288653206.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_gujascb.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 3ad2d4b3403b833ed421c634174be831538fe621ff724946387ec8f91c54f5fa
Instruction ID: 34fc3aff5e218d4630d956a4f9c4c41b7245144a44faa4fd8074b33eba8f9d72
Opcode Fuzzy Hash: 3ad2d4b3403b833ed421c634174be831538fe621ff724946387ec8f91c54f5fa
Instruction Fuzzy Hash: 43017CF5208145E7EB015A948DB0EBA26299B45314F300237B617BA1F4C57D8602E76F

Function 02DF4D85 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02DF4DD6

Memory Dump Source

Source File: 00000004.00000002.2290641536.0000000002DEE000.00000040.00000020.00020000.00000000.sdmp, Offset: 02DEE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2dee000_gujascb.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: cdff3b4344882c267e3fb1478291b1de7900282c4682e985b1a805fbefbdae56
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 8C113C79A00208EFDB01DF98C985E99BBF5EF08350F168094FA489B361D375EA50DF94

Function 00401941 Relevance: 1.3, APIs: 1, Instructions: 44sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000004.00000002.2288653206.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_gujascb.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 6acc595331c6a8be6e6657ef398eef7c869974a8ecae4d1fde63dfd35a725e44
Instruction ID: 53d82b158b021bc4b6cde56962adc0b8c8d23177238c0d6ee964112a53f005ae
Opcode Fuzzy Hash: 6acc595331c6a8be6e6657ef398eef7c869974a8ecae4d1fde63dfd35a725e44
Instruction Fuzzy Hash: 38F0AFB6308249F7DB01AA908DB1EBA36299B54315F300633B617B91F5C57C8A12E76F

Function 00401954 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000004.00000002.2288653206.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_gujascb.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 0dfbee2e4a1c62836b2bd3ba6284fddb5b43d5507a7098400a51ac80bc720613
Instruction ID: f7568a5a22988f4b084f7ac8228f9b89e575eda69d31bfffabc36cd9cbe45c64
Opcode Fuzzy Hash: 0dfbee2e4a1c62836b2bd3ba6284fddb5b43d5507a7098400a51ac80bc720613
Instruction Fuzzy Hash: BDF0C2B6208144F7DB019AA18DB1FBA36299B44314F300233BA17B90F5C67C8612E76F

Function 0040194C Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000004.00000002.2288653206.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_gujascb.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: f575feb9a37452ed4573e207967fb92b714552aa85f9b6ebf0a13cec3e485039
Instruction ID: 9d6088553fbd849a34ffa1589a5f9bffd683413c7e042594889390f4c4f3f426
Opcode Fuzzy Hash: f575feb9a37452ed4573e207967fb92b714552aa85f9b6ebf0a13cec3e485039
Instruction Fuzzy Hash: 08F0C2B2208144F7DB019A958DA0FBA36299B44314F300633B617B91F5C57C8A02E72F

Analysis Process: setup.exePID: 4228, Parent PID: 1960COMMON

Execution Graph

Execution Coverage:	17.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.2%
Total number of Nodes:	1368
Total number of Limit Nodes:	27

Executed Functions

Function 004034CC Relevance: 94.9, APIs: 34, Strings: 20, Instructions: 417
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008001), ref: 004034EF
GetVersionExA.KERNEL32(?), ref: 00403518
GetVersionExA.KERNEL32(0000009C), ref: 0040352F
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004035F8
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 00403635
OleInitialize.OLE32(00000000), ref: 0040363C
SHGetFileInfoA.SHELL32(0041FD10,00000000,?,00000160,00000000,?,00000007,00000009,0000000B), ref: 0040365A
GetCommandLineA.KERNEL32(00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 0040366F
CharNextA.USER32(00000000,"C:\Users\user\AppData\Local\Temp\setup.exe",00000020,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,00000007,00000009,0000000B), ref: 004036A9
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000007,00000009,0000000B), ref: 004037A2
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 004037B3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 004037BF
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 004037D3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004037DB
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004037EC
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004037F4
DeleteFileA.KERNELBASE(1033,?,00000007,00000009,0000000B), ref: 00403808
ExitProcess.KERNEL32(?,?,00000007,00000009,0000000B), ref: 004038AE
OleUninitialize.OLE32(?,?,00000007,00000009,0000000B), ref: 004038B3
ExitProcess.KERNEL32 ref: 004038D4
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,?,00000007,00000009,0000000B), ref: 004038E7
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A1B0,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,?,00000007,00000009,0000000B), ref: 004038F6
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,?,00000007,00000009,0000000B), ref: 00403901
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp), ref: 0040390D
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 00403929
DeleteFileA.KERNEL32(0041F910,0041F910,?,00425000,?,?,00000007,00000009,0000000B), ref: 00403986
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\setup.exe,0041F910,00000001), ref: 0040399B
CloseHandle.KERNEL32(00000000,0041F910,0041F910,?,0041F910,00000000,?,00000007,00000009,0000000B), ref: 004039C8
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000009,0000000B), ref: 004039F6
OpenProcessToken.ADVAPI32(00000000), ref: 004039FD
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403A11
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403A30
ExitWindowsEx.USER32(00000002,80040002), ref: 00403A55
ExitProcess.KERNEL32 ref: 00403A76

Strings

C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403891
C:\Users\user\AppData\Local\Temp\setup.exe, xrefs: 00403996
Error launching installer, xrefs: 0040386C
~nsu, xrefs: 004038DF
NSIS Error, xrefs: 00403660
UXTHEME, xrefs: 004035EC, 004035F1, 004035F7
1033, xrefs: 00403803
", xrefs: 004036CC
TEMP, xrefs: 004037E7
.tmp, xrefs: 004038FB
\Temp, xrefs: 004037B9
C:\Users\user\AppData\Local\Temp, xrefs: 00403906, 0040390B, 00403938
C:\Users\user\AppData\Local\Temp\, xrefs: 00403797, 0040379C, 004037B2, 004037BE, 004037CD, 004037DA, 004037E6, 004037EE, 004038E4, 004038F5, 00403900, 0040390C, 00403919, 00403928, 004039DD
Low, xrefs: 004037D5
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00403675, 0040367B, 0040382A
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034E1
A, xrefs: 0040356A
SeShutdownPrivilege, xrefs: 00403A0B
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403787, 00403886, 0040392F, 00403939
TMP, xrefs: 004037EF

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: "$"C:\Users\user\AppData\Local\Temp\setup.exe"$.tmp$1033$A$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\setup.exe$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2882342585-4217013349
Opcode ID: 52eec0119052631d70130b9923c1eece19bfae2d8fd8cd18d56f0b379d03721e
Instruction ID: 1a4863036e4e50ed5e1acae1e6299f6db15da00d6e87979e5214c03ba8a99dba
Opcode Fuzzy Hash: 52eec0119052631d70130b9923c1eece19bfae2d8fd8cd18d56f0b379d03721e
Instruction Fuzzy Hash: 99E1D270A04354AADB21AF659D49B6F7EB89F86306F0540BFF441B61D2CB7C4A05CB2E

Function 00405B4A Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405B73
lstrcatA.KERNEL32(00421D58,\*.*,00421D58,?,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BBB
lstrcatA.KERNEL32(?,0040A014,?,00421D58,?,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BDC
lstrlenA.KERNEL32(?,?,0040A014,?,00421D58,?,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BE2
FindFirstFileA.KERNELBASE(00421D58,?,?,?,0040A014,?,00421D58,?,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BF3
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405CA0
FindClose.KERNEL32(00000000), ref: 00405CB1

Strings

"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00405B53
\*.*, xrefs: 00405BB5

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$\*.*
API String ID: 2035342205-2936579034
Opcode ID: 2ba348f7f603991e7b2998a01f0f2af9ee039e7695cfc72fde993ee98a245b0d
Instruction ID: 9e5d3321e74a3647b1fb2cdcf4bec0a51507e3563529971eb59e862f6dba24c5
Opcode Fuzzy Hash: 2ba348f7f603991e7b2998a01f0f2af9ee039e7695cfc72fde993ee98a245b0d
Instruction Fuzzy Hash: 2B519130908B04AAEB316B61CC49BAF7AB8DF82755F14813FF851B51D2C73C5982DE69

Function 00406A88 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b420139e1bb7bdc71f93166ff3cf2c8d4b4e2e8bf29b11b667125d81af8f4237
Instruction ID: c2ee61ea0ab5e5811791f69f03c7ffba3fbd093a674906ee4b434ab4c587e2e9
Opcode Fuzzy Hash: b420139e1bb7bdc71f93166ff3cf2c8d4b4e2e8bf29b11b667125d81af8f4237
Instruction Fuzzy Hash: 0FF18A70D04269CBDF28CF98C8946ADBBB0FF44305F24816ED856BB281D7786A86DF45

Function 004066FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(75923410,004225A0,C:\,00405E4B,C:\,C:\,00000000,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0), ref: 0040670A
FindClose.KERNEL32(00000000), ref: 00406716

Strings

C:\, xrefs: 004066FF

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
Instruction ID: 083b1303d1f5dd1ba3b50291930e0491dd498af142a60d7bee4daa0eb941c193
Opcode Fuzzy Hash: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
Instruction Fuzzy Hash: B3D01231515120BBC3405B38AE0C95B7E589F093747618A36F066F22E4DB74CC6286AC

Function 00403B6E Relevance: 49.2, APIs: 13, Strings: 15, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406794: GetModuleHandleA.KERNEL32(?,00000000,?,0040360E,0000000B), ref: 004067A6
Part of subcall function 00406794: GetProcAddress.KERNEL32(00000000,?), ref: 004067C1

lstrcatA.KERNEL32(1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,75923410,C:\Users\user\AppData\Local\Temp\,?,"C:\Users\user\AppData\Local\Temp\setup.exe",00000009,0000000B), ref: 00403BE9
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,?,?,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000000,C:\Users\user\AppData\Roaming\GamePall,1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,75923410), ref: 00403C5E
lstrcmpiA.KERNEL32(?,.exe), ref: 00403C71
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,"C:\Users\user\AppData\Local\Temp\setup.exe",00000009,0000000B), ref: 00403C7C
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\GamePall), ref: 00403CC5

Part of subcall function 004062E6: wsprintfA.USER32 ref: 004062F3

RegisterClassA.USER32(00423EE0), ref: 00403D02
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403D1A
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403D4F
ShowWindow.USER32(00000005,00000000,?,"C:\Users\user\AppData\Local\Temp\setup.exe",00000009,0000000B), ref: 00403D85
GetClassInfoA.USER32(00000000,RichEdit20A,00423EE0), ref: 00403DB1
GetClassInfoA.USER32(00000000,RichEdit,00423EE0), ref: 00403DBE
RegisterClassA.USER32(00423EE0), ref: 00403DC7
DialogBoxParamA.USER32(?,00000000,00403F0B,00000000), ref: 00403DE6

Strings

1033, xrefs: 00403B8E, 00403BE4
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00403C2C, 00403C34, 00403C41, 00403C8B, 00403C91
RichEd32, xrefs: 00403D99
RichEd20, xrefs: 00403D8B
C:\Users\user\AppData\Local\Temp\, xrefs: 00403B73
Control Panel\Desktop\ResourceLocale, xrefs: 00403BA2
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00403B71
PB, xrefs: 00403B9A
>B, xrefs: 00403CD4
.DEFAULT\Control Panel\International, xrefs: 00403BD4
_Nb, xrefs: 00403CE1, 00403D49
.exe, xrefs: 00403C6B
RichEdit, xrefs: 00403DB8
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403BF8, 00403C00, 00403C98, 00403C9E, 00403CAE
RichEdit20A, xrefs: 00403DA9, 00403DAF

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$Control Panel\Desktop\ResourceLocale$PB$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$>B
API String ID: 1975747703-1349787809
Opcode ID: e590d0c5fa98f393744fb4f016bdb4800495c857999addaceec8a385476c3f6f
Instruction ID: 5836c5bb6a6ef8c4ff0aed12ec42ff3eebf2d58129c507535c8ab2622d1094a3
Opcode Fuzzy Hash: e590d0c5fa98f393744fb4f016bdb4800495c857999addaceec8a385476c3f6f
Instruction Fuzzy Hash: 4F61D670204200AED620AF65AD45F3B3A7CEB8574AF41453FF951B62E2CB7D9D028B6D

Function 00402F5C Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F70
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\setup.exe,00000400), ref: 00402F8C

Part of subcall function 00405F1B: GetFileAttributesA.KERNELBASE(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405F1F
Part of subcall function 00405F1B: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00402FD5
GlobalAlloc.KERNELBASE(00000040,00000009), ref: 00403117

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00402F66, 0040312F
Null, xrefs: 00403053
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00402F65
C:\Users\user\AppData\Local\Temp\setup.exe, xrefs: 00402F76, 00402F85, 00402F99, 00402FB6
Error launching installer, xrefs: 00402FAC
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403160
Inst, xrefs: 00403041
soft, xrefs: 0040304A
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 004031AE
C:\Users\user\AppData\Local\Temp, xrefs: 00402FB7, 00402FBC, 00402FC2

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\setup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-1586733961
Opcode ID: 948897f0a7bf445ed3fd87f3f97ca94f99971360adfd1b44ac20b9f0a6b79c08
Instruction ID: 8a05da1d373fd2b3e089436e62a275652004ed3b6aa6cfe031be989f12afac8e
Opcode Fuzzy Hash: 948897f0a7bf445ed3fd87f3f97ca94f99971360adfd1b44ac20b9f0a6b79c08
Instruction Fuzzy Hash: 0771E231A01218ABDB20EF65DD85B9E7BACEB44356F10813BF910BA2C1D77C9E458B5C

Function 0040641B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000400), ref: 00406549
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000400,?,00420530,00000000,004054E1,00420530,00000000), ref: 0040655C
SHGetSpecialFolderLocation.SHELL32(004054E1,00000000,?,00420530,00000000,004054E1,00420530,00000000), ref: 00406598
SHGetPathFromIDListA.SHELL32(00000000,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe), ref: 004065A6
CoTaskMemFree.OLE32(00000000), ref: 004065B2
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D6
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,00420530,00000000,004054E1,00420530,00000000,00000000,00000000,00000000), ref: 00406628

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D0
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00406445, 00406515, 00406516, 00406517, 00406533, 00406548, 0040655B, 00406577, 004065A2, 004065D5, 004065DB, 004065F3, 00406606, 00406621, 00406627, 0040662F, 00406659
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406518

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1374779285
Opcode ID: 28fe3fa0c873c230fa859cbc890347587b683f5d94c1146f2a959db860f2b1f6
Instruction ID: f38e20b3a3e0c1a2470d5ac0c6d90f06be75126661b475aa23e0086d5b044b98
Opcode Fuzzy Hash: 28fe3fa0c873c230fa859cbc890347587b683f5d94c1146f2a959db860f2b1f6
Instruction Fuzzy Hash: 9F612370900114AEDF205F24EC90BBA3BA4EB52314F52403FE913B62D1D37D8A62DB4E

Function 00401759 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000000,00000000,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00406388: lstrcpynA.KERNEL32(0000000B,0000000B,00000400,0040366F,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406395

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Strings

C:\Users\user\AppData\Roaming\GamePall, xrefs: 00401786
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7
C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe, xrefs: 00401826, 00401842

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe
API String ID: 1941528284-3318693634
Opcode ID: 531cf43c35c58c4dd4a4f90f95c8ebf7c3fa560a9c590302947909e1ab3ecca7
Instruction ID: 0d76be79c55a0237b493b10f9ec5be6125ba7ce9be49b25e4c886387d44134cc
Opcode Fuzzy Hash: 531cf43c35c58c4dd4a4f90f95c8ebf7c3fa560a9c590302947909e1ab3ecca7
Instruction Fuzzy Hash: E141B731900615BBCB107BB5CC45DAF3668EF45329B61833BF422F10E1D67C8A529AAE

Function 00406726 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040673D
wsprintfA.USER32 ref: 00406776
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040678A

Strings

%s%s.dll, xrefs: 00406770
UXTHEME, xrefs: 0040672F
\, xrefs: 0040674E

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
Instruction ID: 0c3db372634d2cfba6f48721b0c795b31ebca02323a8b7d7371d162bf0ec7b9a
Opcode Fuzzy Hash: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
Instruction Fuzzy Hash: FBF0FC7050021966DB15A764DD0DFEA365CAB08309F1404BEA586E20C1D6B8D5258B69

Function 004027E8 Relevance: 9.1, APIs: 6, Instructions: 91
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402849
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 00402865
GlobalFree.KERNEL32(?), ref: 004028A4
GlobalFree.KERNEL32(00000000), ref: 004028B7
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028D3
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028E6

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: Global$AllocFree$ChangeCloseDeleteFileFindNotification
String ID:
API String ID: 2989416154-0
Opcode ID: 89df3cefb7dd421bed2d3b7eed546734cb5ae329452e645b4cc4e6c356db934a
Instruction ID: cd924008ac91bdcd896aacfcc8aadc4f9c7de1b4393fc14a433ce499bdbf1d56
Opcode Fuzzy Hash: 89df3cefb7dd421bed2d3b7eed546734cb5ae329452e645b4cc4e6c356db934a
Instruction Fuzzy Hash: D931AC32800128ABDF216FA5DE49D9E7A75FF08364F24423AF450B62D0CB7949419F68

Function 00405F4A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F5E
GetTempFileNameA.KERNELBASE(0000000B,?,00000000,?,?,004034CA,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007), ref: 00405F78

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F4D
nsa, xrefs: 00405F55

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-44229769
Opcode ID: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
Instruction ID: 05c77450f8afc2c62a5a11a921c51d956a1ea51751b09822177720344b0c8500
Opcode Fuzzy Hash: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
Instruction Fuzzy Hash: 02F082363042087BDB109F55DD44BAB7B9CDF91750F14C03BFE48DA180D6B4D9988798

Function 004020A5 Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 004020D0

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 004020E0
GetProcAddress.KERNEL32(00000000,?), ref: 004020F0
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040215A

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 55027bfb1e7038bef75906a0c7732c3b75841ebb17574d5b7e2f6ee6ad6aef08
Instruction ID: efc1da79dccaef9ffb2761d2644f5cd4432d5c2edc08e83b6cf0327c91c21bf2
Opcode Fuzzy Hash: 55027bfb1e7038bef75906a0c7732c3b75841ebb17574d5b7e2f6ee6ad6aef08
Instruction Fuzzy Hash: 2B210832904214E7CF207FA58E4DAAE3A60AF44358F60413FF601B61E0DBBD49819A6E

Function 00403A7C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,004038B3,?,?,00000007,00000009,0000000B), ref: 00403A8E
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,004038B3,?,?,00000007,00000009,0000000B), ref: 00403AA2

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A81
C:\Users\user\AppData\Local\Temp\nswE436.tmp\, xrefs: 00403AB2

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nswE436.tmp\
API String ID: 2962429428-3703984348
Opcode ID: 860558c91a71a64e21cfc04441b923a48857e57a960d7bb4a44cdc910ceccc08
Instruction ID: f2bf129958ed6937e4157d035670f95a6da1e01cb45a681b65e96f9405f647bf
Opcode Fuzzy Hash: 860558c91a71a64e21cfc04441b923a48857e57a960d7bb4a44cdc910ceccc08
Instruction Fuzzy Hash: F4E08631640B1896C130EF7CAD4D8853B189B413357204726F1B9F20F0C738A9574EE9

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405DB3: CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405DC1
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DC6
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DDA

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 0040596F: CreateDirectoryA.KERNEL32(?,0000000B,C:\Users\user\AppData\Local\Temp\), ref: 004059B2

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\GamePall,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\AppData\Roaming\GamePall, xrefs: 00401631

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\GamePall
API String ID: 1892508949-4021349974
Opcode ID: f3ba161a3ac08c4a0fb9ad52a50d0308f78dcdedc211e6075dac0401aebdcf48
Instruction ID: f3b3600b6319d637c5497ea1020ed17c5aedac6227b62b2eaa768bc98e31f113
Opcode Fuzzy Hash: f3ba161a3ac08c4a0fb9ad52a50d0308f78dcdedc211e6075dac0401aebdcf48
Instruction Fuzzy Hash: 09115731508140EBCF306FA54D405BF23B09E96324B28453FF8D1B22E2DA3D0C42AA3E

Function 00405E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406388: lstrcpynA.KERNEL32(0000000B,0000000B,00000400,0040366F,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406395

Part of subcall function 00405DB3: CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405DC1
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DC6
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DDA

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405E5B
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0), ref: 00405E6B

Strings

C:\, xrefs: 00405E0E, 00405E13, 00405E19, 00405E54, 00405E5A, 00405E62, 00405E6A

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 9b5a40e36fb6d6325312229f101030c034a2baba4673648e7d7a04b0a2ff685f
Instruction ID: eca821d8ca18e415d707ee210574ba5bb9731226a542ad11e9256983d04766a4
Opcode Fuzzy Hash: 9b5a40e36fb6d6325312229f101030c034a2baba4673648e7d7a04b0a2ff685f
Instruction Fuzzy Hash: F7F02831105D5116C6223336AD09AAF1644CE9732471A453FFCE1B52D2DB3C8A539CEE

Function 00406EBD Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3294aed7e6278100db64414b9f116292b07b09feaa7d8b5145f731feae0eba26
Instruction ID: 14484b0326c8a5630d33184448731c7578348ec986130544f859662fecd3ad08
Opcode Fuzzy Hash: 3294aed7e6278100db64414b9f116292b07b09feaa7d8b5145f731feae0eba26
Instruction Fuzzy Hash: 04A12471E04229CBDF28CFA8C844BADBBB1FF44305F14816AD956BB281C7786986DF45

Function 004070BE Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e067d77b8d7a9b68dd685dca04d3d71c5ee3b4c66787705bfaaaffb075589f
Instruction ID: 16a3963220edad981734dfbd86db7ae4535d0e52bcc7a87e0ef86c627c8cfaa4
Opcode Fuzzy Hash: 74e067d77b8d7a9b68dd685dca04d3d71c5ee3b4c66787705bfaaaffb075589f
Instruction Fuzzy Hash: 2D912370D04268CBDF28CF98C854BADBBB1FF44305F14816AD956BB281C7786986DF45

Function 00406DD4 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffa2499bf387f79f1209cac769e5c71ba3d3f6d53411ba5d370abef73c06fe0
Instruction ID: e981be8a744509f315cfd76b32476d9c10b76e0a4aa84739a8d113cb33934a41
Opcode Fuzzy Hash: 7ffa2499bf387f79f1209cac769e5c71ba3d3f6d53411ba5d370abef73c06fe0
Instruction Fuzzy Hash: 37812471E04228CBDF24CFA8C844BADBBB1FF45305F24816AD856BB291C7789986DF45

Function 004068D9 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b20245c0637e97ad79b0c04fd837c43a33b4178456ec09291c35722496dfe88
Instruction ID: 8182d74baebb800b0d472bca2432a1a472ea96a2662ae7b36db949844af6c4d7
Opcode Fuzzy Hash: 9b20245c0637e97ad79b0c04fd837c43a33b4178456ec09291c35722496dfe88
Instruction Fuzzy Hash: DF815971E04228DBEF24CFA8C844BADBBB1FF44305F10816AD956BB281C7786986DF45

Function 00406D27 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d628358dfeac25ccb8ac491a47a372453481bb06581bffe716440ea5054c50f9
Instruction ID: 516ab04208dd2bc2fd7cdea6c41d3130492ff38fa800e35acf718bd73fbf6333
Opcode Fuzzy Hash: d628358dfeac25ccb8ac491a47a372453481bb06581bffe716440ea5054c50f9
Instruction Fuzzy Hash: A4712271E04228CBDF24CF98C844BADBBB1FF48305F14806AD856BB281C778A986DF45

Function 00406E45 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8eb04bd933ca205c297744f59a7b7035fe2e59d11d29800bf5f20fbdb1e525a
Instruction ID: 835baf8de871759411e2c74e4a47f0112f02d54065241c3c7dcda5dc236b3f46
Opcode Fuzzy Hash: e8eb04bd933ca205c297744f59a7b7035fe2e59d11d29800bf5f20fbdb1e525a
Instruction Fuzzy Hash: 92712571E04228CBEF28CF98C844BADBBB1FF44305F15816AD856BB281C7786996DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed70085a56e3aedeea153169e26c1aa9cf9d7e4654945abbe59913f8bdc615b9
Instruction ID: ccec74d0ee3a806077926e8984c2e201e8b1f3d886c73ab216be699138b2bca7
Opcode Fuzzy Hash: ed70085a56e3aedeea153169e26c1aa9cf9d7e4654945abbe59913f8bdc615b9
Instruction Fuzzy Hash: 39715771E04228CBEF28CF98C844BADBBB1FF44305F14806AD956BB281C778A946DF45

Function 00403305 Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403319

Part of subcall function 00403484: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403182,?), ref: 00403492

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,0040322F,00000004,00000000,00000000,0000000B,?,004031A9,000000FF,00000000,00000000,00000009,?), ref: 0040334C
SetFilePointer.KERNELBASE(155C335B,00000000,00000000,004138F8,00004000,?,00000000,0040322F,00000004,00000000,00000000,0000000B,?,004031A9,000000FF,00000000), ref: 00403447

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: f3fd145fe371a3aefb2ec72eaaf4336e3a5ddfe71b6918c4f9f269c5704fa6fa
Instruction ID: 5f41a1ef9683aad456499e8308d87ccfcfa217f8aa92108fcff4f05b83e24891
Opcode Fuzzy Hash: f3fd145fe371a3aefb2ec72eaaf4336e3a5ddfe71b6918c4f9f269c5704fa6fa
Instruction Fuzzy Hash: 1F319F72A002059FC711BF2AFE849663BACE741356710C13BE814B62F0CB3859458FAD

Function 0040247E Relevance: 4.6, APIs: 3, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0040AC20,00000023,00000011,00000002), ref: 004024C9
RegSetValueExA.KERNELBASE(?,?,?,?,0040AC20,00000000,00000011,00000002), ref: 00402509
RegCloseKey.KERNELBASE(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: CloseValuelstrlen
String ID:
API String ID: 2655323295-0
Opcode ID: ef8eeb58056491ee092ed80bef3546efe310264daaab0f586760f51b4d92765b
Instruction ID: e1e6ae2a7b536448810537a1ffa9a52b32d6c636ce9630cd27147c6707bb0a71
Opcode Fuzzy Hash: ef8eeb58056491ee092ed80bef3546efe310264daaab0f586760f51b4d92765b
Instruction Fuzzy Hash: 04116371E04208AFEB10AFA5DE49AAEBA74EB84714F21443BF504F71C1DAB94D409B68

Function 00402590 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025C2
RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 004025D5
RegCloseKey.KERNELBASE(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 039baf7d42ae34e4e7f4f0d82c42536c565db7a64b10d6b3f593835efb4c20b6
Instruction ID: 33ff3e85e785963e302667c06a3cb1355a7acd8bf142a31c2560ef5bcfc7d759
Opcode Fuzzy Hash: 039baf7d42ae34e4e7f4f0d82c42536c565db7a64b10d6b3f593835efb4c20b6
Instruction Fuzzy Hash: 2C017571904104FFE7158F54DE88ABF7BACEF81358F20443EF101A61C0DAB44E449679

Function 00405B02 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405EF6: GetFileAttributesA.KERNELBASE(?,?,00405B0E,?,?,00000000,00405CF1,?,?,?,?), ref: 00405EFB
Part of subcall function 00405EF6: SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405F0F

RemoveDirectoryA.KERNELBASE(?,?,?,00000000,00405CF1), ref: 00405B1D
DeleteFileA.KERNELBASE(?,?,?,00000000,00405CF1), ref: 00405B25
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405B3D

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: fdbfe47bebcd8a5232fcae5ebebd8a359ed736e28fe734178b51a2620122945d
Instruction ID: eeb49a2f717892c2e0964ab94aaac89db2a73fdd151ed94c70539e0cf44bba43
Opcode Fuzzy Hash: fdbfe47bebcd8a5232fcae5ebebd8a359ed736e28fe734178b51a2620122945d
Instruction Fuzzy Hash: 6CE0E531109A9097C62067349908A5B7AF8EF86314F094D3AF9A1F20D0DB38B9468EBD

Function 004031FD Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000009,00000000,00000000,00000000,00000000,0000000B,?,004031A9,000000FF,00000000,00000000,00000009,?), ref: 00403222

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 966fed337372371c4087f3b005d0b036fc883b56c67f04ec2e368497ceacb8e7
Instruction ID: 301e065564a74905a78554ad982773151ad037ba2d6e6f8d8cd401a7b941de18
Opcode Fuzzy Hash: 966fed337372371c4087f3b005d0b036fc883b56c67f04ec2e368497ceacb8e7
Instruction Fuzzy Hash: E2318D30200219FFDB109F95ED45A9A3FA8EB05755B20847EB914E61D0D738DB509FA9

Function 0040251E Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 0040254E
RegCloseKey.KERNELBASE(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 6617ca3d26eaa2170afdc71dc748124b2257766e2e1ea0df1a2f7a4cdc0ba340
Instruction ID: 7c766f3f1fb2abd04e903467a79d83897fdaad9d0bba0580308fe752c8381985
Opcode Fuzzy Hash: 6617ca3d26eaa2170afdc71dc748124b2257766e2e1ea0df1a2f7a4cdc0ba340
Instruction Fuzzy Hash: 1B11BF71905205EFDB25CF64DA985AE7BB4AF11355F20483FE042B72C0D6B88A85DA1D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 04d136d289144069680b1fecce7da664cc2fd5e0b622116f853907ec40370e1b
Instruction ID: c6e23866af321c238b4b59365f681da1ab702c54c00e726fca3ee5b0521d1f72
Opcode Fuzzy Hash: 04d136d289144069680b1fecce7da664cc2fd5e0b622116f853907ec40370e1b
Instruction Fuzzy Hash: 5201D131B242109BE7194B38AE04B2A36A8E754315F51813AF851F61F1DB78CC129B4D

Function 00405A21 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422558,00000009,00000009,0000000B), ref: 00405A4A
CloseHandle.KERNEL32(?), ref: 00405A57

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
Instruction ID: 70dcd79ab4e1e9e84cc9ba673cd08f466e07e48f17d85ed3475224309c024e1a
Opcode Fuzzy Hash: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
Instruction Fuzzy Hash: A5E04FB4600209BFEB009B64ED09F7B77ACFB04244F808421BE40F2150D67899658A78

Function 00406794 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000000,?,0040360E,0000000B), ref: 004067A6
GetProcAddress.KERNEL32(00000000,?), ref: 004067C1

Part of subcall function 00406726: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040673D
Part of subcall function 00406726: wsprintfA.USER32 ref: 00406776
Part of subcall function 00406726: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040678A

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 6cfaa89c8510a3ae83a05a93334a7968bfc88d7e7cb527baf598ad9b980e56cb
Instruction ID: 2a593beb9babc16b4b5ae8275dbdfb46ef4ebf17ea7291b62b5d373670c31446
Opcode Fuzzy Hash: 6cfaa89c8510a3ae83a05a93334a7968bfc88d7e7cb527baf598ad9b980e56cb
Instruction Fuzzy Hash: B6E0863260421157D21067705E4897773ACAF94B54302043EF546F3144D7389C76966D

Function 00405F1B Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405F1F
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
Instruction ID: c1cd633b288b309c16b37b55694bd397a2d2f3fd27c3ea135bedd35eac3c4d3c
Opcode Fuzzy Hash: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
Instruction Fuzzy Hash: D9D09E31254602AFEF0D8F20DE16F2E7AA2EB84B00F11952CB682944E2DA715819AB19

Function 00405EF6 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,00405B0E,?,?,00000000,00405CF1,?,?,?,?), ref: 00405EFB
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405F0F

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7db639ec3fc6e9a5b47d3eb1dfb332e917e8410632ca84ceba79978e33b6a3d0
Instruction ID: 2a9487917742c73a52daa6fa2dda6e447083e2efb983b62a69771bacbdb33add
Opcode Fuzzy Hash: 7db639ec3fc6e9a5b47d3eb1dfb332e917e8410632ca84ceba79978e33b6a3d0
Instruction Fuzzy Hash: E3D0C972504422ABD2102728AE0889BBB55DB94271702CA35FDA5A26F1DB304C569A9C

Function 004059EC Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004034BF,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004059F2
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 00405A00

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
Instruction ID: 42ce2bd36b25b14d2ed8d631edf33fc643f4c4eb5ed9af5e51ab4a49ffb09bba
Opcode Fuzzy Hash: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
Instruction Fuzzy Hash: 9BC04C303145419AD6505B309F4DB177A54AB50741F51553A638AE01A0DA348465DD2D

Function 0040623C Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CEA,00000000,?,?), ref: 00406265

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction ID: 57b18be241489d6c3509c0f1b2cb500900bdd64e2c84313365475615acd8ae2e
Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction Fuzzy Hash: 16E0E672010109BEDF196F50DD0AD7B371DEB04341F01492EF916D4091E6B5A9309734

Function 00405FC2 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000009,00000000,00000000,00000000,00000000,0040C475,0040B8F8,00403405,0040B8F8,0040C475,004138F8,00004000,?,00000000,0040322F,00000004), ref: 00405FD6

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: d5187e51ab0d96a1766449b5dbb93cac2cdd9e80b7d20ab2fc0b5d8c8d5322e8
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: 4AE0EC3221065BABDF109E659C04EEB7B6CEB05360F004437FA55E3150D675E8219BA4

Function 00405F93 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000009,00000000,00000000,00000000,00000000,004138F8,0040B8F8,00403481,00000009,00000009,00403385,004138F8,00004000,?,00000000,0040322F), ref: 00405FA7

