Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1467829
MD5:	e337b912b6816939b56c2c03859cabb4
SHA1:	fbb4ad3e5c3cac638d075b1add6db11c55c50794
SHA256:	9d7926dac81c4f7200c84298c7839162a2996339262f58bd815d2a94c380a151
Tags:	exeSmokeLoader
Infos:

Detection

LummaC, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected LummaC Stealer

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Query firmware table information (likely to detect VMs)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Too many similar processes found

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 3500 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E337B912B6816939B56C2C03859CABB4)

explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

23E4.exe (PID: 320 cmdline: C:\Users\user\AppData\Local\Temp\23E4.exe MD5: BD2EAC64CBDED877608468D86786594A)

5371.exe (PID: 6444 cmdline: C:\Users\user\AppData\Local\Temp\5371.exe MD5: 60172CA946DE57C3529E9F05CC502870)

setup.exe (PID: 1712 cmdline: "C:\Users\user\AppData\Local\Temp\setup.exe" MD5: FF2293FBFF53F4BD2BFF91780FABFD60)

GamePall.exe (PID: 6676 cmdline: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 3440 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2624 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1272 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1888 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5324 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6856 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 4912 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5480 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2576 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1852 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2992 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 616 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1580 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 892 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 7152 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2424 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1256 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6456 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6996 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 3220 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3472 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2140 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3660 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2364 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3592 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1856 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720115578234356 --launch-time-ticks=4603408239 --mojo-platform-channel-handle=3948 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 3452 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720115578234356 --launch-time-ticks=4603422960 --mojo-platform-channel-handle=4012 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5168 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5692 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 3876 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 4260 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

aggtjfs (PID: 5864 cmdline: C:\Users\user\AppData\Roaming\aggtjfs MD5: E337B912B6816939B56C2C03859CABB4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: LummaC

{"C2 url": ["pedestriankodwu.xyz", "towerxxuytwi.xyz", "ellaboratepwsz.xyz", "penetratedpoopp.xyz", "swellfrrgwwos.xyz", "contintnetksows.shop", "foodypannyjsud.shop", "potterryisiw.shop", "potterryisiw.shop"], "Build id": "bOKHNM--"}

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://evilos.cc/tmp/index.php", "http://gebeus.ru/tmp/index.php", "http://office-techs.biz/tmp/index.php", "http://cx5519.com/tmp/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2079888304.0000000002D8E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x76e8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000003.2468539842.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000003.2484065314.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2079676068.0000000002C20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2079676068.0000000002C20000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000003.2498316899.0000000000B59000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000003.2468539842.0000000000B43000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000003.2467985016.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000003.2457202713.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000003.2484065314.0000000000B43000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2324008509.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.2324008509.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000004.00000002.2323963441.0000000002D80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.2323963441.0000000002D80000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000003.2467985016.0000000000B43000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000003.2498215186.0000000000BA2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2079658197.0000000002C10000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000005.00000003.2446354815.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2324083099.0000000002E1F000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6c80:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000002.2323917643.0000000002D70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000005.00000003.2498005958.0000000000B43000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2080052883.0000000004851000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2080052883.0000000004851000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
Process Memory Space: 23E4.exe PID: 320	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 23E4.exe PID: 320	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 23E4.exe PID: 320	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 21 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\setup.exe, ProcessId: 1712, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GamePall

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\aggtjfs, CommandLine: C:\Users\user\AppData\Roaming\aggtjfs, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\aggtjfs, NewProcessName: C:\Users\user\AppData\Roaming\aggtjfs, OriginalFileName: C:\Users\user\AppData\Roaming\aggtjfs, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: C:\Users\user\AppData\Roaming\aggtjfs, ProcessId: 5864, ProcessName: aggtjfs

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://foodypannyjsud.shop/piy	Avira URL Cloud: Label: malware
Source: http://cx5519.com/tmp/index.php	Avira URL Cloud: Label: malware
Source: http://evilos.cc/tmp/index.php	Avira URL Cloud: Label: malware
Source: ellaboratepwsz.xyz	Avira URL Cloud: Label: malware
Source: swellfrrgwwos.xyz	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/apiP	Avira URL Cloud: Label: malware
Source: foodypannyjsud.shop	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop:443/apiOYFBOLXA.pdfPK	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Avira: detection malicious, Label: HEUR/AGEN.1313486
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Avira: detection malicious, Label: HEUR/AGEN.1359405
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\huge[1].dat	Avira: detection malicious, Label: HEUR/AGEN.1359405
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Avira: detection malicious, Label: HEUR/AGEN.1359405
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Avira: detection malicious, Label: HEUR/AGEN.1352426

Found malware configuration

Source: 00000000.00000002.2079676068.0000000002C20000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://evilos.cc/tmp/index.php", "http://gebeus.ru/tmp/index.php", "http://office-techs.biz/tmp/index.php", "http://cx5519.com/tmp/index.php"]}
Source: 23E4.exe.320.5.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["pedestriankodwu.xyz", "towerxxuytwi.xyz", "ellaboratepwsz.xyz", "penetratedpoopp.xyz", "swellfrrgwwos.xyz", "contintnetksows.shop", "foodypannyjsud.shop", "potterryisiw.shop", "potterryisiw.shop"], "Build id": "bOKHNM--"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\23E4.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\5371.exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Roaming\aggtjfs	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\GamePall\Del.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GamePall

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\WidevineCdm\_platform_specific\win_x86\widevinecdmadapter.dll.pdb source: widevinecdmadapter.dll.9.dr
Source:	Binary string: libEGL.dll.pdb source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\work\newContent\secondBranch\new\GamePall\obj\Release\GamePall.pdb source: GamePall.exe, 0000000A.00000000.3646470195.00000000001A2000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdb source: GamePall.exe, GamePall.exe, 0000000D.00000002.3915071142.0000000005912000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdbSHA256 source: GamePall.exe, 0000000D.00000002.3915071142.0000000005912000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdbLK source: GamePall.exe, 00000014.00000002.3758165596.0000000004FE2000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\WidevineCdm\_platform_specific\win_x86\widevinecdmadapter.dll.pdbGCTL source: widevinecdmadapter.dll.9.dr
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdb source: GamePall.exe, GamePall.exe, 00000014.00000002.3758165596.0000000004FE2000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: libGLESv2.dll.pdb source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Xilium.CefGlue.pdb source: setup.exe, 00000009.00000002.3996841528.000000000068A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \swiftshaderXilium.CefGlue.pdb source: setup.exe, 00000009.00000002.3996841528.000000000068A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *?\|<>/":%s%s.dllC:\Users\user\AppData\Roaming\GamePall\GamePall.exewall.dlldll.pdbC:\Users\user\AppData\Roaming\GamePall\Uninstall.exeePalll source: setup.exe, 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\libGLESv2.dll.pdb source: libGLESv2.dll0.9.dr

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Directory queried: number of queries: 1659

Source: C:\Users\user\AppData\Local\Temp\5371.exe	Code function: 8_2_00405B4A CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	8_2_00405B4A
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Code function: 8_2_004066FF FindFirstFileA,FindClose,	8_2_004066FF
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Code function: 8_2_004027AA FindFirstFileA,	8_2_004027AA
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 9_2_00405B4A CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	9_2_00405B4A
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 9_2_004066FF FindFirstFileA,FindClose,	9_2_004066FF
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 9_2_004027AA FindFirstFileA,	9_2_004027AA

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 77.221.157.163 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 127.0.0.127 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 152.231.127.132 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 188.114.96.3 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.149.100.242 443	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: pedestriankodwu.xyz
Source: Malware configuration extractor	URLs: towerxxuytwi.xyz
Source: Malware configuration extractor	URLs: ellaboratepwsz.xyz
Source: Malware configuration extractor	URLs: penetratedpoopp.xyz
Source: Malware configuration extractor	URLs: swellfrrgwwos.xyz
Source: Malware configuration extractor	URLs: contintnetksows.shop
Source: Malware configuration extractor	URLs: foodypannyjsud.shop
Source: Malware configuration extractor	URLs: potterryisiw.shop
Source: Malware configuration extractor	URLs: potterryisiw.shop
Source: Malware configuration extractor	URLs: http://evilos.cc/tmp/index.php
Source: Malware configuration extractor	URLs: http://gebeus.ru/tmp/index.php
Source: Malware configuration extractor	URLs: http://office-techs.biz/tmp/index.php
Source: Malware configuration extractor	URLs: http://cx5519.com/tmp/index.php

Source: Joe Sandbox View	IP Address: 77.221.157.163 77.221.157.163
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 104.21.45.251 104.21.45.251

Source: Joe Sandbox View	ASN Name: INFOBOX-ASInfoboxruAutonomousSystemRU INFOBOX-ASInfoboxruAutonomousSystemRU
Source: Joe Sandbox View	ASN Name: ENTELCHILESACL ENTELCHILESACL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/1085
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/1423136
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/1423136dumpTranslatedShadersWrite
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/1452
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/1452expandIntegerPowExpressionsThe
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/1512
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/1637
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/1936
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/2046
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/2152
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/2152skipVSConstantRegisterZeroIn
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/2162
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/2273
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/2517
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/2894
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/2970
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/2978
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3027
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3078
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3205
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3206
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3246
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3246allowClearForRobustResourceInitSome
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3452
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3498
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3502
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3577
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3584
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3586
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3623
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3624
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3625
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3682
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3682allowES3OnFL100Allow
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3729
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3832
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3862
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3965
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3970
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/3997
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/4214
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/4267
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/4324
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/4384
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/4405
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/4428
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/4551
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/4633
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/4646
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/4722
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/482
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/4836
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/4901
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/4937
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5007
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5007disableDrawBuffersIndexedDisable
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5055
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5061
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5281
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5371
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5375
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5421
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5430
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5469
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5535
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5577
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5658
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5658forceGlErrorCheckingForce
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5750
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5750forceRobustResourceInitForce-enable
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5881
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5901
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/5906
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/6041
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/6041forceInitShaderVariablesForce-enable
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/6048
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/6141
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/6248
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/6439
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/6651
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/6692
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/6755
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/6860
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/6876
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/6878
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/6929
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/6953
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7036
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7036dumpShaderSourceWrite
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7047
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7172
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7279
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7279cacheCompiledShaderEnable
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7370
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7406
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7488
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7527
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7553
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7556
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7724
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7724disableAnisotropicFilteringDisable
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7760
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7760enableShaderSubstitutionCheck
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7761
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/7761disableProgramCachingDisables
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/8162
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/8172
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/8215
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/8229
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/8280
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/8280enableTranslatedShaderSubstitutionCheck
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/8291
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://anglebug.com/8297
Source: GamePall.exe, 00000025.00000002.4208470703.00000000032A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.install-stat.debug.world/clients/activity
Source: GamePall.exe, 0000001B.00000002.4359179275.0000000002498000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 00000022.00000002.4414982018.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 00000025.00000002.4208470703.00000000031F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.install-stat.debug.world/clients/activity=4
Source: GamePall.exe, 00000015.00000002.4360441462.0000000002B28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.install-stat.debug.world/clients/activity=4P
Source: GamePall.exe, 00000011.00000002.3819047170.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.install-stat.debug.world/clients/activityh
Source: GamePall.exe, 00000025.00000002.4208470703.00000000032A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.install-stat.debug.world/clients/installs
Source: GamePall.exe, 00000013.00000002.3891933668.00000000027D7000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 00000015.00000002.4360441462.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 0000001B.00000002.4359179275.0000000002498000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 00000022.00000002.4414982018.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 00000025.00000002.4208470703.00000000031F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bageyou.xyz
Source: GamePall.exe, 0000000A.00000002.3936347863.0000000002717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bageyou.xyz/c/g
Source: GamePall.exe, 0000000A.00000002.3936347863.0000000002717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bageyou.xyz/c/g4
Source: 23E4.exe, 00000005.00000003.2468290461.000000000397D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 23E4.exe, 00000005.00000003.2468290461.000000000397D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: explorer.exe, 00000002.00000000.2070752921.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2070752921.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/1094869
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/110263
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/1144207
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/1171371
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/1181068
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/1181193
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/1420130
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/1434317
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/1456243
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/308366
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/403957
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/550292
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/565179
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/642227
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/642605
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/644669
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/650547
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/672380
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/709351
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/797243
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/809422
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/830046
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/883276
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/927470
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/941620
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere
Source: 23E4.exe, 00000005.00000003.2468290461.000000000397D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: explorer.exe, 00000002.00000000.2067597057.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: 23E4.exe, 00000005.00000003.2468290461.000000000397D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 23E4.exe, 00000005.00000003.2468290461.000000000397D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: explorer.exe, 00000002.00000000.2070752921.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2070752921.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: 23E4.exe, 00000005.00000003.2468290461.000000000397D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: explorer.exe, 00000002.00000000.2070752921.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2070752921.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: 23E4.exe, 00000005.00000003.2468290461.000000000397D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: libGLESv2.dll0.9.dr	String found in binary or memory: http://issuetracker.google.com/200067929
Source: GamePall.exe	String found in binary or memory: http://logging.apache.org/log4ne
Source: GamePall.exe, 00000014.00000002.3758165596.0000000004FE2000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://logging.apache.org/log4net/release/faq.html#trouble-EventLog
Source: setup.exe, setup.exe, 00000009.00000003.3646532816.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000009.00000000.3352160919.000000000040A000.00000008.00000001.01000000.0000000B.sdmp, setup.exe, 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmp, Uninstall.exe.9.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: 5371.exe, 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmp, 5371.exe, 00000008.00000000.2521165343.000000000040A000.00000008.00000001.01000000.00000007.sdmp, setup.exe, 00000009.00000003.3646532816.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000009.00000000.3352160919.000000000040A000.00000008.00000001.01000000.0000000B.sdmp, setup.exe, 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmp, Uninstall.exe.9.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000002.00000000.2070752921.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2070752921.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2468290461.000000000397D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000002.00000000.2070752921.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: 23E4.exe, 00000005.00000003.2468290461.000000000397D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: explorer.exe, 00000002.00000000.2070225953.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2069648943.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2070255132.0000000008890000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: GamePall.exe, 0000000A.00000002.3936347863.0000000002A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: GamePall.exe, GamePall.exe, 00000014.00000002.3758165596.0000000004FE2000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.apache.org/).
Source: GamePall.exe, GamePall.exe, 00000014.00000002.3758165596.0000000004FE2000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: GamePall.exe	String found in binary or memory: http://www.apache.org/licenses/LICEN
Source: GamePall.exe, 00000014.00000002.3758165596.0000000004FE2000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000002.00000000.2073342760.000000000C81C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: GamePall.exe, 00000011.00000002.4090183998.0000000006020000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: http://www.unicode.org/copyright.html
Source: 23E4.exe, 00000005.00000003.2468290461.000000000397D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 23E4.exe, 00000005.00000003.2468290461.000000000397D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 5371.exe, 00000008.00000003.4000452126.0000000000864000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xiexie.wf/22_551/huge.dat
Source: 5371.exe, 00000008.00000002.4002663411.0000000000851000.00000004.00000020.00020000.00000000.sdmp, 5371.exe, 00000008.00000003.4000153801.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xiexie.wf/22_551/huge.datF$
Source: 5371.exe, 00000008.00000003.4000153801.0000000000882000.00000004.00000020.00020000.00000000.sdmp, 5371.exe, 00000008.00000002.4002937849.0000000000882000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xiexie.wf/22_551/huge.datL
Source: 5371.exe, 00000008.00000002.4002663411.0000000000851000.00000004.00000020.00020000.00000000.sdmp, 5371.exe, 00000008.00000003.4000153801.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xiexie.wf/22_551/huge.datll
Source: 5371.exe, 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmp	String found in binary or memory: http://xiexie.wf/22_551/huge.datmCGBZvyfGQlwd
Source: 23E4.exe, 00000005.00000003.2446996263.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447100121.00000000039A6000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447457189.00000000039A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000002.00000000.2072714686.000000000C54B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000002.00000000.2069079716.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/4674
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/4830
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/4849
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/4966
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/5140
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/5536
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/5845
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/6574
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/7161
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/7162
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/7246
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/7246enableCaptureLimitsSet
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/7308
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/7319
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/7320
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/7369
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/7382
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/7405
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/7489
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/7604
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/7714
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/7847
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/7899
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/8308
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/8315
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://anglebug.com/8319
Source: explorer.exe, 00000002.00000000.2070752921.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000002.00000000.2069079716.0000000007637000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000002.00000000.2068335090.00000000035FA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.coml
Source: 23E4.exe, 00000005.00000003.2473344005.0000000003971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: 23E4.exe, 00000005.00000003.2446996263.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447100121.00000000039A6000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447457189.00000000039A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 23E4.exe, 00000005.00000003.2446996263.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447100121.00000000039A6000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447457189.00000000039A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 23E4.exe, 00000005.00000003.2446996263.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447100121.00000000039A6000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447457189.00000000039A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr, es-419.pak.9.dr	String found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: ar.pak.9.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=ar&category=theme81https://myactivity.google.com/myactivity/?u
Source: ar.pak.9.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=arCtrl$1
Source: bg.pak.9.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=bg&category=theme81https://myactivity.google.com/myactivity/?u
Source: bg.pak.9.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=bgCtrl$1
Source: ca.pak.9.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=ca&category=theme81https://myactivity.google.com/myactivity/?u
Source: ca.pak.9.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=caCtrl$1
Source: es-419.pak.9.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=es-419Ctrl$1
Source: ja.pak.9.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=ja&category=theme81https://myactivity.google.com/myactivity/?u
Source: ja.pak.9.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=jaCtrl$1
Source: lv.pak.9.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=lv&category=theme81https://myactivity.google.com/myactivity/?u
Source: lv.pak.9.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=lvCtrl$1
Source: te.pak.9.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=te&category=theme81https://myactivity.google.com/myactivity/?u
Source: te.pak.9.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=teCtrl$1
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, tr.pak.9.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=tr&category=theme81https://myactivity.google.com/myactivity/?u
Source: tr.pak.9.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=trCtrl$1
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=uk&category=theme81https://myactivity.google.com/myactivity/?u
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=ukCtrl$1
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=urCtrl$2
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=viCtrl$1
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CN&category=theme81https://myactivity.google.com/myactivity
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CNCtrl$1
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TW&category=theme81https://myactivity.google.com/myactivity
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TWCtrl$1
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr	String found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://chromium.googlesource.com/angle/angle/
Source: 23E4.exe, 00000005.00000003.2473344005.0000000003971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/1042393
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/1046462
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/1060012
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/1091824
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/1137851
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/1300575
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/1356053
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/593024
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/593024selectViewInGeometryShaderThe
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/650547
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/650547callClearTwiceUsing
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/655534
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/655534useSystemMemoryForConstantBuffersCopying
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/705865
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/710443
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/811661
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://crbug.com/848952
Source: 23E4.exe, 00000005.00000003.2446996263.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447100121.00000000039A6000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447457189.00000000039A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 23E4.exe, 00000005.00000003.2446996263.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447100121.00000000039A6000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447457189.00000000039A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 23E4.exe, 00000005.00000003.2446996263.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447100121.00000000039A6000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447457189.00000000039A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 00000002.00000000.2070752921.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: 23E4.exe, 00000005.00000003.2457202713.0000000000B5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/
Source: 23E4.exe, 00000005.00000003.2498005958.0000000000B43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/$
Source: 23E4.exe, 00000005.00000003.2498250189.0000000000BB3000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2498215186.0000000000BA2000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2498420759.0000000000BB5000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2498005958.0000000000B43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/M
Source: 23E4.exe, 00000005.00000003.2498363616.0000000000B5F000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2457202713.0000000000B5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/api
Source: 23E4.exe, 00000005.00000003.2544926449.0000000000B47000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000002.2545320949.0000000000B48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/apiP
Source: 23E4.exe, 00000005.00000003.2484065314.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/obM
Source: 23E4.exe, 00000005.00000003.2498250189.0000000000BB3000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2498215186.0000000000BA2000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2498420759.0000000000BB5000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2498005958.0000000000B43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/op
Source: 23E4.exe, 00000005.00000003.2484065314.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2498250189.0000000000BB3000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2498215186.0000000000BA2000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2498420759.0000000000BB5000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2498005958.0000000000B43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/pi
Source: 23E4.exe, 00000005.00000003.2457202713.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/piy
Source: 23E4.exe, 00000005.00000003.2498005958.0000000000B43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop:443/apiOYFBOLXA.pdfPK
Source: 23E4.exe, 00000005.00000003.2473344005.0000000003971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://issuetracker.google.com/161903006
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://issuetracker.google.com/166809097
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://issuetracker.google.com/184850002
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://issuetracker.google.com/187425444
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://issuetracker.google.com/220069903
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://issuetracker.google.com/220069903emulatePixelLocalStorageEmulate
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://issuetracker.google.com/229267970
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://issuetracker.google.com/250706693
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://issuetracker.google.com/253522366
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://issuetracker.google.com/255411748
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://issuetracker.google.com/258207403
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://issuetracker.google.com/274859104
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://issuetracker.google.com/284462263
Source: libGLESv2.dll0.9.dr	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr, es-419.pak.9.dr	String found in binary or memory: https://myactivity.google.com/
Source: explorer.exe, 00000002.00000000.2070752921.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, bg.pak.9.dr, ar.pak.9.dr	String found in binary or memory: https://passwords.google.com
Source: ca.pak.9.dr	String found in binary or memory: https://passwords.google.comCompte
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr	String found in binary or memory: https://passwords.google.comGoogle
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comT
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr, es-419.pak.9.dr	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr, es-419.pak.9.dr	String found in binary or memory: https://policies.google.com/
Source: explorer.exe, 00000002.00000000.2072714686.000000000C460000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: GamePall.exe, 0000000A.00000002.3936347863.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s.click.aliexpress.com/e/_mOnfcgm?dp=832447959357460480
Source: GamePall.exe, 0000000A.00000002.3936347863.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s.click.aliexpress.com/e/_mOnfcgm?dp=832447959357460480&af=6585985
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr, es-419.pak.9.dr	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: 23E4.exe, 00000005.00000003.2471821273.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 23E4.exe, 00000005.00000003.2471821273.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: GamePall.exe, GamePall.exe, 00000014.00000002.3758165596.0000000004FE2000.00000002.00000001.01000000.0000000F.sdmp, GamePall.exe, 00000014.00000002.3762776477.0000000005026000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://svn.apache.org/repos/asf/logging/log4net/tags/2.0.8RC1
Source: explorer.exe, 00000002.00000000.2070752921.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/)s
Source: explorer.exe, 00000002.00000000.2070752921.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comon
Source: 23E4.exe, 00000005.00000003.2446996263.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447100121.00000000039A6000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447457189.00000000039A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, ja.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html&
Source: ca.pak.9.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlA&judaGestionat
Source: es-419.pak.9.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlA&yudaAdministrado
Source: lv.pak.9.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlP&al
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlT&r
Source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, tr.pak.9.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlYar&d
Source: 23E4.exe, 00000005.00000003.2446996263.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447100121.00000000039A6000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447457189.00000000039A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 23E4.exe, 00000005.00000003.2471821273.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 23E4.exe, 00000005.00000003.2471821273.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 23E4.exe, 00000005.00000003.2471821273.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 23E4.exe, 00000005.00000003.2471821273.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 23E4.exe, 00000005.00000003.2471821273.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: 23E4.exe, 00000005.00000003.2471821273.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.2079676068.0000000002C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2324008509.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2323963441.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2080052883.0000000004851000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\5371.exe

Code function: 8_2_004055E7 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

8_2_004055E7

Source: GamePall.exe

Process created: 56

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2079888304.0000000002D8E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2079676068.0000000002C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.2324008509.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.2323963441.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.2079658197.0000000002C10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000004.00000002.2324083099.0000000002E1F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000004.00000002.2323917643.0000000002D70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2080052883.0000000004851000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401538 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401538
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402FE9 RtlCreateUserThread,NtTerminateProcess,	0_2_00402FE9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004014DE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401496 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401496
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401543 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401543
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401565 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401565
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401579 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401579
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040157C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040157C
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_00401538 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401538
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_00402FE9 RtlCreateUserThread,NtTerminateProcess,	4_2_00402FE9
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_004014DE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_004014DE
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_00401496 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401496
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_00401543 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401543
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_00401565 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401565
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_00401579 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401579
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_0040157C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_0040157C
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Code function: 8_2_100010D0 GetVersionExA,LoadLibraryW,GetProcAddress,LocalAlloc,LocalAlloc,NtQuerySystemInformation,LocalFree,LocalAlloc,FreeLibrary,WideCharToMultiByte,lstrcmpiA,LocalFree,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,lstrlenA,lstrcpynA,lstrcmpiA,CloseHandle,FreeLibrary,	8_2_100010D0

Source: C:\Users\user\AppData\Local\Temp\5371.exe	Code function: 8_2_004034CC EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		8_2_004034CC
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 9_2_004034CC EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		9_2_004034CC

Source: C:\Users\user\AppData\Local\Temp\5371.exe	Code function: 8_2_00406A88	8_2_00406A88
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 9_2_00406A88	9_2_00406A88
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 10_2_00994E20	10_2_00994E20
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_022D4F58	12_2_022D4F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_05026080	12_2_05026080
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_05026950	12_2_05026950
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_05025D38	12_2_05025D38
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 13_2_011E4F58	13_2_011E4F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_01464F58	14_2_01464F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 15_2_01164F58	15_2_01164F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 17_2_02CA4F58	17_2_02CA4F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 17_2_02CA1049	17_2_02CA1049
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 18_2_012E4F58	18_2_012E4F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 18_2_012E1049	18_2_012E1049
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 19_2_00BF4F58	19_2_00BF4F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 19_2_00BF1049	19_2_00BF1049
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 21_2_00E94F58	21_2_00E94F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 21_2_00E93860	21_2_00E93860
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 21_2_00E91049	21_2_00E91049
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 27_2_00AE4F58	27_2_00AE4F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 27_2_00AE3860	27_2_00AE3860
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 27_2_05046080	27_2_05046080
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 27_2_05046D58	27_2_05046D58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 27_2_05045D38	27_2_05045D38
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 34_2_00E74F58	34_2_00E74F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 34_2_00E73860	34_2_00E73860
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 34_2_00E71049	34_2_00E71049
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 37_2_01814F58	37_2_01814F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 37_2_01813860	37_2_01813860
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 37_2_05D36080	37_2_05D36080
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 37_2_05D36D58	37_2_05D36D58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 37_2_05D35D38	37_2_05D35D38

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\huge[1].dat B9BC473FC866909F089E005BAF2537EE7FF2825668D40D67C960D5C2AFB34E9F

Source: file.exe, 00000000.00000002.2079621522.0000000002BE3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesAtlassing0 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamesAtlassing0 vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2079888304.0000000002D8E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2079676068.0000000002C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.2324008509.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.2323963441.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.2079658197.0000000002C10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000004.00000002.2324083099.0000000002E1F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000004.00000002.2323917643.0000000002D70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2080052883.0000000004851000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: aggtjfs.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Ionic.Zip.dll.9.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformBlock'
Source: Ionic.Zip.dll.9.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Ionic.Zip.dll.9.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: GamePall.exe.9.dr, Program.cs

Base64 encoded string: 'pizR9uKkcZIkMW+F1cRjYV0LMt6eYXmLuiNCndESDPkTO3eY1Mjv7Hs2Qvo+t26G', 'ZTDMzZVpdA1FSa2RiY6ZCl2QGyLDtQ3OBRa/N40wO2xxcvcDsATtLRGwKtaEB36dqPJnDF8qXNs92JbMBlsOyg==', 'nYQvMVlU2Asj2rNkmi7xBNqGCkGzSnaP0raCPfB8A9hSwWFTIjPcsKgDrCVAEwSQ1lHf/WOhnKR59a5JjrkJVUOFvV43wO8MM1FKgjYuj7ZzvvuGve+okViUQx+oGN+llGnjS4Fm9o1MUn7p+qcPVIDZRcvMal1ARjQNk+bFvT5vC4J8slkhLZYtvBYmOybvSK90G7/f/U8GPBdM7WBmfFdHzzGxw6WFcHlkdySP8Nvmzff08RdOn8QOu8FlABEqqEjQ0W84v+/lU0lmhvzugpodd8fIp2kb2/twZPg9/Jsy5viOC65K8bs1ES63SA2d62f5cJYpFf1f0WBQbCBcSzfwiDlBCWVIW9vFXW1awyEMdm3q36+BViyETC5tnyHuoLRgf3bXoQAwqE0OIII5DROfW+LmqqHY82rVXHAqhVjdA2wZRWcSI1zxV7+qTfhmp9qbIQAWSuuXTzhbIvI3gjvtPCdz9uBv8rjyg1XZNxfdgYdtF+klyGgKdefnu5G2pgjfT3Kb/VbjgkFvLlqtWNr5K7iC080FVeHsZazMHUrrDtsmNdChtvnX8Zj77rIGVxi9RfvHhhIhBj+WSos+lJ2nuvQkUpqVEa1mrZSwPezG/uoh0qvs+BAHbNFNjv99WS6tgWIkvcQVCi2h3cfxTGQiZDetQZqB+N/mnvgC6WdrcRKGHBE4mp6bpgTY9+nt3lPiH6OZnlxC8rdHbuGtY6R/FgNFYkw49JWXYeZ1VV3KnjSrFMvDlkyMCAW1X9/1VoC+f73WVYMLwXafDKtGO2lfr9vwKms+8HoEgs7bj0aroIPdmLK/z/djAsFZO8Vp', 'T7BWwqrn4yISEECEAnARpwE8R+3lDHSc+RlcJT90an1SNsS27lGBQjOx4RmDHlrj7oJnnzx1IWXOkbTfLzBeCfU6UJhOIoQKhcWidAxAKIxvqZnoB6AujIU0F7dEj65vahyTdEvkIxzFaV2+akbl53KcDi5RPBOP16iXVi0WJdHV5AbSCI9WCEcSX/fUpmukBh4bjVF/T/P/B6TFVtNZintCOSO2Ha+2va2CJMOnJ020zYskwuvcH9d1rGD3Zf9RBC2obzrhRNK2LXTEIYnifs6L2UdqFhw5aANXILziQtzKvsTQKvc15hvHCCoeXJCyyK7/WgA/oRu7bdrTs2DwCQ==', 'ZY0WCEgzqiLEU8ZUVJwGTpbkuL9KoMwYVloBqJXjur8rfBZEXTysQNKRQ1H7/vn7o0wyHAux60SVy06r4v6So5WWxddei09LXvL6ZwK/tyY=', 's7iS2XfzyI+IBoARaZQlTINg1kEy7qT7EopaSHQzpqktZBtc7UiOYrPdv/6f4cNI', 'o2ZleBui4P9C2ZjnB98Vuesy1C+WucHiXjQJ8RANoX6TheGfnLYAWDsXRfSeNCDHWdkBP2RBrkWPBy/nuM2NFLMETMUsPFeG3JHWafvGKzaNEjYO3Up9m61SnaY5tINvLCYJ/TKITszJ9H1YSm2chnmQGLUzbz4pwvWvvKfH8m7z585W73/QZrtw3l/30vcZaVocgwemYusDJYsOTgeWc0okiDahD7qtJcBYZ0aOzxZZmHDMBYigkRVf8GTJ/xucA/i7EHBFpaWoLVZVcuGFMA==', 'T7BWwqrn4yISEECEAnARp+JyVgG3cZc2/9+3VbyOjc4PuRSCU7ZfXuXpIIH8uj2roUU+W7nSmXHqTuxLhe6DBfNVh8PFZrhNX/YhIexDxrk=', 'G4TxOgdwfNBdU+6bscw2hqt3kZYZMfoEuKZtmCxRLrF8xJCK1+L0ocd8eSQjty7d', 'PcG64iM3U1vDIVDm7HuwTSvKhuz45f/WPqYoWZvzLHcapbEfkynZkUjmDgg30eof', 'XGcq7Js3+2f2oGHGFzxJPiYsrodwK+bTw/0lKjiUd0tSWMHEjdVqzAclD1/nPksq3sGhVTN8oFeHMRE7wAt3mCLVCEXKF9JLnNeWw9vvCbs=', 'T7BWwqrn4yISEECEAnARp8UQ6kvfa8mDiwe39obQZ+Rxfj5bbo//kf+4mlTsZUEg0QM/4QBKb6sUDMsk9OTdYg==', 'T7BWwqrn4yISEECEAnARp/U1NCwfjpQ4K5UKuMbDqXSrjfU6Tf/pOCpHlHXtYnU5', 'Gg/rFkGmnFrfPAny9sQ3qerPGxlC7+cuu92x2tgXrCRkqABwTbbIR8+hJN0krbBD9OJX8s2JqeR+xICuD2u17N7KjlWCZwpg4+c7mG1xAahALfXXbu/EvJy+KsAzQlzR9bu8P4wbyuM6r6/7kdf+VQ==', 'Zh3o1d4Zr0FJ548CrzCJDMeQhe52nu1Hz4hkTFOalLT3pudJg4gGhcEax3IHwBI0R5vZR7J9mjUQ8R9MdKz/Fw==', 'Zh3o1d4Zr0FJ548CrzCJDMeQhe52nu1Hz4hkTFOalLTcCwJrbTmNGWmZutw1Di2FSZ+3JxFtC00BiemuQuq2+A=='