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
Instruction ID: 61a6516da629700e98a59d605e8380186fb5f41ecf47873683bd74a9a2ef61d4
Opcode Fuzzy Hash: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
Instruction Fuzzy Hash: 8BE08C3220161EEBEF119E508C00AEBBB6CEB00360F004433FD25E3140E234E9218BA8

Function 00403484 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403182,?), ref: 00403492

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction ID: eadcf480fe67690f272c505b4903882a1233053cb438a9b9796e5ea94341b5dd
Opcode Fuzzy Hash: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction Fuzzy Hash: 25B09231140200AADA215F409E09F057B21AB94700F208424B244280F086712025EA0D

Function 00401F7B Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Part of subcall function 00405A21: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422558,00000009,00000009,0000000B), ref: 00405A4A
Part of subcall function 00405A21: CloseHandle.KERNEL32(?), ref: 00405A57

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FC0

Part of subcall function 00406809: WaitForSingleObject.KERNEL32(?,00000064), ref: 0040681A
Part of subcall function 00406809: GetExitCodeProcess.KERNEL32(?,?), ref: 0040683C

Part of subcall function 004062E6: wsprintfA.USER32 ref: 004062F3

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: b93a315dc59908fe351c40803e733eeda605d55301c746aa3fa59235fa4bc662
Instruction ID: dce1314ccbc215d7d9c334b017be086f7c4cc40ba0f87dfe0d8145fd67a5eb82
Opcode Fuzzy Hash: b93a315dc59908fe351c40803e733eeda605d55301c746aa3fa59235fa4bc662
Instruction Fuzzy Hash: 2DF0B432A05121DBDB20BFA59EC49EEB2A4DF41318B25463FF502B21D1CB7C4D418A6E

Non-executed Functions

Function 004055E7 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405646
GetDlgItem.USER32(?,000003EE), ref: 00405655
GetClientRect.USER32(?,?), ref: 00405692
GetSystemMetrics.USER32(00000002), ref: 00405699
SendMessageA.USER32(?,0000101B,00000000,?), ref: 004056BA
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004056CB
SendMessageA.USER32(?,00001001,00000000,?), ref: 004056DE
SendMessageA.USER32(?,00001026,00000000,?), ref: 004056EC
SendMessageA.USER32(?,00001024,00000000,?), ref: 004056FF
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405721
ShowWindow.USER32(?,00000008), ref: 00405735
GetDlgItem.USER32(?,000003EC), ref: 00405756
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405766
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040577F
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 0040578B
GetDlgItem.USER32(?,000003F8), ref: 00405664

Part of subcall function 0040443A: SendMessageA.USER32(00000028,?,00000001,0040426A), ref: 00404448

GetDlgItem.USER32(?,000003EC), ref: 004057A7
CreateThread.KERNEL32(00000000,00000000,Function_0000557B,00000000), ref: 004057B5
CloseHandle.KERNEL32(00000000), ref: 004057BC
ShowWindow.USER32(00000000), ref: 004057DF
ShowWindow.USER32(?,00000008), ref: 004057E6
ShowWindow.USER32(00000008), ref: 0040582C
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405860
CreatePopupMenu.USER32 ref: 00405871
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405886
GetWindowRect.USER32(?,000000FF), ref: 004058A6
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004058BF
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004058FB
OpenClipboard.USER32(00000000), ref: 0040590B
EmptyClipboard.USER32 ref: 00405911
GlobalAlloc.KERNEL32(00000042,?), ref: 0040591A
GlobalLock.KERNEL32(00000000), ref: 00405924
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405938
GlobalUnlock.KERNEL32(00000000), ref: 00405951
SetClipboardData.USER32(00000001,00000000), ref: 0040595C
CloseClipboard.USER32 ref: 00405962

Strings

PB, xrefs: 004058D7

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: PB
API String ID: 590372296-3196168531
Opcode ID: 463c74343dc9a7e994e8db0b260deb87a45ca3f66d4da0101cb89f9be381629f
Instruction ID: 44a2cb424ceca129f1c721a27905a8e57bc1109532c064cce4e419f7e60c3497
Opcode Fuzzy Hash: 463c74343dc9a7e994e8db0b260deb87a45ca3f66d4da0101cb89f9be381629f
Instruction Fuzzy Hash: 18A13971900608FFDB11AF64DE85AAE7BB9FB48355F00403AFA41BA1A0CB754E51DF58

Function 00404897 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004048E6
SetWindowTextA.USER32(00000000,?), ref: 00404910
SHBrowseForFolderA.SHELL32(?,00420128,?), ref: 004049C1
CoTaskMemFree.OLE32(00000000), ref: 004049CC
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00420D50), ref: 004049FE
lstrcatA.KERNEL32(?,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe), ref: 00404A0A
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404A1C

Part of subcall function 00405A82: GetDlgItemTextA.USER32(?,?,00000400,00404A53), ref: 00405A95

Part of subcall function 00406666: CharNextA.USER32(0000000B,*?|<>/":,00000000,?,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066BE
Part of subcall function 00406666: CharNextA.USER32(0000000B,0000000B,0000000B,00000000,?,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066CB
Part of subcall function 00406666: CharNextA.USER32(0000000B,?,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066D0
Part of subcall function 00406666: CharPrevA.USER32(0000000B,0000000B,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066E0

GetDiskFreeSpaceA.KERNEL32(0041FD20,?,?,0000040F,?,0041FD20,0041FD20,?,00000001,0041FD20,?,?,000003FB,?), ref: 00404ADA
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AF5

Part of subcall function 00404C4E: lstrlenA.KERNEL32(00420D50,00420D50,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404B69,000000DF,00000000,00000400,?), ref: 00404CEC
Part of subcall function 00404C4E: wsprintfA.USER32 ref: 00404CF4
Part of subcall function 00404C4E: SetDlgItemTextA.USER32(?,00420D50), ref: 00404D07

Strings

A, xrefs: 004049BA
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 004049F8, 004049FD, 00404A08
PB, xrefs: 00404994
C:\Users\user\AppData\Roaming\GamePall, xrefs: 004049E7

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$PB
API String ID: 2624150263-4118966266
Opcode ID: 246729fcc772db5bb1fe110679472811f76dfb67008edee7d622b3e588ee8d40
Instruction ID: 03633cdec68ae3b48ba4c7d33c4768738bfb21d85bfcf2e4b9185cba9ee35c0f
Opcode Fuzzy Hash: 246729fcc772db5bb1fe110679472811f76dfb67008edee7d622b3e588ee8d40
Instruction Fuzzy Hash: 7DA150B1A00208AADB11EFA5DD45BAFB6B8EF84315F10803BF601B62D1D77C99418F6D

Function 00402173 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408418,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F8
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004022AA

Strings

C:\Users\user\AppData\Roaming\GamePall, xrefs: 00402238

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Roaming\GamePall
API String ID: 123533781-4021349974
Opcode ID: 975ab102bccf2e3ea3487b48f3b75e49990d828168e5a332ce340ef805c2210c
Instruction ID: 4a55140eb955682c0845ac661669d1effe53c60cfc8a987c49de3bb9103baba8
Opcode Fuzzy Hash: 975ab102bccf2e3ea3487b48f3b75e49990d828168e5a332ce340ef805c2210c
Instruction Fuzzy Hash: B2513575A00208AFDF10DFE4CA88A9D7BB5EF48314F2045BAF505EB2D1DA799981CB54

Function 004027AA Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 004027B9

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 3697544f2be0618a58616ff40495ed399055e36512a5e022deae8fba2564a7e1
Instruction ID: 9767438fe71d1176ff9aac627a01f72906af616df08219c0cc944b63bddc0547
Opcode Fuzzy Hash: 3697544f2be0618a58616ff40495ed399055e36512a5e022deae8fba2564a7e1
Instruction Fuzzy Hash: CCF0A0726082049AD710EBA49A49AEEB7689F51324F60057BF142F20C1D6B889459B2A

Function 00404E0A Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 491windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404E21
GetDlgItem.USER32(?,00000408), ref: 00404E2E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E7D
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404E94
SetWindowLongA.USER32(?,000000FC,0040541D), ref: 00404EAE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404EC0
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404ED4
SendMessageA.USER32(?,00001109,00000002), ref: 00404EEA
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404EF6
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404F06
DeleteObject.GDI32(00000110), ref: 00404F0B
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404F36
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404F42
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404FDC
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 0040500C

Part of subcall function 0040443A: SendMessageA.USER32(00000028,?,00000001,0040426A), ref: 00404448

SendMessageA.USER32(?,00001100,00000000,?), ref: 00405020
GetWindowLongA.USER32(?,000000F0), ref: 0040504E
SetWindowLongA.USER32(?,000000F0,00000000), ref: 0040505C
ShowWindow.USER32(?,00000005), ref: 0040506C
SendMessageA.USER32(?,00000419,00000000,?), ref: 00405167
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 004051CC
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 004051E1
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00405205
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00405225
ImageList_Destroy.COMCTL32(?), ref: 0040523A
GlobalFree.KERNEL32(?), ref: 0040524A
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 004052C3
SendMessageA.USER32(?,00001102,?,?), ref: 0040536C
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 0040537B
InvalidateRect.USER32(?,00000000,00000001), ref: 004053A6
ShowWindow.USER32(?,00000000), ref: 004053F4
GetDlgItem.USER32(?,000003FE), ref: 004053FF
ShowWindow.USER32(00000000), ref: 00405406

Strings

M, xrefs: 00404FC4
N, xrefs: 004050A5
, xrefs: 004053DE

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 4bb258af210f6716591e45ffd85afba0d9fc7d499c01c39e68e435e5f0500988
Instruction ID: c306c4130ea67d8582adb4b0d0e706bf782d7aff15223233fd0d43401108afdf
Opcode Fuzzy Hash: 4bb258af210f6716591e45ffd85afba0d9fc7d499c01c39e68e435e5f0500988
Instruction Fuzzy Hash: 6C025CB0A00609AFDB209F94DD45AAE7BB5FB84354F10817AF610BA2E1D7789D42CF58

Function 00403F0B Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403F47
ShowWindow.USER32(?), ref: 00403F67
GetWindowLongA.USER32(?,000000F0), ref: 00403F79
ShowWindow.USER32(?,00000004), ref: 00403F92
DestroyWindow.USER32 ref: 00403FA6
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403FBF
GetDlgItem.USER32(?,?), ref: 00403FDE
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403FF2
IsWindowEnabled.USER32(00000000), ref: 00403FF9
GetDlgItem.USER32(?,00000001), ref: 004040A4
GetDlgItem.USER32(?,00000002), ref: 004040AE
SetClassLongA.USER32(?,000000F2,?), ref: 004040C8
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00404119
GetDlgItem.USER32(?,00000003), ref: 004041BF
ShowWindow.USER32(00000000,?), ref: 004041E0
EnableWindow.USER32(?,?), ref: 004041F2
EnableWindow.USER32(?,?), ref: 0040420D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404223
EnableMenuItem.USER32(00000000), ref: 0040422A
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00404242
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00404255
lstrlenA.KERNEL32(00420D50,?,00420D50,00000000), ref: 0040427F
SetWindowTextA.USER32(?,00420D50), ref: 0040428E
ShowWindow.USER32(?,0000000A), ref: 004043C2

Strings

PB, xrefs: 0040426F

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID: PB
API String ID: 1860320154-3196168531
Opcode ID: a84a76c7c437068317dea6ec38f5a19867a10701d7094664a652b1a8aea3850c
Instruction ID: 6b3c419a8b2de2434844e8cd53afab52d63163afb5b1bd925d395a768d9dd0e6
Opcode Fuzzy Hash: a84a76c7c437068317dea6ec38f5a19867a10701d7094664a652b1a8aea3850c
Instruction Fuzzy Hash: ECC1D2B1A00204BBCB206F61EE45E2B3A78EB85745F41053EF781B61F1CB3998929B5D

Function 00404570 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004045FB
GetDlgItem.USER32(00000000,000003E8), ref: 0040460F
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040462D
GetSysColor.USER32(?), ref: 0040463E
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040464D
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040465C
lstrlenA.KERNEL32(?), ref: 0040465F
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 0040466E
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404683
GetDlgItem.USER32(?,0000040A), ref: 004046E5
SendMessageA.USER32(00000000), ref: 004046E8
GetDlgItem.USER32(?,000003E8), ref: 00404713
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404753
LoadCursorA.USER32(00000000,00007F02), ref: 00404762
SetCursor.USER32(00000000), ref: 0040476B
LoadCursorA.USER32(00000000,00007F00), ref: 00404781
SetCursor.USER32(00000000), ref: 00404784
SendMessageA.USER32(00000111,00000001,00000000), ref: 004047B0
SendMessageA.USER32(00000010,00000000,00000000), ref: 004047C4

Strings

N, xrefs: 00404701
6B, xrefs: 0040476F

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$6B
API String ID: 3103080414-649610290
Opcode ID: c874497606b373bfbb3475a273ba326ab034ae9c38f8566fe8320349c510c150
Instruction ID: 424ea1d81b5f8fd67bb79b8421ee67f108f717641e3cc5fc4ea293435da972af
Opcode Fuzzy Hash: c874497606b373bfbb3475a273ba326ab034ae9c38f8566fe8320349c510c150
Instruction Fuzzy Hash: CE6190B1A40208BFDB109F61DD45B6A7B69FB84715F10843AFB01BB2D1C7B8A951CF98

Function 00405FF1 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00406182,?,?), ref: 00406022
GetShortPathNameA.KERNEL32(?,00422AE0,00000400), ref: 0040602B

Part of subcall function 00405E80: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E90
Part of subcall function 00405E80: lstrlenA.KERNEL32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EC2

GetShortPathNameA.KERNEL32(?,00422EE0,00000400), ref: 00406048
wsprintfA.USER32 ref: 00406066
GetFileSize.KERNEL32(00000000,00000000,00422EE0,C0000000,00000004,00422EE0,?,?,?,?,?), ref: 004060A1
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060B0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060E8
SetFilePointer.KERNEL32(0040A3F0,00000000,00000000,00000000,00000000,004226E0,00000000,-0000000A,0040A3F0,00000000,[Rename],00000000,00000000,00000000), ref: 0040613E
GlobalFree.KERNEL32(00000000), ref: 0040614F
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406156

Part of subcall function 00405F1B: GetFileAttributesA.KERNELBASE(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405F1F
Part of subcall function 00405F1B: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

Strings

.B, xrefs: 0040603D
%s=%s, xrefs: 0040605C
.B, xrefs: 00406044
*B, xrefs: 00406010
[Rename], xrefs: 004060D0, 004060E2

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]$*B$.B$.B
API String ID: 2171350718-3836630945
Opcode ID: 2ac8773abaa14c2605e43abf0f292608002e21a2c197761b550c40717a00d302
Instruction ID: 7566a5a9e9d08134d14435fb5d3e1561ad96112206bac95af022f508aac3f812
Opcode Fuzzy Hash: 2ac8773abaa14c2605e43abf0f292608002e21a2c197761b550c40717a00d302
Instruction Fuzzy Hash: 68310531200715BBC2207B659D49F6B3A5DDF85754F15003EFE42BA2C3EA7CD8228AAD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00423F40,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: db458c2aac7b07c9de4f1dfd54ee4cc10e0d46da2aaa9c20a0cc65b716daa4c3
Instruction ID: bc851ab26da2bb863bf3a2ee07eb2f950de800ada4cbee7b2d64f78586a04119
Opcode Fuzzy Hash: db458c2aac7b07c9de4f1dfd54ee4cc10e0d46da2aaa9c20a0cc65b716daa4c3
Instruction Fuzzy Hash: 2C419D71800249AFCF058FA5DE459AF7FB9FF45314F00802AF991AA1A0C734DA55DFA4

Function 004054A9 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
SetWindowTextA.USER32(00420530,00420530), ref: 00405517
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Strings

4/@, xrefs: 004054EF, 00405501

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: 4/@
API String ID: 2531174081-3101945251
Opcode ID: 17623ae6e76ffa783ca229a28a88b1e205e4a8d30cb80da27a9000df8195634c
Instruction ID: 7ab3267fb946cf8e7efc5916356ec1270af3577e2396c2c3629ce5ef3fcb69de
Opcode Fuzzy Hash: 17623ae6e76ffa783ca229a28a88b1e205e4a8d30cb80da27a9000df8195634c
Instruction Fuzzy Hash: 0F217A71E00118BBCF119FA5DD8099EBFB9EF09354F04807AF944A6291C7788A90CFA8

Function 00406666 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(0000000B,*?|<>/":,00000000,?,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066BE
CharNextA.USER32(0000000B,0000000B,0000000B,00000000,?,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066CB
CharNextA.USER32(0000000B,?,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066D0
CharPrevA.USER32(0000000B,0000000B,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066E0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406667
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00406666
*?|<>/":, xrefs: 004066AE

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3087229427
Opcode ID: 6bc0e94b7f234696628355ee2fbbbdde5b7464ab094feb853247d74dffcc646e
Instruction ID: 80d428334b402c3338f843ea799862c1973996ffb1638880579f4ae0c72fc655
Opcode Fuzzy Hash: 6bc0e94b7f234696628355ee2fbbbdde5b7464ab094feb853247d74dffcc646e
Instruction Fuzzy Hash: 7E1108518047902DEB3206340C04B7B7F894F977A0F2A087FD8C6722C2D67E5C62967D

Function 00402EBD Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402ED5
GetTickCount.KERNEL32 ref: 00402EF3
wsprintfA.USER32 ref: 00402F21

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

CreateDialogParamA.USER32(0000006F,00000000,00402E25,00000000), ref: 00402F45
ShowWindow.USER32(00000000,00000005), ref: 00402F53

Part of subcall function 00402EA1: MulDiv.KERNEL32(00000000,00000064,0000D822), ref: 00402EB6

Strings

#Vh%.@, xrefs: 00402F34
... %d%%, xrefs: 00402F1B

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%$#Vh%.@
API String ID: 722711167-1706192003
Opcode ID: db62a3d36480f0b73892ce8a9fc69f21d0c49374a29e778f3850d420ffd5c07d
Instruction ID: ac0ca11ee9366edb0cc6a28cc5aeb329eacd7d00ab00b3c3670f6d564c8935e4
Opcode Fuzzy Hash: db62a3d36480f0b73892ce8a9fc69f21d0c49374a29e778f3850d420ffd5c07d
Instruction Fuzzy Hash: 3F01A170542225EBCB21BB50EF0CBAB3778EB40744B04443BF505B21D0C7F894469AEE

Function 0040446C Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404489
GetSysColor.USER32(00000000), ref: 004044C7
SetTextColor.GDI32(?,00000000), ref: 004044D3
SetBkMode.GDI32(?,?), ref: 004044DF
GetSysColor.USER32(?), ref: 004044F2
SetBkColor.GDI32(?,?), ref: 00404502
DeleteObject.GDI32(?), ref: 0040451C
CreateBrushIndirect.GDI32(?), ref: 00404526

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: d8b0c4ae085d5752a0ceb3fd9c96bfdfa4daadee6b5f884e1a531c3ceae13210
Instruction ID: 76b6fc4927f6120469f5ffa52701fcd3ddd76896e52d32ad6f55637f73cee333
Opcode Fuzzy Hash: d8b0c4ae085d5752a0ceb3fd9c96bfdfa4daadee6b5f884e1a531c3ceae13210
Instruction Fuzzy Hash: 9E2147B1501704AFCB31DF68ED08B5BBBF8AF41715B04892EEA96A26E0D734E904CB54

Function 00404D58 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404D73
GetMessagePos.USER32 ref: 00404D7B
ScreenToClient.USER32(?,?), ref: 00404D95
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404DA7
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404DCD

Strings

f, xrefs: 00404DA9

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction ID: de178be9688f757f82ef56a4cbeb6693d0582b60b2ea90e1a00f6814b48fd044
Opcode Fuzzy Hash: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction Fuzzy Hash: BB014871900219BADB01DBA4DD85BFEBBF8AF95B11F10016ABA40B61C0C6B499058BA4

Function 0040596F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,0000000B,C:\Users\user\AppData\Local\Temp\), ref: 004059B2
GetLastError.KERNEL32 ref: 004059C6
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004059DB
GetLastError.KERNEL32 ref: 004059E5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405995
!9@, xrefs: 00405984

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: !9@$C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3700438604
Opcode ID: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
Instruction ID: 4cd508ff09270142ca7a6984d66ae253fefa4e1f6983b248f3af4f59f5a14231
Opcode Fuzzy Hash: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
Instruction Fuzzy Hash: 610108B1D00259DAEF109BA0CA45BEFBBB8EB04354F00403AD645B6290D7789648CF99

Function 00402E25 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E40
wsprintfA.USER32 ref: 00402E74
SetWindowTextA.USER32(?,?), ref: 00402E84
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402E96

Strings

verifying installer: %d%%, xrefs: 00402E69, 00402E72
unpacking data: %d%%, xrefs: 00402E62

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a45d99d8fe85d32cf27a6b993dcd334edf2177b7a3e8b64a3b444c48cc752336
Instruction ID: 7ad4584a5e884be7344c254f70e0401137e7e46ce86c3cf658bb2ab9d23be74a
Opcode Fuzzy Hash: a45d99d8fe85d32cf27a6b993dcd334edf2177b7a3e8b64a3b444c48cc752336
Instruction Fuzzy Hash: 1DF01D7054020DBAEF219F60DE0ABAE3769EB44344F00803AFA16B91D0DBB899558F99

Function 00404C4E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420D50,00420D50,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404B69,000000DF,00000000,00000400,?), ref: 00404CEC
wsprintfA.USER32 ref: 00404CF4
SetDlgItemTextA.USER32(?,00420D50), ref: 00404D07

Strings

%u.%u%s%s, xrefs: 00404CD6
PB, xrefs: 00404CDE

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$PB
API String ID: 3540041739-838025833
Opcode ID: 837710c020be2e613de14c6f4d6baa8c213068046cd931f6ce14c5213cbfad60
Instruction ID: 635705270cf82d3fa6c033b13715314544988666452c3f341a93ad76d23c3d90
Opcode Fuzzy Hash: 837710c020be2e613de14c6f4d6baa8c213068046cd931f6ce14c5213cbfad60
Instruction Fuzzy Hash: 5F11E77360512837EB00656D9D45EAE3298DB85374F26423BFE26F71D1E978CC1286E8

Function 00402D3B Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402D8F
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402DDB
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DE4
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402DFB
RegCloseKey.ADVAPI32(?,?,?), ref: 00402E06

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: e74c2f698c9890700b4790f2c47d05d8785518f345c631b22f69380fd2d26fe8
Instruction ID: 1f7d8097ab2fb743d310579a2b4365e3e31c1a4ec17ce584dda370d325fd3950
Opcode Fuzzy Hash: e74c2f698c9890700b4790f2c47d05d8785518f345c631b22f69380fd2d26fe8
Instruction Fuzzy Hash: 1D214B7150010CBBDF129F90CE89EEB7B7DEF44344F11007AF955B11A0D7B49EA49AA8

Function 00401D65 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D7E
GetClientRect.USER32(?,?), ref: 00401DCC
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401DFC
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401E10
DeleteObject.GDI32(00000000), ref: 00401E20

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 593d1372a554d47c5dd87fed6cfd69f5edd78a04abfcab04570fffcca4b878a5
Instruction ID: cb7cd4706ec086029cb46641885d9617bace417a5341e65c45b3777010ef1041
Opcode Fuzzy Hash: 593d1372a554d47c5dd87fed6cfd69f5edd78a04abfcab04570fffcca4b878a5
Instruction Fuzzy Hash: 35212A72E00109AFDF15DFA4DD85AAEBBB5EB88300F24417EF911F62A0DB389941DB14

Function 00401E35 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E38
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E52
MulDiv.KERNEL32(00000000,00000000), ref: 00401E5A
ReleaseDC.USER32(?,00000000), ref: 00401E6B
CreateFontIndirectA.GDI32(0040B820), ref: 00401EBA

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: de4b304c9a389d7a08c3fe75b8b690b37b20fc1cb77e4e41693a04eab2cef683
Instruction ID: bfe7ce59390996d5b2ac71ca67757b7c78ff13e1b53bdd881068f9c0e557254e
Opcode Fuzzy Hash: de4b304c9a389d7a08c3fe75b8b690b37b20fc1cb77e4e41693a04eab2cef683
Instruction Fuzzy Hash: 66018072504340AEE7007BB0AF8AA9A7FE8E755701F109439F241B61E2CB790449CB6C

Function 00401C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C9E
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401CB6

Strings

!, xrefs: 00401C6A

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 1399452274c26c04b05c3e26325e61428879637001adb01d26c94ca9c19498ca
Instruction ID: a12cfbdd51ff26f17676da16b1bc06906883597644a76ef85f46b7bf1251d8d3
Opcode Fuzzy Hash: 1399452274c26c04b05c3e26325e61428879637001adb01d26c94ca9c19498ca
Instruction Fuzzy Hash: 2A218271948208BEEB059FF5DA8AAAD7FB4EF84304F20447EF101B61D1D7B989819B18

Function 00405D1A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004034B9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 00405D20
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004034B9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 00405D29
lstrcatA.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405D3A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405D1A

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 78cba1d5cb2474798914f87c9b537ab1510ee16986e2efd06177e80df85e38b2
Instruction ID: 6a6775ee8fa4d5d8d60a890cb1840bbff54d6a4bc9e312217f61a2b57c53a4e0
Opcode Fuzzy Hash: 78cba1d5cb2474798914f87c9b537ab1510ee16986e2efd06177e80df85e38b2
Instruction Fuzzy Hash: 82D0A7625015307AD20167154C09DDF29488F523017094027F501B7191C67C5C1187FD

Function 00405DB3 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405DC1
CharNextA.USER32(00000000), ref: 00405DC6
CharNextA.USER32(00000000), ref: 00405DDA

Strings

C:\, xrefs: 00405DB4

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: 39b5ed16b6dfe77c974b4e4dad13ac827778716fd50118a58326aa52b160bb8b
Instruction ID: a81d310af092f64b8c374c4571b8fed5a60269d48026fa3bbeeaae68e06855d2
Opcode Fuzzy Hash: 39b5ed16b6dfe77c974b4e4dad13ac827778716fd50118a58326aa52b160bb8b
Instruction Fuzzy Hash: 71F09661904F542BFB3293648C4CB776B8DCF55351F28947BE6807A6C1C27C59808FEA

Function 0040541D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040544C
CallWindowProcA.USER32(?,?,?,?), ref: 0040549D

Part of subcall function 00404451: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00404463

Strings

, xrefs: 0040542D

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 14b3d6ef5c2a84fc52750bef5e2e8b29c93878db9a0e482e1958f3e7559ce471
Instruction ID: ce4d6245f7a5538c18ae28323cba1b5bdda0ccdff68052f186ad3da5f1ae13b7
Opcode Fuzzy Hash: 14b3d6ef5c2a84fc52750bef5e2e8b29c93878db9a0e482e1958f3e7559ce471
Instruction Fuzzy Hash: 2A015E31200608AFDF216F51DD80BAF3A66EB84716F104537FA05761D2C7799CD29F6A

Function 0040626F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,00000400,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00420530,?,?,?,00000002,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,00406527,80000002), ref: 004062B5
RegCloseKey.ADVAPI32(?,?,00406527,80000002,Software\Microsoft\Windows\CurrentVersion,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,00420530), ref: 004062C0

Strings

C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00406272, 004062A6

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: CloseQueryValue
String ID: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
API String ID: 3356406503-1702744724
Opcode ID: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
Instruction ID: 5c8aa4f59809ec7c4ed175be077f356401e74c3ba082423fbe1b6bbc42bea5f4
Opcode Fuzzy Hash: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
Instruction Fuzzy Hash: 8101BC72100209ABDF229F60CC09FDB3FA8EF45364F01407AFD56A6190D638C974CBA8

Function 00405D61 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,00402FC8,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405D67
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,00402FC8,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405D75

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00405D61

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 2709904686-1943935188
Opcode ID: 46bbde6159133eac16457addd6c3fa88623ef59ff022f94c34d6ba2180d3974b
Instruction ID: 27c40c0738421aba4af956c8f0f705930dfe744a77a65273bf6dbb66402e0641
Opcode Fuzzy Hash: 46bbde6159133eac16457addd6c3fa88623ef59ff022f94c34d6ba2180d3974b
Instruction Fuzzy Hash: CBD0A772409D706EE31353208C04B8F6A48CF13300F0D4063E481A6190C2785C424BFD

Function 00405E80 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E90
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405EA8
CharNextA.USER32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EB9
lstrlenA.KERNEL32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EC2

Memory Dump Source

Source File: 00000008.00000002.3872256876.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3872167044.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872333916.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872362180.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.3872472774.000000000042E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_setup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
Instruction ID: 98ea32bb50e75ca8be10b873c57fc005eda9f523d07111d413316ed06cfa332a
Opcode Fuzzy Hash: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
Instruction Fuzzy Hash: 5FF06235104918AFCB129BA5DD4099EBFA8EF55350B2540B9E880F7211D674DF019BA9

Analysis Process: GamePall.exePID: 3664, Parent PID: 4228COMMON

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	14
Total number of Limit Nodes:	0

Executed Functions

Function 0104CFA7 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0104D5FE,?,?,?,?,?), ref: 0104D6BF

Memory Dump Source

Source File: 00000009.00000002.3805160915.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1040000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2bcea60bd805d79ac2cd45243fd0468d938523e450c8e3fa7fbe69e3fb48feff
Instruction ID: a52a4765e5b382b72008c837cb9fb9bb60213fe6aaad1d1d31a5726a07d65c8d
Opcode Fuzzy Hash: 2bcea60bd805d79ac2cd45243fd0468d938523e450c8e3fa7fbe69e3fb48feff
Instruction Fuzzy Hash: A131A9B1C053589FDB00CFADC484AEEBFF4EB19320F10406EE998A7251C378A942CB64

Function 0104D1D8 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 0104E090

Memory Dump Source

Source File: 00000009.00000002.3805160915.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1040000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: b9fcf202eee6a358097133f5461e4e093f0092a291ed2dff867b0569ed597c5c
Instruction ID: ad0986223dda7c843479c33245830f9f1e885ca0d3088d8a5a6c646877db970a
Opcode Fuzzy Hash: b9fcf202eee6a358097133f5461e4e093f0092a291ed2dff867b0569ed597c5c
Instruction Fuzzy Hash: 3F31EEB1C043599FDB10CFA9C4847DEBFF4EF58320F1084AAD998A3212D2789544CBA5

Function 0104CFBC Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0104D5FE,?,?,?,?,?), ref: 0104D6BF

Memory Dump Source

Source File: 00000009.00000002.3805160915.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1040000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5a4fdc7118f4d40d2fece6fc26f88baa3d2af01e430163f75d18f6bee7fc1108
Instruction ID: 0fec97e19f1201329604ef7134cc8467c5e136e1050fb2ef5db5ca921af8d480
Opcode Fuzzy Hash: 5a4fdc7118f4d40d2fece6fc26f88baa3d2af01e430163f75d18f6bee7fc1108
Instruction Fuzzy Hash: 202116B59012089FDB10CF9AD484ADEBFF9EB48320F14801AE958A3310D374A940CFA4

Function 0104D630 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0104D5FE,?,?,?,?,?), ref: 0104D6BF

Memory Dump Source

Source File: 00000009.00000002.3805160915.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1040000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1b2c35ce739c57ade69ce913a65720fef6084e1746b24ca7a25ddff6b7e77753
Instruction ID: b2cc94047ff13874941b15f7cdba48f7a7a502f3e23a364ff5bf4bbf0578f447
Opcode Fuzzy Hash: 1b2c35ce739c57ade69ce913a65720fef6084e1746b24ca7a25ddff6b7e77753
Instruction Fuzzy Hash: 142116B59002489FDB10CFAAD484ADEBFF9FF48320F14801AE958A3350D374A944CF64

Function 0104D1BF Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 0104E090

Memory Dump Source

Source File: 00000009.00000002.3805160915.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1040000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 74a6635117e07c7299d9e7df6bf3c812096ad101a7ac83e57d3483ff2d60ec07
Instruction ID: 11c90a6a5ce3774e27c57e220c7fd64b2c497613a70b637aa2854de4aa14ce32
Opcode Fuzzy Hash: 74a6635117e07c7299d9e7df6bf3c812096ad101a7ac83e57d3483ff2d60ec07
Instruction Fuzzy Hash: 27214CB58003499FDB10CF9AC485BDEBFF4EF49310F14849AE558A7251D3796544CFA4

Function 0104D1CC Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 0104E090

Memory Dump Source

Source File: 00000009.00000002.3805160915.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1040000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 2d17ab775a6bc91b1c140cae75a70bb6e3bebceae4d590f54aa4c716392658ab
Instruction ID: 98d34610f724f7b1212b3370ed0b8d9991919332380f8d4571a58be26b5b3412
Opcode Fuzzy Hash: 2d17ab775a6bc91b1c140cae75a70bb6e3bebceae4d590f54aa4c716392658ab
Instruction Fuzzy Hash: C5114CB18007499FDB20DF9AC485BDEBFF4FB48320F108469E558A3251D379A944CFA4

Function 0104E020 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 0104E090

Memory Dump Source

Source File: 00000009.00000002.3805160915.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1040000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: f000de8f54121a64e65344feffa80969f8561679f2b2c695d39d49bcf952f130
Instruction ID: 3ac5e1b59a8a5dcf53f89e2355e8f50a5a24592f8ed765c77fbfec1b3e2e49fc
Opcode Fuzzy Hash: f000de8f54121a64e65344feffa80969f8561679f2b2c695d39d49bcf952f130
Instruction Fuzzy Hash: 96113AB18003499FDB10CF9AD485BDEBFF4FB48320F208469E558A3251D379A544DFA5

Function 00D8D1CC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a432e501ceb5e0fa29d3439c01600ba834fa3a2d9a920922f05ad36ed395d824
Instruction ID: d8306a3324c23eacfa256d6815a017da431f74ab117bebe2248d8d63277bf7b4
Opcode Fuzzy Hash: a432e501ceb5e0fa29d3439c01600ba834fa3a2d9a920922f05ad36ed395d824
Instruction Fuzzy Hash: 2121F2B5504304AFDB04EF14D5C0B26BB66FB88314F24C96DE8494B2D6C736D846DB71

Function 00D8D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a80ba060ed5fa0c938221b46cdb7052148a22b0103e04f7cd1678091474eeca
Instruction ID: 7a36d4e69b9cd584b95cba82471701bf69ed107256b8d085af7ae00da9e7fe83
Opcode Fuzzy Hash: 1a80ba060ed5fa0c938221b46cdb7052148a22b0103e04f7cd1678091474eeca
Instruction Fuzzy Hash: 3F21F6B1504244EFDB14EF14D9C4B26BB66FB84324F24C569E9494B2C1C37AD847DB72

Function 00D8E700 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054f7ab7b79096687181274fc2bca9ed15654d2d584b93db487e1e334ec79934
Instruction ID: b99100c772d28d8d73761f1a34d13febbf89eb50bd67de2e1031a263eb8b16ee
Opcode Fuzzy Hash: 054f7ab7b79096687181274fc2bca9ed15654d2d584b93db487e1e334ec79934
Instruction Fuzzy Hash: F621F2B5604204EFDB04EF14D9C0B26BB66FB98314F24C96DE94A4B296C336D846DF71

Function 00D8FEFC Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 319e14a8a7d828ecf58fdb2598599b4d032935a6972134d41b2ee14898e18da7
Instruction ID: 565f0c8dfd98a1180893e93c2ebd429362f7eca1315c059085f13803b578a21d
Opcode Fuzzy Hash: 319e14a8a7d828ecf58fdb2598599b4d032935a6972134d41b2ee14898e18da7
Instruction Fuzzy Hash: 8221F3B56082409FDB04EF14D5C0B26BBA5FF95318F24C97DEA494B281C736D84AC771

Function 00D8E3B8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aef9b281866dc0d4d44056c710565cdee65d7e30fb49350b0627b35accf1b90b
Instruction ID: 3f39f25cf53a01150ecbf9281dc8440438951a70ae353614d1fe8f31a669afcd
Opcode Fuzzy Hash: aef9b281866dc0d4d44056c710565cdee65d7e30fb49350b0627b35accf1b90b
Instruction Fuzzy Hash: FE21C2B1604244AFDB04EF18D5C4B26BBA5EB94714F24C96DD94E4B251C636D806CB71

Function 00D8F8F8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa65aa75591f31ebb0eb24fe2a3938534d90e2f7e74931535470d6abb543f948
Instruction ID: 8ea60f1769978669255cdac908bd06c913d8128fbac4352a8745a6585fc39ecb
Opcode Fuzzy Hash: fa65aa75591f31ebb0eb24fe2a3938534d90e2f7e74931535470d6abb543f948
Instruction Fuzzy Hash: AA21F0B1604240AFDB14FF24D5C0B2ABBA5EB94314F24C97DD98A4B291C73AD846CBB1

Function 00D8E7E8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a37943f178717aac92f4e019ab8c6fe38b1aeb14b534ce402b119f20c54e30f2
Instruction ID: b0a27515ceb55ed01592daaa732000f4f225d17dd7b990feaa43c919bea1c052
Opcode Fuzzy Hash: a37943f178717aac92f4e019ab8c6fe38b1aeb14b534ce402b119f20c54e30f2
Instruction Fuzzy Hash: EA21F3B16042409FDB14EF14D5C4B2ABBB5EBD4314F24CA6DD94A4B251C73AD846CBB2

Function 00D8DF98 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be32bd4fd735d7dfb2333b00f120cb29836f5ec8977a315af9188ad7e40a291e
Instruction ID: 1002bb5610778253f938660da05784ad466c53376dcb5284cb80e26fb56858ef
Opcode Fuzzy Hash: be32bd4fd735d7dfb2333b00f120cb29836f5ec8977a315af9188ad7e40a291e
Instruction Fuzzy Hash: 8D2124B1604240DFDB24EF24D9C0B2ABBA5FB94714F34C96DD94A4B281C37AD846DBB1

Function 00D8F688 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8032314bd4857ab242d421de0e1d5b52485f644a104edbd51dbbeaf3df67b873
Instruction ID: 112e386ae2da21f51a31fb0e19afc8a547aa15eb7fad0349398059ee91fcedf2
Opcode Fuzzy Hash: 8032314bd4857ab242d421de0e1d5b52485f644a104edbd51dbbeaf3df67b873
Instruction Fuzzy Hash: B62162B56042009FEB04EF24C9C0B26BBA9EB94314F34C67CD94A4B291C73AD806CB71

Function 00D8F5B8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd4966bb3ff134fd115e9a93c995ac9d2b5b0a8f574a7a3f0c46d48b9ed90f44
Instruction ID: 0bcf08e6eb2c0b6394154047de02f31b503c2e0f485b17b5e771faa1ae4078ea
Opcode Fuzzy Hash: bd4966bb3ff134fd115e9a93c995ac9d2b5b0a8f574a7a3f0c46d48b9ed90f44
Instruction Fuzzy Hash: 0B2132B1604240AFDB04EF24C9C0B26BBA5FB94314F34C67DD94A4B2A1D33AD806CB71

Function 00D8F278 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8101378b25e87d7894cd383fc0587780772d9d35dfd282e33d0da0eda872e86c
Instruction ID: 63823998477a44c76cade958330f3450f24fcbe789ccb83063c136c708259f94
Opcode Fuzzy Hash: 8101378b25e87d7894cd383fc0587780772d9d35dfd282e33d0da0eda872e86c
Instruction Fuzzy Hash: 5C2102B56042409FDB14EF24D5C0B2ABBA5EB94714F34CA7DD94A8B292C33AD846C7B1

Function 00D8EE68 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77ca85f788bdf450db198a7e4653a97b7b8cafc1c29d55a95e54a46184e57c01
Instruction ID: 1ad09a98303d21a91ee8f4bc5d67015f9262b2af56a9ed52dd0ce76e0863cc3e
Opcode Fuzzy Hash: 77ca85f788bdf450db198a7e4653a97b7b8cafc1c29d55a95e54a46184e57c01
Instruction Fuzzy Hash: AE2105B1604240DFDB15EF14D5C4B26BBA5EB94314F34C96DE94A4B281C33AD846CB71

Function 00D8D001 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b902a84f7a56e366ae24bc0f438fe547dc78ccf973d57335d956fac381f7a84d
Instruction ID: 1d3f625717164387ff58fdce5178282c051b1cd2346143885941823e9ded3a11
Opcode Fuzzy Hash: b902a84f7a56e366ae24bc0f438fe547dc78ccf973d57335d956fac381f7a84d
Instruction Fuzzy Hash: DF2180755093808FCB12DF20D994715BF71EB46314F29C1EBD8898B6A3C33A984ACB62

Function 00D8D1C7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: b466c0aeea684cea88cffdc6d0c2449fd240a8d8059af46969476c542b1c628f
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: D611DDB5504280DFDB11DF14D5C0B15BBA2FB88314F28C6AAD8094B696C33AD84ACB61

Function 00D8E6FB Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: b0bc953b54c14e94ee1f13caf2257c7463a3f6ee0f370b71c6cd3d0d85f4a885
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: CC11DD79504280DFDB11DF10D9C0B25BBA2FB84318F28C6AADC494B696C33AD84ACF61

Function 00D8FEF7 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95376814f4f13af957b0ca8cabb6034ab99dfa3ece923ad96b2e2fc5a13c73bf
Instruction ID: db896757875f1f1e21e5f9936f06f51e5ca97b73b90a0c5fa188f96a075694bb
Opcode Fuzzy Hash: 95376814f4f13af957b0ca8cabb6034ab99dfa3ece923ad96b2e2fc5a13c73bf
Instruction Fuzzy Hash: A211EF75504280CFDB01DF10C6C4B25BFA2FB85318F28C6AED9098B652C33AD80ACB61

Function 00D8E3B3 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95376814f4f13af957b0ca8cabb6034ab99dfa3ece923ad96b2e2fc5a13c73bf
Instruction ID: 8139dea38879f61cff6ba606c2010cf6e9d68663494d06c9e6e9ff36a8dbf56b
Opcode Fuzzy Hash: 95376814f4f13af957b0ca8cabb6034ab99dfa3ece923ad96b2e2fc5a13c73bf
Instruction Fuzzy Hash: FF11BF75504680CFDB15DF14D6C4B15BBA1FB84318F28C6ADD84D4B652C33AD84ACFA2

Function 00D8F8F3 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a597023fe9617df083137b22f2d1e1d9cba5b47bc6bba7a423d3dedd94599fb5
Instruction ID: cec53a915a8a503a5827372177d5fb75b4780ffc696b19e1ff147242e3ef8b62
Opcode Fuzzy Hash: a597023fe9617df083137b22f2d1e1d9cba5b47bc6bba7a423d3dedd94599fb5
Instruction Fuzzy Hash: A8119EB55046809FDB15EF24D5C4B29FBA1FB54314F28C6ADC8494B792C33AD84ACFA2

Function 00D8F683 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a597023fe9617df083137b22f2d1e1d9cba5b47bc6bba7a423d3dedd94599fb5
Instruction ID: d9609a46000362af90d9a42af646b18d2bb856e174804a2f8bd85349b703402e
Opcode Fuzzy Hash: a597023fe9617df083137b22f2d1e1d9cba5b47bc6bba7a423d3dedd94599fb5
Instruction Fuzzy Hash: 3411A0B5504680CFEB15DF24D9C4B25BBB1FB54314F28C6BDC84A4B652C33AD84ACBA2

Function 00D8F5B3 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a597023fe9617df083137b22f2d1e1d9cba5b47bc6bba7a423d3dedd94599fb5
Instruction ID: ccd6807c67f29ce00fa7f8a45ebcf2b832e7cf1606a1978574f674874798c12d
Opcode Fuzzy Hash: a597023fe9617df083137b22f2d1e1d9cba5b47bc6bba7a423d3dedd94599fb5
Instruction Fuzzy Hash: E011E3B5504680CFDB15DF14D5C4B25FBA1FB54314F28C6BEC8494B662D33AD84ACB61

Function 00D8F273 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a597023fe9617df083137b22f2d1e1d9cba5b47bc6bba7a423d3dedd94599fb5
Instruction ID: 88f9436fd2d8f61398770c90b0fd4e8c31357508d4e05e1e0982547f33c8ef6c
Opcode Fuzzy Hash: a597023fe9617df083137b22f2d1e1d9cba5b47bc6bba7a423d3dedd94599fb5
Instruction Fuzzy Hash: B711E3B5504680CFDB15DF14D5C4B15BBA1FB44314F28C6BDD8494B652C33AD84BCB61

Function 00D8EE63 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3686370858.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d8d000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a597023fe9617df083137b22f2d1e1d9cba5b47bc6bba7a423d3dedd94599fb5
Instruction ID: 9bd45678f2dfa3e5056a4fc644b02303de26e6944c4c74214ac10501591607a6
Opcode Fuzzy Hash: a597023fe9617df083137b22f2d1e1d9cba5b47bc6bba7a423d3dedd94599fb5
Instruction Fuzzy Hash: 3A11CEB5504680CFDB15EF14D5C4B25BBA1FB84314F28C6ADD9494B652C33AD84ACFA2

Analysis Process: GamePall.exePID: 2876, Parent PID: 3664COMMON

Executed Functions

Function 01424F58 Relevance: 11.9, Strings: 9, Instructions: 615COMMON

Download Yara Rule

Strings

(wq, xrefs: 014255CF
(wq, xrefs: 014251F9
(wq, xrefs: 01425056
(wq, xrefs: 01425655
(wq, xrefs: 0142589B
(wq, xrefs: 0142586F
(wq, xrefs: 01425082
(wq, xrefs: 014251CD
(wq, xrefs: 014255A3

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq$(wq$(wq$(wq$(wq$(wq$(wq
API String ID: 0-1215394046
Opcode ID: 7747f68b3eb4f7f7cc99d0046ebb83551b3001541587cfd152ce06ede65a183f
Instruction ID: edf246a0b8749462ce38e9678b7bfc6294bb001ca3839d24c59c384da027d269
Opcode Fuzzy Hash: 7747f68b3eb4f7f7cc99d0046ebb83551b3001541587cfd152ce06ede65a183f
Instruction Fuzzy Hash: EE326D70B001248FDB09DF69D4946AEBBF2EFC9200F69806AD505EB365DF749C86CB91

Function 01421049 Relevance: .8, Instructions: 843COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b56b032ecb97923d76269279489d9c7a0009938e5b24bf106750a22430c49d
Instruction ID: 17139f9e2f87a77e584d5f971509d764cc8c6e4edc46589ce63a9bb55acca224
Opcode Fuzzy Hash: d7b56b032ecb97923d76269279489d9c7a0009938e5b24bf106750a22430c49d
Instruction Fuzzy Hash: 50828CB4A10209DBDB06DFF4D594B6E7B72EB88300F105068AA41337A5CF3D6D91EB66

Function 01423750 Relevance: 3.8, Strings: 3, Instructions: 88COMMON

Download Yara Rule

Strings

(wq, xrefs: 01423820
(wq, xrefs: 014237B2
(wq, xrefs: 01423786

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq
API String ID: 0-3966564304
Opcode ID: bf289527ab59137784d772b7a09c188934ee0c98411e110b2d2ab63220e19a17
Instruction ID: 8ce17dd9c558e40f89f8528a89782354e706fc5c0a878d466bcb48ffd7b64340
Opcode Fuzzy Hash: bf289527ab59137784d772b7a09c188934ee0c98411e110b2d2ab63220e19a17
Instruction Fuzzy Hash: AB212B22B085940FCB1AA73D541027F7BE7ABDA210758416ADA06CB7D5DD384C078396

Function 01423BE0 Relevance: 3.0, Strings: 2, Instructions: 465COMMON

Download Yara Rule

Strings

(wq, xrefs: 01423DE5
(wq, xrefs: 0142419C

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq
API String ID: 0-707371155
Opcode ID: 01ffffe35891efdf9672468ff87bcc88c36d29861f8143d73d543e4b57ab3def
Instruction ID: 056345a5770c7af00abe1760f5a5c6fa2faa20a5c6c12d8ed354e35b2027679b
Opcode Fuzzy Hash: 01ffffe35891efdf9672468ff87bcc88c36d29861f8143d73d543e4b57ab3def
Instruction Fuzzy Hash: 8CF14D70B001149FDB09DFB9D89466E7BB7EBC8340F14806AE606EB3A4DE389C42DB51

Function 0142B0B0 Relevance: 1.9, Strings: 1, Instructions: 680COMMON

Download Yara Rule

Strings

eqq^, xrefs: 0142B23E

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID: eqq^
API String ID: 0-3931273305
Opcode ID: deb526526eea1e32145c21945a3135cd70c89f0fcf0e698a405d8dc1e1d47b46
Instruction ID: 5cbd8b776952242c8024a862c67e78ccfb857c5731da045d526dfff4e7d70fab
Opcode Fuzzy Hash: deb526526eea1e32145c21945a3135cd70c89f0fcf0e698a405d8dc1e1d47b46
Instruction Fuzzy Hash: 39523934A01210CFDB19EF38E59856D7BB2FB84701BA5856AD806AB365DF39EC85CF40

Function 0142385B Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

(wq, xrefs: 01423BA1

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID: (wq
API String ID: 0-1062398946
Opcode ID: cd7a4fac25d5c126ee74fa27f7587e8b693e16810b9d16d0d6ad43425d49b61e
Instruction ID: f448fbfdbec7706029e15b10532a3181b9551c04b30928110b91fea8cb69c2bc
Opcode Fuzzy Hash: cd7a4fac25d5c126ee74fa27f7587e8b693e16810b9d16d0d6ad43425d49b61e
Instruction Fuzzy Hash: FEA12B75B102289FDB05DFB9D894AAEBBB6FF8C310F104069E905A7361DE399C41DB90

Function 014235E1 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

(wq, xrefs: 014236B6

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID: (wq
API String ID: 0-1062398946
Opcode ID: 1009b8452da46d60b7345f63c8c789fda87ee6c15e6f2f6a46ce8a8bb1e99f33
Instruction ID: 6d1f3094c7da3af2151ecb5467b39b747f1cf76dffadcc9404cf4342febf4c7a
Opcode Fuzzy Hash: 1009b8452da46d60b7345f63c8c789fda87ee6c15e6f2f6a46ce8a8bb1e99f33
Instruction Fuzzy Hash: 314144313042011FD719BB39986057F6BABFFD9250768887AD906CB3A5DE388C4BC791

Function 0142BEAF Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Tesq, xrefs: 0142BF75

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: 78122d280d0fd6894e7d08dd1220280a9685dbe2c140bcc67d9b7d6b055f7d22
Instruction ID: 840e3d8e59c9c71fc480efd00620afc82728ac314af8061295c13245cecf99cc
Opcode Fuzzy Hash: 78122d280d0fd6894e7d08dd1220280a9685dbe2c140bcc67d9b7d6b055f7d22
Instruction Fuzzy Hash: 654139747105118FC744EF3AC898A6EBBF6FF99710B6580A9E506DB3B1DA71EC018B90

Function 01422B10 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

LRsq, xrefs: 01422B35

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID: LRsq
API String ID: 0-3165563352
Opcode ID: 44d8093705bd6ffd128b63b2f1aec6546bf42792029186719343ad95c3b3f93d
Instruction ID: 1495ec1d519f6cda0993b7f5d0b6e0662486d81f76bd172e4a557bdb6a39b83f
Opcode Fuzzy Hash: 44d8093705bd6ffd128b63b2f1aec6546bf42792029186719343ad95c3b3f93d
Instruction Fuzzy Hash: D2310A707002058FD70AAF39C56996E77B2EBC9A14B218179D10A9B3B4DE39DC47CB84

Function 0142BEC0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Tesq, xrefs: 0142BF75

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: baa97200dc22247443a14c25eb3810fe59a1114bff9df5541e1ebf52f8d6328c
Instruction ID: 731b4180f4cbab541f1f28d99763c1cdb2f59cd24f44aa858f67c111d65d10fd
Opcode Fuzzy Hash: baa97200dc22247443a14c25eb3810fe59a1114bff9df5541e1ebf52f8d6328c
Instruction Fuzzy Hash: 1F313A747105118FC744EF7EC898A6EBBE6FF89710B6580A9E506DB3B1CA71EC018B90

Function 01424237 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

(wq, xrefs: 01424295

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID: (wq
API String ID: 0-1062398946
Opcode ID: dd2811f2092fe3fbde58b73e79cbf6fc3b6d4325921e189540ef36361fd6d2e8
Instruction ID: 660c05c120da51984413145a9745413a5b8481bcbb0e4800ba7914838ad0112b
Opcode Fuzzy Hash: dd2811f2092fe3fbde58b73e79cbf6fc3b6d4325921e189540ef36361fd6d2e8
Instruction Fuzzy Hash: 8A2194327082801FC70AA7B968601BF7BA3EFD629038848AFD542CF341CE345C0AC7A5

Function 01421058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad25f3b1996c207f770d90c596b5cc2d83ee505f46476662b2e9f9449ea82dbe
Instruction ID: 131ff87ca1d3ac4824bc0bd10d939524248328dee6fb3c8f195a302ed82fd0c8
Opcode Fuzzy Hash: ad25f3b1996c207f770d90c596b5cc2d83ee505f46476662b2e9f9449ea82dbe
Instruction Fuzzy Hash: 3E828CB4A10209DBDB06DFF4D594B6E7B72EB88300F105068AA41337A4CF3D6D95EB66

Function 014238A5 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9392e9745eb62a6d0d521d607d1ea2cc9bf923ae73bf9270d59ba6949785e78
Instruction ID: 7fbcfea11b99d46f66814658fd1d111b05844206b0c84300a96ab746c4edaaaa
Opcode Fuzzy Hash: b9392e9745eb62a6d0d521d607d1ea2cc9bf923ae73bf9270d59ba6949785e78
Instruction Fuzzy Hash: 7471DE74B11218AFDB05DFA8D894AADBBB6FF8C310F204069E905A7365CB399C81DB50

Function 0142BB99 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af905b6f89505f51b6b98696a2fee2b5b7e7b943a61fa175249b7b2d417d1d5a
Instruction ID: 9ed078745128a0e4cd195ea1d8688605c993c41da4bccdd6136ae6e3a02737cd
Opcode Fuzzy Hash: af905b6f89505f51b6b98696a2fee2b5b7e7b943a61fa175249b7b2d417d1d5a
Instruction Fuzzy Hash: 44812870602205CFDB14EF28E68991A7BB6FB44704B54C66AD906AB335CB3DEC85DF81

Function 01425A91 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5942eed3d51c18f2bafde6258ac7c95ecbca2596c97d8a295087d096c23bff7f
Instruction ID: 5742c3daffc46bcfba34f2e262f0aa72f97cb530494bfd3cbc85cf271c3589cd
Opcode Fuzzy Hash: 5942eed3d51c18f2bafde6258ac7c95ecbca2596c97d8a295087d096c23bff7f
Instruction Fuzzy Hash: 3B514B75B002168FCB04DF69D594AAEBBF6FF88210B5181A9E509DB371DB30EC45CBA0

Function 01425240 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af556b43b878194a0a042924c8f95afffa828046fe1556eb5063576a6d1aee71
Instruction ID: 8a6b589460f49e69e68d77341a7880115920ea963e21800847bf0783e3f10407
Opcode Fuzzy Hash: af556b43b878194a0a042924c8f95afffa828046fe1556eb5063576a6d1aee71
Instruction Fuzzy Hash: 83512E71A011289FDB04DFA9D494AEEBBF2FF88311F54806AE505AB364DB749C81CF90

Function 014238E5 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd0c53de42675fa620e453230ecc338a5dcf7945df6f73ae0ac07fa03dd66fdd
Instruction ID: 318836700024b4b5956d8f146e74ad1b8bc62584e09c0e86cea0cf8e8a6de5bd
Opcode Fuzzy Hash: fd0c53de42675fa620e453230ecc338a5dcf7945df6f73ae0ac07fa03dd66fdd
Instruction Fuzzy Hash: 5C41E974A11219AFDB05DFA4E894AAEBFB6FF8C310F204025E905B7365CB399D81DB50

Function 01422850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78834481e499f9fbab97426b26256d72d58e8e924313bc8ffc4e82b51bf01282
Instruction ID: 620dd19fdf677718325f53b0b3ec1d04c2cf4b3dcbf10effa4a88b14125d1896
Opcode Fuzzy Hash: 78834481e499f9fbab97426b26256d72d58e8e924313bc8ffc4e82b51bf01282
Instruction Fuzzy Hash: 3741F574E10208DFDB14EFB9D884AAEBBB2FF88340F54552AD901A7260DF759881CF50

Function 0142B0A0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f775bd47ec343a99172196daa8ee9f97dcf2be89ef6c61c45f323320d7a5e031
Instruction ID: 4d0706072b63776c60a6fa7abaff3fd44af149a6c10d28f6f2ad1dee96b6d639
Opcode Fuzzy Hash: f775bd47ec343a99172196daa8ee9f97dcf2be89ef6c61c45f323320d7a5e031
Instruction Fuzzy Hash: B5314470A002148FCB09DB79D9853ADBBE6FF85310F44852ED409EB3A1DF74AC498B81

Function 01425308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59bb5ed2af2b450af0dd6add246d8abd3a33a17016e4c10b6c70e0fd472aa771
Instruction ID: a72083526011c31d6791b12973538f660d4b797ec64314f2d651d947068eddbe
Opcode Fuzzy Hash: 59bb5ed2af2b450af0dd6add246d8abd3a33a17016e4c10b6c70e0fd472aa771
Instruction Fuzzy Hash: 0341ED75A011249FCB04DF65E494AADBBB3FF88311F54846AE905AB374DB389D82CB50

Function 01422843 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb95ad823059de92d94d158bbebb8bd3cc1312b2bc10bad9e9849d5a2817eea9
Instruction ID: 58149cb01b55c6aa24cbd57a3615440c42e27c1ba79b678fc87e8cfd7c4fea8e
Opcode Fuzzy Hash: bb95ad823059de92d94d158bbebb8bd3cc1312b2bc10bad9e9849d5a2817eea9
Instruction Fuzzy Hash: CF316F70E10208DFDB15DFB9D884AEEBBB2FF88340F54452AD501A7260DFB55985CB50

Function 01422C48 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba9a4df210d6ca29c6935ce020189a4d94d1698ac50dba2189d4a69a669ed26
Instruction ID: 68b85f64692231539aaf25306dc401981eb74258d43635ae3fa70d41517f6d08
Opcode Fuzzy Hash: cba9a4df210d6ca29c6935ce020189a4d94d1698ac50dba2189d4a69a669ed26
Instruction Fuzzy Hash: 0141B67490020A8FCB05DFA8D8949EEBBB2FF88310F505569E505B7360DB795E86CFA1

Function 01424B50 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f112b09e07f50540134b1c2f9f0149076acab1c4142138f46fdbf4a13f291a86
Instruction ID: 374f1daa19c73a8b2c82bbefb4df38ba492c640c2fe779ee785e0fdaf6665abb
Opcode Fuzzy Hash: f112b09e07f50540134b1c2f9f0149076acab1c4142138f46fdbf4a13f291a86
Instruction Fuzzy Hash: 8521E7302052425FC70AEB78EC9466EBBA2FFC1240B044E6AE4059B651DF706D899795

Function 01422C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b74249169e92f5e6c77b86ee5b0e582b9890202215fc7ee4dddddf22c96a32d
Instruction ID: 220b24b983d36ba530ace49fb7e379702fd290defc54503dc8f97f894ad2b9be
Opcode Fuzzy Hash: 5b74249169e92f5e6c77b86ee5b0e582b9890202215fc7ee4dddddf22c96a32d
Instruction Fuzzy Hash: DA31B77490020ACFCB05DFA8D5949AEBBB2FB88310F505529E505B7360DB785D81CFA1

Function 01424B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 710a2c147712aa429ce58d86d14e6f5311dcffe91464c7f922f107c0b1c9d69b
Instruction ID: aa35da3a8dcdf9a9e69616fb5c03895f50090ea28f6c8cc9a4ab5922b40bf25b
Opcode Fuzzy Hash: 710a2c147712aa429ce58d86d14e6f5311dcffe91464c7f922f107c0b1c9d69b
Instruction Fuzzy Hash: 4521A2702002025BC719EB79E890A6FB7A7FFC4250B448E29E4059B664DFB0AD899BD5

Function 01425C41 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4841d1732e766ec9dc4b9b85c7e79365abe99cc82bb036911b01dd4fcba8802f
Instruction ID: df45a19f2cef95f9314c82d21e29fd67d143c231c06b0deb36c227af2a1d8d08
Opcode Fuzzy Hash: 4841d1732e766ec9dc4b9b85c7e79365abe99cc82bb036911b01dd4fcba8802f
Instruction Fuzzy Hash: 8321CF30A042988FDB01CBA9C4A8AED7FF1AF49300F64419AD441FB362CB345D82CB60

Function 01426888 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 386105bcdb801eb5f0bb8b9218531607190a30d2e69e843c602433c916ade293
Instruction ID: 82916fd05f195bfe289336065c861cccd8706a01ce9823edbbd87027dbe2ef4d
Opcode Fuzzy Hash: 386105bcdb801eb5f0bb8b9218531607190a30d2e69e843c602433c916ade293
Instruction Fuzzy Hash: D821B471A00215CFDB04DB69C9087EEBBF1EF44304F96806AC805A7271DF759985CB50

Function 01425C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00e238d580c38bde89f766dae8510a3c5e206d00c791268f0b8c44d95771c33
Instruction ID: 348eb788db607d81e4f3e424b5a18bee047874b789144e1aac163f70b0d38d14
Opcode Fuzzy Hash: c00e238d580c38bde89f766dae8510a3c5e206d00c791268f0b8c44d95771c33
Instruction Fuzzy Hash: 55216A35A002288FDF04DBA9D588BDDBBF1AF4C310F6040A6E501BB361DB75AD85CBA0

Function 014241A2 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b2068abb1750e1295850c036ce9c7df2c1c8cef3c909f59f505effb46522168
Instruction ID: 03207175ece28dbaceaed3e550a1d216ea588f7139071d39633042fbdc99fd08
Opcode Fuzzy Hash: 5b2068abb1750e1295850c036ce9c7df2c1c8cef3c909f59f505effb46522168
Instruction Fuzzy Hash: CB0124317092816FC70AA7B8A8601FF6FB7EFC615076844ABD506DB382CE210C0B87A5

Function 014232E0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 056671081562bdde84ac0d2bf97a269ace95285ebaf0ee8e7c1b7e9823aac544
Instruction ID: abed436ac4231c5011ba549f67256dcd3a48ea9598b42bda51a0473d66ca190c
Opcode Fuzzy Hash: 056671081562bdde84ac0d2bf97a269ace95285ebaf0ee8e7c1b7e9823aac544
Instruction Fuzzy Hash: 41112A34E551489FCB04DFB4E568BADBBB3EB98341F80482AD406E7391DB791856CB60

Function 01422A80 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 246465782195b329c0aea6be450b6efa6db808745646be53a15b8cf3f9263a17
Instruction ID: c0b126db983f004f818914a05cd9192981f56599307b82ce297d635e9c1392ff
Opcode Fuzzy Hash: 246465782195b329c0aea6be450b6efa6db808745646be53a15b8cf3f9263a17
Instruction Fuzzy Hash: E90184312102518FC312EB38C4188AABBF2FF8561031489AAD18ADF366DB70EC098BD0

Function 01425940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3784302fd60f73fc8d20aba3a379df22ed6bf7c321d8e63e061583f659eaf6f5
Instruction ID: e7f5ab84d1a32d02cc96ceedc1ea67844ed0ca0b6531d797dad55da0f45b6dba
Opcode Fuzzy Hash: 3784302fd60f73fc8d20aba3a379df22ed6bf7c321d8e63e061583f659eaf6f5
Instruction Fuzzy Hash: DE018C773412249B8704EB79E49486AB7ABFBC96A5315857AEA06C7310CA319C06C7A0

Function 014232F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a9da61898ecdb06f8c8d7a141515ea9ae3140b61c94f4d842f5d1ab496f5da6
Instruction ID: ef1308e26b66e7f83c53b1d2c390a92d85b72bff427d01eb739f1f975946ac40
Opcode Fuzzy Hash: 0a9da61898ecdb06f8c8d7a141515ea9ae3140b61c94f4d842f5d1ab496f5da6
Instruction Fuzzy Hash: C8012934E552089BCB04EFB4E568B9EBBB3AB9C341F804829D402E7390DF795856CB60

Function 01426388 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ca3726cee7f3eb76d4189650319faddd7184577052469781b3166249597805
Instruction ID: 7de8a9fb797a1ae1fde939d37138290a3577bf8f809496822fbb7f1b62ba5101
Opcode Fuzzy Hash: e6ca3726cee7f3eb76d4189650319faddd7184577052469781b3166249597805
Instruction Fuzzy Hash: EBF0C270905288AFCF41EBB8D8515EDBFF2EF9A200B2445D9D448E7212DA300E06DB41

Function 0142593E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d1c9331c25e86dde69383324fc701fcae253cdbad2ed98107e9bb69ebe4233
Instruction ID: f3fff278cf672e7d617ce966a04995006940522ad20d80b3d0759b2f82f674f7
Opcode Fuzzy Hash: 69d1c9331c25e86dde69383324fc701fcae253cdbad2ed98107e9bb69ebe4233
Instruction Fuzzy Hash: 0CF05E763411109F8715DF39E494CAEBBB7FBC92A5325857AE905C7320CA358C02CB60

Function 014241E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b74705eda179d6e7679e1a16d65d8e3b74a585706ef8bf88f71bceae0a5a146
Instruction ID: 707d7e1c91ab580d7df0a2aa33ac67406cf1fed7b92c3b3d6d922e9c05a4983c
Opcode Fuzzy Hash: 1b74705eda179d6e7679e1a16d65d8e3b74a585706ef8bf88f71bceae0a5a146
Instruction Fuzzy Hash: F2E0E5717041052B8708A2A67C509BF769FFBC81A07540829E109D7300CE312C0483A8

Function 01425610 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e630881638cd9bd23c22897e5ce545c8dcbeafeec42ab69b5f13603b98004fe7
Instruction ID: b6b77566b97519a8c954960c2e0ad76751ecb34d5f0ff577321ac7617292878a
Opcode Fuzzy Hash: e630881638cd9bd23c22897e5ce545c8dcbeafeec42ab69b5f13603b98004fe7
Instruction Fuzzy Hash: A4E01211A5E2C04FC7130B7CACB61E93F76CD9309871D41D6D8C8CB523C41A882F9B15