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@299/114@0/6

Source: C:\Users\user\AppData\Local\Temp\5371.exe	Code function: 8_2_004034CC EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		8_2_004034CC
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 9_2_004034CC EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		9_2_004034CC

Source: C:\Users\user\AppData\Local\Temp\5371.exe

Code function: 8_2_00404897 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

8_2_00404897

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_02D95716 CreateToolhelp32Snapshot,Module32First,

0_2_02D95716

Source: C:\Users\user\AppData\Local\Temp\5371.exe

Code function: 8_2_00402173 CoCreateInstance,MultiByteToWideChar,

8_2_00402173

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\aggtjfs

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Mutant created: \Sessions\1\BaseNamedObjects\C__Users_user_AppData_Roaming_GamePall_Logs_mainLog.txt
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Mutant created: \Sessions\1\BaseNamedObjects\C__Users_user_AppData_Roaming_GamePall_Logs_rendLog.txt

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\23E4.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: 23E4.exe, 00000005.00000003.2447100121.0000000003975000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2457765426.000000000398B000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\aggtjfs C:\Users\user\AppData\Roaming\aggtjfs
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\23E4.exe C:\Users\user\AppData\Local\Temp\23E4.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5371.exe C:\Users\user\AppData\Local\Temp\5371.exe
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Process created: C:\Users\user\AppData\Local\Temp\setup.exe "C:\Users\user\AppData\Local\Temp\setup.exe"
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3472 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3660 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3592 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720115578234356 --launch-time-ticks=4603408239 --mojo-platform-channel-handle=3948 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720115578234356 --launch-time-ticks=4603422960 --mojo-platform-channel-handle=4012 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\23E4.exe C:\Users\user\AppData\Local\Temp\23E4.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5371.exe C:\Users\user\AppData\Local\Temp\5371.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Process created: C:\Users\user\AppData\Local\Temp\setup.exe "C:\Users\user\AppData\Local\Temp\setup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3472 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3660 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3592 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720115578234356 --launch-time-ticks=4603408239 --mojo-platform-channel-handle=3948 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720115578234356 --launch-time-ticks=4603422960 --mojo-platform-channel-handle=4012 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cdprt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aggtjfs	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aggtjfs	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aggtjfs	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aggtjfs	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: chrome_elf.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mdmregistration.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mdmregistration.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: omadmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iri.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: chrome_elf.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{317D06E8-5F24-433D-BDF7-79CE68D8ABC2}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GamePall

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\WidevineCdm\_platform_specific\win_x86\widevinecdmadapter.dll.pdb source: widevinecdmadapter.dll.9.dr
Source:	Binary string: libEGL.dll.pdb source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\work\newContent\secondBranch\new\GamePall\obj\Release\GamePall.pdb source: GamePall.exe, 0000000A.00000000.3646470195.00000000001A2000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdb source: GamePall.exe, GamePall.exe, 0000000D.00000002.3915071142.0000000005912000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdbSHA256 source: GamePall.exe, 0000000D.00000002.3915071142.0000000005912000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdbLK source: GamePall.exe, 00000014.00000002.3758165596.0000000004FE2000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\WidevineCdm\_platform_specific\win_x86\widevinecdmadapter.dll.pdbGCTL source: widevinecdmadapter.dll.9.dr
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdb source: GamePall.exe, GamePall.exe, 00000014.00000002.3758165596.0000000004FE2000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: libGLESv2.dll.pdb source: setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Xilium.CefGlue.pdb source: setup.exe, 00000009.00000002.3996841528.000000000068A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \swiftshaderXilium.CefGlue.pdb source: setup.exe, 00000009.00000002.3996841528.000000000068A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *?\|<>/":%s%s.dllC:\Users\user\AppData\Roaming\GamePall\GamePall.exewall.dlldll.pdbC:\Users\user\AppData\Roaming\GamePall\Uninstall.exeePalll source: setup.exe, 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\libGLESv2.dll.pdb source: libGLESv2.dll0.9.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\aggtjfs	Unpacked PE file: 4.2.aggtjfs.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;

Source: Newtonsoft.Json.dll.9.dr

Static PE information: 0xF68F744F [Mon Jan 31 06:35:59 2101 UTC]

Source: C:\Users\user\AppData\Local\Temp\5371.exe

Code function: 8_2_100010D0 GetVersionExA,LoadLibraryW,GetProcAddress,LocalAlloc,LocalAlloc,NtQuerySystemInformation,LocalFree,LocalAlloc,FreeLibrary,WideCharToMultiByte,lstrcmpiA,LocalFree,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,lstrlenA,lstrcpynA,lstrcmpiA,CloseHandle,FreeLibrary,

8_2_100010D0

Source: initial sample

Static PE information: section where entry point is pointing to: .vmpLp

Source: 23E4.exe.2.dr	Static PE information: section name: .vmpLp
Source: 23E4.exe.2.dr	Static PE information: section name: .vmpLp
Source: 23E4.exe.2.dr	Static PE information: section name: .vmpLp
Source: libGLESv2.dll.9.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.9.dr	Static PE information: section name: .voltbl
Source: chrome_elf.dll.9.dr	Static PE information: section name: .00cfg
Source: chrome_elf.dll.9.dr	Static PE information: section name: .crthunk
Source: chrome_elf.dll.9.dr	Static PE information: section name: CPADinfo
Source: chrome_elf.dll.9.dr	Static PE information: section name: malloc_h
Source: libEGL.dll.9.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll0.9.dr	Static PE information: section name: .00cfg
Source: libcef.dll.9.dr	Static PE information: section name: .00cfg
Source: libcef.dll.9.dr	Static PE information: section name: .rodata
Source: libcef.dll.9.dr	Static PE information: section name: CPADinfo
Source: libcef.dll.9.dr	Static PE information: section name: malloc_h

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401CD1 push ecx; ret	0_2_00401CD2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401C91 push 00000076h; iretd	0_2_00401C93
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E96 push B92A2F4Ch; retf	0_2_00402E9B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02C11CF8 push 00000076h; iretd	0_2_02C11CFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02C12EFD push B92A2F4Ch; retf	0_2_02C12F02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02C11D38 push ecx; ret	0_2_02C11D39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D9D1E6 push FFFFFFFBh; iretd	0_2_02D9D1FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D9B168 push edx; ret	0_2_02D9B169
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_00401CD1 push ecx; ret	4_2_00401CD2
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_00401C91 push 00000076h; iretd	4_2_00401C93
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_00402E96 push B92A2F4Ch; retf	4_2_00402E9B
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_02D72EFD push B92A2F4Ch; retf	4_2_02D72F02
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_02D71CF8 push 00000076h; iretd	4_2_02D71CFA
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_02D71D38 push ecx; ret	4_2_02D71D39
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_02E2D77E push FFFFFFFBh; iretd	4_2_02E2D794
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_02E2B700 push edx; ret	4_2_02E2B701
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 15_2_01166193 push eax; ret	15_2_0116619A

Source: file.exe	Static PE information: section name: .text entropy: 7.769292748906175
Source: aggtjfs.2.dr	Static PE information: section name: .text entropy: 7.769292748906175
Source: Ionic.Zip.dll.9.dr	Static PE information: section name: .text entropy: 6.821349263259562

Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\libcef.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5371.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\log4net.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5371.exe	File created: C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Del.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5371.exe	File created: C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5371.exe	File created: C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\blowfish.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5371.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\huge[1].dat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsr4CB.tmp\liteFirewall.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5371.exe	File created: C:\Users\user\AppData\Local\Temp\setup.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\aggtjfs	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\chrome_elf.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\23E4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll	Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\aggtjfs

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\setup.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GamePall			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GamePall			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\file.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\aggtjfs:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aggtjfs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aggtjfs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aggtjfs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aggtjfs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aggtjfs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aggtjfs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\23E4.exe

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\file.exe	API/Special instruction interceptor: Address: 7FF8C88EE814
Source: C:\Users\user\Desktop\file.exe	API/Special instruction interceptor: Address: 7FF8C88ED584
Source: C:\Users\user\AppData\Roaming\aggtjfs	API/Special instruction interceptor: Address: 7FF8C88EE814
Source: C:\Users\user\AppData\Roaming\aggtjfs	API/Special instruction interceptor: Address: 7FF8C88ED584
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	API/Special instruction interceptor: Address: 11191D7
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	API/Special instruction interceptor: Address: 1514DE8
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	API/Special instruction interceptor: Address: 1094E89
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	API/Special instruction interceptor: Address: FB76F5
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	API/Special instruction interceptor: Address: 1159E6B
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	API/Special instruction interceptor: Address: 1153463
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	API/Special instruction interceptor: Address: 119F069

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: aggtjfs, 00000004.00000002.2324030530.0000000002E0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK
Source: file.exe, 00000000.00000002.2079790482.0000000002D7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOKU

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 26C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 23F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 22D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 25D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 45D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 11E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2EF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2D20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1460000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3270000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2F90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1160000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2BB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2930000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1370000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2ED0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2D00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 12E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3020000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1600000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: BF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2780000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2590000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: F60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2940000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4940000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: E90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2B00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2A40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1550000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3230000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 5230000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: B20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2560000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: B90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1050000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2D70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 13A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: F70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2CD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4CD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1560000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 32B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3100000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: AE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2470000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4470000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: DB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2790000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 26D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: BB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2560000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4560000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1650000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3170000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1820000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2F60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3290000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 5290000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 880000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2610000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4710000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 29B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2A60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4A60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: E70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4BA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: BF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2650000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 25A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2E70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2B70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1810000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 31F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1830000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1530000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3240000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3150000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: B50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2540000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: BE0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 362	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 3005	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 924	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1658	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 880	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\libcef.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\log4net.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Del.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\blowfish.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsr4CB.tmp\liteFirewall.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll	Jump to dropped file

Source: C:\Windows\explorer.exe TID: 5144	Thread sleep time: -300500s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6352	Thread sleep time: -92400s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6592	Thread sleep time: -33200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4228	Thread sleep time: -33500s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5144	Thread sleep time: -165800s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe TID: 5020	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe TID: 5020	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe TID: 5020	Thread sleep time: -600000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\5371.exe	Code function: 8_2_00405B4A CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	8_2_00405B4A
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Code function: 8_2_004066FF FindFirstFileA,FindClose,	8_2_004066FF
Source: C:\Users\user\AppData\Local\Temp\5371.exe	Code function: 8_2_004027AA FindFirstFileA,	8_2_004027AA
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 9_2_00405B4A CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	9_2_00405B4A
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 9_2_004066FF FindFirstFileA,FindClose,	9_2_004066FF
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 9_2_004027AA FindFirstFileA,	9_2_004027AA

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: libGLESv2.dll0.9.dr	Binary or memory string: (IsLinux() && isVMWare) \|\| (IsAndroid() && isNvidia) \|\| (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) \|\| (!isMesa && IsMaliT8xxOrOlder(functions)) \|\| (!isMesa && IsMaliG31OrOlder(functions))
Source: libGLESv2.dll0.9.dr	Binary or memory string: VMware
Source: explorer.exe, 00000002.00000000.2070752921.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0r
Source: explorer.exe, 00000002.00000000.2070752921.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: explorer.exe, 00000002.00000000.2067597057.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
Source: 23E4.exe, 00000005.00000003.2457972761.00000000039B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: explorer.exe, 00000002.00000000.2070752921.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2544926449.0000000000B47000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2509471088.0000000000B47000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000002.2545185790.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2468539842.0000000000B43000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447355902.0000000000B43000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2484065314.0000000000B43000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2467985016.0000000000B43000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2446609606.0000000000B43000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2457293614.0000000000B43000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000002.2545320949.0000000000B48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: explorer.exe, 00000002.00000000.2070752921.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: explorer.exe, 00000002.00000000.2070752921.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: explorer.exe, 00000002.00000000.2070752921.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: GamePall.exe, 0000000A.00000002.3746614756.00000000008B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
Source: explorer.exe, 00000002.00000000.2069079716.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
Source: 23E4.exe, 00000005.00000003.2457972761.00000000039B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: explorer.exe, 00000002.00000000.2068335090.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: explorer.exe, 00000002.00000000.2070752921.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
Source: explorer.exe, 00000002.00000000.2070752921.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.2069079716.000000000769A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: explorer.exe, 00000002.00000000.2069079716.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: explorer.exe, 00000002.00000000.2070752921.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.2068335090.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: explorer.exe, 00000002.00000000.2070752921.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATAa
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: GamePall.exe, 00000022.00000002.4110928637.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y_
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: explorer.exe, 00000002.00000000.2070752921.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: GamePall.exe, 00000025.00000002.3981458013.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: explorer.exe, 00000002.00000000.2068335090.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 d9 2e dc 89 72 dX
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: libGLESv2.dll0.9.dr	Binary or memory string: IIAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTest
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: explorer.exe, 00000002.00000000.2068335090.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware,p
Source: explorer.exe, 00000002.00000000.2070752921.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0#{5-
Source: 23E4.exe, 00000005.00000003.2458067588.00000000039A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: explorer.exe, 00000002.00000000.2067597057.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000

Source: C:\Users\user\AppData\Local\Temp\5371.exe	API call chain: ExitProcess graph end node			graph_8-3604
Source: C:\Users\user\AppData\Local\Temp\setup.exe	API call chain: ExitProcess graph end node			graph_9-3649

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\file.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\aggtjfs	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\aggtjfs	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5371.exe

8_2_100010D0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02C10D90 mov eax, dword ptr fs:[00000030h]	0_2_02C10D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02C1092B mov eax, dword ptr fs:[00000030h]	0_2_02C1092B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D94FF3 push dword ptr fs:[00000030h]	0_2_02D94FF3
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_02D70D90 mov eax, dword ptr fs:[00000030h]	4_2_02D70D90
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_02D7092B mov eax, dword ptr fs:[00000030h]	4_2_02D7092B
Source: C:\Users\user\AppData\Roaming\aggtjfs	Code function: 4_2_02E2558B push dword ptr fs:[00000030h]	4_2_02E2558B

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: 5371.exe.2.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 77.221.157.163 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 127.0.0.127 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 152.231.127.132 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 188.114.96.3 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.149.100.242 443	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\file.exe	Thread created: C:\Windows\explorer.exe EIP: 87D19D0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\aggtjfs	Thread created: unknown EIP: 11319D0			Jump to behavior