Function 01426398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcb0a4c27713d1e2c1f5bcb9f69f5c1c8732a9a31f118dbadc6ec7ab68f157d1
Instruction ID: bdf0b7781dbe7074c98c8fc46e709fd56c4b4ca468e6e79e5f2f53433449b112
Opcode Fuzzy Hash: bcb0a4c27713d1e2c1f5bcb9f69f5c1c8732a9a31f118dbadc6ec7ab68f157d1
Instruction Fuzzy Hash: A3F03074E0120DEFCB44EFB8D9445AEBBF6EF94200F6046A9D909E7350DA305E45EB51

Function 01421FF8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99299ff1c7832f53c098807b3a4cf588f7c408f7ffe9c53c99e017afab9e5de5
Instruction ID: 2f7f52766b6b32568c403ddb0c85127377f46bd14c9cf0e14c03dc5520c3c095
Opcode Fuzzy Hash: 99299ff1c7832f53c098807b3a4cf588f7c408f7ffe9c53c99e017afab9e5de5
Instruction Fuzzy Hash: B8E092357412808FCB065B7DD018895BBB5EF8B61631509EFE006CB322CE708C06CB11

Function 01422D97 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b40efe46966dea1af130b2af95c26774b8bd8fba07311d8a50cc31bf5596f79
Instruction ID: 84f4e719f970da9423596b8350bf39e5e7e081b0890be699504ce3db9b6422de
Opcode Fuzzy Hash: 6b40efe46966dea1af130b2af95c26774b8bd8fba07311d8a50cc31bf5596f79
Instruction Fuzzy Hash: 75F01C75E140198FCB44EFBCC4156DE7BF1EF89254B1140A6D549E7322D6708D128B92

Function 01422DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a91785ec513752cf9af8655ad45a6812589a22ea5b758aec7098dcb7696bf181
Instruction ID: b9c9631d71416bbb3bc977da8ca1f3632caeb909a8dc7cc79dd63ae36206d739
Opcode Fuzzy Hash: a91785ec513752cf9af8655ad45a6812589a22ea5b758aec7098dcb7696bf181
Instruction Fuzzy Hash: 54E0ED75E20118CF8B84EFBDD5096DE7BF5FF48210B6140AAD619E7310EB709E018B92

Function 014266C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46021cfd9e1002a51d016a52d22bccd06e4af76166178647ccc1f57c3f41673
Instruction ID: 4592d5446934796dde0ad810896627c0c416e883956f785743f380d2b5d31f32
Opcode Fuzzy Hash: a46021cfd9e1002a51d016a52d22bccd06e4af76166178647ccc1f57c3f41673
Instruction Fuzzy Hash: C6D0A93275A1E04BC30A26BC74200EABBE3DECF49130905ABF284DB302CD254C0BA391

Function 01426469 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c625100361390a5e46dc025b20960e4c143810ac37eea8caf227ab8e732f71a3
Instruction ID: 07ae49a042aebcce68508aa759121a1e0016e38c5442a26a6744e8325f24cd24
Opcode Fuzzy Hash: c625100361390a5e46dc025b20960e4c143810ac37eea8caf227ab8e732f71a3
Instruction Fuzzy Hash: A0E05EB56482804FC7458B38D4D68A87F73EF992A071545F9E489CB372CD25CC43CB05

Function 01426478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaa26c64af35d9ab04aad39ee66584a5d569212039dad2f1e0b53a920c9ddabc
Instruction ID: 7baa1174eded5aa1248d70817208fe204b470daf54d8bcadb883455bc69a4dbe
Opcode Fuzzy Hash: aaa26c64af35d9ab04aad39ee66584a5d569212039dad2f1e0b53a920c9ddabc
Instruction Fuzzy Hash: 08C012753802048FC208DB6CE08082637EAEB8C75031004A8EA09CB375CE20EC828A58

Function 01425640 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3661340037.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1420000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b64b8c5096423dcab63c9f47e38b9d985a08ec4672bd52d93eb5493b0fbc6c51
Instruction ID: 93be9ef274652c0be95446464611933d91e7a58746ba1142f7a9bebc1c7ecc83
Opcode Fuzzy Hash: b64b8c5096423dcab63c9f47e38b9d985a08ec4672bd52d93eb5493b0fbc6c51
Instruction Fuzzy Hash: 75B02B3054020D5796100529BC0C4127B1EEB504553800195ED0C44210ED33C8600084

Analysis Process: GamePall.exePID: 4012, Parent PID: 3664COMMON

Executed Functions

Function 02774F58 Relevance: 11.9, Strings: 9, Instructions: 604COMMON

Download Yara Rule

Strings

(wq, xrefs: 027755CF
(wq, xrefs: 02775056
(wq, xrefs: 02775655
(wq, xrefs: 02775082
(wq, xrefs: 027755A3
(wq, xrefs: 0277589B
(wq, xrefs: 027751F9
(wq, xrefs: 0277586F
(wq, xrefs: 027751CD

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq$(wq$(wq$(wq$(wq$(wq$(wq
API String ID: 0-1215394046
Opcode ID: 7a84284315aca6f61da778e8a55cf23041a87ebc0c6216ac2e2a5f3d671adc1f
Instruction ID: 4fc80869a96f69599c87edc955400cac5f1011ba01c8883739f4e334b2825e47
Opcode Fuzzy Hash: 7a84284315aca6f61da778e8a55cf23041a87ebc0c6216ac2e2a5f3d671adc1f
Instruction Fuzzy Hash: 14327C74B002148FDB48EB68D4946AEBBF2EF89314F558169D906EB3A1DF349C42CB91

Function 02773860 Relevance: 4.4, Strings: 3, Instructions: 620COMMON

Download Yara Rule

Strings

(wq, xrefs: 02773BA1
(wq, xrefs: 02773DE5
(wq, xrefs: 0277419C

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq
API String ID: 0-3966564304
Opcode ID: 3c8eba8e8b8bb57fc42867aab0e74353334ba98b875f81453d2db12cbd30bef1
Instruction ID: 6beafb3e7e4c3e8c7fe30ebb7ee839260c363cc056621ac15f31a03b60d8d337
Opcode Fuzzy Hash: 3c8eba8e8b8bb57fc42867aab0e74353334ba98b875f81453d2db12cbd30bef1
Instruction Fuzzy Hash: 00322D74B002149FDB09EBB8D894A6E7BB7AFC9310F148069EA16E73A4DF349C41DB51

Function 02771049 Relevance: .8, Instructions: 840COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43bef4f916e35e478b5a756c0527d86716c244466aa8662c1de93a542bce0e3
Instruction ID: 34d4ea5dbdbb01510fc71adf752d3660c3237c459411c658db22d193d437b0e3
Opcode Fuzzy Hash: d43bef4f916e35e478b5a756c0527d86716c244466aa8662c1de93a542bce0e3
Instruction Fuzzy Hash: 4D8220B4A01209DBDB06EBF4D594F6E7B72EB88300F109414EA4123799DF396D91EB36

Function 027735F0 Relevance: 5.2, Strings: 4, Instructions: 192COMMON

Download Yara Rule

Strings

(wq, xrefs: 027736B6
(wq, xrefs: 02773786
(wq, xrefs: 02773820
(wq, xrefs: 027737B2

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq$(wq
API String ID: 0-1261553304
Opcode ID: 83597b0272f1d7313b32fa951c492598c5bb58dd93c28a09df626e5c8c5a6030
Instruction ID: dd49ed0f58d6f648c3078fc85593110c0141ee89e25e467ac29ff277bb13125f
Opcode Fuzzy Hash: 83597b0272f1d7313b32fa951c492598c5bb58dd93c28a09df626e5c8c5a6030
Instruction Fuzzy Hash: 715157317081505FEB5DB739A86063F2BABEFD5310B2885B9D906CB394DE389C078795

Function 0277B0B0 Relevance: 1.9, Strings: 1, Instructions: 680COMMON

Download Yara Rule

Strings

e<p^, xrefs: 0277B23E

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID: e<p^
API String ID: 0-2332776331
Opcode ID: 66aaab038931e98aa4acaf7b8cca85c3845e2eb7abee126a5ee27cfacde06da6
Instruction ID: b31d878ff3339b59aa59032182ca9de862301ad3510a26209101630fffb19fc3
Opcode Fuzzy Hash: 66aaab038931e98aa4acaf7b8cca85c3845e2eb7abee126a5ee27cfacde06da6
Instruction Fuzzy Hash: B8523778A01201CFDB19EF34E598A6D77B2FF84305B649869D4169B365EB39EC81CF80

Function 0277BEAF Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Tesq, xrefs: 0277BF75

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: 1c3764756002e1032658ed190e85c264c40677a701eeecb75bfdd66e571e535b
Instruction ID: fc4677d897a888d6c61851916a76d998825131ca7d0998165e593f93abd2939b
Opcode Fuzzy Hash: 1c3764756002e1032658ed190e85c264c40677a701eeecb75bfdd66e571e535b
Instruction Fuzzy Hash: 2B414E747005108FC754EF7AC498A6EBBF6FF89710B6580A9E516DB3B1DA70EC018B90

Function 0277BEC0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Tesq, xrefs: 0277BF75

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: 5538b31761804b6a7f6b02b2564536bf751887c8c762351c361d695eb1fdbf69
Instruction ID: 2cf73c47d95c3500d679dd6ccd405e300c5402c6a7c9dacba6dba22521dae654
Opcode Fuzzy Hash: 5538b31761804b6a7f6b02b2564536bf751887c8c762351c361d695eb1fdbf69
Instruction Fuzzy Hash: BB313B747105008FC754EF6AC498A2EBBE6FF89710B6580A9E506DB3B1CA71EC018B90

Function 02772B10 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

LRsq, xrefs: 02772B35

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID: LRsq
API String ID: 0-3165563352
Opcode ID: 312457effacbcdc34f7f7025c5a9a932ebf268f30d95deda26248d7a7298ecf3
Instruction ID: 4dd3d270824e709aecbbf74b7893ef8df6260fe5fb12d19cb69f1f9d4593d09b
Opcode Fuzzy Hash: 312457effacbcdc34f7f7025c5a9a932ebf268f30d95deda26248d7a7298ecf3
Instruction Fuzzy Hash: 66310A75740605CFD70AAB38D555A5E33B2EFCAA10F218168D20A8B3B9EE359C478B84

Function 02772B20 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

LRsq, xrefs: 02772B35

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID: LRsq
API String ID: 0-3165563352
Opcode ID: a91170e135d33a50170a1c4afe9add6ce318e7573f307ddf2d44800311536ed1
Instruction ID: db058558b30601751d8cab86894d8de030c378aa904f32e05806e65284f9a332
Opcode Fuzzy Hash: a91170e135d33a50170a1c4afe9add6ce318e7573f307ddf2d44800311536ed1
Instruction Fuzzy Hash: C131EB74740605CFD749AB35D555A5E33B2EFC9A10B218168D20A8B3A8EE35DC478B84

Function 02774248 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

(wq, xrefs: 02774295

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID: (wq
API String ID: 0-1062398946
Opcode ID: d69e2a90d784902666867ce4a9a31a4df6e6b9ae5917cb5140190e831b4cd262
Instruction ID: a024f29867f341589f48f58b36adf73687840a707e93e137d0e80919dd524a64
Opcode Fuzzy Hash: d69e2a90d784902666867ce4a9a31a4df6e6b9ae5917cb5140190e831b4cd262
Instruction Fuzzy Hash: 72019C7270C2801FD70AA37D682813E3BA3DFD2210748449ED842DF351CE28AD46C7D5

Function 02771058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd2fb82611b08f69b241c40d96d056fe8f7afe79f221bb29c63075fa12e7992
Instruction ID: 6a77ad964e419933b5df58e7e284cb4ee500bc54a4a565ea01b48b004f57a723
Opcode Fuzzy Hash: cfd2fb82611b08f69b241c40d96d056fe8f7afe79f221bb29c63075fa12e7992
Instruction Fuzzy Hash: 358220B4A01209DBDB06EBF4D594F6E7B72EB88300F109414EA4123799DF396D91EB36

Function 0277BB99 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c13faeb3fa09f753b0d232a852ce08726f0ed52018b54e2a3b9bc2d64f437ebf
Instruction ID: 450fd4a3da3a82c9430cea47dc674a5088a28d31e8a281bcdacab6fe051ba1ed
Opcode Fuzzy Hash: c13faeb3fa09f753b0d232a852ce08726f0ed52018b54e2a3b9bc2d64f437ebf
Instruction Fuzzy Hash: 348138B8A02105CFD716EF34E589E29BBB2FF44304B54D968D5248B329EB78E885DF41

Function 0277385B Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a853ab07fcb06e3d49f1839640c9196f240946e6d3a9ca96545b1a55e91ea586
Instruction ID: b9c19961707f6f827ee62135517bd61008a49347f318e6c99d6264af23d99aa6
Opcode Fuzzy Hash: a853ab07fcb06e3d49f1839640c9196f240946e6d3a9ca96545b1a55e91ea586
Instruction Fuzzy Hash: 3E611A74B11218EFDF05DFA9E894AADBBB6FF88310F108065E905A73A4DB35AC41DB50

Function 02775AA0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd7e29c292e2ec3b44ab24d7e9ad5c770a3ba66ec06716794666cc6ca763a85
Instruction ID: 7c0287b3f801fc1bd7697713983cdf5d161fa343a47fe3db23201ef1ca86f66e
Opcode Fuzzy Hash: fcd7e29c292e2ec3b44ab24d7e9ad5c770a3ba66ec06716794666cc6ca763a85
Instruction Fuzzy Hash: 495140B5B002058FCB04DF69D594A6EBBF6EF88314B5141A8E906EB361DB30EC41CB91

Function 02775240 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0412bde907dc30bd6c46c8b6cec06fa5ccf55e7188927685eb3c72f18792998
Instruction ID: dd0733082f4327369375620a272f37d1393e03450ebd2f74e4db585ca75805e5
Opcode Fuzzy Hash: a0412bde907dc30bd6c46c8b6cec06fa5ccf55e7188927685eb3c72f18792998
Instruction Fuzzy Hash: DF511A75A002189FDF08DFA5D498AAEBBB3BF88315F54C169E905A7364DB34AC41CF90

Function 02772850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a561b69281e573298eb43566ebef89e6cc56a8a7b0cc19860bcffbff8111c5
Instruction ID: f162736bf9ef710003ccff0493789f9bd22ba5806270b9c3fc7ef4a3c7f2f7f0
Opcode Fuzzy Hash: 54a561b69281e573298eb43566ebef89e6cc56a8a7b0cc19860bcffbff8111c5
Instruction Fuzzy Hash: C0412AB4E10208DFDF18EFA5D884AADBBB6FF88300F109569D911B7255EB359881CF20

Function 02775A91 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5aa82667abdca1a6a953237f11b1f8a4ab7623a6b9cbda2646b1533cacb441f
Instruction ID: bab73e06dcdf147c7301ea6e783066f6d9023034bc7600a1c5e5a8b21ee717f3
Opcode Fuzzy Hash: e5aa82667abdca1a6a953237f11b1f8a4ab7623a6b9cbda2646b1533cacb441f
Instruction Fuzzy Hash: A0415CB5B006068FCB04DF68D984A6ABBF6EF89314B5141A9E909DB361DB30EC05CB91

Function 02772843 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1881276ccc8a0aec9b1660af780da3e3f02b5f6aadf17ea005a1f74eeb46e7e8
Instruction ID: e6c47c561ade1731edbb4568f0c77d33e122559a3de43804096280f1e07a100a
Opcode Fuzzy Hash: 1881276ccc8a0aec9b1660af780da3e3f02b5f6aadf17ea005a1f74eeb46e7e8
Instruction Fuzzy Hash: C2415BB4E10208DFEF18DFA5E8806ED7BB6FF88300F145569D911B7255EB359985CB20

Function 02775308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0589c1f415b2eb48a59463de23fb8f54a339297bfd5ff1aab93db619084781a5
Instruction ID: 74724776e16ee4402caba2fc27e26281472237ba69a12231187cf50b238c584b
Opcode Fuzzy Hash: 0589c1f415b2eb48a59463de23fb8f54a339297bfd5ff1aab93db619084781a5
Instruction Fuzzy Hash: B341F974A001189FCF09EFA5E498AADBBB3FF88315F508465E916A7364EB349D41CF50

Function 02772C48 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 401ff4d57446ed649235fb7cfb5db3f8c85e588e1faddc89c28895c42098e6ab
Instruction ID: 6665209c1c508ee04d547153cb9e38ddc19b3562df08f8e5b5505244af747084
Opcode Fuzzy Hash: 401ff4d57446ed649235fb7cfb5db3f8c85e588e1faddc89c28895c42098e6ab
Instruction Fuzzy Hash: 7541F974A00209CFCB05EFA4D894BEDBBB2FF89314F108569E511B7355EB395941CB91

Function 0277B0A0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82c00db5a4b0355c121e9ec565a34104dfdaa88cbc268d2a173ebd5ecef675a0
Instruction ID: 272e5d0acf79d82ff17ede0128932e38e49b2710110e4f5c14a62b5d9ec15681
Opcode Fuzzy Hash: 82c00db5a4b0355c121e9ec565a34104dfdaa88cbc268d2a173ebd5ecef675a0
Instruction Fuzzy Hash: 7931F770A002149FDB14EF78E89869DB7B6FF85304F10992DD11AAB391EF70AC068BD0

Function 02772C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 844308c071276cfa19a94275fffac8c2656601d9d6a99b15177fac4842410d0e
Instruction ID: be5a017dfeac28137e63b93e0001d0f8452e91e1f6be7748f27881f0e28d92b2
Opcode Fuzzy Hash: 844308c071276cfa19a94275fffac8c2656601d9d6a99b15177fac4842410d0e
Instruction Fuzzy Hash: 5C31D874900209CFCB08EFA4D494AEEBBB2FF89314F109569E611B7354EB346981CF91

Function 02774B50 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf462012c0e481d4f639549cb231d7852fdd72bef044d5a5536491d2d5f393b2
Instruction ID: 653aaa89f64c61f39185d2bc137466df27521a6ba015d9dbba617e165cac8977
Opcode Fuzzy Hash: cf462012c0e481d4f639549cb231d7852fdd72bef044d5a5536491d2d5f393b2
Instruction Fuzzy Hash: EC2107702043415FD719EB78E890A5EBBB3EFC5310B048E69D4069F2A5DF70AC898B95

Function 02775698 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f650a3bbd748cb8fe805eebc16abdd63e2e84b5524eb92a9cfd2721a41d2dbbf
Instruction ID: 0fd227d61252699e05a58b1494586e3566b8e81703b948412af32c952c7f08e7
Opcode Fuzzy Hash: f650a3bbd748cb8fe805eebc16abdd63e2e84b5524eb92a9cfd2721a41d2dbbf
Instruction Fuzzy Hash: 192188B4B012148FCB08DF69D598A6EBBF6AF88700F644069E806E7361DF70EC01CB50

Function 02774B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08d828cdaad5d6e874c3635dbfe90edcd5d3b528a191373ba4d7dfe9cb337f45
Instruction ID: bf3aeafdfcdcff1b9d25781de5f2b3f9345e8835661bf8c744afa74379295687
Opcode Fuzzy Hash: 08d828cdaad5d6e874c3635dbfe90edcd5d3b528a191373ba4d7dfe9cb337f45
Instruction Fuzzy Hash: 4921A2702003015BD719EB79E8D5A6EB7A7FFC4310B448E28E4069B664DF70BD898BE5

Function 02775C41 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4954cce90e8c434ed258c662d71567a1d9fdb70e2516187a5402cf09fd937c
Instruction ID: f13a84e55309bfe8d8cbaf42fe18b48119c06d185935eb30f8210f6e898f9392
Opcode Fuzzy Hash: 0d4954cce90e8c434ed258c662d71567a1d9fdb70e2516187a5402cf09fd937c
Instruction Fuzzy Hash: A8217A71A082988FDF15DBA8C494BDCBFF2AF4A310F650099C841EB2A2DB359D45CB61

Function 02775C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b2a55582d63c0cd8a021bbf1d35de61c9b3289a04a1dc8644eff1c59954ef1
Instruction ID: 873fd146e795e3bdea2ce3f7804eeb1c94e90b54e56f74b34ad7feda774af90f
Opcode Fuzzy Hash: f6b2a55582d63c0cd8a021bbf1d35de61c9b3289a04a1dc8644eff1c59954ef1
Instruction Fuzzy Hash: 47213675A002188FDF04CBA9C598BDDBBF2AF4C310F6000A5E905BB361DB75AD84CBA0

Function 02776888 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29be2d19d7a56fd95cefaefd8d23c5ace00b8c1a3397228abe6b0483b0275a88
Instruction ID: 989de67d011199b739ea7da2d767e755021967c87289499d3ba83456e3eca80a
Opcode Fuzzy Hash: 29be2d19d7a56fd95cefaefd8d23c5ace00b8c1a3397228abe6b0483b0275a88
Instruction Fuzzy Hash: 2721D2B1900609CFEF18DBA4C908BEEBFF6EF45300F518469C001A7265DB758A04CF51

Function 02772A80 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d87da93bde2a4e99f0d7af09f9844b4b755c5420e71055ca46b91c2607eb9aa
Instruction ID: 81e4e94672e335623a7b91b7bd2d7337c9e838e0255aba66b4adcfbb912a3839
Opcode Fuzzy Hash: 6d87da93bde2a4e99f0d7af09f9844b4b755c5420e71055ca46b91c2607eb9aa
Instruction Fuzzy Hash: F2119E756447408FC722EB38C55499BBFE2EF46214B1589A9C195CF366DB30EC098F91

Function 02775911 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958470fe674f44c2f7c96fafe7b0e5524f6dc9326350fa1994f5b9af916c6c59
Instruction ID: 526a99a51535969fdb23d94e8c1ac017f22c861454a2158de1d3dc02ed221ba5
Opcode Fuzzy Hash: 958470fe674f44c2f7c96fafe7b0e5524f6dc9326350fa1994f5b9af916c6c59
Instruction Fuzzy Hash: 5C01B5763053508FD7159B34E490A1CBBB6EF86354B2584AED545C73A3DA348C45C750

Function 02775940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa5df59e3db27be04e7042a60d6bcf607e2e13dd95b46efa6f8df3d7c81810bc
Instruction ID: 6f0de7628e054dcbb1d2c55f3f0598f1cfb652f83b5b3dde37dc5a28d85fa496
Opcode Fuzzy Hash: aa5df59e3db27be04e7042a60d6bcf607e2e13dd95b46efa6f8df3d7c81810bc
Instruction Fuzzy Hash: 0F01A4B63003208F9744EB69E498D2EB7ABEBC9765310857EEA06D7310DE35DC418BA0

Function 027732E0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d2c51662470f12d45652d38cb73311d2f7adc378ff6c3ce40cd3f7f2ec5c28
Instruction ID: dd88f987ab60425acacd12a5a4d3372d8fe914cebcb40b22aa076bc8df4e13ef
Opcode Fuzzy Hash: 49d2c51662470f12d45652d38cb73311d2f7adc378ff6c3ce40cd3f7f2ec5c28
Instruction Fuzzy Hash: 61114F38A143408FCB45AF78E458B9D3FB6EB8A311F0445A9D552A7292DB380C55CB11

Function 027732F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1e4e26fca8f4b9d1fe1142ee089b8239f73cdddc8a652d1d01f4b15c5edbb8d
Instruction ID: a7b11b0cf4d2e3e82e1679ff7898907525d28172b67ec1ea07a3a3e51203fcc0
Opcode Fuzzy Hash: e1e4e26fca8f4b9d1fe1142ee089b8239f73cdddc8a652d1d01f4b15c5edbb8d
Instruction Fuzzy Hash: 90012938A003048BCF44EBB4E458B9E7BBAEBC9301F408469D912A7380EF3D5C54CB61

Function 02772A90 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98cf4ba6f5cdb1cb618981c9e8d5ccadf1808cb3f4f85b138c43538136fe1d23
Instruction ID: 093aa9a173fbcc9a7e21126d4e4bae455bfd75f411dd1cae76b5058e3479a07f
Opcode Fuzzy Hash: 98cf4ba6f5cdb1cb618981c9e8d5ccadf1808cb3f4f85b138c43538136fe1d23
Instruction Fuzzy Hash: F0F042726406008FC720EB28C51984BBBE2EB8561475189A9E15ADF325EF31EC088FE0

Function 027741D0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11df9b74dcd35cbbe287edba56bc3818065c1d6c586768a842661fb46b4bae73
Instruction ID: 7f9a589205bf37723b7ad0e3b031b8bbf8691209ba1c40fb24fd40c2cb2e928b
Opcode Fuzzy Hash: 11df9b74dcd35cbbe287edba56bc3818065c1d6c586768a842661fb46b4bae73
Instruction Fuzzy Hash: C2F059B6A042005FD328E7A4B8A02AE3B9BEBC9361B5804ADD406E73A1CF305C058765

Function 027741E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d59b859f1ac7fea57fccd4ab29922de4f6dfac67bb1778d7e8c27c6f6aa25e15
Instruction ID: 0c3f7317c778ea891ab29cb27beec2f25b6408a7e626bd7e6e182260ba01277e
Opcode Fuzzy Hash: d59b859f1ac7fea57fccd4ab29922de4f6dfac67bb1778d7e8c27c6f6aa25e15
Instruction Fuzzy Hash: 44E0E5717042046BA758A2A67C6596F669FEBC92607540469E50AE7300CE216C0047A8

Function 02774237 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feadc65e35d54002d59a6e27116bf7d3de54cce1a25b18b79c6706b6047b87d8
Instruction ID: c5eb36cc2d70be9232a6f268ab803655f370de72e9f9bb991481100fd947c5ff
Opcode Fuzzy Hash: feadc65e35d54002d59a6e27116bf7d3de54cce1a25b18b79c6706b6047b87d8
Instruction Fuzzy Hash: BBF027762086404FC72DA738E85026E3B53EFC5361F4A06ADD8818B696CF305D5686D5

Function 02776388 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc635e92e3de81f98299f5bbdd7dbdee8403e3c392f98ea090c1e99e40baa57f
Instruction ID: ce359b0b67c0dae5209515f78a4b4857f1b479332f4c4d15726d040c42b5180e
Opcode Fuzzy Hash: cc635e92e3de81f98299f5bbdd7dbdee8403e3c392f98ea090c1e99e40baa57f
Instruction Fuzzy Hash: 36F04674A043849FDB04EB78E44049D7FB2DF83314B1182D8D486AB1E3CE306D42DB42

Function 02775610 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff643a87195f9acf61cd720b5a07a557df042fa8d9a9e74b957ac0dd284e771
Instruction ID: 6cea3f3f808ea92ced342554e32c2ca7dfdb1c2a13d9c2f23d4b0537303059cd
Opcode Fuzzy Hash: dff643a87195f9acf61cd720b5a07a557df042fa8d9a9e74b957ac0dd284e771
Instruction Fuzzy Hash: D3E0DFA26493824FE7030B38AC916903F30EB63314B4A41EAD881CA257E62A885B8211

Function 02776398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5392802f2cd507a22b0484a66d8ffa8fb4b3c73d69b08df03aebac1d649f8de5
Instruction ID: b1a1aaf4b1adb81caaf49fbe1f2510bb461df06aa440a0fcb6e38706ac0a67b7
Opcode Fuzzy Hash: 5392802f2cd507a22b0484a66d8ffa8fb4b3c73d69b08df03aebac1d649f8de5
Instruction Fuzzy Hash: 9EF08274E00308EFCB44EFB8E45559D7BB6DF84300F1081A8980AF7250DA306E45DB45

Function 02772D93 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23d1cc86d1f194b74c222d7180382ae595e9fabc45db21c68cd27e936b292e1f
Instruction ID: 29cd59f1e9aba6f82fe9676c696676bdee91004c626bff143cdf228b13a2c564
Opcode Fuzzy Hash: 23d1cc86d1f194b74c222d7180382ae595e9fabc45db21c68cd27e936b292e1f
Instruction Fuzzy Hash: 17F0A0B1F54029CFDB65EB6CC8514CD7BB2EB4836432141A5D126E72A2EF318D038B85

Function 02772DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523a449b6d7b9e29bc658fa1cc242d2762ea845c887e8b37f7d48f56321de8bd
Instruction ID: 7e3729515bbb03a0a3c1afcd2f576fbcec21420153a68618720178bdfc937fcb
Opcode Fuzzy Hash: 523a449b6d7b9e29bc658fa1cc242d2762ea845c887e8b37f7d48f56321de8bd
Instruction Fuzzy Hash: 7CE0C271E101188F8B94EFADD5056DEBBF5EB48314B2140AADA19E7311EB709E118BA1

Function 02771FF8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39aae4568be676f710e50d9825f04f03b385b29ed88e4ca961d7101c029257df
Instruction ID: 523597a4c2ee0f68c7982e613505750586c43be7d55b045dbfbe80c8f796570d
Opcode Fuzzy Hash: 39aae4568be676f710e50d9825f04f03b385b29ed88e4ca961d7101c029257df
Instruction Fuzzy Hash: FAE012797002508FC7165778E4586987BA6DF9A22671604E9D149CB3B2DE348C05C721

Function 02772008 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01a8e77e5ddbafa37b4ef3a19cb1dad950063d07b5216fbbe46d9f8e59b4b0c
Instruction ID: b1dd88b5dd5d004c8d86cfe77d255848f708fc86adc8ad73a55efc3d9af49084
Opcode Fuzzy Hash: f01a8e77e5ddbafa37b4ef3a19cb1dad950063d07b5216fbbe46d9f8e59b4b0c
Instruction Fuzzy Hash: 25D017797002148FCB18AABEE41C95E7BEEEFC962230104AAE50AC7361DE75DC4187A0

Function 027766C8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07382540263f70ac77705ead28af85900ce26b6d3826ada8f8881a0b88ff5e93
Instruction ID: 1414809b05866492cd6e832e0ae2687acccea544455d3e4a95d34729e6278622
Opcode Fuzzy Hash: 07382540263f70ac77705ead28af85900ce26b6d3826ada8f8881a0b88ff5e93
Instruction Fuzzy Hash: 6DE0C221B082A04BD312232CB4006B87B868B8B261B4A02EBE141D73A7CF244C068385

Function 02776469 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce6f139d6ebe76441222f67289c8af9a0751acad4279396553318fa2c8e736ff
Instruction ID: 46de054a498b1c761a1485b89f115bc8ab58c71646cc68c1dad110275b1dedef
Opcode Fuzzy Hash: ce6f139d6ebe76441222f67289c8af9a0751acad4279396553318fa2c8e736ff
Instruction Fuzzy Hash: FED017B92592508FD308AB28E1908683B72AB8A32870106D5E998CB6B7DE24D856C719

Function 02776478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec64b29af257f4d6ea0aaaa9727e02c5870cae6526dab7f07ff77cb5673906ae
Instruction ID: 24a115815c78b3e195ad2d3fd82af82c0b8dff16c6f597a01ab8e0ff915f919b
Opcode Fuzzy Hash: ec64b29af257f4d6ea0aaaa9727e02c5870cae6526dab7f07ff77cb5673906ae
Instruction Fuzzy Hash: 20C012B43402048FC208EB6CE080C2933FAABCC71431045A8E949CB379DE20FC828A68

Function 02775640 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3669026602.0000000002770000.00000040.00000800.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2770000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ddcb5ce141b3311969f77685f38141883dc7e5fd9f84504a2e80095c172a666
Instruction ID: 3520e881290157883fb03f29f882d90ecc9ccce18e1920a780de1b5312d96765
Opcode Fuzzy Hash: 1ddcb5ce141b3311969f77685f38141883dc7e5fd9f84504a2e80095c172a666
Instruction Fuzzy Hash: D6B02B34210309578A000616AC085113F1DEB805183400294BC0840100AE23D8500080

Analysis Process: GamePall.exePID: 2568, Parent PID: 3664COMMON

Executed Functions

Function 03164F58 Relevance: 11.9, Strings: 9, Instructions: 607COMMON

Download Yara Rule

Strings

(wq, xrefs: 03165056
(wq, xrefs: 0316589B
(wq, xrefs: 031655A3
(wq, xrefs: 03165655
(wq, xrefs: 0316586F
(wq, xrefs: 03165082
(wq, xrefs: 031655CF
(wq, xrefs: 031651CD
(wq, xrefs: 031651F9

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq$(wq$(wq$(wq$(wq$(wq$(wq
API String ID: 0-1215394046
Opcode ID: 0ba9eff87eb83cd375f1a395a0237f12d5fa061f687b82ce5ce4b0dbd048eb2d
Instruction ID: 23ec6d310b0a31055f07f20335fd2400af7dd5941ca47618407649669fe5ff82
Opcode Fuzzy Hash: 0ba9eff87eb83cd375f1a395a0237f12d5fa061f687b82ce5ce4b0dbd048eb2d
Instruction Fuzzy Hash: C3326B74B042149FCB48DBA9D4946AEBBF7AF89300F158069E806EB395DF349C46CB91

Function 03163860 Relevance: 4.4, Strings: 3, Instructions: 653COMMON

Download Yara Rule

Strings

(wq, xrefs: 03163DE5
(wq, xrefs: 03163BA1
(wq, xrefs: 0316419C

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq
API String ID: 0-3966564304
Opcode ID: c6ed9d2a4b7ce19daa747b1921a4b133c42442cbb3e0881364e8a286293a313a
Instruction ID: 6c1f3ca6211ff729b96e607e156f59534c5689eac2e5b39f1ea526e3790fcce2
Opcode Fuzzy Hash: c6ed9d2a4b7ce19daa747b1921a4b133c42442cbb3e0881364e8a286293a313a
Instruction Fuzzy Hash: F2324274B102149FDB09DBB9D894AAEBBB7EFC8300F148459EA15973A4DF349C42DB90

Function 03161049 Relevance: .8, Instructions: 840COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b729ea23dcacd684df1ea22ba3943e7f83715f6abb87089043e422064cc84df7
Instruction ID: 0e310deabbb641ab9f2cc102cb7f6b67e808883b9d75f0a9302a0a828f12e011
Opcode Fuzzy Hash: b729ea23dcacd684df1ea22ba3943e7f83715f6abb87089043e422064cc84df7
Instruction Fuzzy Hash: AB823FB8A10209DBDB06DBF5D598B6E7B72EB88300F109014EA4123794CF396DD5EB76

Function 031635F0 Relevance: 3.9, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

(wq, xrefs: 031637B2
(wq, xrefs: 03163786
(wq, xrefs: 031636B6

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq
API String ID: 0-3966564304
Opcode ID: 2dd261fe077a208cc7802e1efee35c9b1f0e7199ff0b1faa99018dabae26be72
Instruction ID: a6fe954215351815fd6fa364c92ff9ba8df08bb45c790b26f2441379a6b1adae
Opcode Fuzzy Hash: 2dd261fe077a208cc7802e1efee35c9b1f0e7199ff0b1faa99018dabae26be72
Instruction Fuzzy Hash: C64114317081001BD75CB77A989063F66EBEBD9254B688868E906CB394DF349D0B87E9

Function 0316BEAF Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Tesq, xrefs: 0316BF75

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: c0086a38dad9cc53c40e01259e49c07320e4517ef8b887fcc858cd169a8d8e84
Instruction ID: cf338bc968dae31c990e169671b76f7058a195d282b28b32762a7bf556b4667a
Opcode Fuzzy Hash: c0086a38dad9cc53c40e01259e49c07320e4517ef8b887fcc858cd169a8d8e84
Instruction Fuzzy Hash: 95414E747105008FC754DF7EC898A6EBBE6BFC9710B6580A9E506DB3B1CA71DC028B90

Function 0316BEC0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Tesq, xrefs: 0316BF75

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: b1b12338ddacd0ef16ac9fb7e512279eeb4e49583a32d9efd5880c6403186864
Instruction ID: 1acc276d6dbbc2864dcdd2d0d232f53ee2a1790c4c3fd230008dcd88273de215
Opcode Fuzzy Hash: b1b12338ddacd0ef16ac9fb7e512279eeb4e49583a32d9efd5880c6403186864
Instruction Fuzzy Hash: CD313C747105008FC744DF7EC498A2EBBE6BFC9710B6580A9E506DB3B1CA71EC018B90

Function 03162B10 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

LRsq, xrefs: 03162B35

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID: LRsq
API String ID: 0-3165563352
Opcode ID: 10908274009f3592899b24a8f235a514a727a5ef2846c30c2784bcec4542b6c0
Instruction ID: 0c51313332784d703c03a5097b5c0d26ee491d1329ebf5a2b51337e8aef31852
Opcode Fuzzy Hash: 10908274009f3592899b24a8f235a514a727a5ef2846c30c2784bcec4542b6c0
Instruction Fuzzy Hash: 82316C707402058FC709DB39C559A6E37B2EBC9A04F218079D10ACB3B8DE36DC478B84

Function 03162B20 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

LRsq, xrefs: 03162B35

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID: LRsq
API String ID: 0-3165563352
Opcode ID: ce52cfeaee07caaa47b78af01c940194ed066253264f0c52893938ff17f1d3f3
Instruction ID: 5eda41e086b9745f7ec19687f059753c1e355ebebb0143a2ada17e320264a2b5
Opcode Fuzzy Hash: ce52cfeaee07caaa47b78af01c940194ed066253264f0c52893938ff17f1d3f3
Instruction Fuzzy Hash: 7C310A74740605CFD70ADB3AD59992E37B2EBC9A14F21C169D10A8B3A8DE35DC478B84

Function 03164248 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

(wq, xrefs: 03164295

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID: (wq
API String ID: 0-1062398946
Opcode ID: f1f5c3f46d228725e2ff266a3c369e636265d3e1ecd61a9dd1a640fdc05eaa06
Instruction ID: 204516e9540943fda8198eaa4000991b0fe757f211e1c8f209f1ee117b76e3c8
Opcode Fuzzy Hash: f1f5c3f46d228725e2ff266a3c369e636265d3e1ecd61a9dd1a640fdc05eaa06
Instruction Fuzzy Hash: 1B01973270C1801FC30EA3BE685412E7BA3EFDA211388449FD442CF341CE289D4A87D5

Function 031637F0 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

(wq, xrefs: 03163820

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID: (wq
API String ID: 0-1062398946
Opcode ID: f5e3ab3e1c61d51da93959c9ffbf5e50739fb0d2a6c939abeaea35c76db67a36
Instruction ID: 01cbfc811c5c3ca2098784282af9c760912bc5e2fd591e5a0156765120d3bf7c
Opcode Fuzzy Hash: f5e3ab3e1c61d51da93959c9ffbf5e50739fb0d2a6c939abeaea35c76db67a36
Instruction Fuzzy Hash: F4F09E3270C2505FC709A7BD581013E7AEFDBC9220B08866AEA05C77C0EE254C0B43D1

Function 03161058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d804de6df77d2e902247a1dd15ceca429ea87ff8e133887ee8940927ff652a5
Instruction ID: f8ab473333634e360713538b92306ee16918d88589b3a62844f02cc314d976f7
Opcode Fuzzy Hash: 7d804de6df77d2e902247a1dd15ceca429ea87ff8e133887ee8940927ff652a5
Instruction Fuzzy Hash: 08823FB8A10209DBDB06DBF5D598B6E7B72EB88300F109014EA4123794CF396DD5EB76

Function 0316B0B0 Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9152e482ed26d14d937deb75387cb5277f5c1fdd6e8a83c70cca85aaaf47b57
Instruction ID: fa11217dc294dc49f7daa0428dda8488dca2dab178c4c7ed058b725263d7d2fb
Opcode Fuzzy Hash: f9152e482ed26d14d937deb75387cb5277f5c1fdd6e8a83c70cca85aaaf47b57
Instruction Fuzzy Hash: 6C523834A11204CFC718EF66D5989687BB2FB88301B69C469E816DB3A5DF35EC95CF80

Function 0316BB99 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be80e1081496996fdc6a90f774ba0a7b84ed7ee5272dd6e6fe32957dbfa4ca39
Instruction ID: ba2b06f43b4a13d05a7de6e7fb70dc8a5df32f7022cadb00d52d4f41cbb55bee
Opcode Fuzzy Hash: be80e1081496996fdc6a90f774ba0a7b84ed7ee5272dd6e6fe32957dbfa4ca39
Instruction Fuzzy Hash: B3813B74A02209CFC728DF56E589D197BB6FB48304B59C568D9258B325CB38ECA6DFC0

Function 0316385A Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e8d72fcb58c8d9aae57a7d779cdc9fc782cf847549db68a57425e0714603986
Instruction ID: 9e247963055234919d0524b474d6b20d54281b31303fcde9b966f3ec97f91758
Opcode Fuzzy Hash: 5e8d72fcb58c8d9aae57a7d779cdc9fc782cf847549db68a57425e0714603986
Instruction Fuzzy Hash: 41611978A11218AFCB05DFE5D894AAEBBB6FF8C310F148419E911A73A4DB35AC41DB50

Function 03165AA0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07b8cf61e4e5d86d145a9108347892615a329084adee46ec90460b44037fb9e
Instruction ID: 31b90743435a6cf7309652bb838c1bc8eedb0c53f0eafc94771d880b7eaeb3e0
Opcode Fuzzy Hash: f07b8cf61e4e5d86d145a9108347892615a329084adee46ec90460b44037fb9e
Instruction Fuzzy Hash: 26512A75B002068FCB04DFA9D59496EBBF6FF8D215B1141A9E50ADB361DB30EC45CBA0

Function 03162850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e09276f0049c232977c693138aaf2ba8f0bb71024a939b187591a0c42ea94b
Instruction ID: eae9c1bbfb2bf24b370285b1198943203537b24b38a863ebc6d62cc46e5ed1d1
Opcode Fuzzy Hash: 44e09276f0049c232977c693138aaf2ba8f0bb71024a939b187591a0c42ea94b
Instruction Fuzzy Hash: 1C41E974A10208DFCB18DFA5D8859EDBBB6FF89304F149529E901A7394DF349886DF60

Function 03165A91 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea91ef2c6341f20466779811396fe494eb53afebd1569707e533aeec9a81690
Instruction ID: ec9b49f2fa4350828f12938ff17b846d1012e7f8327926ff1495e1eca14610c1
Opcode Fuzzy Hash: 8ea91ef2c6341f20466779811396fe494eb53afebd1569707e533aeec9a81690
Instruction Fuzzy Hash: 14313B75B005068FC704DFA9D994A6ABBFAFF8D214B514169E509DB321DB30EC45CB60

Function 0316B0A0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3f498286e9429d1b5d3d13c1b5a7e90e02f9cc1cf7311fc2becf58c0ee8251e
Instruction ID: 4653d3ad9178bce8c63c0766b03840d66e4d7b1f210b7b1f68b03d4bb47c6ab8
Opcode Fuzzy Hash: f3f498286e9429d1b5d3d13c1b5a7e90e02f9cc1cf7311fc2becf58c0ee8251e
Instruction Fuzzy Hash: 123148716042188FC708DBBAE88529DBBE6FF85310F04852DD016DB3A1DF746D458B90

Function 03162842 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67801d3f2a3e262ff7fecf0caf61bb19e76c208ab17c5e592b6163107a8427a
Instruction ID: ba4323c7b5a885869fb6236fe57e282774528c96d21466c11057a2562b5cb6cd
Opcode Fuzzy Hash: e67801d3f2a3e262ff7fecf0caf61bb19e76c208ab17c5e592b6163107a8427a
Instruction Fuzzy Hash: 90315A709102089FCB08DFE5D8856EEBBB6FFC8304F149929E901A7290EF749885DF60

Function 03165308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a52e5d5ecc3b467ece45fec7548cd1736b46d9f9278245f78a3a9317a2799bb7
Instruction ID: 8a3500bdd626cb593ceb72e3870fde754ba217d4c7dc1c4c9a263e2fbb17751b
Opcode Fuzzy Hash: a52e5d5ecc3b467ece45fec7548cd1736b46d9f9278245f78a3a9317a2799bb7
Instruction Fuzzy Hash: 1C41FA74A102149FCB08DFA5E4949ADBBB3FF8D311F248465E906A7364DB349D92CF90

Function 03162C48 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30251db9edb5f1a52ad327d6e77b54f651e7a4ad58063dcde91d0d0808b37d68
Instruction ID: 7a2ae61dbdc9fdc77cf7f8079eaeb95fd8a277a80136813545f87c5585d82ce2
Opcode Fuzzy Hash: 30251db9edb5f1a52ad327d6e77b54f651e7a4ad58063dcde91d0d0808b37d68
Instruction Fuzzy Hash: 8641F8B49102098FCB04DFA5D885AEEBBB2FF88314F104569E911B7390DB346E85DF91

Function 03162C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249ef0064c0c284ff228c5d50ddd801924f04e67a1336c6772743b9b40367338
Instruction ID: 435920fc1af1f312127e4d1167caf7889f252bc089897b5d2649feee45c30140
Opcode Fuzzy Hash: 249ef0064c0c284ff228c5d50ddd801924f04e67a1336c6772743b9b40367338
Instruction Fuzzy Hash: 6E31E5B491020ACFCB04DFA9D885AEEBBB2FF88314F104569E511A7390EB346D85DF91

Function 0316288D Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44bbe0e042a1b26ff9856dcffac9c6940be300f422b8b9d330e5242b0efbed08
Instruction ID: 89dfa66653e92ed960fb2d649fb9a62cccf915269395aa01c28015a2f997d216
Opcode Fuzzy Hash: 44bbe0e042a1b26ff9856dcffac9c6940be300f422b8b9d330e5242b0efbed08
Instruction Fuzzy Hash: 8A31E874A102199FCB18DFE5E8856ADBBB2FFC8304F14992AD802A7294DF745885DF60

Function 03164B70 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a62c28e520571b187de9de72e7bfac15ec12d6e0115feddb5d72e7b0b34d12a
Instruction ID: 409fde1ee2e51a31851ad928d93ced00b2529ad138ac10d48bd6ec25b1af8223
Opcode Fuzzy Hash: 0a62c28e520571b187de9de72e7bfac15ec12d6e0115feddb5d72e7b0b34d12a
Instruction Fuzzy Hash: CD2106312042016FC709EB79ECC0A5EB7A6FBC0205B448E28E0068B655DF70BD898BE8

Function 03164B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802f989c49f330d22e9102f0071ed918de72f105a57ccd3a2073415c3f97478a
Instruction ID: 2ca1987b241f97f5b501c580eee0e221953d6c0f8ad17c35b62c152bfb4a5163
Opcode Fuzzy Hash: 802f989c49f330d22e9102f0071ed918de72f105a57ccd3a2073415c3f97478a
Instruction Fuzzy Hash: F021A5702042026BC709EB7DE8C0A5EB7A6FFC4215B448E28E4068F654DF70BD899BE5

Function 03162908 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8088f95ef814ec43275370b1daf4a59c8728067baf19e3f2ecdaf5a44a4273
Instruction ID: 161d6e0ebbd6fb2270098174bdfe2f8b7a607e4c5be2af23e9dae881306324ee
Opcode Fuzzy Hash: 5f8088f95ef814ec43275370b1daf4a59c8728067baf19e3f2ecdaf5a44a4273
Instruction Fuzzy Hash: BB2124B4E101199FCB18DFE9D8809EDBBB2FFC8300F04852AD811A7294DB305886DF60

Function 03165C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f0911d9d114773f0e0791392ee9c6119120790203e3609402737c0437a3fe2c
Instruction ID: 8a5835dce6ebda05054d2bb8d97713caf5569150461d25ccdde639dca6a69cab
Opcode Fuzzy Hash: 6f0911d9d114773f0e0791392ee9c6119120790203e3609402737c0437a3fe2c
Instruction Fuzzy Hash: 13214A75A002188FDF14CBA9C588BDDBBF6AF4C310F2400A5E505BB361DB75AD84CBA0

Function 03166888 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59f51bb0f4efa8b366067334de0c490478cebf8ce74bb4b78eb5d2c1f16af46a
Instruction ID: e75eed52960c8e6973f3ae0e0a5ef5d829abec1e450d27d6d1cb7051d8f3bd29
Opcode Fuzzy Hash: 59f51bb0f4efa8b366067334de0c490478cebf8ce74bb4b78eb5d2c1f16af46a
Instruction Fuzzy Hash: 7921AC71900209CFDB14DFA4CA48BEEFBF5EF88304F54806AD805AB252CB759A65CB51

Function 0316296A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f868eab53f36c01271257d80f0ab254c7e90cb84fac11d6210432bbd795a33
Instruction ID: c696b41cfa0f13db0660716998aee63a53f7378db0869c5d45ba4166242f6d0f
Opcode Fuzzy Hash: 41f868eab53f36c01271257d80f0ab254c7e90cb84fac11d6210432bbd795a33
Instruction Fuzzy Hash: 5621E974910218DFCF14DFA9D8809ADBBB2FF88304F10551AE905AB390DB345D95DF51

Function 03165C5A Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2dae5267a0b6b828664643898fec95e683169746a00146d418941cb1b6f25f
Instruction ID: b37f8dd68ecec1698aea916325743c13a50de3b6ebbede2b1133f1d62ed44c1f
Opcode Fuzzy Hash: 6a2dae5267a0b6b828664643898fec95e683169746a00146d418941cb1b6f25f
Instruction Fuzzy Hash: 97113A75E002188FDB14CBA9C998BDDBBF6AF4C310F650495D401BB3A1DB759D84CBA0

Function 031641A2 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c9b03ca471068114b2ca7554e0c9ec34178813dc0d6372d7b7618e07c6ae30
Instruction ID: 4b15dca36d86c2e1677d769bce2cb420d95fcaf9275113270a1dced9444625e3
Opcode Fuzzy Hash: 11c9b03ca471068114b2ca7554e0c9ec34178813dc0d6372d7b7618e07c6ae30
Instruction Fuzzy Hash: 8B01F73130C2802FC74A63795CB55AF7FFAEBC6115794489AE406DB381CE255D0A87A9

Function 03165911 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9b6f550741717a681bcdbd46b0dfd259c4863deb105f216c8a6849040677cd6
Instruction ID: 88753796d823eb2b32f6512eda0308d804ae8c99a2cbddcb0afc4b758467901f
Opcode Fuzzy Hash: a9b6f550741717a681bcdbd46b0dfd259c4863deb105f216c8a6849040677cd6
Instruction Fuzzy Hash: 3B014E733112105FC3049B2AD894A9A7FF9EFDA355719447FE544C7341CA30DC418BA0

Function 031632E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e442a3e862ff14aa7a947bbe03b5c38dc9544fa1621dd209dfda0d653b9f13e
Instruction ID: 194ab082fc7911908caf6c8b325464b31bcff1f6e6447f102936a3f4b7fca686
Opcode Fuzzy Hash: 0e442a3e862ff14aa7a947bbe03b5c38dc9544fa1621dd209dfda0d653b9f13e
Instruction Fuzzy Hash: 3A118E39A202448BCB04DBB5E85A7AE7FB6EBCC319F00446AE90297341DF346809EF50

Function 03165940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcc0979c21b46600cd6bf9f94d0b89b2a5cfc1ff3a87926dce65194d8d5c5281
Instruction ID: bc43c530a55a3d76842f2ad2c82ef7584e64ebe842ee6e69b7c3663d42469a82
Opcode Fuzzy Hash: bcc0979c21b46600cd6bf9f94d0b89b2a5cfc1ff3a87926dce65194d8d5c5281
Instruction Fuzzy Hash: F301A9763101108F8704DB6EE49485EB7FAFBC9665314857BE606C7340CE31DC058BE0

Function 03162A80 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767b8df33a120f81f73e26819069c1e372fb3f4269b68001b27740d4237c4d9b
Instruction ID: 31e1b8d04d905cde531cd6265efce2dfd2d33f6042627386d0bca86dea55001e
Opcode Fuzzy Hash: 767b8df33a120f81f73e26819069c1e372fb3f4269b68001b27740d4237c4d9b
Instruction Fuzzy Hash: 390178712106048FC310EB68C949A9BBBE6FB88618B54C969E54ADF724DF71EC048BD0

Function 031632F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7bfabc8223adf16a36bac3a8eae7bf7d643e082d16ad974b5f081843390f2e2
Instruction ID: e8273a7a3bdad4bc6606cffe56c2d6f7647e06c79289115ece7943c141134d41
Opcode Fuzzy Hash: c7bfabc8223adf16a36bac3a8eae7bf7d643e082d16ad974b5f081843390f2e2
Instruction Fuzzy Hash: A401403CA202448BCB04DFB5E45A7AE7FB2ABCC319F004469E90697341DF755849EF50

Function 03162A90 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72979cdc0453548481b9a2a223d97978a4f35370cedfa8a154b2faaa6ca0bc35
Instruction ID: b4c58ca03a53978cb67455720ac4866c9d00cb8a22cd7820c457ba9589fd1f03
Opcode Fuzzy Hash: 72979cdc0453548481b9a2a223d97978a4f35370cedfa8a154b2faaa6ca0bc35
Instruction Fuzzy Hash: 4FF064716006048FC310EB79C54885ABBE2FF89628750CDA9E54ADF324EF71EC048BD0

Function 03164237 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65b2edf9c524ffb486e3e65d53945e963956404058638a877dfababdb587b1c9
Instruction ID: dad3e118b4bc487f4d28ddd67fc7053beb0f8ef031e60c5888ff04c987be360e
Opcode Fuzzy Hash: 65b2edf9c524ffb486e3e65d53945e963956404058638a877dfababdb587b1c9
Instruction Fuzzy Hash: 0EF0E53620410427D61CA66AEC86BBF775BEBC4611F88452DFC028B644CE70BD495AE9

Function 03166388 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae65c8c04224003e9d28cfae41fd342bdeb4bf4d3f7dda30875bb3dc6fa2760
Instruction ID: a4865dfccd4835bd7b8f3450eab13810f73489027b4a9d31694727d2477d6842
Opcode Fuzzy Hash: 5ae65c8c04224003e9d28cfae41fd342bdeb4bf4d3f7dda30875bb3dc6fa2760
Instruction Fuzzy Hash: 1AF0B4B4D0020DBFCF40EBB8D98169DBBF1EB94205F5085989809EB340DE305E45AB91

Function 03166398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c72fc9decc8aa6148e92ea93a24e7af9e8cdb4c5f2d012fe49a3ae8258e437fc
Instruction ID: b53596491429000342d8e2b76566c397811294927e6e42c9b76f5ac13018cffd
Opcode Fuzzy Hash: c72fc9decc8aa6148e92ea93a24e7af9e8cdb4c5f2d012fe49a3ae8258e437fc
Instruction Fuzzy Hash: 6EF08C74A00209AFCB04EFB8D98055DBBF1EB88205F5085A8A809A7340DF301E54AB85

Function 03162D92 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e598ad86a82376d1b12dd1f937ecbe074669813a6f2c911e930948b01357e45
Instruction ID: 33567a11457f614d688f56845144eb1c6c757c47d336ee6f570c911b709e0e7e
Opcode Fuzzy Hash: 8e598ad86a82376d1b12dd1f937ecbe074669813a6f2c911e930948b01357e45
Instruction Fuzzy Hash: F5F08C35E200188FCB84EFBCC8056EE7BF4FB4D214B1180AAD919E3300DB308A018F92

Function 03161FF8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2af53ced5b351ef91344f77a6f5b2ea4220fc5f4e2b9353cbd863cd6ea8891c
Instruction ID: 620ddc1d7ea5caf4d92ae1f7425d8c9b84e0572d1cb5231ee088ade79578c196
Opcode Fuzzy Hash: f2af53ced5b351ef91344f77a6f5b2ea4220fc5f4e2b9353cbd863cd6ea8891c
Instruction Fuzzy Hash: A2E026363101045FCB041679D80DE9B7BEDEBC8216B000466F405C7320CD30ED099BA0

Function 03162DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc0ffb2b65cc5b1e562ec4393d0184f38aa5259cc3bfc45ac450a4fe37a1a1fd
Instruction ID: 36d670e1866dc95de859a8a8b751ea99f50b5590b68410634eba28b67ab23745
Opcode Fuzzy Hash: fc0ffb2b65cc5b1e562ec4393d0184f38aa5259cc3bfc45ac450a4fe37a1a1fd
Instruction Fuzzy Hash: 92E06D71E101188FCB84EFBCC4046DE7BF4FF48214B2140AAD509E3300EB309E018B91

Function 031637EE Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87261262d53feced12ac0afbb441ed38a54c51d5292f75fdb351071d4b2a0dd3
Instruction ID: bfb952ea31ed2178742e3d5b81b21ad6c3a1a23eef83f134b5635a85dad80c37
Opcode Fuzzy Hash: 87261262d53feced12ac0afbb441ed38a54c51d5292f75fdb351071d4b2a0dd3
Instruction Fuzzy Hash: AFD02BB771010057CB1485D9A841AF7339FDBC8221B084526FA04C3250FE618C0113D0

Function 03162008 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9a75097ef0f58085f18c852cd41d3fb43dc2cfb80c376cd27a7ae9fc845491
Instruction ID: 75d47950bfc66cc3b0d6519c9c8037255a2a1aa2a5427d90adad5495ee09d540
Opcode Fuzzy Hash: ab9a75097ef0f58085f18c852cd41d3fb43dc2cfb80c376cd27a7ae9fc845491
Instruction Fuzzy Hash: 67D012357102144FCB145ABDD41D85A7BE9DFC96263010466F50AC7320DE71DC058BA0

Function 031666C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2b60d66765a7df88985bfb5854d43189e369e64822a2087e567c16dcbd12cb
Instruction ID: 0a78f71791ae3da36a654128197d4ad5ceb6d29f6c69a83596f8b6de2777ee36
Opcode Fuzzy Hash: 2f2b60d66765a7df88985bfb5854d43189e369e64822a2087e567c16dcbd12cb
Instruction Fuzzy Hash: E6D0223231002003C600221CB8A23DD82EEFBC862AB8A083BF102EF304CE248C02A783

Function 03166469 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8f3765b3535f9703a39eb75d6d9d3142ca0a1a5923763f37bac07ea4cc9c15
Instruction ID: d8a5058e9f4ca9eb786de9a77926f9b02575e24314ac4e0092fbbe45b9278ce4
Opcode Fuzzy Hash: 4a8f3765b3535f9703a39eb75d6d9d3142ca0a1a5923763f37bac07ea4cc9c15
Instruction Fuzzy Hash: F0D052793082044FC308AB2CD8A1A5637F6FB8861874108A5E948CB3A2CD24EC828A59

Function 03166478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9655744516fc1cf7473373ac7d5cc4bb99aaf662faa4e5bd369d8cca660839a6
Instruction ID: e964838a93e5f3b5346ae5958128f0fc43c6151d839b1d1943e2d3256eccb126
Opcode Fuzzy Hash: 9655744516fc1cf7473373ac7d5cc4bb99aaf662faa4e5bd369d8cca660839a6
Instruction Fuzzy Hash: 14C012743402048FC208EB6CE08082533EAFBCC71431008A8E909CB3B6CE20FC828A98

Function 03165640 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3669861359.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ac802e41216a76d51e883aec9aa191eb4ee9d13777b15e7c794780fe8e0edd
Instruction ID: 9bcfd515963e991f368fc28a1b0322dc008067857d97724060422f99359d93a0
Opcode Fuzzy Hash: c2ac802e41216a76d51e883aec9aa191eb4ee9d13777b15e7c794780fe8e0edd
Instruction Fuzzy Hash: 62B02B3815020957C6110555EC0D4217B1FEB4101C3040195BC0C00100EE23D4244480

Analysis Process: GamePall.exePID: 6292, Parent PID: 3664COMMON

Executed Functions

Function 00AF4F58 Relevance: 11.9, Strings: 9, Instructions: 609COMMON

Download Yara Rule

Strings

(wq, xrefs: 00AF51F9
(wq, xrefs: 00AF589B
(wq, xrefs: 00AF5056
(wq, xrefs: 00AF586F
(wq, xrefs: 00AF5082
(wq, xrefs: 00AF51CD
(wq, xrefs: 00AF55A3
(wq, xrefs: 00AF55CF
(wq, xrefs: 00AF5655

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq$(wq$(wq$(wq$(wq$(wq$(wq
API String ID: 0-1215394046
Opcode ID: 8a507817b409ec5f32920623ba70aadf9b8a6f34b0eea21402985eabbe7533ed
Instruction ID: ec5e5ed2d9339b85f3dfa10d96cfe93f30400c7f26ca1e7e81fd394dc21a9fe0
Opcode Fuzzy Hash: 8a507817b409ec5f32920623ba70aadf9b8a6f34b0eea21402985eabbe7533ed
Instruction Fuzzy Hash: C4327F34E045188FDB18DFB9D4946AEBBF2AF89300F248169EA05EB351DF349D46CB91

Function 00AF3BE0 Relevance: 3.0, Strings: 2, Instructions: 465COMMON

Download Yara Rule

Strings

(wq, xrefs: 00AF3DE5
(wq, xrefs: 00AF419C

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq
API String ID: 0-707371155
Opcode ID: ede24d57739ce631f198c62ca79932ce483c2590a73e6cfc9b3cc97d3e96e426
Instruction ID: c7842de33626d96925acd8bd2948ed4653bc1d244e9ac6f2829b91858797ca0a
Opcode Fuzzy Hash: ede24d57739ce631f198c62ca79932ce483c2590a73e6cfc9b3cc97d3e96e426
Instruction Fuzzy Hash: B1F16075B002049FDB19EBB8D894A6E7BF7EFC8300B148459EA06AB365DF349D42DB50

Function 00AF3750 Relevance: 2.6, Strings: 2, Instructions: 50COMMON

Download Yara Rule

Strings

(wq, xrefs: 00AF37B2
(wq, xrefs: 00AF3786

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq
API String ID: 0-707371155
Opcode ID: aff122ff9c45816236a6c793d0866897d7bc3850f589c8bc8029fe976b02b403
Instruction ID: 7115962ff02512dc811376f5b08448089395bf84f55b969cab57036be305771c
Opcode Fuzzy Hash: aff122ff9c45816236a6c793d0866897d7bc3850f589c8bc8029fe976b02b403
Instruction Fuzzy Hash: 39017626B0C1580FDB6D7379146013F2FE79FC621036940AEE906DB381DE288E0B83C6

Function 00AF385A Relevance: 1.6, Strings: 1, Instructions: 303COMMON

Download Yara Rule

Strings

(wq, xrefs: 00AF3BA1

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID: (wq
API String ID: 0-1062398946
Opcode ID: 031ea0920549be0018ffbafb13e4f015f151a16d657f55773cb63d8b5656cf50
Instruction ID: 087d9c874b59691c86759be4ee7ab5b5d367898210ae226b47ede378259cd654
Opcode Fuzzy Hash: 031ea0920549be0018ffbafb13e4f015f151a16d657f55773cb63d8b5656cf50
Instruction Fuzzy Hash: B6C13075B102189FDF05DBE8D894AAEBBF6EF88310F104119EA05A7364DF359D41DB90

Function 00AFBEAF Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Tesq, xrefs: 00AFBF75

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: 7eac1955ebac3914f3e428c24feebf637a3619280e1ab58c671714b9617936c0
Instruction ID: 35df745f41ae775c8c9b97389cf5c495b324cd9224568a018fa77ddcc4df3775
Opcode Fuzzy Hash: 7eac1955ebac3914f3e428c24feebf637a3619280e1ab58c671714b9617936c0
Instruction Fuzzy Hash: 73414C747005008FC754DF79C898A6EBBF6BFC9700B6581A9E506DB3B2CA70DD018B90

Function 00AF2B10 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

LRsq, xrefs: 00AF2B35

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID: LRsq
API String ID: 0-3165563352
Opcode ID: 59121501827111b9182d6c89abc383c9e8eecbce32f27b448f21301ead97b8f9
Instruction ID: a808665ec20a0baa442a4d506d703cf181be5299f715e99d5b775af2697811e9
Opcode Fuzzy Hash: 59121501827111b9182d6c89abc383c9e8eecbce32f27b448f21301ead97b8f9
Instruction Fuzzy Hash: 5B311A31700215CFD74AAB39D599A6E37F2EBC9A50B218168D10ACF3A8DE35DC47CB84

Function 00AFBEC0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Tesq, xrefs: 00AFBF75

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: c2763d1b201ec913762d22b4f09b5c13e2a3af717064d5bc869d9793c76dd0de
Instruction ID: a293cbc6dbabb6a76587a5410f9b17c2074014087c88b5c5407cd0214ff1c801
Opcode Fuzzy Hash: c2763d1b201ec913762d22b4f09b5c13e2a3af717064d5bc869d9793c76dd0de
Instruction Fuzzy Hash: 80313D747005048FC758DF7AC498A2EBBF6BFC9710B6581A9E506DB3B2CA71DD018B90

Function 00AF4237 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

(wq, xrefs: 00AF4295

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID: (wq
API String ID: 0-1062398946
Opcode ID: 7ced3e45a5dcab1e5ee404074664c5e5dc195fb984a5316a7a46d866c825f37a
Instruction ID: 593f80448db823f95ef74bd03e20e8e91ea05c005fff78bc1e105b59f5b65c70
Opcode Fuzzy Hash: 7ced3e45a5dcab1e5ee404074664c5e5dc195fb984a5316a7a46d866c825f37a
Instruction Fuzzy Hash: E311442560C1C00FD31A537968A92BE7FA2DFC621074845DFE8C2CF652CE285E0BD795

Function 00AF37EB Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

(wq, xrefs: 00AF3820

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID: (wq
API String ID: 0-1062398946
Opcode ID: 67dd47ef022990c3d5324c1d5c6a042be5bb851848a73894ead1af06496dc7c2
Instruction ID: 0aaab96281ac5cad9495c991943dd852ec88e2400730dd90a0f00feee8e8b5c1
Opcode Fuzzy Hash: 67dd47ef022990c3d5324c1d5c6a042be5bb851848a73894ead1af06496dc7c2
Instruction Fuzzy Hash: 37F02B327081904FD719577D141057E3FE79BC522071847AAE906DB7D1DE258C074351

Function 00AF1049 Relevance: .8, Instructions: 842COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c55144f53cbd5a1b2228ec8bf828d0041ac1b693e3619238e4f9bd51c4417b
Instruction ID: 7a834078fa578eb583facf535217ef09ebb95699bbd0a18767f7cbeb4136224a
Opcode Fuzzy Hash: 88c55144f53cbd5a1b2228ec8bf828d0041ac1b693e3619238e4f9bd51c4417b
Instruction Fuzzy Hash: 9782F0B8A10209DBDB06EBF4D594B6E7BB3EB88300F105414EA4137398CF756D91EB66

Function 00AF1058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f34a6b264f8eddf05a252eed34a6163224198a14f4177b89ac07b001663f4f
Instruction ID: cf1dec535f49f390d5ccdfa7d6c27812106073e1e169c18e438f2ca9690c42ba
Opcode Fuzzy Hash: e1f34a6b264f8eddf05a252eed34a6163224198a14f4177b89ac07b001663f4f
Instruction Fuzzy Hash: 5D82F0B8A10209DBDB06EBF4D594B6E7BB3EB88300F105414EA4137398CF756D91EB66