LummaC encrypted strings found

Source: 23E4.exe, 00000005.00000002.2545555551.0000000000C6D000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: pedestriankodwu.xyz
Source: 23E4.exe, 00000005.00000002.2545555551.0000000000C6D000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: towerxxuytwi.xyz
Source: 23E4.exe, 00000005.00000002.2545555551.0000000000C6D000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: ellaboratepwsz.xyz
Source: 23E4.exe, 00000005.00000002.2545555551.0000000000C6D000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: penetratedpoopp.xyz
Source: 23E4.exe, 00000005.00000002.2545555551.0000000000C6D000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: swellfrrgwwos.xyz
Source: 23E4.exe, 00000005.00000002.2545555551.0000000000C6D000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: contintnetksows.shop
Source: 23E4.exe, 00000005.00000002.2545555551.0000000000C6D000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: foodypannyjsud.shop
Source: 23E4.exe, 00000005.00000002.2545555551.0000000000C6D000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: potterryisiw.shop

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\file.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aggtjfs	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aggtjfs	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3472 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3660 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3592 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720115578234356 --launch-time-ticks=4603408239 --mojo-platform-channel-handle=3948 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720115578234356 --launch-time-ticks=4603422960 --mojo-platform-channel-handle=4012 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/127.0.0.0 mobile safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3472 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:2
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-us --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/127.0.0.0 mobile safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3660 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-us --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/127.0.0.0 mobile safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3592 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/127.0.0.0 mobile safari/537.36" --user-data-dir="c:\users\user\appdata\local\cef\user data" --first-renderer-process --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720115578234356 --launch-time-ticks=4603408239 --mojo-platform-channel-handle=3948 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/127.0.0.0 mobile safari/537.36" --user-data-dir="c:\users\user\appdata\local\cef\user data" --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720115578234356 --launch-time-ticks=4603422960 --mojo-platform-channel-handle=4012 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/127.0.0.0 mobile safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3472 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-us --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/127.0.0.0 mobile safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3660 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-us --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/127.0.0.0 mobile safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3592 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/127.0.0.0 mobile safari/537.36" --user-data-dir="c:\users\user\appdata\local\cef\user data" --first-renderer-process --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720115578234356 --launch-time-ticks=4603408239 --mojo-platform-channel-handle=3948 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/127.0.0.0 mobile safari/537.36" --user-data-dir="c:\users\user\appdata\local\cef\user data" --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720115578234356 --launch-time-ticks=4603422960 --mojo-platform-channel-handle=4012 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1	Jump to behavior

Source: explorer.exe, 00000002.00000000.2070752921.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd=
Source: explorer.exe, 00000002.00000000.2067993388.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000002.00000000.2068950941.0000000004B00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2067993388.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000000.2067993388.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000002.00000000.2067993388.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000002.00000000.2067597057.0000000000EF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PProgman

Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\5371.exe

Code function: 8_2_004034CC EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

8_2_004034CC

Source: C:\Users\user\AppData\Local\Temp\23E4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 23E4.exe, 00000005.00000003.2544926449.0000000000B47000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2509471088.0000000000B47000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000002.2545320949.0000000000B48000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\23E4.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: Process Memory Space: 23E4.exe PID: 320, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.2079676068.0000000002C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2324008509.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2323963441.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2080052883.0000000004851000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 23E4.exe, 00000005.00000003.2544926449.0000000000B47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: 23E4.exe, 00000005.00000003.2468539842.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash
Source: 23E4.exe, 00000005.00000003.2468539842.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 23E4.exe, 00000005.00000003.2544926449.0000000000B47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 23E4.exe, 00000005.00000003.2498316899.0000000000B59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 23E4.exe, 00000005.00000003.2468539842.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: 23E4.exe, 00000005.00000003.2544926449.0000000000B47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: 23E4.exe, 00000005.00000003.2468539842.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 23E4.exe, 00000005.00000003.2468539842.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: 23E4.exe, 00000005.00000003.2446609606.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live.

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla\Notes9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23E4.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Directory queried: number of queries: 1659

Source: Yara match	File source: 00000005.00000003.2468539842.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2484065314.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2498316899.0000000000B59000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2468539842.0000000000B43000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2467985016.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2457202713.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2484065314.0000000000B43000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2467985016.0000000000B43000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2498215186.0000000000BA2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2446354815.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2498005958.0000000000B43000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 23E4.exe PID: 320, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: Process Memory Space: 23E4.exe PID: 320, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.2079676068.0000000002C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2324008509.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2323963441.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2080052883.0000000004851000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	22 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 Windows Service	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	LSASS Memory	115 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Registry Run Keys / Startup Folder	1 Windows Service	21 Obfuscated Files or Information	Security Account Manager	631 Security Software Discovery	SMB/Windows Admin Shares	1 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Command and Scripting Interpreter	Login Hook	312 Process Injection	12 Software Packing	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	3 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	241 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	312 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	37%	ReversingLabs	Win32.Trojan.Amadey
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\23E4.exe	100%	Avira	HEUR/AGEN.1313486
C:\Users\user\AppData\Local\Temp\setup.exe	100%	Avira	HEUR/AGEN.1359405
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\huge[1].dat	100%	Avira	HEUR/AGEN.1359405
C:\Users\user\AppData\Local\Temp\5371.exe	100%	Avira	HEUR/AGEN.1359405
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	100%	Avira	HEUR/AGEN.1352426
C:\Users\user\AppData\Local\Temp\23E4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\GamePall\Del.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\huge[1].dat	3%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\23E4.exe	79%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\5371.exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\INetC.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\blowfish.dll	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\nsProcess.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsr4CB.tmp\liteFirewall.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\setup.exe	3%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\GamePall\Del.exe	7%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	3%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\chrome_elf.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\libcef.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\log4net.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\aggtjfs	37%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
http://anglebug.com/8280enableTranslatedShaderSubstitutionCheck	0%	Avira URL Cloud	safe
https://www.google.com/chrome/privacy/eula_text.htmlP&al	0%	Avira URL Cloud	safe
http://anglebug.com/4633	0%	Avira URL Cloud	safe
https://anglebug.com/4674	0%	Avira URL Cloud	safe
https://www.google.com/chrome/privacy/eula_text.htmlA&judaGestionat	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://support.google.com/chrome/answer/6098869	0%	Avira URL Cloud	safe
https://anglebug.com/7382	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	Avira URL Cloud	safe
https://issuetracker.google.com/284462263	0%	Avira URL Cloud	safe
https://foodypannyjsud.shop/piy	100%	Avira URL Cloud	malware
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	0%	Avira URL Cloud	safe
http://crbug.com/883276	0%	Avira URL Cloud	safe
https://crbug.com/1356053	0%	Avira URL Cloud	safe
http://api.install-stat.debug.world/clients/activity=4P	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=urCtrl$2	0%	Avira URL Cloud	safe
http://crbug.com/550292	0%	Avira URL Cloud	safe
https://photos.google.com/settings?referrer=CHROME_NTP	0%	Avira URL Cloud	safe
https://anglebug.com/5536	0%	Avira URL Cloud	safe
https://anglebug.com/7714	0%	Avira URL Cloud	safe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	0%	Avira URL Cloud	safe
http://crbug.com/110263	0%	Avira URL Cloud	safe
http://cx5519.com/tmp/index.php	100%	Avira URL Cloud	malware
https://crbug.com/705865	0%	Avira URL Cloud	safe
http://anglebug.com/6929	0%	Avira URL Cloud	safe
http://xiexie.wf/22_551/huge.datmCGBZvyfGQlwd	0%	Avira URL Cloud	safe
http://bageyou.xyz	0%	Avira URL Cloud	safe
http://anglebug.com/5281	0%	Avira URL Cloud	safe
http://logging.apache.org/log4ne	0%	Avira URL Cloud	safe
https://issuetracker.google.com/255411748	0%	Avira URL Cloud	safe
http://evilos.cc/tmp/index.php	100%	Avira URL Cloud	malware
http://anglebug.com/6248	0%	Avira URL Cloud	safe
https://anglebug.com/7246	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3/J	0%	Avira URL Cloud	safe
https://anglebug.com/7369	0%	Avira URL Cloud	safe
https://anglebug.com/7489	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=arCtrl$1	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://issuetracker.google.com/161903006	0%	Avira URL Cloud	safe
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
http://anglebug.com/2152skipVSConstantRegisterZeroIn	0%	Avira URL Cloud	safe
https://www.google.com/chrome/privacy/eula_text.html&	0%	Avira URL Cloud	safe
https://crbug.com/1300575	0%	Avira URL Cloud	safe
https://crbug.com/1137851	0%	Avira URL Cloud	safe
https://www.google.com/chrome/privacy/eula_text.htmlT&r	0%	Avira URL Cloud	safe
https://crbug.com/593024	0%	Avira URL Cloud	safe
ellaboratepwsz.xyz	100%	Avira URL Cloud	malware
swellfrrgwwos.xyz	100%	Avira URL Cloud	malware
https://crbug.com/710443	0%	Avira URL Cloud	safe
http://xiexie.wf/22_551/huge.dat	0%	Avira URL Cloud	safe
https://crbug.com/1042393	0%	Avira URL Cloud	safe
https://crbug.com/1060012	0%	Avira URL Cloud	safe
http://anglebug.com/3078	0%	Avira URL Cloud	safe
http://xiexie.wf/22_551/huge.datF$	0%	Avira URL Cloud	safe
http://anglebug.com/7553	0%	Avira URL Cloud	safe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	0%	Avira URL Cloud	safe
http://anglebug.com/5375	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=tr&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
http://anglebug.com/3246allowClearForRobustResourceInitSome	0%	Avira URL Cloud	safe
https://foodypannyjsud.shop/apiP	100%	Avira URL Cloud	malware
http://anglebug.com/5371	0%	Avira URL Cloud	safe
http://anglebug.com/3997	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=ukCtrl$1	0%	Avira URL Cloud	safe
http://anglebug.com/4722	0%	Avira URL Cloud	safe
http://anglebug.com/1452	0%	Avira URL Cloud	safe
foodypannyjsud.shop	100%	Avira URL Cloud	malware
https://support.google.com/chrome/a/answer/9122284	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=caCtrl$1	0%	Avira URL Cloud	safe
https://svn.apache.org/repos/asf/logging/log4net/tags/2.0.8RC1	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=teCtrl$1	0%	Avira URL Cloud	safe
http://api.install-stat.debug.world/clients/activity=4	0%	Avira URL Cloud	safe
http://anglebug.com/7556	0%	Avira URL Cloud	safe
https://crbug.com/650547callClearTwiceUsing	0%	Avira URL Cloud	safe
https://word.office.comon	0%	Avira URL Cloud	safe
http://anglebug.com/6692	0%	Avira URL Cloud	safe
https://issuetracker.google.com/258207403	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=ar&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
http://crbug.com/1420130	0%	Avira URL Cloud	safe
http://anglebug.com/3623	0%	Avira URL Cloud	safe
http://anglebug.com/3502	0%	Avira URL Cloud	safe
http://anglebug.com/3625	0%	Avira URL Cloud	safe
http://anglebug.com/3624	0%	Avira URL Cloud	safe
http://crbug.com/642605	0%	Avira URL Cloud	safe
http://www.unicode.org/copyright.html	0%	Avira URL Cloud	safe
http://anglebug.com/5007	0%	Avira URL Cloud	safe
http://crbug.com/1181068	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
http://anglebug.com/3862	0%	Avira URL Cloud	safe
http://anglebug.com/4836	0%	Avira URL Cloud	safe
https://foodypannyjsud.shop:443/apiOYFBOLXA.pdfPK	100%	Avira URL Cloud	malware
https://issuetracker.google.com/issues/166475273	0%	Avira URL Cloud	safe
http://anglebug.com/2894	0%	Avira URL Cloud	safe
http://bageyou.xyz/c/g	0%	Avira URL Cloud	safe
http://api.install-stat.debug.world/clients/activity	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://cx5519.com/tmp/index.php	true	Avira URL Cloud: malware	unknown
http://evilos.cc/tmp/index.php	true	Avira URL Cloud: malware	unknown
ellaboratepwsz.xyz	true	Avira URL Cloud: malware	unknown
swellfrrgwwos.xyz	true	Avira URL Cloud: malware	unknown
foodypannyjsud.shop	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://anglebug.com/4674	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u	setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/privacy/eula_text.htmlA&judaGestionat	ca.pak.9.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	23E4.exe, 00000005.00000003.2446996263.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447100121.00000000039A6000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447457189.00000000039A6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	23E4.exe, 00000005.00000003.2446996263.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447100121.00000000039A6000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447457189.00000000039A6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/8280enableTranslatedShaderSubstitutionCheck	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/answer/6098869	setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/privacy/eula_text.htmlP&al	lv.pak.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4633	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://anglebug.com/7382	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	23E4.exe, 00000005.00000003.2473344005.0000000003971000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/284462263	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	GamePall.exe, 00000014.00000002.3758165596.0000000004FE2000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://api.install-stat.debug.world/clients/activity=4P	GamePall.exe, 00000015.00000002.4360441462.0000000002B28000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crbug.com/550292	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop/piy	23E4.exe, 00000005.00000003.2457202713.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chrome.google.com/webstore?hl=urCtrl$2	setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crbug.com/883276	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/1356053	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://photos.google.com/settings?referrer=CHROME_NTP	setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr, es-419.pak.9.dr	false	Avira URL Cloud: safe	unknown
https://anglebug.com/7714	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://anglebug.com/5536	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/705865	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/110263	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/6248	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/6929	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://xiexie.wf/22_551/huge.datmCGBZvyfGQlwd	5371.exe, 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5281	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	GamePall.exe, 0000000A.00000002.3936347863.0000000002A09000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://bageyou.xyz	GamePall.exe, 00000013.00000002.3891933668.00000000027D7000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 00000015.00000002.4360441462.0000000002B28000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 0000001B.00000002.4359179275.0000000002498000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 00000022.00000002.4414982018.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 00000025.00000002.4208470703.00000000031F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://logging.apache.org/log4ne	GamePall.exe	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/255411748	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000002.00000000.2073342760.000000000C81C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anglebug.com/7246	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://anglebug.com/7369	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://anglebug.com/7489	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=arCtrl$1	ar.pak.9.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/593024	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/1137851	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	23E4.exe, 00000005.00000003.2446996263.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447100121.00000000039A6000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447457189.00000000039A6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	23E4.exe, 00000005.00000003.2468290461.000000000397D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/161903006	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/privacy/eula_text.html&	setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/2152skipVSConstantRegisterZeroIn	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/1300575	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/privacy/eula_text.htmlT&r	setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	23E4.exe, 00000005.00000003.2446996263.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447100121.00000000039A6000.00000004.00000800.00020000.00000000.sdmp, 23E4.exe, 00000005.00000003.2447457189.00000000039A6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://xiexie.wf/22_551/huge.dat	5371.exe, 00000008.00000003.4000452126.0000000000864000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://crbug.com/710443	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/1042393	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/1060012	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3078	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/7553	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://xiexie.wf/22_551/huge.datF$	5371.exe, 00000008.00000002.4002663411.0000000000851000.00000004.00000020.00020000.00000000.sdmp, 5371.exe, 00000008.00000003.4000153801.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5375	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3246allowClearForRobustResourceInitSome	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	setup.exe, setup.exe, 00000009.00000003.3646532816.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000009.00000000.3352160919.000000000040A000.00000008.00000001.01000000.0000000B.sdmp, setup.exe, 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmp, Uninstall.exe.9.dr	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=tr&category=theme81https://myactivity.google.com/myactivity/?u	setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, tr.pak.9.dr	false	Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop/apiP	23E4.exe, 00000005.00000003.2544926449.0000000000B47000.00000004.00000020.00020000.00000000.sdmp, 23E4.exe, 00000005.00000002.2545320949.0000000000B48000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://anglebug.com/5371	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=ukCtrl$1	setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3997	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4722	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/642605	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/1452	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/7556	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/a/answer/9122284	setup.exe, 00000009.00000002.3997212622.0000000002878000.00000004.00000020.00020000.00000000.sdmp, te.pak.9.dr, lv.pak.9.dr, ja.pak.9.dr, tr.pak.9.dr, bg.pak.9.dr, ar.pak.9.dr, ca.pak.9.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=caCtrl$1	ca.pak.9.dr	false	Avira URL Cloud: safe	unknown
http://api.install-stat.debug.world/clients/activity=4	GamePall.exe, 0000001B.00000002.4359179275.0000000002498000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 00000022.00000002.4414982018.0000000002BC8000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 00000025.00000002.4208470703.00000000031F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://crbug.com/650547callClearTwiceUsing	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=teCtrl$1	te.pak.9.dr	false	Avira URL Cloud: safe	unknown
https://svn.apache.org/repos/asf/logging/log4net/tags/2.0.8RC1	GamePall.exe, GamePall.exe, 00000014.00000002.3758165596.0000000004FE2000.00000002.00000001.01000000.0000000F.sdmp, GamePall.exe, 00000014.00000002.3762776477.0000000005026000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.comon	explorer.exe, 00000002.00000000.2070752921.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crbug.com/1420130	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/6692	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/258207403	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=ar&category=theme81https://myactivity.google.com/myactivity/?u	ar.pak.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3502	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3623	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3625	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3624	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://www.unicode.org/copyright.html	GamePall.exe, 00000011.00000002.4090183998.0000000006020000.00000002.00000001.00040000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5007	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/1181068	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	23E4.exe, 00000005.00000003.2473344005.0000000003971000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/2894	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3862	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4836	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/issues/166475273	libGLESv2.dll0.9.dr	false	Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop:443/apiOYFBOLXA.pdfPK	23E4.exe, 00000005.00000003.2498005958.0000000000B43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://bageyou.xyz/c/g	GamePall.exe, 0000000A.00000002.3936347863.0000000002717000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micro	explorer.exe, 00000002.00000000.2070225953.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2069648943.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2070255132.0000000008890000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://api.install-stat.debug.world/clients/activity	GamePall.exe, 00000025.00000002.4208470703.00000000032A9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
77.221.157.163	unknown	Russian Federation	30968	INFOBOX-ASInfoboxruAutonomousSystemRU	true
152.231.127.132	unknown	Chile	27651	ENTELCHILESACL	true
188.114.96.3	unknown	European Union	13335	CLOUDFLARENETUS	true
104.21.45.251	unknown	United States	13335	CLOUDFLARENETUS	false
185.149.100.242	unknown	Turkey	209853	VERIDYENVeridyenBilisimTeknolojileriSanayiveTicaretLi	true