Function 00AFB0B0 Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf162419fd8c6042874c98ddf329f58348c6b14f8603397dd39b1cf2b92ced0
Instruction ID: 50f24cd1a6ba2470565f42572773b45dd9502a7c2254a76ffb1d92aec1769645
Opcode Fuzzy Hash: 9bf162419fd8c6042874c98ddf329f58348c6b14f8603397dd39b1cf2b92ced0
Instruction Fuzzy Hash: A3524634A11204CFCB29EF74D598A687BF2FB84341B618869E506AF366DF31EC41DB90

Function 00AFBB99 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e0b1f52458a4dab6bebb984bb229456ec9603505280409b24c9ab86f9967c0
Instruction ID: e3273669e28e06a0e06bd28b1d6359ea5640672ef5316835a6bcc183bb203e26
Opcode Fuzzy Hash: 70e0b1f52458a4dab6bebb984bb229456ec9603505280409b24c9ab86f9967c0
Instruction Fuzzy Hash: 2D813A78612209CFC766EF54E9899697BF2FB40341B15C568E545AF32ACB30EC49EF80

Function 00AF5A91 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9829a006d21b29956984eefe8aee108c80a82156d2e147cb95deb2f313d98bc2
Instruction ID: 628a74cdce81ada086597afb954973dc3523120b61f1589c02ce3723051d5041
Opcode Fuzzy Hash: 9829a006d21b29956984eefe8aee108c80a82156d2e147cb95deb2f313d98bc2
Instruction Fuzzy Hash: 56510B75B006058FCB08DFB8D5949BABBF5EF88310B1141A9E606DB365DB30ED05CB60

Function 00AF5240 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 912ee5e15d08e31553eb78b586250383e6b242d591bb22698278cdc6d6876e94
Instruction ID: d71e942a0b323357984fb718da74ff03820b927745935edc87ba68d2e03e352a
Opcode Fuzzy Hash: 912ee5e15d08e31553eb78b586250383e6b242d591bb22698278cdc6d6876e94
Instruction Fuzzy Hash: B0512D30E00619DFCB18DFA9D594AADB7F2BF88311F248165E605AB364DB309C41CB90

Function 00AF2850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 139effe1f540f8f8c8694622875d7f68546a88572692997260454fb510727c4b
Instruction ID: 282ac355f7dd9ac7a6232fa0c300202b3a3f8f767e5d4c597c54b9c3bb376901
Opcode Fuzzy Hash: 139effe1f540f8f8c8694622875d7f68546a88572692997260454fb510727c4b
Instruction Fuzzy Hash: 7841B474E10208DFDB18EFA5D894AAEBBF2FF88340F205929E901AB254DF715945DF50

Function 00AF5308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c109c7b8fda8387cb11e7a888018d52ec901fb7088128c3e3ecb72b757327c3
Instruction ID: c7b5c1be568e6958ce659fef1f8e79f4dab025112529ebeec729af3a9747cd0b
Opcode Fuzzy Hash: 4c109c7b8fda8387cb11e7a888018d52ec901fb7088128c3e3ecb72b757327c3
Instruction Fuzzy Hash: A1410634E005189FCB08EFB4E5949ADBBF2FF88311B208569FA06AB365DB349D41CB50

Function 00AF2842 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 483d1030d2aa9965884e1ebb2f2628371c29232a2b44622210f264ca97f50f5d
Instruction ID: 8d6d20f9e65f9809158c73152696c0b419be61a74dcbb94715058021be6a9898
Opcode Fuzzy Hash: 483d1030d2aa9965884e1ebb2f2628371c29232a2b44622210f264ca97f50f5d
Instruction Fuzzy Hash: 03311774E102089FDB18EFB5D4946EEBBF2FF88340F209929E901AB294EF705945DB50

Function 00AF2C48 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ccf891beee447fd8acd77ba95e4219418a6627fe82d2698a11ccf3e78388646
Instruction ID: de343375715c4fad2c33d108ec260f7298e996fba1403c5042a989617355c2ac
Opcode Fuzzy Hash: 3ccf891beee447fd8acd77ba95e4219418a6627fe82d2698a11ccf3e78388646
Instruction Fuzzy Hash: CC41F678900209CFCB55EFA8D885AEEBBF2FF88310F104969E511BB265EB305945CF91

Function 00AF4B50 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 216a3f0d6e424e260d050caea42f02bb143d7c52986aac0af4a54a3ed0ae953d
Instruction ID: c065a7d10b42e5f9807886a58039e727b1c708a4edcb40867858bc49e7e1245d
Opcode Fuzzy Hash: 216a3f0d6e424e260d050caea42f02bb143d7c52986aac0af4a54a3ed0ae953d
Instruction Fuzzy Hash: 602107302042415FD71EEB78ECD1AAE7BA2EFC1310B048E6AE4468F656DF706D4A8795

Function 00AFB0A0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b22de2a26d803be18c525ce02e16270e0ecc75c39bf169a05344652d49dd538f
Instruction ID: 67040fe7627c0104ff4ab3384fd8fa2e04579662494e004407628342d6f7817c
Opcode Fuzzy Hash: b22de2a26d803be18c525ce02e16270e0ecc75c39bf169a05344652d49dd538f
Instruction Fuzzy Hash: 7131D470A102189FDB18EB78D8946EDB7F2EF85300F148A2DE116AB391DF70AD05CB91

Function 00AF2C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 797e8b1598956aca619628249bc67e6cc473e6f22e2bfd0c5be5cb53984e712b
Instruction ID: e44b6388da60ee760a62c16f4fdb1bef60b5e6c6a37a6ec66cada79cd8545fb7
Opcode Fuzzy Hash: 797e8b1598956aca619628249bc67e6cc473e6f22e2bfd0c5be5cb53984e712b
Instruction Fuzzy Hash: 0F31EA74900209DFCB04EFA8D485AAEBBF2FF88310F504929E511BB364EB305941CF91

Function 00AF288D Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c587d106812c29c2bc833cd136c0b22841b5de3d801b9028ad6091d3c187814
Instruction ID: 068380e3ae3f1e0599680d120a52317743ade7bf6fc6c9dc9c939f9418c385ed
Opcode Fuzzy Hash: 2c587d106812c29c2bc833cd136c0b22841b5de3d801b9028ad6091d3c187814
Instruction Fuzzy Hash: F331E674E10218DFDB18EFB5E8946AEBBF2FF88340F209529E901AB254DF705845DB60

Function 00AF4B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 262ee19208534c2e5d8d9e7278d5de665fd67bc9b1aa7d4fb1e45662c133baf4
Instruction ID: 40a88af750b85f31e219e6be157eb2bb23e496de6cbf4f4171ee27aee22ca774
Opcode Fuzzy Hash: 262ee19208534c2e5d8d9e7278d5de665fd67bc9b1aa7d4fb1e45662c133baf4
Instruction Fuzzy Hash: E421A2702002016BD71CEB79E8D1B6EB7E6EFC4310B448E29E4059F655DF70AD898BE5

Function 00AF5C42 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3cee593d6575edd5b41a33b28012bd8c282e0a1b01480df612717b5f7807f47
Instruction ID: a6a6de4aae24fc189b20d0039f1a1aaecd08bb9bb80eabee7c1f3564d37593d0
Opcode Fuzzy Hash: e3cee593d6575edd5b41a33b28012bd8c282e0a1b01480df612717b5f7807f47
Instruction Fuzzy Hash: 8021C130E082988FCF11CBB8C494AEDBFF1AF49310F154099E941BB262CB749D45CB60

Function 00AF2908 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe778148149082813ed3f7780c366b57c4c309afbd707ddf04f0bb69373b0b2f
Instruction ID: d50c0e628c816edae5eb7f7e87565253c9e590a3ce967a6a0a20c0c5306305f2
Opcode Fuzzy Hash: fe778148149082813ed3f7780c366b57c4c309afbd707ddf04f0bb69373b0b2f
Instruction Fuzzy Hash: 96211974E101189FDB18EFE9D890AADBBF2FF88340F10952AE911AB254DF705805DF61

Function 00AF6888 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9fd8348912b67ba2628d4bd8a3d26bc9fafeca423f004caa014212d3ff8aa3
Instruction ID: 6952a8ce3c810c754cd1754460052efb254e17852ef99fa68b0869ce414abae1
Opcode Fuzzy Hash: ee9fd8348912b67ba2628d4bd8a3d26bc9fafeca423f004caa014212d3ff8aa3
Instruction Fuzzy Hash: 3821A271900209CFDB14DFA0CA897BEBBF1FF45300F14806AE505AB252DBB59D05DB61

Function 00AF5C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d81298126735ab5ebead235765b0548d93eae56ac6acf9442734145b3818e1
Instruction ID: fc6c3d26b27e5616f4042c8cadcb1e90555e8f4c85c670919b2580954a942d46
Opcode Fuzzy Hash: e1d81298126735ab5ebead235765b0548d93eae56ac6acf9442734145b3818e1
Instruction Fuzzy Hash: 8821F775E002188FDF14DBA9D598AEDBBF1AF4C314F6000A5E605BB361DB75AD44CBA0

Function 00AF296A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc74ec74c58e9dd71dea98ea2d54ecfe22ceed55cf70bbc3d05caacb42406c71
Instruction ID: beb5f3ab7b499c2fa360ba8c3406eac879d3fc4a7aa26a8611dadd3eeca21fc5
Opcode Fuzzy Hash: bc74ec74c58e9dd71dea98ea2d54ecfe22ceed55cf70bbc3d05caacb42406c71
Instruction Fuzzy Hash: EC21A674901218DFDB18EFA8D490AADBBF2FF88340F20551AE905AB354DB705D45DF51

Function 00AF41A2 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc4655441c76212096008908109adf82423112664d1de99066d784f850225581
Instruction ID: 91044fea2e379c4e3a3904290298cd292d251ab3e1a2f5b29e316d7b3d8c765a
Opcode Fuzzy Hash: cc4655441c76212096008908109adf82423112664d1de99066d784f850225581
Instruction Fuzzy Hash: F301243170D2802FE75E637458B56AF3FA7DBC6210768459BE846DB382CE250D0B83A5

Function 00AF32E0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d072405df595a317c99bb8a8d1afeaec928cc931fff25143d2324e46b77d75a1
Instruction ID: da72bceef6a15e96408ef023103a3765c34b667bf51a7bc0168aa7f76f856412
Opcode Fuzzy Hash: d072405df595a317c99bb8a8d1afeaec928cc931fff25143d2324e46b77d75a1
Instruction Fuzzy Hash: B0115E38E501448FCB4CEBB4E9997EE7BF2EB88301F044929E942A7242DB355816DF50

Function 00AF5940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1daef4525ba482eafb4bedfc15eef1c17b3c07c8d570d7894c237b85c131bfa1
Instruction ID: 079a645ad16412d2141564111e89a3cf93b069ed9081599d3eccef73fae6d90c
Opcode Fuzzy Hash: 1daef4525ba482eafb4bedfc15eef1c17b3c07c8d570d7894c237b85c131bfa1
Instruction Fuzzy Hash: A7013176700620CB8718AB79E494D6EB7E6EBC9661314857BE605D7310DE719C01C7A0

Function 00AF2A80 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54e483d720a0ae2892f0004bc8d2a82427037ab12afea10bbb593a50bee0fb97
Instruction ID: 5c47cd627745ad8c942bb41b7130e8b8508fe7cbeb0ee2d44f7cab9edeb118e7
Opcode Fuzzy Hash: 54e483d720a0ae2892f0004bc8d2a82427037ab12afea10bbb593a50bee0fb97
Instruction Fuzzy Hash: FC0171356146404FC3129B78C4599AB7BE2FF85314724CAAAE186DF326DF71EC058BD1

Function 00AF32F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 781a3d41f9ea15895527c633fc2816867bf28ef761ae92b26bdfb08b359a0cf7
Instruction ID: 8cf5b458a0d4fd46f64bb7d9ae0a4bf36911f11f170ae890fb25f4a23290bff1
Opcode Fuzzy Hash: 781a3d41f9ea15895527c633fc2816867bf28ef761ae92b26bdfb08b359a0cf7
Instruction Fuzzy Hash: 0B014C38E402088BDB0CEFF4E5597AE7BF2AB88305F044829E502A7382DF755814DF50

Function 00AF6388 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4a431d4f55482f08bf3a8cb62ba3f891b185474d64c69e71a3a8ae89b6660dd
Instruction ID: 03be3612d6a6808e76d5f31f08769d990e114a8e54f2b13e5c1eb927da0ff110
Opcode Fuzzy Hash: c4a431d4f55482f08bf3a8cb62ba3f891b185474d64c69e71a3a8ae89b6660dd
Instruction Fuzzy Hash: F3F06274D04288AFCB44EBB899915ADBFF1DF86210F2086E9D849EB252DA311F06DB51

Function 00AF593E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 760e7456b861959f49cb9b663cfa62710690e1815620d990924b9e535eaf1a1c
Instruction ID: 003f1c720ca08554c8670ca77ef8c2f4e636a261d2ea2afef0b1953780dcf56f
Opcode Fuzzy Hash: 760e7456b861959f49cb9b663cfa62710690e1815620d990924b9e535eaf1a1c
Instruction Fuzzy Hash: 05F05E75700210CF8718DB79E4D8DAEBBE6EBC9261324856EEA05D7310DA719C02CBA0

Function 00AF41E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdf510f400cc66ec8a0cb765e94c4181ea08fc98f77f324b149bf4815054d1a4
Instruction ID: ba2ba49f4e54aa3c840220befb2c85708a919df38fff64e806ce47ce11a5d0c7
Opcode Fuzzy Hash: fdf510f400cc66ec8a0cb765e94c4181ea08fc98f77f324b149bf4815054d1a4
Instruction Fuzzy Hash: 73E0E5717041046BA71CA2B6BCA1E6F679EEBC8260754492AF409D7300CF212D0043B8

Function 00AF2D92 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a079728a929d5b144e63db5ecf65ab54e8d06c9bc9b742c6338984a89e49550
Instruction ID: b89d1b1fbc2a02fc1a8d3e78eea3dccd68ab584743f6ac7050865fe031414e50
Opcode Fuzzy Hash: 2a079728a929d5b144e63db5ecf65ab54e8d06c9bc9b742c6338984a89e49550
Instruction Fuzzy Hash: 77F08234E140588FC784DFBCC4096EE7FF0EF49314B2040A5D959E7322DA308A019B91

Function 00AF6398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793a14f32e94f7fb203ed648f0ed6906c962a73c5ee9880ecf743536b8feda26
Instruction ID: 16c98d78a180ba9f1f4ce15849d7b508e4ecc4a6890fcc23e052715cd2566da2
Opcode Fuzzy Hash: 793a14f32e94f7fb203ed648f0ed6906c962a73c5ee9880ecf743536b8feda26
Instruction Fuzzy Hash: 64F08274E00208EFCB44EFB8D85196D7BF1DB84200F6046A9A408E7340DF301F049B41

Function 00AF1FF8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1305ca1c65a99ef73aa4125bcf56bad75bd753c9f7769bd2289facd1a085a53c
Instruction ID: 52e936c9daafbb301c8e656474bda38a5f876f5fc188a61453e34a4c6c64cdf2
Opcode Fuzzy Hash: 1305ca1c65a99ef73aa4125bcf56bad75bd753c9f7769bd2289facd1a085a53c
Instruction Fuzzy Hash: A4E092387952904FC71957B9D8288A93FE5EF8A21130908EAE596CB332C920DC16D751

Function 00AF2DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7de87688d653a4fbef4625937902ccfdfa76089c283beb6ca29ec7362a83628e
Instruction ID: 324f5fb0086f6b3a54d164ed7f8e5a56c2b9931d2d26306f433f7366b4e063f4
Opcode Fuzzy Hash: 7de87688d653a4fbef4625937902ccfdfa76089c283beb6ca29ec7362a83628e
Instruction Fuzzy Hash: 5EE0ED71E101188F8B84EFBCD5056DE7BF5EF49310B2180AAE619E7311EB709E018B91

Function 00AF374E Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ebeb996869a8b769e58f04f1168bfccdd4f9483ad0226caad746cb8a0d4df8
Instruction ID: b8524151864d6f36d5517d7d17723c81702f4483fa58bdc26dc85515bdacb321
Opcode Fuzzy Hash: e6ebeb996869a8b769e58f04f1168bfccdd4f9483ad0226caad746cb8a0d4df8
Instruction Fuzzy Hash: 7AE0C2B7B041141B8B38A3BA64845FF3BA7DBC92613284069EE09C3318EEA08D07D791

Function 00AF66C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1489ca5aa8f72f3120613be1d2873e1bc1985397e7b9c2c245cd883925ef781d
Instruction ID: e27e33d32c7e2118de5fb58f6b01382803db1a54fcb7b0565e414ac9a38746ab
Opcode Fuzzy Hash: 1489ca5aa8f72f3120613be1d2873e1bc1985397e7b9c2c245cd883925ef781d
Instruction Fuzzy Hash: 24D0A7313451905F920A17BC74604D97BD5DECF11031906A7F541C7302CD545C076751

Function 00AF6469 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e8cec0a21fa5c5da9ab5e5af4a194f2f920752ea9cf79776a51562dd78f274
Instruction ID: ac65ce2db1497e87edde5fb422eb99d505bf5b1601b95803357c92da6eb754f1
Opcode Fuzzy Hash: 27e8cec0a21fa5c5da9ab5e5af4a194f2f920752ea9cf79776a51562dd78f274
Instruction Fuzzy Hash: 37E017746482804FC349973894E98A93FB2EB9922072406EAE88ACB366DD259C47CB15

Function 00AF6478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99b9a9ec7655abd195334ab2ded6fb99da5fb95d1a844ad5bf47146a28b3215
Instruction ID: 76b18ea7bb03402dbfb9bf1aa1678d2e5f2618d957aa915c0310c00678f38df1
Opcode Fuzzy Hash: e99b9a9ec7655abd195334ab2ded6fb99da5fb95d1a844ad5bf47146a28b3215
Instruction Fuzzy Hash: 37C012743402048FC208EB6CE48482637EAAB8C71031005A9E90ACB379CE20EC828A58

Function 00AF5640 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3662104487.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_af0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931ea606b0ebbb406089dd115178754139c12cb5c2d9281f4cf44079c9aea305
Instruction ID: 804cb3170577b13f45aa0e18d2b9495b24a552fef7ceb5a68fec5850959bff6e
Opcode Fuzzy Hash: 931ea606b0ebbb406089dd115178754139c12cb5c2d9281f4cf44079c9aea305
Instruction Fuzzy Hash: E7B02B3C98020D5787100B65AC08421371DEB401147440194BE0841100AD23D8200480

Analysis Process: GamePall.exePID: 1876, Parent PID: 3664COMMON

Executed Functions

Function 00E64F58 Relevance: 11.9, Strings: 9, Instructions: 624COMMON

Download Yara Rule

Strings

(wq, xrefs: 00E651CD
(wq, xrefs: 00E655CF
(wq, xrefs: 00E65082
(wq, xrefs: 00E65655
(wq, xrefs: 00E6586F
(wq, xrefs: 00E6589B
(wq, xrefs: 00E655A3
(wq, xrefs: 00E651F9
(wq, xrefs: 00E65056

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq$(wq$(wq$(wq$(wq$(wq$(wq
API String ID: 0-1215394046
Opcode ID: 4c41be9c43984685da6d6528ecb6b909c189e51074f363a1804b302b604bae03
Instruction ID: 9105ab4d3d34032e8e49609e1346aa92d9c2f4a08670cfc28d53468029bc7fbc
Opcode Fuzzy Hash: 4c41be9c43984685da6d6528ecb6b909c189e51074f363a1804b302b604bae03
Instruction Fuzzy Hash: 02329071B446149FDB08EF69D4546AEBBF2EF88340F249069E406EB361DF34AD42CB91

Function 00E63860 Relevance: 4.4, Strings: 3, Instructions: 690COMMON

Download Yara Rule

Strings

(wq, xrefs: 00E63BA1
(wq, xrefs: 00E63DE5
(wq, xrefs: 00E6419C

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq
API String ID: 0-3966564304
Opcode ID: 23ec43c4ea1b2f5e1eeb61436a2fc7101cd511cba03956f3ec493cd2f8b03d67
Instruction ID: 7ed2d4a0a06944d08041a8c88d904256337d137bedf5de314c963b6addced5d4
Opcode Fuzzy Hash: 23ec43c4ea1b2f5e1eeb61436a2fc7101cd511cba03956f3ec493cd2f8b03d67
Instruction Fuzzy Hash: E24273B4B402149FDB05EBB8D894AAE7BF7EF88340F149019E906AB3A5DF349D41DB50

Function 00E61049 Relevance: .8, Instructions: 843COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c9d409d28a93c4c813cf90f84b3261692addfbb9082124e4377f2854f928396
Instruction ID: 876c549435b4dc4ca6d4eee9e26e3d5daf523e87e1e7ce88ade4f497ca44a79c
Opcode Fuzzy Hash: 1c9d409d28a93c4c813cf90f84b3261692addfbb9082124e4377f2854f928396
Instruction Fuzzy Hash: 7182CFF8A14209DBDB06EBF4D594B6E7B73EB88300F105414EA8127798CF356991EB36

Function 00E635F0 Relevance: 5.2, Strings: 4, Instructions: 198COMMON

Download Yara Rule

Strings

(wq, xrefs: 00E63786
(wq, xrefs: 00E63820
(wq, xrefs: 00E637B2
(wq, xrefs: 00E636B6

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq$(wq
API String ID: 0-1261553304
Opcode ID: 46942f78c0c84b7b4497ca360cc537e2b3cc0ad79b4fa7dfeb046fa803668992
Instruction ID: b5e75b2d07a29174fcf23cdec377cde23e47bd9d2245136eddaa377605767cfd
Opcode Fuzzy Hash: 46942f78c0c84b7b4497ca360cc537e2b3cc0ad79b4fa7dfeb046fa803668992
Instruction Fuzzy Hash: 7C5166717081406FE71DBB39686017F2BE7EFC5350368446AE806DB3A5DE24AE0B83E1

Function 00E6BEAF Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Tesq, xrefs: 00E6BF75

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: 35f33f077ea1033042ccb38e0ebacd3bf5df49930d08a460777bbeb88de4dca3
Instruction ID: 26bb2d865b5b1d5d7b5a1c8314b323f208381ff78718a7b2f999e1c6ed86eefa
Opcode Fuzzy Hash: 35f33f077ea1033042ccb38e0ebacd3bf5df49930d08a460777bbeb88de4dca3
Instruction Fuzzy Hash: C3414F747005149FC744EF6EC498A6EBBE6FF89710B6580A9E506DB3B2CE71ED018B90

Function 00E62B10 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

LRsq, xrefs: 00E62B35

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID: LRsq
API String ID: 0-3165563352
Opcode ID: d518062c6e1f451f58259b392b68633fba0a69184251f9c92d407a48e249fc49
Instruction ID: 105fa3cb0f56003aed4d5748b3b293388367bbf0fed9a8b386c35d44b8a13771
Opcode Fuzzy Hash: d518062c6e1f451f58259b392b68633fba0a69184251f9c92d407a48e249fc49
Instruction Fuzzy Hash: 0B312A707442058FD70AAB39D555A6E33A2EFC9A40B218078D50A8F3B8DE359C479B84

Function 00E6BEC0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Tesq, xrefs: 00E6BF75

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: e9142860bbb4aa068d2da6877156780f7034dd308fc8a09ea91b130dba330984
Instruction ID: 578c91ec386fb6e11178439a4090338f3709084f56f36c25523661fd5aaf5624
Opcode Fuzzy Hash: e9142860bbb4aa068d2da6877156780f7034dd308fc8a09ea91b130dba330984
Instruction Fuzzy Hash: 85313B747105008FC744EF6EC498A6EBBE6FF89710B6580A9E506DB3B2CE71ED018B90

Function 00E62B20 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

LRsq, xrefs: 00E62B35

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID: LRsq
API String ID: 0-3165563352
Opcode ID: 836c4ad4f9242088af74d394b8462bd819ab2e776a97f2c3e533d3e870552cfc
Instruction ID: 567bd34134f1b25ef40a0cd8d27de080cef1959029dc72cd4116a41fa0f55900
Opcode Fuzzy Hash: 836c4ad4f9242088af74d394b8462bd819ab2e776a97f2c3e533d3e870552cfc
Instruction Fuzzy Hash: 4C311870B04205CFDB0AAB39D555A6E33A2EFC9A10B218168D50A8F3B8DE35DC479B84

Function 00E66888 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

Fi, xrefs: 00E66932

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID: Fi
API String ID: 0-596379814
Opcode ID: 9e75474c27d0a3bf520a45bee3f4022e336787a33f7d371f56577915e9cb287b
Instruction ID: 0884021645b81870fdca1fddf7aee10169a9165aa5b423688eefd79a7f66b73a
Opcode Fuzzy Hash: 9e75474c27d0a3bf520a45bee3f4022e336787a33f7d371f56577915e9cb287b
Instruction Fuzzy Hash: AB21E170990209CFCB04DFA4DA497EEBBF1EF88304F108069D805B7261DB799E09DBA1

Function 00E64248 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

(wq, xrefs: 00E64295

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID: (wq
API String ID: 0-1062398946
Opcode ID: b7af8f1b52bed89c7efa53e116c6235d1bd8df01887d3b2f996373e6a79541b2
Instruction ID: 4e42e0d72565b395ebc30b46ecd4d5138e5c3309939f8264ffe5fa2302bcf857
Opcode Fuzzy Hash: b7af8f1b52bed89c7efa53e116c6235d1bd8df01887d3b2f996373e6a79541b2
Instruction Fuzzy Hash: EE019C7270C1805FD30AA77D642516E3B93DFC2611398449EE442DF392CE28AD06D3E5

Function 00E61058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be9aa0f67b58d2c5e4c4d48e7c44300bbcb914890c94b31ed03e48932b4dc88c
Instruction ID: 6b1f48dd2995490248077a551c8671208c19b04eff0e8ecff2d7d0a2bdf66f73
Opcode Fuzzy Hash: be9aa0f67b58d2c5e4c4d48e7c44300bbcb914890c94b31ed03e48932b4dc88c
Instruction Fuzzy Hash: D082BEF8A14209DBDB06EBF4D594B6E7B73EB88300F105414EA8127798CF356991EB36

Function 00E6B0B0 Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578b8dc624ccd86630548ac7d7ca21daaee29cf7890cd7bae36157e10ae7ab00
Instruction ID: 4ce44c35c5be9c722483082de766c8fed17a1ed4ed482e37fb43a2ba02fce6ff
Opcode Fuzzy Hash: 578b8dc624ccd86630548ac7d7ca21daaee29cf7890cd7bae36157e10ae7ab00
Instruction Fuzzy Hash: D6525674A41200CFCB19EF28E59896D77A2FF84345B60956AD40AEF36ADF35EC81CB41

Function 00E6BB99 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 804006f3851d3d0c3e95de8a3d49e20242cb3e31793db1b5135b37169228a835
Instruction ID: c848057131e50dfd5d018304e423c7c2ec954029c677a8af40765bf38c46971e
Opcode Fuzzy Hash: 804006f3851d3d0c3e95de8a3d49e20242cb3e31793db1b5135b37169228a835
Instruction Fuzzy Hash: 7B8112B86A6208CFC706FB18E9C99597BA2FF40305B10D569D1099F329CB31EC89DF81

Function 00E6385B Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c8387efa7d79717b1d1b656d9f511ef07ab13ac993d4825ff290862faaafc9f
Instruction ID: 506528538f50321aacb41f8519899eea4747a6169fab3b6053c7abb0b4d69e44
Opcode Fuzzy Hash: 1c8387efa7d79717b1d1b656d9f511ef07ab13ac993d4825ff290862faaafc9f
Instruction Fuzzy Hash: F2612D74B51218EFDB05DFA4E894AAEBBB2FF88310F105025E905B7365DB34AD41DB50

Function 00E65AA0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22dafd9df1228263346228b04640f15a4ab78baff0f50a34ee969aa6c3867bb
Instruction ID: 9f9884fc91c4d0ab873e195d85aab0a49b2ac564ae6a6e811f831cc1c81f9556
Opcode Fuzzy Hash: d22dafd9df1228263346228b04640f15a4ab78baff0f50a34ee969aa6c3867bb
Instruction Fuzzy Hash: 20513CB5B406058FCB04EF69D994E6EBBF5EF88314B115168E506EB365DB70EC01CBA0

Function 00E62850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e41628e0549a2feee68265f952f53ef0a1cf265cb6dd333664fe9b211a50e1
Instruction ID: 295561435751daffe9ed6d59860b3c7d8cbaaecbd2f5faa4a5003aa8df0860ef
Opcode Fuzzy Hash: e6e41628e0549a2feee68265f952f53ef0a1cf265cb6dd333664fe9b211a50e1
Instruction Fuzzy Hash: 4E41F8B4E50208DFDB14EFA5E894AEDBBB2FF88341F105529D901AB265DB749C41CF50

Function 00E65A91 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475c724c154c1276c7901ef715a41971d09f0007ed69e33ff5db4134e0586327
Instruction ID: cb8d404938047fc075b85011db8242eeb1a15741a56febbf5f2c08078ab0490e
Opcode Fuzzy Hash: 475c724c154c1276c7901ef715a41971d09f0007ed69e33ff5db4134e0586327
Instruction Fuzzy Hash: C8414B75B406058FCB04DF69D998D6ABBF5EF89310B1581A9E509EB372DB70EC01CB60

Function 00E6B0A0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b28c6deaa3cb1f7ae0522fc972f9dc19464e9d64f2957db4622c6263741bc7c2
Instruction ID: a047dcc5a7f11b8485fb22b2d57cab9d3b8769f263b395624620ec9e5ec3d0d1
Opcode Fuzzy Hash: b28c6deaa3cb1f7ae0522fc972f9dc19464e9d64f2957db4622c6263741bc7c2
Instruction Fuzzy Hash: DA3128706043049FDB09EF78E89429DBBA6FF85300F04952DD119EB3A6DF70AD468B91

Function 00E62843 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb0f15a39214546360719e6aaf88a16cee307c7b7100090c08ab052355de19b6
Instruction ID: cefe51801998f42f97d44d63e2530e5c10ba1181af78d8b42edb71083d2e6b10
Opcode Fuzzy Hash: cb0f15a39214546360719e6aaf88a16cee307c7b7100090c08ab052355de19b6
Instruction Fuzzy Hash: 51315BB0E402089FDB18EFE5E8945EDBBB2FF88340F146529D501BB2A5EB749945CB10

Function 00E65308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8316bdcb625ffa15cb589e3cbb2f24be4d5484a48a8b52820c2e59890e906552
Instruction ID: 31efb8012eed153b7059a36f520f1e73c82ee3edd46c553a2f35e2f9be05b413
Opcode Fuzzy Hash: 8316bdcb625ffa15cb589e3cbb2f24be4d5484a48a8b52820c2e59890e906552
Instruction Fuzzy Hash: DF411675B41514DFCB08EFA4E494AADBBF2FF88351F209069E806AB364DB349D41CB50

Function 00E62C48 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45812bf094ce283eee3406c3b6916482d9480d8190f80be13acc0eedd5478916
Instruction ID: e79e308f01ba6b08f339d0282b4587e5c2d248b0858843b6c5f0acd6305a35f6
Opcode Fuzzy Hash: 45812bf094ce283eee3406c3b6916482d9480d8190f80be13acc0eedd5478916
Instruction Fuzzy Hash: 23410AB4944209CFCB05EFA4D8946AEBBB1FF88314F105529D901BB359DB709981DB91

Function 00E64B50 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975b12b2f5740740b42047ea4b19a1e770aa4864dc0c008dda57c4c548f05969
Instruction ID: 18e0b160562505e6908e28ea79aea787c3db5e58119bbb4194a4a4dfcba9bb64
Opcode Fuzzy Hash: 975b12b2f5740740b42047ea4b19a1e770aa4864dc0c008dda57c4c548f05969
Instruction Fuzzy Hash: 7A2147B02483416FC709FB79EC9169D7BA6EFC1300B444D69E0029F1A6DF60BD4887E5

Function 00E62C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a57021c90b25e7dd7a11c49130370afbc9d90588e6c19ccd43d00acc2b5d778
Instruction ID: 1c21370245a8cb46e9be4a31295b9fb79aca277dcbb769ef54c2e0a41732f147
Opcode Fuzzy Hash: 7a57021c90b25e7dd7a11c49130370afbc9d90588e6c19ccd43d00acc2b5d778
Instruction Fuzzy Hash: 3C31EAB490420ACFCB04EFA4D4946AE7BB1FF88315F105529E901BB358EB705D81DF91

Function 00E65698 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73befa7676057ea3cd6e049db71ee2be7d76f29392ff7d1882001d57d6352e9f
Instruction ID: fed369a9a3da00a6d22077df9bd2808aba076dfe1dd93da413ccbfbf9eb70397
Opcode Fuzzy Hash: 73befa7676057ea3cd6e049db71ee2be7d76f29392ff7d1882001d57d6352e9f
Instruction Fuzzy Hash: 24219C71B016049FCB08DF69E598AAEBBF6AF88740F644069E806E7361CF70ED01CB50

Function 00E6288D Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a2a4243fe4dc6d8825e697760760535d19a3e2f66f83acbdadb520032912f1
Instruction ID: d78dcfa4bde742fe12b180897753f12b826436e3c7f296285d44385a6759e929
Opcode Fuzzy Hash: 17a2a4243fe4dc6d8825e697760760535d19a3e2f66f83acbdadb520032912f1
Instruction Fuzzy Hash: 0B310CB4E50208DFDB18DFE5E4946EDBBB2FF88345F145529D502BB264DB749841CB10

Function 00E65C41 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ae1a08555b6dacf1b762c9038acb56d5e4082b160527da7323ed565a0eb73ff
Instruction ID: 2f46816b7c948ffe78a425e2abbcdc56134fa96cd0210e5669c3bf02ae167385
Opcode Fuzzy Hash: 8ae1a08555b6dacf1b762c9038acb56d5e4082b160527da7323ed565a0eb73ff
Instruction Fuzzy Hash: 9821EA71A043888FDF11CBA8D898BDDBFF1AF49300F25109AD404BB2A2CB35AD45CB60

Function 00E64B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab4e08512e34e457fd928f9538a110062ecef0e37e89839d290761c2f85b60fe
Instruction ID: 57e3321a06f3484e91abd2f5b1bac6fcc35d3c324f55f5241cccee1a7de5bd47
Opcode Fuzzy Hash: ab4e08512e34e457fd928f9538a110062ecef0e37e89839d290761c2f85b60fe
Instruction Fuzzy Hash: B921C6702042016BD709FF79E881A5EB7A6EFC4310B409E28E4068F665DF70BD8997E5

Function 00E64237 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edbf4ba4c8f4d6eb6ef31fcc955eaa6dc9be863f94bbce9532041d12c26b78eb
Instruction ID: f4e07549c93a1d556ff680d57a0f6990c5b5d7834d31248abc295b2c4273120c
Opcode Fuzzy Hash: edbf4ba4c8f4d6eb6ef31fcc955eaa6dc9be863f94bbce9532041d12c26b78eb
Instruction Fuzzy Hash: C01159B1348204ABD30CBB6AB8615BE2756EFC93507A4042DF402EB295CE307D4583F5

Function 00E62908 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7148eef72705f0237bfcd7da7666052078c55f2f42e9f91d9e13915917c0aef
Instruction ID: 8f51cc1873d62caa2908817dd581b5880295de9c883d03d0c25c4e80b766acf3
Opcode Fuzzy Hash: d7148eef72705f0237bfcd7da7666052078c55f2f42e9f91d9e13915917c0aef
Instruction Fuzzy Hash: CE21D6B4E501099FDB18DFE5E890AEDBBB2FF88340F109129D915BB268DB709841DF61

Function 00E65C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dc9f5d6b8ec8e6b7cc76f49964cec0260ba2dbda9ed32d47155214257076ba3
Instruction ID: fd405d1bfffdf9d6f263bd3635b62476a033252f6b3893eeeba3e70815a38333
Opcode Fuzzy Hash: 0dc9f5d6b8ec8e6b7cc76f49964cec0260ba2dbda9ed32d47155214257076ba3
Instruction Fuzzy Hash: 57211376A402188FDB14DBA9D588ADDBBF1AF48314F2010A5E505BB3A1DB75AD84CBA0

Function 00E6296A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a77a6946a639c4e510cb496dff00ae56f8695c6df4c195cc7b749e2498f57a8a
Instruction ID: fb2f637bbc06514f6d424f92583aa84957a1114601b9095efb8962794ebbd808
Opcode Fuzzy Hash: a77a6946a639c4e510cb496dff00ae56f8695c6df4c195cc7b749e2498f57a8a
Instruction Fuzzy Hash: 0B21C6B4E41208DFDB14DFA4E480AADBBB2FF88304F205529E905AB365DB70AD41DF51

Function 00E641A2 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e06707cfbf0ce356ae62867c8407707d8869680d26dbd32d6a7517d57e930fe5
Instruction ID: ff91213552eb519030fb2e134e580894006e07e8feb37e396fe841242e08090c
Opcode Fuzzy Hash: e06707cfbf0ce356ae62867c8407707d8869680d26dbd32d6a7517d57e930fe5
Instruction Fuzzy Hash: 0201287534D2806FD30A7B796C610AE3FAADFC62543A4049BE406E7293CE256D0AC3B5

Function 00E632E0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1548900d5945b48c97c63fc1c25332f0de7161bb92f13da58c6add564c5f33dd
Instruction ID: 949cdf7eebe8b0e92461ad5e2e4f5146065edecc967b3ea424a9ebdcb44678aa
Opcode Fuzzy Hash: 1548900d5945b48c97c63fc1c25332f0de7161bb92f13da58c6add564c5f33dd
Instruction Fuzzy Hash: 9C11CE34AC0244CFDB44EFB5E46979E7BB2EB88306F105429E442A73A9DF7A5C05CB90

Function 00E62A80 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee0bad96f15d622592111db2edf3be3c5953efe574a04ae55309bb8fddf36f5e
Instruction ID: 1ff0bb6606e6c7b63b12ce61c0efa73320efe55759040d781568b795e449d2d3
Opcode Fuzzy Hash: ee0bad96f15d622592111db2edf3be3c5953efe574a04ae55309bb8fddf36f5e
Instruction Fuzzy Hash: 6901F131684B008FC315EB38D41A88B7BE1EF8465435098AEE116DF362DF70EC048BE0

Function 00E666F9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: debc0960dd68a21e57fa891e8ae3e375c6fba427403e2973c4a78b4360e98224
Instruction ID: 90ff17c87d22878843c2f050bd5370fd01bb1eef5673f3b7d9515abc2f6b15d4
Opcode Fuzzy Hash: debc0960dd68a21e57fa891e8ae3e375c6fba427403e2973c4a78b4360e98224
Instruction Fuzzy Hash: BE01AD713042008FC315AB2CF89849EBFA2EFC9221300457AF50ACB362DE74DC4ACBA1

Function 00E65940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08463ecf522ffa71de442f6b36c130fdc1950945386979d28f6d826c0d4e352b
Instruction ID: f49c198f2ba995bdcab820cb0fd4d30889c0d408ac30f4cba722da8b2601dd40
Opcode Fuzzy Hash: 08463ecf522ffa71de442f6b36c130fdc1950945386979d28f6d826c0d4e352b
Instruction Fuzzy Hash: 740181763402209F8704AE6EF898D5AB7AAEBC9666310453AE606C7364CE35EC0187A0

Function 00E632F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba7ab5e041e606f84d55ae61afb009ad903b229d5942ffdc68d85f7939711a0
Instruction ID: d8449e9c967101e5919b655a292d91165169455e2d764c55c7f635a14a147808
Opcode Fuzzy Hash: aba7ab5e041e606f84d55ae61afb009ad903b229d5942ffdc68d85f7939711a0
Instruction Fuzzy Hash: 93011E74E942448FDB44EFB5E46879E7BF2EB88302F004429D542A7399DF795C05CB50

Function 00E62A90 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d956e667d64ba7b02d9ec27654c6a067349a26a66cbcdf3d5f5b39b46b284b6
Instruction ID: 604acb3caaffda3fa3bf38dec76262f3c43fdb7745217b55d437f539c307c66d
Opcode Fuzzy Hash: 6d956e667d64ba7b02d9ec27654c6a067349a26a66cbcdf3d5f5b39b46b284b6
Instruction Fuzzy Hash: 27F064716406008FC314EB38D41A89BBBE6EF8461479099A9E15ADF365EF31ED048BE0

Function 00E66388 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a57b0b2c6965a1b42bde80153d6b0ad966555c71bc2cde4daf34b5db5b87e9bc
Instruction ID: 4a3c65c397026db5ec19d9e96907a5beb366ecea1b912e32c0aeb0e069011873
Opcode Fuzzy Hash: a57b0b2c6965a1b42bde80153d6b0ad966555c71bc2cde4daf34b5db5b87e9bc
Instruction Fuzzy Hash: 50F062B4D09208AFDB00FFA8E8919DDBBB1EF45301F5095A9D409E7292DA306F05AB91

Function 00E6593F Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23c785928438a34243d0f25c78a7095672a83afb63867d392c3e8924f85ac29
Instruction ID: 078cdb846129026a9b09a831e45a9c681593e4f91d581a83b2561b84de0112ac
Opcode Fuzzy Hash: d23c785928438a34243d0f25c78a7095672a83afb63867d392c3e8924f85ac29
Instruction Fuzzy Hash: C8F054763401109F8305AF69E484D59B7A6EBC9665314406AE506C7364CA75DC0287A0

Function 00E61FF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff571f69ea106da90416ed34b8bd028d77246e9fecc56bacdb2da5686ab064f
Instruction ID: 06ede7bf9cc6d9583aa4d84e02d1b2fb5f55c7510d34ace8020eeba263602848
Opcode Fuzzy Hash: 7ff571f69ea106da90416ed34b8bd028d77246e9fecc56bacdb2da5686ab064f
Instruction Fuzzy Hash: 1DE092757842808FCB055A79B42889A7BAADFC665231504FFE205CB376DD748C09C7A1

Function 00E66398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58af764605546842111fe28ff08f1140d166bffa50639a76a249f08d56d6619
Instruction ID: 7072e300bddc55f14dbb5872509dd4dd83327eadaf51f7fd70a37117153854e0
Opcode Fuzzy Hash: f58af764605546842111fe28ff08f1140d166bffa50639a76a249f08d56d6619
Instruction Fuzzy Hash: EAF082B0E44208EFDB04EFB8E98199D7BB2EF84201F5051A8A809E7290DA307F04AB51

Function 00E62D9B Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4efc1540cb167c39df28651bd1c256be2a9653efa27848292008ee2d8701a350
Instruction ID: a604ccd56c3a9a9bbb1bd3557445c0b4ca50e8d7116d8dea4c395ae46ac572b1
Opcode Fuzzy Hash: 4efc1540cb167c39df28651bd1c256be2a9653efa27848292008ee2d8701a350
Instruction Fuzzy Hash: 27F03071E50118CF8794EFACD8055DD7BF5EF48314B2040AAE609E7311EB309E018BA1

Function 00E62DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739debc8296abf37455339eb5c91ce0b491729a11f7679345dd3c5989ce3e3ce
Instruction ID: 249f260dbc9411c9ce1e44e7906d28fa31177ad292a37927936d4507f2921a89
Opcode Fuzzy Hash: 739debc8296abf37455339eb5c91ce0b491729a11f7679345dd3c5989ce3e3ce
Instruction Fuzzy Hash: A5E0ED71E50118CF8B84EFBCD5056DE7BF5EF48314B2140AAD619E7311EB709E118BA1

Function 00E62008 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602d25a60ac3d3a1e4916188529b3bb9f099f2e5535ee3ae038d28ba0d102940
Instruction ID: 9f0bab8028287abdad8cb7cd2ee61e53f063d53d3d945512240ef2f00fbc06c5
Opcode Fuzzy Hash: 602d25a60ac3d3a1e4916188529b3bb9f099f2e5535ee3ae038d28ba0d102940
Instruction Fuzzy Hash: ACD017757402148FCB186ABEE41C85A77EAEFC962230104BAE50AC7325DE75DC0187A1

Function 00E666C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fdc722864e01ce6f661ef819f9e3054bd22726eb2b842a7bc6505430095ffdf
Instruction ID: fedec6f416478f7428634ef2af872c76911bac8aa3594e45ffc338ed001ba115
Opcode Fuzzy Hash: 4fdc722864e01ce6f661ef819f9e3054bd22726eb2b842a7bc6505430095ffdf
Instruction Fuzzy Hash: 7FD05E317591205FC6412A6C74254E867E2CF8A61130901ABF605EB3A6CE1C9D069395

Function 00E66469 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29110723311db0c202c3a1e5cce2aa3d7970ce83f8d2098b586b3236aeefa20e
Instruction ID: d38d906424a06e31ee26b5eabbb6312fc6023fbbf3332e6d0191c3abb5f334ca
Opcode Fuzzy Hash: 29110723311db0c202c3a1e5cce2aa3d7970ce83f8d2098b586b3236aeefa20e
Instruction Fuzzy Hash: 5AD05EB475C2044FD304AB58D09181437B2EB8D31070144A5E549CB376CE34DD42C749

Function 00E66478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3662684319.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_e60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ad12fdfd9f44fd7b0639fa53e663a14593375801c658e3df837c14d829c25c
Instruction ID: 00640b29bc7c389a6a237f1bbd3b4b18011ea2ef3991c08183fb26c6483507f9
Opcode Fuzzy Hash: a3ad12fdfd9f44fd7b0639fa53e663a14593375801c658e3df837c14d829c25c
Instruction Fuzzy Hash: 61C012B43442044FC208EB5CD08181533E6BB8C71431014A4E909CB775CD30FC418658

Analysis Process: GamePall.exePID: 5456, Parent PID: 3664COMMON

Executed Functions

Function 00934F58 Relevance: 11.9, Strings: 9, Instructions: 609COMMON

Download Yara Rule

Strings

(wq, xrefs: 00935056
(wq, xrefs: 009351F9
(wq, xrefs: 0093586F
(wq, xrefs: 00935655
(wq, xrefs: 009355CF
(wq, xrefs: 0093589B
(wq, xrefs: 00935082
(wq, xrefs: 009355A3
(wq, xrefs: 009351CD

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq$(wq$(wq$(wq$(wq$(wq$(wq
API String ID: 0-1215394046
Opcode ID: a53cf3354371552c7bd593e57f66840cfa8f5a871bfd1e76185b836ae4a62954
Instruction ID: 8921c5551ab050dea9138afa891bf0cc3f4f559119418e6baec265e6bcf4c979
Opcode Fuzzy Hash: a53cf3354371552c7bd593e57f66840cfa8f5a871bfd1e76185b836ae4a62954
Instruction Fuzzy Hash: 59328074B045148FCB08EF69D454AAEBBF2AF89310F25846AE805EB395DF349D42CF91

Function 00933750 Relevance: 3.8, Strings: 3, Instructions: 88COMMON

Download Yara Rule

Strings

(wq, xrefs: 009337B2
(wq, xrefs: 00933820
(wq, xrefs: 00933786

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq
API String ID: 0-3966564304
Opcode ID: bc26a132a47be8eadd19474071254f7aaf26428021a471a9079083edf00daeef
Instruction ID: 3bb86a6fdd1c7b429f36be2750dd1983b667f3d49179efb884304912c489701c
Opcode Fuzzy Hash: bc26a132a47be8eadd19474071254f7aaf26428021a471a9079083edf00daeef
Instruction Fuzzy Hash: AA214B367085944FCB196739141453E3FE79FC631071841AEE90ACB3D1DE284D078796

Function 00933BE0 Relevance: 3.0, Strings: 2, Instructions: 465COMMON

Download Yara Rule

Strings

(wq, xrefs: 00933DE5
(wq, xrefs: 0093419C

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq
API String ID: 0-707371155
Opcode ID: f1c02938dd3c30ef7e8403cb151cf2d0aaf0064f457da60c4dc002d24bd2c963
Instruction ID: ea662c50dc4044877ba0a39094cb8a73546278bc6831382ca8f3e5fb85bd2fab
Opcode Fuzzy Hash: f1c02938dd3c30ef7e8403cb151cf2d0aaf0064f457da60c4dc002d24bd2c963
Instruction Fuzzy Hash: A6F16E74B105049FCB09ABB8D894AAE7BB7EFC8300F148459E906DB3A5DF349D46DB90

Function 0093B0B0 Relevance: 1.9, Strings: 1, Instructions: 680COMMON

Download Yara Rule

Strings

e r^, xrefs: 0093B23E

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID: e r^
API String ID: 0-2885775133
Opcode ID: d6f12d8cbb6557d9b8521c87e869ec68739b78631ef9ae3b20d49508c39b4651
Instruction ID: 431446c26088d444faf2948676cd58ca9be146d92e84b54c917e08b678099bb5
Opcode Fuzzy Hash: d6f12d8cbb6557d9b8521c87e869ec68739b78631ef9ae3b20d49508c39b4651
Instruction Fuzzy Hash: CD524734A11604CFCB19EF24E598A2D77B2FF85309B64846DD5068B26ADF39EC86DF40

Function 0093385A Relevance: 1.6, Strings: 1, Instructions: 303COMMON

Download Yara Rule

Strings

(wq, xrefs: 00933BA1

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID: (wq
API String ID: 0-1062398946
Opcode ID: a5ffed47f71bf0c738a5d9b95807947bcbffccc4485bfa87fdad348ae48deb5c
Instruction ID: 8d215e95aa75d63142fdbc8a99cefb3ba072951ab7008d741c93f8b04e5acfea
Opcode Fuzzy Hash: a5ffed47f71bf0c738a5d9b95807947bcbffccc4485bfa87fdad348ae48deb5c
Instruction Fuzzy Hash: 82C13174B102189FCB05DBA8D894AAEBBB7EF88310F108059E905A73A5DF349D42DF90

Function 0093BEAF Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Tesq, xrefs: 0093BF75

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: 967c2f27635cc0f23c08c7055a35bc6dceedfc19b82f8a58413adea59e9c203e
Instruction ID: 2c6fba56bb46dea8a11099e5a3dc5c53c92a93a63ff79f25ee74c995b38eed1e
Opcode Fuzzy Hash: 967c2f27635cc0f23c08c7055a35bc6dceedfc19b82f8a58413adea59e9c203e
Instruction Fuzzy Hash: 72414E747005008FC754DF6EC498A6EBBE6BFC9710B6580A9E506DB3B2DE71DD018B91

Function 00932B10 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

LRsq, xrefs: 00932B35

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID: LRsq
API String ID: 0-3165563352
Opcode ID: f53dfe86977d1b9eb8bf4c53411c7293882f7002d2c97130dacbb4dc498c3335
Instruction ID: 340f5fca1d403b8e43119a484ffc40b634a1f8e3d339de6e86ee720cf0271a8c
Opcode Fuzzy Hash: f53dfe86977d1b9eb8bf4c53411c7293882f7002d2c97130dacbb4dc498c3335
Instruction Fuzzy Hash: F2311931700601CFD71AAB39D55996E37B2EFC9A04B2181ACD00A8B3B9DE359C4BDB84

Function 0093BEC0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Tesq, xrefs: 0093BF75

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: 8421e674140279382a11abb55e06524dbd6e342e003fb7c43693e2c3cd6b5d51
Instruction ID: 5284311efc5a0b9e7773586ba269df0095900fa8d65b5d1a2140b45475f882d5
Opcode Fuzzy Hash: 8421e674140279382a11abb55e06524dbd6e342e003fb7c43693e2c3cd6b5d51
Instruction Fuzzy Hash: 1E313B747105008FC754EF6AC498A2EBBE6BFC9710B6580A9E506DB3B2CA71ED018B90

Function 00934237 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

(wq, xrefs: 00934295

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID: (wq
API String ID: 0-1062398946
Opcode ID: 6322b2ff70833a7d57c6d86230b4ed28f17e73b26101130d3c2c82c7dbc31d96
Instruction ID: 656eafd6d2684d67267c08be65003733693e1e8fe56d7a8e96dd565ac63a9e35
Opcode Fuzzy Hash: 6322b2ff70833a7d57c6d86230b4ed28f17e73b26101130d3c2c82c7dbc31d96
Instruction Fuzzy Hash: 6611212260C1804FD70A537968642AE3FA3EFD621074949DFD481DFA52CE2D5D4BCB91

Function 00931049 Relevance: .8, Instructions: 842COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be276a14eb5b6e22126dfa9f2045f034af8a86df8f8f2737500b393d76f7265c
Instruction ID: 60fe6dda60733df7e8b15f5bb8a6c18408170e70a87c5ccb517cc42272bd8421
Opcode Fuzzy Hash: be276a14eb5b6e22126dfa9f2045f034af8a86df8f8f2737500b393d76f7265c
Instruction Fuzzy Hash: C38223B4A20609DFDF06EBF4D594F6E7B72EB88304F105414AA4023369CF356996FB26

Function 00931058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7ef075a8a6a75b2dba2e356215203b44ae5b6bd966a47f593e7cb0643b8693e
Instruction ID: c787ef8af94c34c9b4cd29f1ac1b49b19b383c7e70c3f0f7f790eef34f980788
Opcode Fuzzy Hash: a7ef075a8a6a75b2dba2e356215203b44ae5b6bd966a47f593e7cb0643b8693e
Instruction Fuzzy Hash: 4D8223B4A20609DFDF06EBF4D594F6E7B72EB88304F105414AA4123369CF356986FB26

Function 0093BB99 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07e54a619edcc0f469a58f42fdc85e0c22eb210dd65f819b6e20767df026c99
Instruction ID: 69657a771ee37ab019c0f748e7fd71b7f93b64f4be7e9ac2492fffab67f71500
Opcode Fuzzy Hash: d07e54a619edcc0f469a58f42fdc85e0c22eb210dd65f819b6e20767df026c99
Instruction Fuzzy Hash: 2F81F578612509CFC716FB18E589D69BBE2FB44308B15C558D6158B33ACB78EC4AEF80

Function 00935A91 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c74093b4991305ae0e7e34aaab43612da0852989a4d51a8165c556b6090bc75
Instruction ID: a89d9b299b340944db954569946735a14e73f8d5037209b71ba9076bdaf3a669
Opcode Fuzzy Hash: 3c74093b4991305ae0e7e34aaab43612da0852989a4d51a8165c556b6090bc75
Instruction Fuzzy Hash: 15514A75B006058FCB04EF68D598A6ABBF6FF8C314B1140A9E50ADB365DB34DD05CBA1

Function 00935240 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24223501cf7ee059e6a9d154064b54ffddc047f770c1c4c39781464952c8ed9b
Instruction ID: ada5985f71a0d0264b49f92b96c48e915b9569f8bbb6a88d0a048c353503bf23
Opcode Fuzzy Hash: 24223501cf7ee059e6a9d154064b54ffddc047f770c1c4c39781464952c8ed9b
Instruction Fuzzy Hash: D1512A74A00A18DFCB18DFA5D494AAEB7F2BF8C311F158569E805A7364DB34AC41CF90

Function 00932850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f34ebad91101f6fabca7d05d0b909467d5d4e7c7ceccc4ac91905777bbab955
Instruction ID: 291c5f73b9f3f99cd037fe24b8c701fad83c9788cb62e3931233d9cba1022b27
Opcode Fuzzy Hash: 8f34ebad91101f6fabca7d05d0b909467d5d4e7c7ceccc4ac91905777bbab955
Instruction Fuzzy Hash: 67411974E10208CFCB18EFA5D984AEDBBB2FF88300F205929D801AB264DF359945DF50

Function 00935308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5279aacda993623bdeb35125e061d88c41cdcbdf18a41cd58c308c8f8401aefa
Instruction ID: 9da710392ddde22749d312c672caf9069b7543cc2d289f6809cc2394fc78c34b
Opcode Fuzzy Hash: 5279aacda993623bdeb35125e061d88c41cdcbdf18a41cd58c308c8f8401aefa
Instruction Fuzzy Hash: 87410934A10514DFCB08EFA5E494AADBBB3BF88315F218469E805A7365DB34AD42DF90

Function 00932842 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c9ec84781c25a335fc54c29715b3d9a84e4ade87c46f83099531f5bca2569a2
Instruction ID: db135587d2b12cc45a4e3b934ecc75370c10c70ce2749ac5f8caa82eb6c48b95
Opcode Fuzzy Hash: 5c9ec84781c25a335fc54c29715b3d9a84e4ade87c46f83099531f5bca2569a2
Instruction Fuzzy Hash: 1D311770E10208DFDB19EFA5E588AEDBBB2FF88300F204929D401AB294EF355946DF51

Function 00932C48 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc85f4efabedbb5ff7f2b93e118a131327e143d3640fec5346d846c1bd88df3b
Instruction ID: 1cadab56e7d4ec3c1bb298ca1b21805a85027083266128558b0f55f293f40b20
Opcode Fuzzy Hash: cc85f4efabedbb5ff7f2b93e118a131327e143d3640fec5346d846c1bd88df3b
Instruction Fuzzy Hash: 24415A74910609CFCB05EFA8D8849EEBBB1FF88314F104569D401A73A5DB305D86DF90

Function 00934B50 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ae2e014b870e719ddc480ca33f4e43e4af871d10e8bdfca9792330a59f4a4e
Instruction ID: 079ee9c4d7a9958ae335cdfb7768c873f5a5e9d7532afdb0feeecb39103bd3cb
Opcode Fuzzy Hash: 25ae2e014b870e719ddc480ca33f4e43e4af871d10e8bdfca9792330a59f4a4e
Instruction Fuzzy Hash: FE2128302046415FC709EB78E8D5A9E7BA3FFC5310B048E5EE0058F666DF646D8A8B91

Function 0093B0A0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 571fc12292273307860de8693ea4fe5f9f8acdd256dc42dea81a4b360edaa3c6
Instruction ID: 1ee13d33a3fcd9dd7af01adb85a4ac929568b6224c0266f1d9a6cbcbdc405358
Opcode Fuzzy Hash: 571fc12292273307860de8693ea4fe5f9f8acdd256dc42dea81a4b360edaa3c6
Instruction Fuzzy Hash: 3A314B71A006089FDB04EB78D89469DB7F6FF85304F00892DD11AAB3A1DF74AD0A8BD1

Function 00932C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87bf9b3818ac702db237337e903bbe9aac6e0dd58d2f01d97259ed1ce4754211
Instruction ID: 85b93eab8d98c63a7324d8ffa3e806a4df5091d837e2922e5e796d1ca18f57b6
Opcode Fuzzy Hash: 87bf9b3818ac702db237337e903bbe9aac6e0dd58d2f01d97259ed1ce4754211
Instruction Fuzzy Hash: B231397491060ACFCB04EFA8D8849EEBBB2FF88314F105569E401A73A4DB306986DF91

Function 00934B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4b3cd33009480455e02d5c6d36b418280b3ca710765938ee2f4c4133da1c4a
Instruction ID: f7079b55621e14fb33bb2db5f0e1cd47c01e4ef85a4865f9eca3a7ff312cc3d1
Opcode Fuzzy Hash: 8b4b3cd33009480455e02d5c6d36b418280b3ca710765938ee2f4c4133da1c4a
Instruction Fuzzy Hash: 8A21C3312006019FC708EB79E8C4A6EB7A7FBC4310B008E2DE0098B625DF70AD899BD1

Function 00935C42 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e70790ef8b1d567e7d4c2dbce202868ec90646120d60c46615a98a9be4e2681
Instruction ID: 6bf63bea5add82c672f8769e1e127a48e27733729211d2d14f68938d272559f3
Opcode Fuzzy Hash: 8e70790ef8b1d567e7d4c2dbce202868ec90646120d60c46615a98a9be4e2681
Instruction Fuzzy Hash: C821AF30A042988FDB05CBA8C498AEDBFF1AF4D310F254099D445FB2A2CB799D45CF60

Function 00936888 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d04fbd4b52a29e25c09fc58570eb6278b2e96f7c83cd7ccc30224fe6dac8cb
Instruction ID: 64d7af7cb8881f6c2b7b5c7f398904954f1b5e5ede145710d358925aa8dcdd6c
Opcode Fuzzy Hash: 32d04fbd4b52a29e25c09fc58570eb6278b2e96f7c83cd7ccc30224fe6dac8cb
Instruction Fuzzy Hash: A3219D71900209DFDB04DBA0C909BAEBBF1EF85304F55C06AD005AB262DB799E09DF50

Function 00935C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926e39aaf6bcce258a2bd4bf8d705aa8b71bb6755646b17684bf1ac9fa5c18c0
Instruction ID: f879676678585f5c71e878f99a677a186a0b842d7d285c2c8ecd68548223733f
Opcode Fuzzy Hash: 926e39aaf6bcce258a2bd4bf8d705aa8b71bb6755646b17684bf1ac9fa5c18c0
Instruction Fuzzy Hash: 3C212475A002188FDF04DBA9C588ADDBBF5AF8C314F2110A5E505BB3A1DB75AD84CFA0

Function 009341A2 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d5281be450351aff252aab79bcf2bf8e989018ad325080d377aa5ad274ab5d2
Instruction ID: 95dc051b49440d37aa40c04ac82454f4ca4a34499c9b53243119b74aa026bfc7
Opcode Fuzzy Hash: 1d5281be450351aff252aab79bcf2bf8e989018ad325080d377aa5ad274ab5d2
Instruction Fuzzy Hash: 3601283230D2805FC71A67756C655AE7FB7EFC6320358449FE445DB682CE290D0AC766

Function 009332E0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e90e1c7b4dae34eeeb440720132564dca235845378c2fbc24870c243daedd6c
Instruction ID: ffd4040ec6e603c59da491d46c82b7fcd716a02b0880b3a419d1bc85e32bcb3f
Opcode Fuzzy Hash: 4e90e1c7b4dae34eeeb440720132564dca235845378c2fbc24870c243daedd6c
Instruction Fuzzy Hash: A3117C34E901408FCB08EFB8E458BEEBBB2ABD9311F048829D44297682DB394816CF51

Function 00935940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef67477ff39bc4a07aabdb55ea3a2f44c1d30ed3d481a54156b109ed0a49e0af
Instruction ID: 464f85586240425f51e85ab96b5dbc8d60ddc97aed4c6bae6f3f9baa53b0f60c
Opcode Fuzzy Hash: ef67477ff39bc4a07aabdb55ea3a2f44c1d30ed3d481a54156b109ed0a49e0af
Instruction Fuzzy Hash: 01018176700510CF8704AB69F498D6AB7AAFBDD765310857EE60AC7310CE319C06CBA0

Function 00932A80 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa2687387ac23e4de7721e513819cdacce2abcf1ac737b171539763fc8220c3
Instruction ID: dee943663ca69e51499b6e33b9ea18c059bf3aef9584c02259fe293f0fb3e253
Opcode Fuzzy Hash: 6fa2687387ac23e4de7721e513819cdacce2abcf1ac737b171539763fc8220c3
Instruction Fuzzy Hash: 650188712186408FC3129B38845989ABBF2EF8631075489AEE08ACB326DF34EC058B91

Function 009332F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e302fe0a6f02b68e6c87dcd6d5c0c77dd9f728150de75e509b478226d12039e
Instruction ID: d920498c4fce8a2d90788295f7879bb6bc2e559ba2c83b97fd40fdca79b0b878
Opcode Fuzzy Hash: 4e302fe0a6f02b68e6c87dcd6d5c0c77dd9f728150de75e509b478226d12039e
Instruction Fuzzy Hash: 1A014C34E502048FCB08EFB8E458BAEBBB6ABDC301F004829E40297381DF355815DF61

Function 00936388 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85801293fac0c383713df868e6734365a1b69212fd8d951ffb04c059735546ae
Instruction ID: bec0f54182b14e8466ff7ae72cf210d754305013eb8eee1f126655df5df29036
Opcode Fuzzy Hash: 85801293fac0c383713df868e6734365a1b69212fd8d951ffb04c059735546ae
Instruction Fuzzy Hash: F2F0AF70D04288EFCF44EBB8A8519ADBFF2DF46210F1085EDD448E7212DA311E46DB01

Function 0093593E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b775451d6c7efb0f81b35efda52fc0e664ab705bb451e79c7b84b7f59d2e11
Instruction ID: e931e3ce89aafe2b2c6cf8a7d82d1b57a69d110a4562ef89e5d8c9fdf307d829
Opcode Fuzzy Hash: 32b775451d6c7efb0f81b35efda52fc0e664ab705bb451e79c7b84b7f59d2e11
Instruction Fuzzy Hash: 39F05475700510DF8714AB39E494DADBBA6EBDD365314856EE509C7311CE358C06CB50

Function 009341E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc9641f47646b1eee40a47667e3903a9640261db4657fa85ac3c2eb525cccd1
Instruction ID: baf953065eb0121519b6078f7a9d9858b24e09f4427da3a8ed5cfa1f6c1e385b
Opcode Fuzzy Hash: ccc9641f47646b1eee40a47667e3903a9640261db4657fa85ac3c2eb525cccd1
Instruction Fuzzy Hash: 3AE0E532704104AB8708A2A6BC99A6F6B9FFBC8260754482EF00ED7304CF212D0043B9

Function 00932D92 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f73037d303577c95d1e8cb490bf646a724fb03e71c8edc54645546d23dcd25c
Instruction ID: 718133e69995e3acac378053bfa2a567b000bbc75447fda81f41ca1d8bf9286a
Opcode Fuzzy Hash: 1f73037d303577c95d1e8cb490bf646a724fb03e71c8edc54645546d23dcd25c
Instruction Fuzzy Hash: A6F05E70E140588FCB45EFBCC4056DD7FF0EF89314B2145AAD549E7222D6348E028B91

Function 00931FF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb5593bfdf1537390e7263ad34a2da845748ab23f51b2035bb62ad276154ff4
Instruction ID: 608220fc5eedef5554b74e03ed760aecbe488aed3adc8d2d4ef2792049c93168
Opcode Fuzzy Hash: ccb5593bfdf1537390e7263ad34a2da845748ab23f51b2035bb62ad276154ff4
Instruction Fuzzy Hash: 83E06D357892805FC71957B9D46889A7FA9DFCF22130A08EAE146CF762CD299C12C761

Function 00936398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20903af7f8ec998a4ff1a44cfc756095cc71f468e4456539c820b38739e047f5
Instruction ID: 5b361f8f6634bb98399de460a19f573f396751a1ff42ccbbb0b1f4082a280c59
Opcode Fuzzy Hash: 20903af7f8ec998a4ff1a44cfc756095cc71f468e4456539c820b38739e047f5
Instruction Fuzzy Hash: 55F05870E00208EFCF04EFA8E841A6DBBF6EB88200F1085A9A808A7250DB302E449B41