Private

IP
127.0.0.127

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467829
Start date and time:	2024-07-04 20:56:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 16m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@299/114@0/6
EGA Information:	Successful, ratio: 55.6%
HCA Information:	Successful, ratio: 85% Number of executed functions: 416 Number of non-executed functions: 57
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Execution Graph export aborted for target 23E4.exe, PID 320 because there are no executed function
Execution Graph export aborted for target GamePall.exe, PID 2140 because it is empty
Execution Graph export aborted for target GamePall.exe, PID 2364 because it is empty
Execution Graph export aborted for target GamePall.exe, PID 3220 because it is empty
Execution Graph export aborted for target GamePall.exe, PID 3452 because it is empty
Execution Graph export aborted for target GamePall.exe, PID 3876 because there are no executed function
Execution Graph export aborted for target GamePall.exe, PID 5168 because it is empty
Execution Graph export aborted for target GamePall.exe, PID 5692 because it is empty
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:57:01	API Interceptor	335651x Sleep call for process: explorer.exe modified
14:57:36	API Interceptor	9x Sleep call for process: 23E4.exe modified
14:59:40	API Interceptor	1x Sleep call for process: GamePall.exe modified
20:57:17	Task Scheduler	Run new task: Firefox Default Browser Agent 4414DA0EEB5A4C09 path: C:\Users\user\AppData\Roaming\aggtjfs
20:59:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run GamePall C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
20:59:53	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run GamePall C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
77.221.157.163	file.exe	Get hash	malicious	SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	5GOuTtZoQn.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
188.114.96.3	Scan405.exe	Get hash	malicious	FormBook	Browse	www.jjjw.xyz/ypml/
	AuT5pFGTFw.exe	Get hash	malicious	FormBook	Browse	www.coinwab.com/efdt/
	http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	Get hash	malicious	HTMLPhisher	Browse	business.ifbsmetaiidentiityconfirms.com/favicon.ico
	BL Draft.exe	Get hash	malicious	FormBook	Browse	www.ediancai.cn/x7r2/
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/btd2ptah/download
	Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Get hash	malicious	FormBook	Browse	www.ad14.fun/oc7s/
	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	www.ad14.fun/oc7s/
	9098393827383039.exe	Get hash	malicious	FormBook	Browse	www.coinwab.com/kqqj/
	SOA 020724.exe	Get hash	malicious	FormBook	Browse	www.ad14.fun/az6h/?Vn=Ydx4qJJ0n&3jJlx=2tWzkzncG4ra8DBegJJBToW7oB13AdJXZ1KkbDLW+Ah9MGsNEQDOdLre6u2t4zOJ63yLnsPJ97sPnqMxsSzbOxuABFq0Im2Ecm9EQ8GOdhogxDCvRrrALITlDFg7ZHNgcXHQPxMcHnGf
	Adjunto confirmacion de pedido.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.coinwab.com/kqqj/
104.21.45.251	file.exe	Get hash	malicious	SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	LXbM8RbhLa.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.2850.19434.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	OBbrO5rwew.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	SmokeLoader	Browse
	35bf9dfd223e02da2ee3d57ec493156787a3c2cecb8b655a583985a2f14cc6e3_dump.exe	Get hash	malicious	LummaC, SmokeLoader	Browse
	ZXQ3AcEN5Q.exe	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	xJwSq336bs.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://chorbie.com/services/	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://share.mindmanager.com/#publish/mnPTcUqLfLnU6HRHMb6xC3qXYGZYU6tmBtOy3sS6	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer, zgRAT	Browse	104.17.28.25
	Invoice - 06736833774062515586349558087774116555577037575401 - Daiichi-sankyo.pdf	Get hash	malicious	HTMLPhisher	Browse	104.21.40.60
	0001.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Leaked.exe	Get hash	malicious	XWorm	Browse	188.114.96.3
	Zz3h8cOX1E.exe	Get hash	malicious	Quasar	Browse	104.26.13.205
	Luciana Alvarez CV.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Acal BFi UK - Products List 020240704.exe	Get hash	malicious	AgentTesla, RedLine, StormKitty, XWorm	Browse	172.67.74.152
INFOBOX-ASInfoboxruAutonomousSystemRU	file.exe	Get hash	malicious	SmokeLoader	Browse	77.221.157.163
	file.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	77.221.157.163
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	77.221.157.163
	5GOuTtZoQn.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	77.221.157.163
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	77.221.157.163
	Eclf71HXa1.exe	Get hash	malicious	Unknown	Browse	77.221.149.185
	Eclf71HXa1.exe	Get hash	malicious	Unknown	Browse	77.221.149.185
	file.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse	77.221.149.185
	file.exe	Get hash	malicious	PureLog Stealer	Browse	77.221.140.76
	file.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	77.221.140.76
CLOUDFLARENETUS	xJwSq336bs.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://chorbie.com/services/	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://share.mindmanager.com/#publish/mnPTcUqLfLnU6HRHMb6xC3qXYGZYU6tmBtOy3sS6	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer, zgRAT	Browse	104.17.28.25
	Invoice - 06736833774062515586349558087774116555577037575401 - Daiichi-sankyo.pdf	Get hash	malicious	HTMLPhisher	Browse	104.21.40.60
	0001.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Leaked.exe	Get hash	malicious	XWorm	Browse	188.114.96.3
	Zz3h8cOX1E.exe	Get hash	malicious	Quasar	Browse	104.26.13.205
	Luciana Alvarez CV.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Acal BFi UK - Products List 020240704.exe	Get hash	malicious	AgentTesla, RedLine, StormKitty, XWorm	Browse	172.67.74.152
ENTELCHILESACL	j980HN1yJw.elf	Get hash	malicious	Unknown	Browse	200.72.248.178
	vCh0ttyibb.elf	Get hash	malicious	Unknown	Browse	11.109.246.111
	205.185.124.50-arm-2024-07-03T23_47_53.elf	Get hash	malicious	Mirai, Moobot	Browse	152.231.87.147
	2HFh2OjMG7.elf	Get hash	malicious	Unknown	Browse	11.124.126.127
	eW8ah5TCen.elf	Get hash	malicious	Unknown	Browse	11.102.83.132
	BNd5XPrLzR.elf	Get hash	malicious	Mirai, Moobot	Browse	164.77.0.194
	J1ridkwLHt.elf	Get hash	malicious	Mirai, Moobot	Browse	200.111.182.87
	Setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	11.116.12.113
	TGYj8HxqY9.elf	Get hash	malicious	Mirai	Browse	181.43.123.149
	I6e9WczGlf.elf	Get hash	malicious	Mirai	Browse	181.43.123.120

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\huge[1].dat	file.exe	Get hash	malicious	SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	5GOuTtZoQn.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	JuHVfiAuLo.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	LXbM8RbhLa.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	EiPVv5yELP.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	6IMo1kM9CC.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\huge[1].dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\5371.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	107232830
Entropy (8bit):	7.999946456161068
Encrypted:	true
SSDEEP:	1572864:6F6Q78DDbO8pDfwpK5ZAQ5WKor2G5N6Y7ZxFo9jk7WUTLECglga1R7P435MZZDXA:jPNVfsQZoL5NJdo9jKWergS89P4qZZc
MD5:	FF2293FBFF53F4BD2BFF91780FABFD60
SHA1:	61A9EDCF46228DC907AD523AA6FD035CC26C9209
SHA-256:	B9BC473FC866909F089E005BAF2537EE7FF2825668D40D67C960D5C2AFB34E9F
SHA-512:	C31A0046BA580926097422DF34619B614AA0DEB6435EC5CE68A553846FAD15BC61908B8C8292D25EE061BA1974637A7B91D72F19CCCCC2C76B9AC737B1CB4A5E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 5GOuTtZoQn.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe, Detection: malicious, Browse Filename: JuHVfiAuLo.exe, Detection: malicious, Browse Filename: LXbM8RbhLa.exe, Detection: malicious, Browse Filename: EiPVv5yELP.exe, Detection: malicious, Browse Filename: 6IMo1kM9CC.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........................................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\23E4.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6642176
Entropy (8bit):	7.866419732571782
Encrypted:	false
SSDEEP:	98304:LqhZ67opwYckx35SF2XKgxVvHuCPU8GSbO3JAXV1LrA+ZlL9CxpzTp2:LgErupSgKORuCT43JeV1LE+/s3p
MD5:	BD2EAC64CBDED877608468D86786594A
SHA1:	778AD44AFD5629F0A5B3B7DF9D6F02522AE94D91
SHA-256:	CAE992788853230AF91501546F6EAD07CFD767CB8429C98A273093A90BBCB5AD
SHA-512:	3C8F43045F27ADDCB5FB23807C2CE1D3F247CC30DD1596134A141B0BBC7FA4D30D138791214D939DC4F34FD925B9EC450EA340E5871E2F4F64844226ED394312
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....U~f..............................M...........@...................................e...@..................................O......P......................@.......................................................@3..............................text...+........................... ..`.rdata...*..........................@..@.data.... ..........................@....vmpL.p.....0...................... ..`.vmpL.p@....@3.....................@....vmpL.p..]..P3...]................. ..`.reloc.......@........].............@..@.rsrc.......P...f....].............@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5371.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	modified
Size (bytes):	293869
Entropy (8bit):	5.61569579822855
Encrypted:	false
SSDEEP:	3072:lFi6z/VXzAf3ocMNqB3r1Josf+OMhERMlm+twHBumSYyDgIoIPM7l0UGHM7:lxFSIjs+OM2eLFmSFgIZk7+HM7
MD5:	60172CA946DE57C3529E9F05CC502870
SHA1:	DE8F59D6973A5811BB10A9A4410801FA63BC8B56
SHA-256:	42CEB2252FEC41FD0ACC6874B41C91E0BA07C367045D6A9A7850D59781C2584C
SHA-512:	15D37AF3CAB96FC9026A1898E09C775FE0D277098A3FE20C2E591272DE996A243850D43F3B48B4C037C5FED359E57795A7CF1652547D7AD8B16B186AB9508792
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........`..X............................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...X....`......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsk4E9F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\5371.exe
File Type:	data
Category:	dropped
Size (bytes):	60466
Entropy (8bit):	5.603640719549413
Encrypted:	false
SSDEEP:	1536:akqg31kqY3Q4Oc//////Q0LatojW/lX1Xb41:3qg323Sc//////Q3tojW/XXy
MD5:	DE806154A80E3916669C466B6D001BD6
SHA1:	B85BD0EC436125772A9C5403162628B7AAB35F49
SHA-256:	10D9B7F2238EFFEB71990F979B9DFE4F3BE3D212B05232EF34C39F9578CC11E3
SHA-512:	63CC5D6865C89AE2C41EEE3C76FD865D9461E96DBC570270982EB6DB5A15FB234098286CEE3FF9DB2255FEDA5207A222AB67743475AD60CCFD89A86B881BCB94
Malicious:	false
Reputation:	unknown
Preview:	",......,..................."...\|%......H+......",..............................................................................................................................................................................................................................................................j.......,.../...5.......3.......................................................................................................................N.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\INetC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5371.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.668346578219837
Encrypted:	false
SSDEEP:	384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
MD5:	92EC4DD8C0DDD8C4305AE1684AB65FB0
SHA1:	D850013D582A62E502942F0DD282CC0C29C4310E
SHA-256:	5520208A33E6409C129B4EA1270771F741D95AFE5B048C2A1E6A2CC2AD829934
SHA-512:	581351AEF694F2489E1A0977EBCA55C4D7268CA167127CEFB217ED0D2098136C7EB433058469449F75BE82B8E5D484C9E7B6CF0B32535063709272D7810EC651
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9<.EXR.EXR.EXR.b.).LXR.EXS..XR.b. .FXR.b.(.DXR.b...DXR.b.*.DXR.RichEXR.................PE..L....I6V...........!.....8...P......Q?.......P...................................................................... G..l....?..d.......(...............................................................................P............................text....7.......8.................. ..`.data...<<...P.......<..............@....rsrc...(............D..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\blowfish.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5371.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.674611218414922
Encrypted:	false
SSDEEP:	384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
MD5:	5AFD4A9B7E69E7C6E312B2CE4040394A
SHA1:	FBD07ADB3F02F866DC3A327A86B0F319D4A94502
SHA-256:	053B4487D22AACF8274BAB448AE1D665FE7926102197B47BFBA6C7ED5493B3AE
SHA-512:	F78EFE9D1FA7D2FFC731D5F878F81E4DCBFAF0C561FDFBF4C133BA2CE1366C95C4672D67CAE6A8BD8FCC7D04861A9DA389D98361055AC46FC9793828D9776511
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................6..........dD.......P....@.....................................................................Y.......................................p...................................................................................CODE....\|4.......6.................. ..`DATA....8....P.......:..............@...BSS..........p.......L...................idata...............L..............@....edata..Y............P..............@..P.reloc..p............R..............@..P.rsrc................V..............@..P.....................X..............@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\nsProcess.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5371.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	4.666004851298707
Encrypted:	false
SSDEEP:	48:iYXzAm8HGJLvwM8GJFd6I7W4JtT2bxNNAa4GsNf+CJ8aYqmtlKdgAtgma1QvtCSJ:lz2mJkpGR6GY74GQ1YqmstgGCtR
MD5:	FAA7F034B38E729A983965C04CC70FC1
SHA1:	DF8BDA55B498976EA47D25D8A77539B049DAB55E
SHA-256:	579A034FF5AB9B732A318B1636C2902840F604E8E664F5B93C07A99253B3C9CF
SHA-512:	7868F9B437FCF829AD993FF57995F58836AD578458994361C72AE1BF1DFB74022F9F9E948B48AFD3361ED3426C4F85B4BB0D595E38EE278FEE5C4425C4491DBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.I...I...I...n\|f.L...I...Q...@..K...@..H...@..H...RichI...........PE..L...`..N...........!......................... ...............................`.......................................#....... ..<....@.......................P..\|.................................................... ..`............................text............................... ..`.rdata....... ......................@..@.data... ....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsr4CB.tmp\liteFirewall.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	6.389604568119155
Encrypted:	false
SSDEEP:	1536:Dli3i1jKfTV0LzYpAzMk2nACScLw5jPAT:j9KLQ+ScLw5jPAT
MD5:	165E1EF5C79475E8C33D19A870E672D4
SHA1:	965F02BFD103F094AC6B3EEF3ABE7FDCB8D9E2A5
SHA-256:	9DB9C58E44DFF2D985DC078FDBB7498DCC66C4CC4EB12F68DE6A98A5D665ABBD
SHA-512:	CD10EAF0928E5DF048BF0488D9DBFE9442E2E106396A0967462BEF440BF0B528CDF3AB06024FB6FDAF9F247E2B7F3CA0CEA78AFC0CE6943650EF9D6C91FEE52A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W=.e9n.e9n.e9n...n.e9n...n.e9n..Bn.e9n.e8n.e9n.7.n.e9n...n.e9n...n.e9n...n.e9nRich.e9n........PE..L...,.N...........!.........^.......%...............................................3..................................`...$'..d....`.......................p...................................... ...@...............h............................text...1........................... ..`.rdata..P/.......0..................@..@.data........0......................@....rsrc........`.......*..............@..@.reloc.......p.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nst9548.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	358363995
Entropy (8bit):	6.972150585647623
Encrypted:	false
SSDEEP:	3145728:KTzytRGD/CYRNIPKYTFBhfmOS9KBaVzTx9OSsKV97nM:KnUs4tvaVzTD99M
MD5:	5F9D89B40243E83C0B48206CE4EB77D1
SHA1:	477A019AB11E5793168B3E41D83B80A8AC8F1D43
SHA-256:	2BF31800E731EF63E7E5BDEECD87B50B349EC8F5C9D752AACB807AC0E82E95B9
SHA-512:	5B812C2D341FE8A9296EF68E416E0EFA8185FB3ECCEC0917AB206CD7639E1810E6444538B61583E2260F1A46D4209E1995CFBF940A1D9836C4155ADF0504940B
Malicious:	false
Reputation:	unknown
Preview:	........,.......................H...........................................................................................................................................................................................................................................................e...i...............j.......................3.......................................................................................................................t....V..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\setup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5371.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	107232830
Entropy (8bit):	7.999946456161068
Encrypted:	true
SSDEEP:	1572864:6F6Q78DDbO8pDfwpK5ZAQ5WKor2G5N6Y7ZxFo9jk7WUTLECglga1R7P435MZZDXA:jPNVfsQZoL5NJdo9jKWergS89P4qZZc
MD5:	FF2293FBFF53F4BD2BFF91780FABFD60
SHA1:	61A9EDCF46228DC907AD523AA6FD035CC26C9209
SHA-256:	B9BC473FC866909F089E005BAF2537EE7FF2825668D40D67C960D5C2AFB34E9F
SHA-512:	C31A0046BA580926097422DF34619B614AA0DEB6435EC5CE68A553846FAD15BC61908B8C8292D25EE061BA1974637A7B91D72F19CCCCC2C76B9AC737B1CB4A5E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........................................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_0

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Reputation:	unknown
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_1

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012096502606932763
Encrypted:	false
SSDEEP:	3:MsEllllkXl:/M/6
MD5:	259E7ED5FB3C6C90533B963DA5B2FC1B
SHA1:	DF90EABDA434CA50828ABB039B4F80B7F051EC77
SHA-256:	35BB2F189C643DCF52ECF037603D104035ECDC490BF059B7736E58EF7D821A09
SHA-512:	9D401053AC21A73863B461B0361DF1A17850F42FD5FC7A77763A124AA33F2E9493FAD018C78CDFF63CA10F6710E53255CE891AD6EC56EC77D770C4630F274933
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_2

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_3

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	modified
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\index

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlnvP//:Ls3vP//
MD5:	69F6812A119728DDA605322FA951BCB0
SHA1:	A1C03FBC766842C2C9EEEED2A174FEAC02123C5B
SHA-256:	75FC9331A3C652932F81301EB2E761CFD1514D06AB85263DCE4F2AA19FAACCB7
SHA-512:	4134C11555685C446554098C0B95C2F6837E9865216270349B41836643440376DE35DDFB4F5CE58650FFDC142B5EA896CD8C972E8A012F8902698550EA50FE20
Malicious:	false
Reputation:	unknown
Preview:	........................................U....{/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\Del.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.622398838808078
Encrypted:	false
SSDEEP:	96:QPjzIyfbInD3W0IwrBmEH7UewW4ORIhmY5XO40uK8DDzNt:pQIS0IwrJbU7W4kIX5e4kgF
MD5:	97D4D47D539CB8171BE2AEFD64C6EBB1
SHA1:	44ABF82DD553CCE0C1F41B9B78D853075DDD1F16
SHA-256:	8D996D5F68BF2248F223C4F3549303BC6A8EC58CC97FCB63B7BB7D8068850273
SHA-512:	7D402847B093E208410C695095DE815A3F5D5DA81630FD51C88C009C48C269D0EA5016D626351BB9D38862163FAD930645072C50ACCCD743DC0E19531A592FDE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....&.].........."...0.............64... ...@....@.. ....................................@..................................3..O....@.......................`.......2............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H........#...............1...............................................0..-.......(....r...p(.....(.......(....,...(....(........0..T........~....(.....~....(.....(....s....%.o....%.o....%.o....%.o....%~....o....(....&..&..........PP.......0..6.......(....(......( ...r...p~....r...p(!.....("...,...(#......0..........r...p.~$.....o%.....,..~....o&......,..o'....ra..p.~$.....o%.....,..~....o(......,..o'....r...p.~$.....o%.....,..~....o(......,..o'......&..*....4.......#..

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_0

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Reputation:	unknown
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_1

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012096502606932763
Encrypted:	false
SSDEEP:	3:MsEllllkXl:/M/6
MD5:	259E7ED5FB3C6C90533B963DA5B2FC1B
SHA1:	DF90EABDA434CA50828ABB039B4F80B7F051EC77
SHA-256:	35BB2F189C643DCF52ECF037603D104035ECDC490BF059B7736E58EF7D821A09
SHA-512:	9D401053AC21A73863B461B0361DF1A17850F42FD5FC7A77763A124AA33F2E9493FAD018C78CDFF63CA10F6710E53255CE891AD6EC56EC77D770C4630F274933
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_2

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_3

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\index

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlsRl/:Ls3Il/
MD5:	ED34D12323A82A56DE07CFFBF80DD6C2
SHA1:	BBB510FA27B37E43AE5C0B36D1B8E59E714FF8D1
SHA-256:	C84B69EA2F181C6ECF3BCE13B9BC09B11E4A20A315075D416BAF697F64E9C660
SHA-512:	B3CF01C99E034F1FFDE5AD3C149389679B3F0047E76C3CBA5B9A9D6DE3259C88CBC0994A1EF1A16FDC93131CE75BF43D0B9F890A665A064F5D5688663CF74DEA
Malicious:	false
Reputation:	unknown
Preview:	.............................................{/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	296448
Entropy (8bit):	5.660420770467009
Encrypted:	false
SSDEEP:	3072:xTpjI4TptgvmHMaellnhblkK0m2QEk0xjo4OVzdvayfvYn6A:ppbVtsg1e5b2Px2zdyyq
MD5:	7A3502C1119795D35569535DE243B6FE
SHA1:	DA0D16BC66614C7D273C47F321C5EE0652FB5575
SHA-256:	B18FEFB56ED7B89E45CEC8A5494FBEC81E36A5CB5538CCBB8DE41CCE960FAA30
SHA-512:	258B111AC256CD8145CBE212D59DFF5840D67E70EFFD7CDDC157B2A3461B398BBC3446004980131FAA6A8762C19305F56E7B793F045331B56B8BD17D85B884C4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....rf..............0.............>.... ........@.. ....................................@....................................O.......t............................................................................ ............... ..H............text...d.... ...................... ..`.rsrc...t...........................@..@.reloc..............................@..B................ .......H....... ...$...........D...p............................................(....s....Z..(....,...(....(.....(......(......(............~........0..W.......(....".....(......,..o....-...o.....+...( .....o....&..(!...-...........o"....."...BZ.......%..A.......0..Q.......(....(........,..o....-...o.....+...( .....o....&.._...(!...-...........o"..............!. A.......0..V.......(....(......,..o....-.~#.....o.....+...( ...."...B[..o....&..(!...-...........o"....*......

C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	462336
Entropy (8bit):	6.803831500359682
Encrypted:	false
SSDEEP:	6144:leSYvQAd10GtSV41OJDsTDDVUMle6ZjxLV/rHo0Oaaz2R9IY:oJBdBS4msNUCe65frHMnz2R9
MD5:	6DED8FCBF5F1D9E422B327CA51625E24
SHA1:	8A1140CEBC39F6994EEF7E8DE4627FB7B72A2DD9
SHA-256:	3B3E541682E48F3FD2872F85A06278DA2F3E7877EE956DA89B90D732A1EAA0BD
SHA-512:	BDA3A65133B7B1E2765C7D07C7DA5103292B3C4C2F0673640428B3E7E8637B11539F06C330AB5D0BA6E2274BD2DCD2C50312BE6579E75C4008FF5AE7DAE34CE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=N...........!................N#... ...@....@.. ..............................T.....@.................................."..O....@..P....................`......."............................................... ............... ..H............text...T.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................0#......H.......0U..l...........P%.../..P ......................................6..`N.?O...%.C.k_..d...I......5a.......9x......R...gg8...JM...`.[. .o..eE1$_.M.h.q.oz..1..........@....s.c/J..wk.D.....t..&...(.......0..2........r...p(....}.......}"....(........(.........(......r...p(....}.......}"....(........(......0..j.........o....-..s#...+..}......(......(......}.....(....s....}......}......}......(......%-.&r...p}......j(#...rr!..p.{.....{.....B...(....*..0..A........{..

C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	574376
Entropy (8bit):	5.8881470355864725
Encrypted:	false
SSDEEP:	12288:ZzfhypmNGgHA37YyUD1AboTf3xnpJbC8VGSBJjRuz7:ZoI1AbQf3xnpJbC8VLBJjRuz7
MD5:	8F81C9520104B730C25D90A9DD511148
SHA1:	7CF46CB81C3B51965C1F78762840EB5797594778
SHA-256:	F1F01B3474B92D6E1C3D6ADFAE74EE0EA0EBA6E9935565FE2317686D80A2E886
SHA-512:	B4A66389BF06A6611DF47E81B818CC2FCD0A854324A2564A4438866953F148950F59CD4C07C9D40CC3A9043B5CE12B150C8A56CCCDF98D5E3F0225EDF8C516F3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ot............" ..0.............6.... ........... ....................................@....................................O.......................................T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........f...P............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{E....3...{D......(....,...{D.....{F.......-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..

C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	561424
Entropy (8bit):	4.606896607960262
Encrypted:	false
SSDEEP:	6144:XqqUmk/Rik2rH6dl0/IaHNpOVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QyMYFLse:DUK
MD5:	928ED37DB61C1E98A2831C8C01F6157C
SHA1:	98103C2133EBDA28BE78BFE3E2D81D41924A23EE
SHA-256:	39F6A4DB1BE658D6BAFF643FA05AAE7809139D9665475BFCA10D37DCA3384F21
SHA-512:	F59387BFA914C7DB234161E31AD6075031ACA17AAEF4B8D4F4B95C78C7A6A8D0E64211566CA2FD4549B9DA45231F57A4191FBCD3809404653F86EE2ABD4937A4
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Newtonsoft.Json</name>.. </assembly>.. <members>.. <member name="T:Newtonsoft.Json.Bson.BsonObjectId">.. <summary>.. Represents a BSON Oid (object id)... </summary>.. </member>.. <member name="P:Newtonsoft.Json.Bson.BsonObjectId.Value">.. <summary>.. Gets or sets the value of the Oid... </summary>.. <value>The value of the Oid.</value>.. </member>.. <member name="M:Newtonsoft.Json.Bson.BsonObjectId.#ctor(System.Byte[])">.. <summary>.. Initializes a new instance of the <see cref="T:Newtonsoft.Json.Bson.BsonObjectId"/> class... </summary>.. <param name="value">The Oid value.</param>.. </member>.. <member name="T:Newtonsoft.Json.Bson.BsonReader">.. <summary>.. Represents a reader that provides fast, non-cached, forward-only access to s

C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	215862
Entropy (8bit):	5.849338245796311
Encrypted:	false
SSDEEP:	3072:rFi6z/VXzAf3oc8+vat7fvYnDAdOVz5kNx:rxFSI+y1qk6zuNx
MD5:	9D21A25AA1B5985A2C8CBCE7F7007295
SHA1:	86EBF56352B4DBB831FAE0CCA180B4ADD951240D
SHA-256:	E41F984C39183BA4FD1578134D71E203F4A7A8C23F278924562876326FC40EE2
SHA-512:	EE4A1AC97968F2DDA3C54A49AC33D3FCE28C4DAE72032D9FDD1F8D8BA41B07A1D78D15E11586DA54AD5E0F2BD4A48C79A0CBAC84DE3D957B2AC6C1B5F41A33BB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........................................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	875520
Entropy (8bit):	5.621956468920589
Encrypted:	false
SSDEEP:	12288:jsRfnBqqvFXWesd2HiZ9fyn+5FHrvUR1Qnzx7LuQ:jsRITeWAQ5vtu
MD5:	B03C7F6072A0CB1A1D6A92EE7B82705A
SHA1:	6675839C5E266075E7E1812AD8E856A2468274DD
SHA-256:	F561713347544E9D06D30F02A3DFCEC5FE593B38894593AEEDF5700666B35027
SHA-512:	19D6792EB9BA8584B94D0D59E07CE9D1C9C4DA5516490F4ABCE5AE0D7D55B357BDA45B2093B3E9EB9D6858061E9D3F530A6655C4779A50C911501AE23925C566
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..R...........p... ........... ....................................@..................................p..O.......x............................o..T............................................ ............... ..H............text....P... ...R.................. ..`.rsrc...x............T..............@..@.reloc...............Z..............@..B.................p......H....... .................................................................(......(......(....^.(.......=...%...}....:.(......}....:.(......}....^.(.......>...%...}....:.(......}.....(.............0..,.......(....o.......3......... ....3.(....-.....0..L.......~..... . ..(......(....-..(....r...p( ...,.......&...~....(!...,..("..............+1...........4.......~.....~......(.....~....,..(#...-.(....-..(....+.r...ps$...z(..........b.r...p(%...~.....(....&*.r

C:\Users\user\AppData\Roaming\GamePall\cef.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1946739
Entropy (8bit):	7.989700491058983
Encrypted:	false
SSDEEP:	49152:fpXzD2VLpS71ycdao6LreGCL/0jJZWOiBiXkbEia9T:xjyFgZ0Lr2/0jJU5BiIEN
MD5:	96AD47D78A70B33158961585D9154ECC
SHA1:	149BF6F6905A76B0CC9E9ACA580357BD6C3497A2
SHA-256:	C861117D1F1DBF02867B46FA87CB8C65C3213D196029EE81A02B617D131236E2
SHA-512:	6A971F742B5754EEF39C6C2C64DB13DFDCB74D8CB23833404E9EF5AD89E142278E5DF789F508DB561C5E957013AE0C60D002CDFA93BCD87CA4967D610DF1579B
Malicious:	false
Reputation:	unknown
Preview:	........V...f.....g.7........................!.....%....o8...).>...).F...).H...).X...).a...)i...).k...).q...)Lt...).v...)Tw...).x...).}...).....)I....)i....)....).....).....)L....)....)....)t....).....).....).....)s....).... )....!)....")....#)....$)}...%)+...&)h#..').'..().-..)).>..).A..+).C..,).Q..-)CU...).]..<).d..=).l..>)i...?)G...@)H...A)r...B)....C)z...T)....U)....V)+...W)....X)....Y)....Z)....[)#...\)}...]).!..^)R1.._).2..`).;..a).=..b)mE..c)QG..d).H..e)qL..f).U..g).]..h).b..i))d..j).e..k).g..l)Pi..m).p..n).z..s).z...).....)b....).....)'....).....)....)....).....).....)....).....)s....)F....)j....)....).....)....)....)....)h....)H....)....).....).....)k....).....)L....)q....)2....).....).....).....).....).....)N....)\|....).....).....).....).!...).)...).6...).C...)RE...).L...).N...).O...).U...)bV...).W...).^...)o_...)(g...)Si...).v...).....)0....)/....).....),....)..........F....]....3....v........v...................$... ....!8..."....#....$....%*..

C:\Users\user\AppData\Roaming\GamePall\cef_100_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	214119
Entropy (8bit):	7.955451054538398
Encrypted:	false
SSDEEP:	6144:m5S+8U5mtp0ra7rFrJzw95T9OHCZg0Gb0OveGe04mExhLY:mWU5OGUFoqoORehrQ
MD5:	391F512173ECEC14EB5CE31299858DE1
SHA1:	3A5A41A190C1FB682F9D9C84F500FF50308617FC
SHA-256:	E0F5C754C969CCA0AC4594A6F3F2C23D080A09EEA992AF29E19F4291FD1E0B06
SHA-512:	44D7B9BCB3544C3F5550150EF3522BF6A0B36900695E6A13E44F5616E16A058548189D4FEA4A22248B1CB2B273B0EAA7D559EB2D8F013BED520E4097BD45D800
Malicious:	false
Reputation:	unknown
Preview:	........................#.b...&.....:.g....7.....7.....7.....7\|(...7.-...7t5...7.6...7.9...7s:...7hB...7.E...7.G...7.K...7qN...7.Q...7yR...7.S...7.W...7.\...7.b...7.i...7.k...76m...7Vq...7.r...7.v...7.y...7.{...7.~...7Z....75....7;....7W....7.....7c....7u....7b....7.....7.....7.....7Q....7*....7\....8."...8,)..<FqG..=F7I..>F.L..?F$O..@F.P..AFaQ..BFnT..CF.W..DF.Y..EFJ\..FF.^..MF(b..NF.c..QF.e..RF.f..YFZg..ZF.p..[F.x..\F.{..]F.{...L.\|...L.....L....Ni....N.....NJ....N2....N+....N^....No....N9....NK....N....N1....N$....N....Nh....N.....N.....U.....U.....U.....U.....U.....U[....U.&...Uh(...U?/...U.4...U.:...U.@...U.B...U,G...U.K...U)N...U.R...UF\...U.`...U.b...U.j...U]s...UEt...U.u...U.w...U.z...Uh{...U.}...U#....U.....U^....U.....U\|....U.....U.....U.....U.....U.....U.....U.....U.....U.....U]....U?....U.....U9....U....U.....Um....U<....U!....U.....U.....U....Uq....U3....U!....U.....U....U.....Uu....UJ....U.....U.....U.....U.....U`....U'....U.....U.....Ul....U%....U7....U.....U.....UW.

C:\Users\user\AppData\Roaming\GamePall\cef_200_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	290001
Entropy (8bit):	7.9670215100557735
Encrypted:	false
SSDEEP:	6144:tS+8U5mtp0ra7rFriDQYaF+9bQHgs4jTlmOHCZVWGMRe8InVXYopym74:CU5OGUFrfs4gs4jTQ6ebVIo374
MD5:	BF59A047984EAFC79E40B0011ED4116D
SHA1:	DF747125F31F3FF7E3DFE5849F701C3483B32C5E
SHA-256:	CD9BE67AA0527F16E309189FA2369E1A2596D0601A7D55C405F8A619F4D095E9
SHA-512:	85A545758E8C89EF47BF11B553C57D23ED7DA6AE89A8BCCB262F509AABE61A1121C3F87EC9200791F2670225BAEECC3C92AED6AFDA86C08CA0FD611DA2E595D2
Malicious:	false
Reputation:	unknown
Preview:	........................#.....&.....:......7.....7.....7.....7.+...7.1...7.8...7.9...7)<...7.=...7xE...7.H...7.J...7'N...7.Q...7.T...7.U...7.W...7.Z...7._...7.e...7.l...7.n...7Fp...7ft...7.v...7)y...7.\|...7.~...7.....7j....7E....7K....7g....7.....7s....7.....7r....7.....7.....7.....7a....7:....7l"...8.%...8<,..<F.J..=F.N..>FtV..?F9\..@Fw_..AFr`..BF0g..CFll..DF\|o..EF.v..FF){..MF....NF...QFf...RF....YF`...ZF...[F....\F....]F....L....L.....L.....N.....N.....N.....N.....N.....N.....N.#...N.&...N.'...N.)...N....N.+...Nv,...N.-...N;r...N.\|...Um....U.....UM....UV....U.....U....UC....U.....U....UM....U.....U.....Um....U.....U.....U.....U.....UQ....U.....U7....U.....U.....Uk....U.....U.....U.....U.....U.....U.....U.....U.....U.....U{....U.....U.....U.....U~&...U.)...U.Q...U.Q...U.V...U.[...U.\...U._...U.`...U?a...U.a...Uic...U.d...U\f...U.g...U.i...U1l...U.p...U.u...U.}...U.....U.....U^....U.....U.....Ux....U....U.....Uy....U6....U.....U....UR....Uq....U.....U.....U_....U.....U.....U..

C:\Users\user\AppData\Roaming\GamePall\cef_extensions.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1305142
Entropy (8bit):	7.99463351416358
Encrypted:	true
SSDEEP:	24576:8AkckSbnVLjWG13xdT0b+SLzRYt2k+lbG9EjJNH/osm22O+EcRfPLP:88zVXWG1hdAKSxY4k5EFNHgvPPLP
MD5:	20DDA02AF522924E45223D7262D0E1ED
SHA1:	378E88033A7083AAC24E6CD2144F7BC706F00837
SHA-256:	8448C2BA10A3D7DC8CA3FB24F580BF99D91F746107B1A06E74932749CC1CAB01
SHA-512:	E71320B2AA0CB52938206EC00187D78274646C4C7D3579B33A0163262C063B7813FE7ACD0D2E5807082ADE772069AA577FED7F594964790C2F7C061CE38467B6
Malicious:	false
Reputation:	unknown
Preview:	........i...f+....i+....l+....m+{...n+q...o+7(..p+.1..q+X3..r+~5..s+aI..t+.]..u+.f..v+Ui..w+'k..x+.l..y+.q..z+.s..{+O{..\|+...}+=...~+.....+....+-....+.....+.....+.....+.....+.....+.....+.....+.....+.....+%....+.....+&(...+.Q...+.Y...+Xe...+Bj...+cv...+.}...+....+H....+....+Q....+l....+I....+.....+ ....+T....+!....+m....+.....+.....+U....+.....+.....+.....+l....+~....+.....+=....+w....+.....+-"...+.(...+.0...+.2...+.4...+.G...+uS...+.....+9....+y....+.....+.....+N....+....+0....+.....+.....+.....+_....+.....+.....+.....+.....+.....+.....+.....+.....+S....7`....7R...(7/...)7.....L.m...LO....L.....Mk....M.....M.....M>....M.....M.....Mq....M.....M.....M\....M.....M.....M.....M.....M.....M.....M.....M.....M.....MO....M.....M.....M.!...M.(...Mf5...M.;...M&E...M.P...M.T...M<]...M.`...M.j.. M.k..!M2v.."M.w..#M.z..$M....%M...&M...'M#...(M@...)M....*M(...+MY...,Mu...-M$....M..../MV...0M;...1Mx...2M....3M....4Mi...5M....6M....7MP...8M"...DM....EM.....Mi....M.~...M.~...Mb....M_....M....M.

C:\Users\user\AppData\Roaming\GamePall\cef_sandbox.lib

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	87182312
Entropy (8bit):	5.477474753748716
Encrypted:	false
SSDEEP:	196608:v0b1XAJ5V8XYcrfCNJsTtU0ZhdYHbgMnn6d25JOcLRiLnIrBcnK0EAeg1GF:78JaNJyZhdE6383rWEAR8
MD5:	FFD456A85E341D430AFA0C07C1068538
SHA1:	59394310B45F7B2B2882D55ADD9310C692C7144F
SHA-256:	F188B96639B5157E64222BB8483D76CD21A99141FC2614EF275E20639C739264
SHA-512:	EB4CB388383CB37B1D89531D560169985A80DF9335F005AFBBFDE56F9031821A933D735138B1086CF81D006E480FF14711A8A95B3DB8A0FD4037AA6EFD926B50
Malicious:	false
Reputation:	unknown
Preview:	!<arch>./ 1696073295 0 1940897 `...Y..:.t.:.>.:...:...:...:...:...;/..;/..;/..;/..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..@...@...@...@...@...A...A...A...A...A...A...A...A...A...A...A...A...Co..Co..Co..Co..Co..Co..Co..Co..Co..Co..E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...G..G..G..G..G..G..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=.

C:\Users\user\AppData\Roaming\GamePall\chrome_100_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	656926
Entropy (8bit):	7.964275415195004
Encrypted:	false
SSDEEP:	12288:fI3Hdjzgsz5B0GDJQrnKs8SNP+QSsSilRBdNze0Vc+gIXgt4z8oO0TehEr7:g397zEEmPLSOdNze05gUgmz8oO0TOW
MD5:	3404DD2B0E63D9418F755430336C7164
SHA1:	0D7D8540FDC056BB741D9BAF2DC7A931C517C471
SHA-256:	0D3FCA7584613EB1A38BAF971A7DD94F70803FC130135885EC675E83D16A4889
SHA-512:	685D63633DB8A57D84225C2B92C92016E1CE98BA2BF8D3DDACE2EB120B3BCF84C718787D59DB6EC61F34CF91CB651500B4E4FF0AC37AEB89561CDCC586946C80
Malicious:	false
Reputation:	unknown
Preview:	..........+...........................&..........;.....;N....;.....;"....;.....;.....;N....;.....;.....;s....;....;.....;.....;....;4....;.....;.....;0....;.....;c....;7....;.....;.....;.....;.....;?....;:....;G....;.....;n....;x....;.....;.....;.....;#....;.....;.....;B....;.....;.....;.....;N....;.....;.....;+....;.....;% ...;c!...;.!...;."...;E+...;t4...;qH...;I\...;.]...;.^...;>a...;.c...;.g...;.o...;pw...;.\|...;h....;.....;.....;....;.....;....;o....;.....;.....;.....;....;y....;.....;.....;3....;9....;h....;.....;.....;.....;F....;."...;.+...;.0...;.8...;?:...;'X...;.q...;.....;....;.....;t....;.....;.....;.....;./...;.X...; m...;....;.....;.....;.....;+....;.....<O....<.....<.....<=....<2$...<y+...<.3...<.<...<aA...<.L...<.W...<.[...<._...<.d...<Dv...<t....<!....<....<....<.....<.....<.....<V....<.....<.#...<.8...<\|F...<hP...<bW.. <i^..!<ts.."<(...#<{...)<`...<c...+<d...,<"...;<x...<<k...=<....><-...?<....@<....A<'...B<g...C<....D<U...E<....F<....G<....J<....K<....L<v%

C:\Users\user\AppData\Roaming\GamePall\chrome_200_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1017158
Entropy (8bit):	7.951759131641406
Encrypted:	false
SSDEEP:	24576:m3Tl5zLmmibkFR8+mZRUumegvQtc05UwvdAbatzk6edhOLoe9:m3Tl53mNbkFRJmHURhQW05JvdlzkjrOH
MD5:	3FBF52922588A52245DC927BCC36DBB3
SHA1:	EF3C463C707A919876BF17C3E1CD05C0D2C28CA9
SHA-256:	C6FE346106C5E4950161ED72EB0A81FE3537A94E4A59461AAF54E750D1904F76
SHA-512:	682EB6D61B564C878FDB971A6439FCDA9F1E108BD021A32E8990B68B1338986A4866A0965DEA62567501C8826D43CEBF2B7C8BE8323DE415A75E8D89A9D592E7
Malicious:	false
Reputation:	unknown
Preview:	..........+.....................b................;.....;&....;.....;.....;.....;.....;b....;....;8....;.....;.....;o....;....;<....;.....;.....;l....;....;/....;.....;[....;Q....;.....;j....;.....;.....;L'...;.E...;lZ...;.o...;.q...;.r...;.s...;.{...;.{...;.~...;"....;.....;U....;.....;.....;.....;....;d....;.....;.....;i....;.....;f....;....;0....;.....;.....;.(...;+...;.+...;A....;54...;.9...;,O...;.`...;.n...;.~...;.....;.....;M....;....;;....;q....;Z....;.....;.....;.-...;\=...;.P...;.d...;@\|...;.....;Y....;#....;_....;/....;.....;.#...;.;...;.J...;gc...;cf...;W....;....;W....;.....;.....;.....;7....;.-...;.I...;Y\...;W....;....;.....;S....;.....;t....;.....;.....<W....<.&...<9<...<iG...<jQ...<.X...</a...<gi...<.n...<Pz...<.....<f....<.....<I....<.....<.....<.....<4C...<4d...<....<....<.....<.....<.....<D8...<.e...<_....<....<.... <I...!<...."<.E..#<.E..)<.G..<%j..+<N...,<....;<....<<v...=<....><....?<....@<y...A<....B<....C<....D<....E<"F..F<.J..G<.O..J<.X..K<.e..L<.r

C:\Users\user\AppData\Roaming\GamePall\chrome_elf.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1174528
Entropy (8bit):	6.475826085865088
Encrypted:	false
SSDEEP:	24576:I3lp87thPKuxyj+tWF8lCwOvzr90p5OM3:FauY+tWF8b5OM3
MD5:	207AC4BE98A6A5A72BE027E0A9904462
SHA1:	D58D2C70EA0656D81C627D424F8F4EFCCEF57C86
SHA-256:	2BA904DA93ACC4766639E7018AC93CC32AA685DB475F3A59B464C6BC8B981457
SHA-512:	BFB6C58774829DB3D5FADC92CB51477FF4EAC8FB934DB6583A312BB1157468F6DD3A4A3AFAF25A687B74890DC8A69857A12D0B38B18D83E82836E92E02046FF3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....v...p......P.....................................................@A........................vT......AX..<.......x...........................<<.......................;......(...............<[.......O.......................text....u.......v.................. ..`.rdata..\............z..............@..@.data...H...........................@....00cfg...............F..............@..@.crthunk.............H..............@..@.tls.................J..............@...CPADinfo(............L..............@...malloc_h.............N.............. ..`.rsrc...x............P..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2106216
Entropy (8bit):	6.4563314852745375
Encrypted:	false
SSDEEP:	49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
MD5:	1C9B45E87528B8BB8CFA884EA0099A85
SHA1:	98BE17E1D324790A5B206E1EA1CC4E64FBE21240
SHA-256:	2F23182EC6F4889397AC4BF03D62536136C5BDBA825C7D2C4EF08C827F3A8A1C
SHA-512:	B76D780810E8617B80331B4AD56E9C753652AF2E55B66795F7A7D67D6AFCEC5EF00D120D9B2C64126309076D8169239A721AE8B34784B639B3A3E2BF50D6EE34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.h...;...;...;..];...;...;...;.._;...;..h;0..;..i;'..;..X;...;..l;D..;?M.;...;..Y;...;..^;...;Rich...;........PE..L...92.K...........!.........d...............................................p .....O. ...@.........................@.......@...P..................... .h............................................i..@............................................text...S........................... ..`.data....~.......B..................@....rsrc................(..............@..@.reloc..D............,..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4127200
Entropy (8bit):	6.577665867424953
Encrypted:	false
SSDEEP:	49152:OS7PQ+besnXqRtHKzhwSsz6Ku1FVVOsLQuouM0MeAD36FqxLfeIgSNwLTzHiU2Ir:O4PhqqFVUsLQl6FqVCLTzHxJIMd
MD5:	3B4647BCB9FEB591C2C05D1A606ED988
SHA1:	B42C59F96FB069FD49009DFD94550A7764E6C97C
SHA-256:	35773C397036B368C1E75D4E0D62C36D98139EBE74E42C1FF7BE71C6B5A19FD7
SHA-512:	00CD443B36F53985212AC43B44F56C18BF70E25119BBF9C59D05E2358FF45254B957F1EC63FC70FB57B1726FD8F76CCFAD8103C67454B817A4F183F9122E3F50
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!7P.OdP.OdP.Od..NeR.OdP.Nd..OdY..dU.Od.Jem.Od.KeQ.Od...dQ.Od..Leo.Od..Je..Od..OeQ.Od..Ge..Od..Kec.Od...dQ.Od..MeQ.OdRichP.Od................PE..L..................!.....2<..*...............P<...............................?.......?...@A.........................<<.u.....=.P.....=.@.............>..%....=.........T....................u..........@.............=..............................text...e0<......2<................. ..`.data...`"...P<......6<.............@....idata........=.......<.............@..@.rsrc...@.....=.......<.............@..@.reloc........=.......<.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\devtools_resources.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	2205743
Entropy (8bit):	7.923318114432295
Encrypted:	false
SSDEEP:	49152:qHlbrhXKMVp/DVegxF2Xe1WFG4F3KMWB7rwz3yY+23:qFnhXKwggr0cWEgaMi7rwrw23
MD5:	54D4E14BFF05C268248CAB2EEDFB61DD
SHA1:	33AF472176F6E5FB821FFE23C9FBCCC7C735B5B9
SHA-256:	2CAC401BFFA9FD4DFFE11E05EE18FC5CA7A30EC5BF7EF6A3EA8518A4F3344790
SHA-512:	5A6893E7EA30EAA0EFF44687B0D15366A8224E476E4AE8FE0D5C7EF2B3C62E6B0184F73EAD36C4E4E08D6936524CEF8429660B3EC29453EED128E3C5368CE78C
Malicious:	false
Reputation:	unknown
Preview:	........K....[.....[.....[.....[Y....[.....[.....[.....[.....[P ...[.!...[."...[.#...[.$...[.%...[.%...[T&...[0'...[/(...[.(...[.(...[....[.+...[{,...[1-...[.-...[3....[b/...[.0...[.1...[.2...[.3...[,4...[.4...[P5...[.5...[#6...[!8...[.8...[.9...[.9...[::...[q;...[Y=...[.=...[ ?...[.@...[0A...[iB...[?D...[.E...[pE...[UF...[.G...[.H...[)I...[.I...[.M...[.M...[DN...[.N...[FO...[.O...[.Q...[oV...[uW...[cX...[[\...[.]...[Ea...[bc...[.c...[ d...[.d...[oe...[.f...[.h...[.i...[Xj...[.k...[.l...[An...[.o...[.p...[.....[....[.....[.....[.....[.....[[!...[.%...[d....[x1...[.4...[.4...[.9...[.C...[.Q...[KS...[#V...[=]...\.b...\.z...\Q}...\.....\.....\....\`....\.^...\7b...\uy...\g....\.....\.....\=....\....\....\....\'....\.....\....\.... \....!\...."\....$\....%\....&\....)\....\....+\.Q..,\.S..-\.U...\..../\w...0\....1\8...2\....3\....4\....5\....6\....7\.T..8\.z..9\6...:\....;\c...<\)&..=\...>\>5..?\JU..@\.r..A\....B\9...C\....D\S...E\....F\\y..G\Y...H\%...I\....J\M...K\.a..L\.j..M\.n

C:\Users\user\AppData\Roaming\GamePall\icudtl.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	10717392
Entropy (8bit):	6.282534560973548
Encrypted:	false
SSDEEP:	196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
MD5:	E0F1AD85C0933ECCE2E003A2C59AE726
SHA1:	A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
SHA-256:	F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
SHA-512:	714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
Malicious:	false
Reputation:	unknown
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW..K..P...L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

C:\Users\user\AppData\Roaming\GamePall\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	377856
Entropy (8bit):	6.602916265542373
Encrypted:	false
SSDEEP:	6144:oJ4tr7XVkL/2qBCOeRMIKVpqtXmzKwdo23zqyU73omBT095OiZH:2NfBCOeR/KVpqtio23zqyOsOo
MD5:	8BC03B20348D4FEBE6AEDAA32AFBBF47
SHA1:	B1843C83808D9C8FBA32181CD3A033C66648C685
SHA-256:	CBEE7AC19C7DCCCA15581BD5C6AD037A35820DDFE7C64E50792292F3F2E391E6
SHA-512:	3F9EEC2C75D2A2684C5B278A47FB0E78B57F4F11591FAC4F61DE929F716BBAA8F7DF05E10390408AD6628538611541548C26869822372E9C38D2C9C43881651E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....`...`............................................... ............@A........................8,..h....:..(.......x........................>..........................D........p..............(<..`............................text....^.......`.................. ..`.rdata..L....p.......d..............@..@.data....4...p.......`..............@....00cfg...............\|..............@..@.tls.................~..............@....rsrc...x...........................@..@.reloc...>.......>..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6635008
Entropy (8bit):	6.832077162910607
Encrypted:	false
SSDEEP:	196608:HrmMLEFtac5bM68f8Oi3WjH13GzSW3430aTwQCe:a+ktad68f8Oi3oH13GztokaTwbe
MD5:	63988D35D7AB96823B5403BE3C110F7F
SHA1:	8CC4D3F4D2F1A2285535706961A26D02595AF55C
SHA-256:	E03606B05EEAED4D567EA0412350721C0D566B3096B18C23BD0B3FCDE239E45A
SHA-512:	D5F5ACA00BE9E875FCD61531CC7F04F520FB12999E36E4FE06BEAAE491B47D2E9FE182015DB1CBFBB8E78CF679F2EB49E20ECDF1B16D1D42058D6F2D91BC3359
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!......L...........@.......................................e...........@A.........................].......^.d.....a.......................a.."...U]......................T].....X.L.............H.^.@.....].@....................text.....L.......L................. ..`.rdata...I....L..J....L.............@..@.data...X....._.......^.............@....00cfg........a.......a.............@..@.tls..........a.......a.............@....rsrc.........a.......a.............@..@.reloc..."....a..$....a.............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\libcef.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176517632
Entropy (8bit):	7.025874989859836
Encrypted:	false
SSDEEP:	1572864:VSuR7JVHywK/Sf1rWID4Pu2v8zgguHWJEqM90Hw4DclJkBLrWXmfnehuWNIPKtlL:MCYRNIPKYTFBhfmOS9KBaVz
MD5:	F5259CC7721CA2BCC8AC97B76B1D3C7A
SHA1:	C2FC0C8396D8CD6764809A2A592972E2EBCA64BA
SHA-256:	3FE6A262EF01CB8FD4DC2D4373DE0F1F0A89EE51953452ED4557CB55F1DA9AB4
SHA-512:	2D01B1F2B24717EFF37965BBC32D167434A65F3DFFF74342D2E2FA8FBB0E97C3F61FDF673A13AD63031D630D9CE46A6F9F0C4F89EBD30C31F3EA55817B9D1331
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.........N.......k....................................................@A........................#..........h....0J.(C....................L.\|.\.P................................?..............`.......LY..@....................text............................... ..`.rdata...%2..0...&2.................@..@.data...dr+..`.......>..............@....00cfg........I.......&.............@..@.rodata.@.....I.......&............. ..`.tls..........J.......&.............@...CPADinfo(.....J.......&.............@...malloc_h..... J.......&............. ..`.rsrc...(C...0J..D....&.............@..@.reloc..\|.\...L..0\..B).............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\libcef.lib

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	40258
Entropy (8bit):	4.547436244061504
Encrypted:	false
SSDEEP:
MD5:	310744A0E10BD9C2C6F50C525E4447F9
SHA1:	9BA62D6AC2CB8EFF46C9B21051677FC1DC66D718
SHA-256:	E9C55CFF925E26812139CDCAD6612E0D69E317CB7BB1435C9EB5113D338ACCE7
SHA-512:	6DF9E3F9AFD7CDEC750B006987E5AEC445E163DD0B9CF1A9EA53F78DB2EE5FD654E3B4F82BCA3E1F4BEDB189F5DFA51189C820905676AD048DBE2E0AD405BF5B
Malicious:	false
Reputation:	unknown
Preview:	!<arch>./ 0 0 0 0 14390 `.......8z..:&..:...;...;...<&..<&..<...<...=...=...=...=...>...>...>...>...>...>...?f..?f..?...?...@B..@B..@...@...A$..A$..A...A...B"..B"..B...B...C...C...C...C...D...D...D...D...D...D...E...E...E...E...Fn..Fn..F...F...GZ..GZ..G...G...HJ..HJ..H...H...I$..I$..I...I...J...J...J...J...K ..K ..K...K...L...L...L...L...M...M...M...M...N...N...N\|..N\|..N...N...Od..Od..O...O...P`..P`..P...P...QP..QP..Q...Q...RT..RT..R...R...S@..S@..S...S...T...T...T...T...U...U...Un..Un..U...U...VP..VP..V...V...W,..W,..W...W...X...X...X...X...X...X...Y\..Y\..Y...Y...ZB..ZB..Z...Z...[,..[,..[...[...\...\...\...\...\...\...]b..]b..]...]...^N..^N..^...^..._6.._6.._..._...`$..`$..`...`...a...a...a...a...b...b...b...b...c...c...c...c...c...c...dj..dj..d...d...e^..e^..e...e...fV..fV..f...f...g8..g8..g...g...h..h..h...h...i"..i"..i...i...j...j...j...j...k...k...k...k...l...l...l...l...l...l...mh..mh..m...m...nN..nN..n...n...o2..o2..o...o...p...p...p.

C:\Users\user\AppData\Roaming\GamePall\locales\af.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	470498
Entropy (8bit):	5.409080468053459
Encrypted:	false
SSDEEP:
MD5:	64F46DC20A140F2FA3D4677E7CD85DD1
SHA1:	5A4102E3E34C1360F833507A48E61DFD31707377
SHA-256:	BA5CA0A98E873799A20FD0DF39FDB55AAB140E3CC6021E0B597C04CCE534246D
SHA-512:	F7D789427316595764C99B00AF0EF1861204F74B33F9FAB0450F670CB56290C92BFB06EF7D1D3B3BF0B6ACDC6295E77F842C49579BD9973E3D5805920CDB2527
Malicious:	false
Reputation:	unknown
Preview:	........$$..e.>...h.F...i.N...j.Z...k.i...l.t...n.\|...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................&...........5.....<.....C.....D.....E.....J.....W.....f.....w.................x.................A.......................S.........................................%.....{.......................V.......................J.......................Y.......................e.......................a.......................l...................................O.....f.......................).....z.......................6.....u.......................Q.......................E.....w.................!.....I.....R.............................l.......................f.................+.............................f.......................D.......................<......................._.......................2.....~.................2.....v.................X...........$.....8.................P.....r...........6.....j.....}.................1.....?...................

C:\Users\user\AppData\Roaming\GamePall\locales\am.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	763010
Entropy (8bit):	4.909167677028143
Encrypted:	false
SSDEEP:
MD5:	3B0D0F3EC195A0796A6E2FAB0C282BFB
SHA1:	6FCFCD102DE06A0095584A0186BD307AA49E49BD
SHA-256:	F9F620F599BC00E84A9826948C3DA985AC9ADB7A6FFB4C6E4FBEFEAF6A94CF85
SHA-512:	CA9217F22C52EF44E4F25142D1AD5DD9D16E4CCC3B6641609E1F4C2650944E35BA4CAB59CA5CD9EA6FEFD6BE1D3E8227FC0E3E6BDEDD14B059CA2C72D096D836
Malicious:	false
Reputation:	unknown
Preview:	........>${.e.r...h.z...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.(...\|.....}.@.....H.....M.....U.....].....e.....l.....s.....z.....{.....\|...............................................F.....f.....'...........V...........Y.............................5.................F.................!.................d.....z...............................................C...........\.................z...........h...........3...........$.....C.................e.................i.................,.......................X.............................h.......................!.....\|...........$.............................1.....}.........................................Z.................\|...........'.....N...........F.................;.............................G.................v............ ....4 ..... ....X!.....!.....!....x"....."....Z#.....#....M$.....%.....%.....%.....&....+'.....'.....'.....(....D).....).....)....2....................+....",.....,

C:\Users\user\AppData\Roaming\GamePall\locales\ar.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	838413
Entropy (8bit):	4.920788245468804
Encrypted:	false
SSDEEP:
MD5:	C70B71B05A8CA5B8243C951B96D67453
SHA1:	DEED73A89F0B3EDAB8FF74117CC6B31CB4F426E8
SHA-256:	5E0D4BC0893A334B6FFF610F66E4A00920530D73EC3257EB9D37A96EBD555C13
SHA-512:	E000FD3592AC5FE700C4CE117868915C066AC66D5954A1DE4F5AFF0F4559C93F7DFF47623F1837CE827FFF94E91ECD89A974037BE9CCCC8E672E229A1E8115E9
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.!...n.)...o.....p.;...q.A...r.M...s.^...t.g...v.\|...w.....y.....z.....\|.....}.........................................................................-.....d.................n...........A...........u.......................O.......................D.................Y...........3.....J...........=.....g.....~.....&.................O.......................B.....!...........u...........5...........).....W.................3.....N.....U.....B...........!.........../.....Y........... .......................g...........).....I.................#.....A...........@.................6........... .....D...........I.................%.............................=.................?...................................G...................................).....t............ ..... ..... ..... ....o!.....!....6"....\"....."....S#.....#.....#.....$.....%....V&.....&....5'.....'.....(....J(.....(....X).....).....).........z..............t+.....,....{,.....,....--

C:\Users\user\AppData\Roaming\GamePall\locales\bg.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	869469
Entropy (8bit):	4.677916300869337
Encrypted:	false
SSDEEP:
MD5:	12A9400F521EC1D3975257B2061F5790
SHA1:	100EA691E0C53B240C72EAEC15C84A686E808067
SHA-256:	B7FD85B33B69D7B50F6C3FDC4D48070E8D853C255F2711EEDAA40D1BA835F993
SHA-512:	31EAA1CBF13BC711750B257C6B75813ACC8E4E04E9262815E399A88B96BA7B5BE64CE2450638B5521D5CB36750C64848944168C3234D2CE15A7E3E844A1E1667
Malicious:	false
Reputation:	unknown
Preview:	........%$..e.@...h.H...i.P...j.\...k.k...l.v...n.~...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}................... .....(.....0.....7.....>.....E.....F.....G.....L.....n...................................I...........Q...........q.......................T.................E.......................7.....~...........<.................:.....&...........F.................X...........$.................Z...........X...........m.................C.........................................{...........:.....a...................................8................._...........O.....}...................................$.....h.........................................2.............................3 ....e .....!.....!.....!.....".....".....#....W#.....#....{$....-%.....%.....%.....&....k'.....'....T(.....).....).....).....).....*....`+.....+.....+.....,....p-.....-....&....../...../.....0.....0.....1....o2.....2....73.....4.....4.....4....-5.....5....X6.....6.....6.....7.....8.....9

C:\Users\user\AppData\Roaming\GamePall\locales\bn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1118348
Entropy (8bit):	4.2989199535081895
Encrypted:	false
SSDEEP:
MD5:	89A24AF99D5592AB8964B701F13E1706
SHA1:	2177122C6DCC20E1D07EF43AF5A112E8E5C6B95B
SHA-256:	5BDBBCD0D07B6AE3A7F96F07871EE541F4111D90D73FD6E112C5ABE040025C96
SHA-512:	60F6CD73BF35886EF54FA6200F86BCED78DD11F612C8071F63EB31108F109C166D45609879E8E5107024A025BAFCFCF1C80051B6D8FF650D92DCF17136384EB1
Malicious:	false
Reputation:	unknown
Preview:	........($..e.F...h.N...i._...j.k...k.z...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......#.....(.....0.....8.....=.....E.....L.....S.....Z.....[.....