Function 00932DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 236b40906d5617e7eafb0832110ef51d30cbce11490ad7455fac69ef9c40fb1e
Instruction ID: c801cda81b42fd6be85d705b77d33a737313972e6c298808302653a844629bcc
Opcode Fuzzy Hash: 236b40906d5617e7eafb0832110ef51d30cbce11490ad7455fac69ef9c40fb1e
Instruction Fuzzy Hash: 1EE0ED71E10118DF8B84EFBCD5096DE7BF5EF49311B2140AAD519E7351EB709E018B91

Function 0093374E Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c26a2912d46f668a8aa31e6f0a1ce3451ab6917547230614986e7c1778cf6ea
Instruction ID: d5200a5e267233cab04ae2bf73f2d007922e87e3dad7a38f1e4228ed9060fe4a
Opcode Fuzzy Hash: 0c26a2912d46f668a8aa31e6f0a1ce3451ab6917547230614986e7c1778cf6ea
Instruction Fuzzy Hash: 26E0C2B6B009144F8738523A64449FE2BABABC83727188029DD0AC3355EE248D0BDE90

Function 009337F0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae53cb1e4704ddc459c6b7a1edd87cd091e8df9df04804c41b16b7bad4afe10
Instruction ID: 1894c1cff54b3009232d206c9bf3272271473b0006ca53926b3679c2334ef173
Opcode Fuzzy Hash: fae53cb1e4704ddc459c6b7a1edd87cd091e8df9df04804c41b16b7bad4afe10
Instruction Fuzzy Hash: 97D02B7374021017CB18555B6800D7737DFE7C8334F044025FE04C3250EEA19C0153D0

Function 009366C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7064d9b844e821312cc20f8b00011fc5123e4a2b45d8aea2932819c75f0cd14a
Instruction ID: b151f987a4103470e6b60281b6036ce5863e5df48f89e77cc50026f5b6479e09
Opcode Fuzzy Hash: 7064d9b844e821312cc20f8b00011fc5123e4a2b45d8aea2932819c75f0cd14a
Instruction Fuzzy Hash: B0D0A7323551A05FC60557DCB4544D97BD6EECB11034901AFF108C7302CD984C479756

Function 00936469 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3025d971808bf8baa7950cb7c135fd4e6a6871ef7d36024f1d5c536872df46
Instruction ID: 86e32803137a6c41e23d2f3238e21534f19278be8ce7a3334fc7bf389464a4d4
Opcode Fuzzy Hash: fb3025d971808bf8baa7950cb7c135fd4e6a6871ef7d36024f1d5c536872df46
Instruction Fuzzy Hash: 24E012757586404FC745977890958993F72EB5A32071405E9D489C7376CD19CC47CB04

Function 00936478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 586ad8746aa087b44ca6562c3ab33e5602924ac31dafadd8ec5debda65ebb372
Instruction ID: 97ae3b699beaa9e732c573d4e4d0940fbdd20f33e4ee7f2da377a968212be54b
Opcode Fuzzy Hash: 586ad8746aa087b44ca6562c3ab33e5602924ac31dafadd8ec5debda65ebb372
Instruction Fuzzy Hash: 2EC012753442048FC608EB6CE080C2637EAEB8C71431014A9E90ACB779CE20EC828A58

Function 00935640 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3669349002.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_930000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75779f6d42355a3d60328ce4cda0a0a05b109f8028ae9ed0ea062a8c3b8cf530
Instruction ID: bea6652d1a7108c9d98822d17ef25a15c19256a6606910051b58b3a791a287d9
Opcode Fuzzy Hash: 75779f6d42355a3d60328ce4cda0a0a05b109f8028ae9ed0ea062a8c3b8cf530
Instruction Fuzzy Hash: 26B02B305402095786000915EC0E411371DEB942187400194AC0800100AD23C8200880

Analysis Process: GamePall.exePID: 4740, Parent PID: 5304COMMON

Executed Functions

Function 01314F58 Relevance: 11.9, Strings: 9, Instructions: 607COMMON

Download Yara Rule

Strings

(wq, xrefs: 013155CF
(wq, xrefs: 01315655
(wq, xrefs: 013151CD
(wq, xrefs: 01315056
(wq, xrefs: 013151F9
(wq, xrefs: 01315082
(wq, xrefs: 013155A3
(wq, xrefs: 0131589B
(wq, xrefs: 0131586F

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq$(wq$(wq$(wq$(wq$(wq$(wq
API String ID: 0-1215394046
Opcode ID: 3fdc57f24f204140c86516ed6db434aa0e1db646321745b4e0c8fa4bf926b760
Instruction ID: 95a62cf35e7397d162e1106fa6352ab1d03d46b43653497e6da8603ed406b86f
Opcode Fuzzy Hash: 3fdc57f24f204140c86516ed6db434aa0e1db646321745b4e0c8fa4bf926b760
Instruction Fuzzy Hash: 14328C71B041189FCB49EF69D4946AEBBF2AFC9314F14806AE906EB355DB349C42CB90

Function 01313860 Relevance: 4.4, Strings: 3, Instructions: 651COMMON

Download Yara Rule

Strings

(wq, xrefs: 01313BA1
(wq, xrefs: 0131419C
(wq, xrefs: 01313DE5

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq
API String ID: 0-3966564304
Opcode ID: c1d9d43d4387df2fff8a6ec6098959f8aa002c1af2d26dcb1bedc41ac3f10a54
Instruction ID: 26c6c9df42e0ab14b5bb10bec0634a5e0b123a6670fa660aa88f9f5340fcb697
Opcode Fuzzy Hash: c1d9d43d4387df2fff8a6ec6098959f8aa002c1af2d26dcb1bedc41ac3f10a54
Instruction Fuzzy Hash: 12324F75B101189FDB09EBB9D8A4AAEBBB7EF88310F148069E90597398DF749C41CB50

Function 01311049 Relevance: .8, Instructions: 840COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed73a8935cae7dbae64dad11c744b410b4074151dc7c611dccde9adecec172fa
Instruction ID: 7e89c514a6eade5055f54524ab14c97c6513676fda024ecc55a50b47e9cc4d0e
Opcode Fuzzy Hash: ed73a8935cae7dbae64dad11c744b410b4074151dc7c611dccde9adecec172fa
Instruction Fuzzy Hash: 2E82D1B8A1010DDBDB06EBF4E5A4B6E7B73EB88300F105414EA4123799CF356D95EB26

Function 013135F0 Relevance: 3.9, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

(wq, xrefs: 013136B6
(wq, xrefs: 01313786
(wq, xrefs: 013137B2

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID: (wq$(wq$(wq
API String ID: 0-3966564304
Opcode ID: d1c5998ce6be7f1b8e4916315960c8250af6426798fd4dd62459085ff486e453
Instruction ID: 595e28c2e70bc30b4f8c64686c2b846a0d74b6247734dc531be7e812f212714a
Opcode Fuzzy Hash: d1c5998ce6be7f1b8e4916315960c8250af6426798fd4dd62459085ff486e453
Instruction Fuzzy Hash: 094148317081102BD75CB73998A037F6AD7EFD5260BA88839D806CB398DE349D0B87E5

Function 0131BEAF Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Tesq, xrefs: 0131BF75

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: 234335892ffe9ee967e6f745cb7920a44146dbe263a5db702f3ea3baf343ccb8
Instruction ID: d7ea04e0077b8e9eef9e893bb8a2f80609fef439cb2c116a7802265c2e0f297c
Opcode Fuzzy Hash: 234335892ffe9ee967e6f745cb7920a44146dbe263a5db702f3ea3baf343ccb8
Instruction Fuzzy Hash: A1416F747105019FC748DF3EC898A6EBBE6FF89710B6584A9E506DB3B5CA70EC018B90

Function 0131BEC0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Tesq, xrefs: 0131BF75

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: 24bef52b7cb5e5f89ba61d1cba84a143fb52651def2f07916d43be530c2c86f8
Instruction ID: 81ac645f8b5f9c05dac805cd038b890cd6025f873886f926cb2936ea4007f559
Opcode Fuzzy Hash: 24bef52b7cb5e5f89ba61d1cba84a143fb52651def2f07916d43be530c2c86f8
Instruction Fuzzy Hash: 1E315C747105008FC748EF3EC498A6EBBE6BF89710B6580A8E506DB3B5CA70EC018B90

Function 01312B10 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

LRsq, xrefs: 01312B35

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID: LRsq
API String ID: 0-3165563352
Opcode ID: 86d5840b30c0edfe48436b8f64cfad86090f2ba45c683405f7f269c1b3ef2eb9
Instruction ID: 9d93ea8c2439a819b31bb054e9d91af6c69676d67d80650f69394073325784f1
Opcode Fuzzy Hash: 86d5840b30c0edfe48436b8f64cfad86090f2ba45c683405f7f269c1b3ef2eb9
Instruction Fuzzy Hash: 0A310A317002158FD749AB39C5A5A6E33E3EFC9A54F618068D10ACB3A8DE75DC478B94

Function 01312B20 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

LRsq, xrefs: 01312B35

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID: LRsq
API String ID: 0-3165563352
Opcode ID: 027ff8b8a1fdf9903f46475fc0ac5c12c85030a5c9fe409855a1f8db53b7fd09
Instruction ID: d8162784df31e1454e27c9631434c76e428a4efa649e3d95f9dc8a063a9799bf
Opcode Fuzzy Hash: 027ff8b8a1fdf9903f46475fc0ac5c12c85030a5c9fe409855a1f8db53b7fd09
Instruction Fuzzy Hash: 263109317002058FD74AEB39C5A5A6E33F3EFC9A10B218168D10A8B3A8DE75DC478B84

Function 01314248 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

(wq, xrefs: 01314295

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID: (wq
API String ID: 0-1062398946
Opcode ID: d9f3a5aa0972ab096d1063308ce7457e047a2a8e5d30523bb69d07d96b57d1fb
Instruction ID: af873ca5e4fa1aebc927b46edf5bf277610cdbd92d34177248be777cb524130b
Opcode Fuzzy Hash: d9f3a5aa0972ab096d1063308ce7457e047a2a8e5d30523bb69d07d96b57d1fb
Instruction Fuzzy Hash: 3B01683270C1801BD70EA37D64641BE7FA3EFD6610388449FD441CB645CE289D4AC3D5

Function 013137F0 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

(wq, xrefs: 01313820

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID: (wq
API String ID: 0-1062398946
Opcode ID: e7eb1008a563be1af7ba21e8ab07ea9e15ecf8d84af493b998ef25a0e8aae248
Instruction ID: c14a1804253397e8a0623d264d60bc39676c7662bd519caddebffefc38767434
Opcode Fuzzy Hash: e7eb1008a563be1af7ba21e8ab07ea9e15ecf8d84af493b998ef25a0e8aae248
Instruction Fuzzy Hash: F6F09E327081501BC70D677E585017E3EEBDFC5230B54422AEA05C73D0DE655C0B43A1

Function 01311058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fc43ea7ab472c9983b1dec927ed9cf5b14aff36a5be357c96c01dbbf62aec2c
Instruction ID: 6b1b8f30279fff25b7b6daa4796f3bc73127bb0d1ba192387e513457e8bebf67
Opcode Fuzzy Hash: 9fc43ea7ab472c9983b1dec927ed9cf5b14aff36a5be357c96c01dbbf62aec2c
Instruction Fuzzy Hash: FC82D1B8A1010DDBDB06EBF4E5A4B6E7B73EB88300F105414EA4123799CF356D91EB26

Function 0131B0B0 Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45eb5daf503560cbb861d9e7bbca1edda33466be6729a07fe60acd1b43cef887
Instruction ID: 73188814fc447b24f56a06258525052a6ba7ca5ecd7b9008bd349231606017ea
Opcode Fuzzy Hash: 45eb5daf503560cbb861d9e7bbca1edda33466be6729a07fe60acd1b43cef887
Instruction Fuzzy Hash: 18521834B11205CFCB69EF28E5A856DBBB3FF84305B64846AE5069B269DF31EC45CB40

Function 0131BB99 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aec38a741212991e714b7b834e0d750f11e7c177030deb90966553803858f51
Instruction ID: 4bbb8170a48c0f3461dab74fa86d54f7fdf46fcd1065500c009e1b02a8d2411d
Opcode Fuzzy Hash: 6aec38a741212991e714b7b834e0d750f11e7c177030deb90966553803858f51
Instruction Fuzzy Hash: 0A81257860210ACFC79AEF18E5A9919BBB3FF80305B55C56AD5058B22DCB30EC85DF91

Function 0131385A Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c53d51158e34592d9220f52c70e9b81ea5b09a569e9cad04137c43bdc9be15
Instruction ID: 79e46c0a6ee20c8ccc9affb2869a5b28502a69d599f99f013908c6a0e59c5ac8
Opcode Fuzzy Hash: 10c53d51158e34592d9220f52c70e9b81ea5b09a569e9cad04137c43bdc9be15
Instruction Fuzzy Hash: 7C61FA75A11218EFDB09DFA9E894AAEBFB7FF88310F108015E905A7364DB35AC41DB50

Function 01315AA0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56ba163e1fc5fc6468a972cbbde33391dc453673245f43c5da9814b309f956e1
Instruction ID: 3183268524ea3cba7c15b8e80ca39b18696dd2faba58e59eb8da4f11c71a3510
Opcode Fuzzy Hash: 56ba163e1fc5fc6468a972cbbde33391dc453673245f43c5da9814b309f956e1
Instruction Fuzzy Hash: 17511A75B002068FCB08DF69D594AAEBBF6FF89314B5141A9E506DB365DB30EC05CBA0

Function 01315240 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93fb4a4d81f17845eff64adf343f394573dd1ebdaaaef4d0816910ad463bfd06
Instruction ID: f728056b82a793ee0009d592f1682a8f2e0cd05750734b6507f684cf0c825cf8
Opcode Fuzzy Hash: 93fb4a4d81f17845eff64adf343f394573dd1ebdaaaef4d0816910ad463bfd06
Instruction Fuzzy Hash: 3A512B71A00118DFDF08DFA9D494AAEBBF2BFC9315F158469E906A7358DB709C41CB90

Function 01312850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c90402a688bd935e2e207799f79699ea8ad82b0bb03400f4ca19cdd55e6d1e4
Instruction ID: db92d1d5cb01bdbc41ae91c093a9820cf0c63e5f955516a368db20625b453204
Opcode Fuzzy Hash: 4c90402a688bd935e2e207799f79699ea8ad82b0bb03400f4ca19cdd55e6d1e4
Instruction Fuzzy Hash: 0B41F775A10208DFDB18EFA9D8949EEBBB2FF88350F205529E901A7358DF705945CF60

Function 01315A91 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c168c3f985eced38c51fedc2bcfe53a888ba7ea661888772c60a455f6a44adc9
Instruction ID: 5591791d002f4e338189ecb3d32b7538d7073ecd26add324d1d99fb33b082f93
Opcode Fuzzy Hash: c168c3f985eced38c51fedc2bcfe53a888ba7ea661888772c60a455f6a44adc9
Instruction Fuzzy Hash: C5317C75B005068FCB08DF69C8D4AAABBF5FF89314B514169E509DB325DB30EC01CBA0

Function 0131B0A0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58cc9c5b3b183e777e0a5db7aba3d471c8370dbb34b8d5ecf15bc8dc7b933d60
Instruction ID: 48e4e186a14a867db6fdc13325ab63814f561bef19446fc896943a1003fae6ac
Opcode Fuzzy Hash: 58cc9c5b3b183e777e0a5db7aba3d471c8370dbb34b8d5ecf15bc8dc7b933d60
Instruction Fuzzy Hash: 5B3107717102198FC718EB79E8952ADBBB2FF85310F448A2ED1059B399DF7469098B90

Function 01312842 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f02b2ff16e1bad54d4f8033e6fc620b5daae3f06753573d9dde2bc4e013c377
Instruction ID: 0be9d949ace29ea92d2f49a4f8cfaf1fb78c0862c9b7340927b5181da4276729
Opcode Fuzzy Hash: 5f02b2ff16e1bad54d4f8033e6fc620b5daae3f06753573d9dde2bc4e013c377
Instruction Fuzzy Hash: 38313D71D10208DFDB18EFA9D8946EEBBB2FF88354F205529E501A7258EF305945CB61

Function 01315308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c3cd68bdef55c091db2192aabd79d1c5cd7c5aa9e95ae512fe12f3b3522c9a
Instruction ID: 08311a76c56bb0bef9f6f759963466cc2fe419f33e1de13e18d1e9483e699fa7
Opcode Fuzzy Hash: e8c3cd68bdef55c091db2192aabd79d1c5cd7c5aa9e95ae512fe12f3b3522c9a
Instruction Fuzzy Hash: 95410B75A01118DFCB08EF68E494AADBBF3FF88315F208065E906A7368DB749D41CB50

Function 01312C48 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f402e38611c28acfc8fa36b8d6c51f8f441161d94d496e720a51c1a6867b66
Instruction ID: b01f76a0c844671960e2adbec647715ec989827ac53694bf55fc95e8cba2c459
Opcode Fuzzy Hash: 50f402e38611c28acfc8fa36b8d6c51f8f441161d94d496e720a51c1a6867b66
Instruction Fuzzy Hash: 6441107490020DCFDB44EFA8D8A56EEBBB2FF48314F504525E901A7354DB709985CF91

Function 01312C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed5fdefcb02fd356f8f63f273a7e0b92a70cda2280f143c007426f57a683c207
Instruction ID: 0bbb353b33a7be56d2ae2ecda5c67ce9f6b31b66fea501743d5ce53c26ead618
Opcode Fuzzy Hash: ed5fdefcb02fd356f8f63f273a7e0b92a70cda2280f143c007426f57a683c207
Instruction Fuzzy Hash: D1310F7490020ECFCB48EFA8D4956EEBBB2FF88314F105529E901A7358DB709985CFA1

Function 0131288D Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a47781e3efd2199a3a838ee34737ab9adcea44614191373f3f9612782b558e
Instruction ID: aa68f2554e1a02b8b27a017e7ea7eb474c29960acc607d5868723c4e4725b9b9
Opcode Fuzzy Hash: d1a47781e3efd2199a3a838ee34737ab9adcea44614191373f3f9612782b558e
Instruction Fuzzy Hash: D131F875A1020CDFDB18EFA9E8946EDBBB2FF88354F20552AE901A7258DF705845CB20

Function 01314B70 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89333645499d1eac395311d69ac21bc8ed969f636e315bfe52c3eabc6e141de8
Instruction ID: 0ea06e7c773c2d0931dd8b4c50f74f0ce97cdca004c5d7cf4c59b7ef655768ae
Opcode Fuzzy Hash: 89333645499d1eac395311d69ac21bc8ed969f636e315bfe52c3eabc6e141de8
Instruction Fuzzy Hash: 2021B5712042056BC709FB79ECD06AEB7A6FFC0310B444E29E0058B255DF70AD498BE5

Function 01314B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bab450afd2bee3bfe58f7ac2903eaf93767cf86a0c87ca94e09187062c27ce3
Instruction ID: 991efa0ff1ebf850b6e55a3ab166da618d92a36c79b8bb33acf985c1e3bf8640
Opcode Fuzzy Hash: 5bab450afd2bee3bfe58f7ac2903eaf93767cf86a0c87ca94e09187062c27ce3
Instruction Fuzzy Hash: 3B21D8702142066BC708FB79E8D0AAEB7A7FFC4350B408E28E4058B614DF70BD499BE5

Function 01315C41 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1a4d7c0a565ab9dbf67f7571256ee1f34e43d1ebe591847f513eb209ec239ec
Instruction ID: 6d54280d1421dc06545db0412b63b51c140c23e454004af7b775582692608dd0
Opcode Fuzzy Hash: e1a4d7c0a565ab9dbf67f7571256ee1f34e43d1ebe591847f513eb209ec239ec
Instruction Fuzzy Hash: 0921AF71A042488FDB05CBA8C998BDC7FF1AF49314F15419AD401FB366CB359D44CB60

Function 01312908 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fbfe1deba25f0bf8b5004d201afd6a2377844a01015dd03c715f5ebbda2c56d
Instruction ID: 733242ef57e9578ec37a2bbc8cfcbf846599cfdb4d2b1afc383c453839a9d1fe
Opcode Fuzzy Hash: 6fbfe1deba25f0bf8b5004d201afd6a2377844a01015dd03c715f5ebbda2c56d
Instruction Fuzzy Hash: 0E21E6B5E1010C9FDB18EFA9D8909EEBBB2FF88340F10852AE915A7258DF705855CF61

Function 01316888 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99f4439da9a60f16c409e74196dda388ef9d6996611f44327b8ca1fc3d2e9e7
Instruction ID: 46410b077bb11b6e13c186949531b15385290d5040f2cf9c0054ca9892d7fad1
Opcode Fuzzy Hash: c99f4439da9a60f16c409e74196dda388ef9d6996611f44327b8ca1fc3d2e9e7
Instruction Fuzzy Hash: 2221B4B1900209CFDF58DFE9CA4A7EEBBF2EF44308F508469C401A7255DBB59905CB51

Function 01315C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 997b8fe36ddb9e64ac45bf3f3cd972fbb4b01ab99a1fd6610254d1b3b8fb167a
Instruction ID: 38b33c228969319d2d9a92121c8818a6958faeb76b20c437e4cae5b7f01ad59b
Opcode Fuzzy Hash: 997b8fe36ddb9e64ac45bf3f3cd972fbb4b01ab99a1fd6610254d1b3b8fb167a
Instruction Fuzzy Hash: 02213675A002188FDF14CBA9D588ADDBBF1AF8C314F6001A9E505BB365DB75AD84CBA0

Function 0131296A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d24a584106f7cb75df1b0a669d30f453996468998c940fce7e106636d77a242
Instruction ID: a1c285af27c9a32499dba4cfa20c0d77aa89e4c26d921332b5c345f912f93622
Opcode Fuzzy Hash: 1d24a584106f7cb75df1b0a669d30f453996468998c940fce7e106636d77a242
Instruction Fuzzy Hash: 1221C67591020CDFDB18EFA8D4909EDBBB2FF88340F20452AE905A7354DB705955CF61

Function 013141A2 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba3cff96d0c2241fcbfe41968d53bde3ee9c77793bcdbef527201ddaaa22979
Instruction ID: d8e09de5eb59115171dc38924a30b3506310d80fba69e1fbf821b8136bb7a0d3
Opcode Fuzzy Hash: bba3cff96d0c2241fcbfe41968d53bde3ee9c77793bcdbef527201ddaaa22979
Instruction Fuzzy Hash: FF01243130C2816FC74AA7759CB41EE7FBAEFC6211394089BE405D7286CE211C0A87B5

Function 01315911 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d331732944fb94b644879166a4092ab7c216df7ffd262b95e0dbbe9290d00a13
Instruction ID: ec6e2c23d8966cad75dcbce3eb9f522e9262472ba32f0cbf2aa079d6ffab09c5
Opcode Fuzzy Hash: d331732944fb94b644879166a4092ab7c216df7ffd262b95e0dbbe9290d00a13
Instruction Fuzzy Hash: 8E0126733252005FC345AB29E8A9A9ABFB6EFDA261719406BE844C7352CA30DC05C7B1

Function 013132E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c9c2363ff2d0c799fc8612c61fcb4e0800139ad50c6ed6c8947f8a95f5fb00
Instruction ID: 70e5e6c27f682b4019ebd75cb1ad79204e84b0921c9bf2078c2b22c0c8bfbb92
Opcode Fuzzy Hash: 56c9c2363ff2d0c799fc8612c61fcb4e0800139ad50c6ed6c8947f8a95f5fb00
Instruction Fuzzy Hash: F4118035A251049BCB0CEFB8E8697EE7FB6AB88325F404429E402D7345DF795805CB60

Function 01315940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133f660cbfd0b9de8d87bdd4dd7e10f9e907af0abc6a08fc2ac433acf61bea2f
Instruction ID: 16b94a2199cf9a49b645a71eb5ef87402f523bb2e6ad888dec01124bc1fc6e9a
Opcode Fuzzy Hash: 133f660cbfd0b9de8d87bdd4dd7e10f9e907af0abc6a08fc2ac433acf61bea2f
Instruction Fuzzy Hash: 890181767111109B8708EA69E4988AAB7A6EBC9665350457AEA05C7314CE319C0587A0

Function 01312A80 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 242fe5b473fb65db1cd092aa5bb1d33cc1e53a10bb5d7690562742038403280b
Instruction ID: 6769a576fa3d4842916aa6cdaf2e8cc0cacaa72908cdd54c008b9a1e89bb43fd
Opcode Fuzzy Hash: 242fe5b473fb65db1cd092aa5bb1d33cc1e53a10bb5d7690562742038403280b
Instruction Fuzzy Hash: B0018B752106108FC310EB29C498A9BBBF2FF84614B948DA9D54ADF324EF71EC088BD0

Function 013132F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcbe9575ea623515bee23c1b0612ccb29c121b527196618877b7601a3870a50f
Instruction ID: 446ffc80c1a29421a96b6fbe922ba21b8cb40efcaaaeaca8a7ee5599db1dccde
Opcode Fuzzy Hash: bcbe9575ea623515bee23c1b0612ccb29c121b527196618877b7601a3870a50f
Instruction Fuzzy Hash: 2A011235A251448FDB0CEFB8E5697EE7FF6AB88325F404428E50297345DF755805CB60

Function 01312A90 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b043aeb27d833ded04a4eaf4aacd1b7fbacee2d01ec250578d2eb3db49496e
Instruction ID: bab33d8cf42cf214a77207390cd96c999e23598af09a7ad5b3520e23de30203e
Opcode Fuzzy Hash: e2b043aeb27d833ded04a4eaf4aacd1b7fbacee2d01ec250578d2eb3db49496e
Instruction Fuzzy Hash: F3F046756506008FC314EB29C44889BBBF2FF846247508DA9D54ADB324EF71EC088BD0

Function 01314237 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffa763707bb99126e7763cf6034894acc6499507d38be88857d0b5edac6dbeed
Instruction ID: d1ee61b3432d3edb2b447d7361ea6a1080add109450b9069a006f4625a884ea4
Opcode Fuzzy Hash: ffa763707bb99126e7763cf6034894acc6499507d38be88857d0b5edac6dbeed
Instruction Fuzzy Hash: 18F0553220411027C61CE62DEC907FF7B97EFC0721F88092EE801DB604CE71AC8646E4

Function 01316388 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf5b415b32e37990c76db0f800c4591b4dd5ff04139d021b1a2f65cf0bf6d3d
Instruction ID: e0a10265a42875a8c4653b7569753469c25698f4026d3df6b711855be53d65a5
Opcode Fuzzy Hash: 5bf5b415b32e37990c76db0f800c4591b4dd5ff04139d021b1a2f65cf0bf6d3d
Instruction Fuzzy Hash: F9F090B4E00209BFCB44EBB4D8956EDBBB5EF54300F505959D808E7340DB305E09ABA1

Function 01316398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c70949c9c0f821a4b500772a715dedb0d0ce368352e16b7353f71ebc71511484
Instruction ID: f2e2a9aaf9a5d6c0d484248c461db9889e98897b91fe2686845abb4720e5ca1f
Opcode Fuzzy Hash: c70949c9c0f821a4b500772a715dedb0d0ce368352e16b7353f71ebc71511484
Instruction Fuzzy Hash: 1DF01274E04209EFCB44EFB8D9955ADBBB5EF54300F5049999808A7344DB306E489B95

Function 01312D92 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccf0fc3c185aa5acb17799923d26378fbc650630418ca0b083a46080f8dfa5f8
Instruction ID: cbefab24bcca1e77b889f372efd1b50167e5737a881ee048af91183c0a3933e3
Opcode Fuzzy Hash: ccf0fc3c185aa5acb17799923d26378fbc650630418ca0b083a46080f8dfa5f8
Instruction Fuzzy Hash: A7F08C35F100188FCB84EFBCC4556EABBF4EB48204B2080AAD569E3700EB308E018BA1

Function 01315610 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b92bf891b02681cc39822dc9598dc2f349c4bd1a2eb7884c4e9b2fb3e4db2e
Instruction ID: 0ace0c8056e3ca0adbe8599188bc6c64f2cc451e1bd34fbba27b48e5a66ba875
Opcode Fuzzy Hash: e7b92bf891b02681cc39822dc9598dc2f349c4bd1a2eb7884c4e9b2fb3e4db2e
Instruction Fuzzy Hash: 7AE0867241934A4FD7870F14EC4A6E07F35EB53239B5882FAE844C5252D726CC168B80

Function 01311FF8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb0787d0dcd6c9e271a479eae2b90b70b508f64d30edcf006f96d9f9d70a3ea
Instruction ID: a16504d50642dd913d4920a70190d60ccf7409df57fae4f5408e10031ca06047
Opcode Fuzzy Hash: 6eb0787d0dcd6c9e271a479eae2b90b70b508f64d30edcf006f96d9f9d70a3ea
Instruction Fuzzy Hash: 26E04F363101144BCB1857BED86DBDA7BE9EFC9666B440466F505C7320DE75CC0186B0

Function 01312DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f01fbfdd9c587dd9bea702bd6284b47da3c0b8c0f33ad0b9d4cb241a847d725
Instruction ID: b883c945f401b437bac2a7b448b576f2b3acad76cf70b84fbd668d688b7b3933
Opcode Fuzzy Hash: 2f01fbfdd9c587dd9bea702bd6284b47da3c0b8c0f33ad0b9d4cb241a847d725
Instruction Fuzzy Hash: ACE0C975E101188FCB84EFADD5456EE7BF5EB48214B6140AAD519E7310EB709E018B91

Function 013137EE Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8136a1ccc2b646a96ea0c4bb4ccad309e6a503ef72c22234a5abed97dc0efe
Instruction ID: 679dae922aa48f23b58c2543969c86751b9d54d1c47ebf879a2114592abf6f30
Opcode Fuzzy Hash: ff8136a1ccc2b646a96ea0c4bb4ccad309e6a503ef72c22234a5abed97dc0efe
Instruction Fuzzy Hash: F2D02EB370020057CB0C96AAA844ABA379FEBC8231B08422AFE08C3254EEA198065390

Function 01312008 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a7c4f569d940bc1da5b6bb5f77d4e9dd5489fc1db9c7cc4d746c16524eb937
Instruction ID: 6353c09c7ff5c750ccc27fc5c99dd2fd4907116a3f406d97687fa63ab2811b2a
Opcode Fuzzy Hash: 12a7c4f569d940bc1da5b6bb5f77d4e9dd5489fc1db9c7cc4d746c16524eb937
Instruction Fuzzy Hash: F4D017357112148FCB186ABEE41C89A7BEAEFC962234108AAF50AC7320DE71DC0187A0

Function 013166C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df1578196e3f3c7eba422a6d24a2db2ac64a46598ce14771c5cce824b1527dad
Instruction ID: cc2241cc339700b1459bec9c4b67581301402d97c3aa2c5737d7c50f725346b2
Opcode Fuzzy Hash: df1578196e3f3c7eba422a6d24a2db2ac64a46598ce14771c5cce824b1527dad
Instruction Fuzzy Hash: 88D0A73232002053C654111CBC9A3EAB2ADE7C4A61B89003BF101D7304DE14880143A6

Function 01316469 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8296e4796c55f8ffb1868ef95472ec3d39081cf18d581673d37f43d0e4438ac2
Instruction ID: a1f2b1d95a86e147a6980c876eb65741235e0c901fc0a0fb9f01ad56caa03ed9
Opcode Fuzzy Hash: 8296e4796c55f8ffb1868ef95472ec3d39081cf18d581673d37f43d0e4438ac2
Instruction Fuzzy Hash: D6D0A7753183044FC3449718D8E59A277F6EB8C71074004EAE508C737ADE20EC41CA69

Function 01316478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed95149ebb1d62c17cc4b72891ae5dea3de03ab7b5dd87513ee53e160848a2e5
Instruction ID: 68f668f931578924cee2c82dca42af83998760bf64e0b11d5dfa19937c1f7a35
Opcode Fuzzy Hash: ed95149ebb1d62c17cc4b72891ae5dea3de03ab7b5dd87513ee53e160848a2e5
Instruction Fuzzy Hash: 8AC012743442044FC208EB5CD09082573E6EB8C71031004A9E909C7779CE20EC418A58

Function 01315640 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.3752192702.0000000001310000.00000040.00000800.00020000.00000000.sdmp, Offset: 01310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_1310000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2951d908f013a2fb324ecad794ff71c3357ca73306b39c176799e735d5707e17
Instruction ID: 367a40d702546c429045fef3ca8fc1cdeab41582af46dc5942b7efd8c89c084c
Opcode Fuzzy Hash: 2951d908f013a2fb324ecad794ff71c3357ca73306b39c176799e735d5707e17
Instruction Fuzzy Hash: 39B02B3012020957D6050E1ABC094113F1DEB810393000194BD0840100ED23C41000D0

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\huge[1].dat

C:\Users\user\AppData\Local\Temp\39FF.exe

C:\Users\user\AppData\Local\Temp\nsi3790.tmp\INetC.dll

C:\Users\user\AppData\Local\Temp\nsi3790.tmp\blowfish.dll

C:\Users\user\AppData\Local\Temp\nsi3790.tmp\nsProcess.dll

C:\Users\user\AppData\Local\Temp\nsm803B.tmp

C:\Users\user\AppData\Local\Temp\nswE436.tmp\liteFirewall.dll

C:\Users\user\AppData\Local\Temp\setup.exe

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_0

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_1

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_2

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_3

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre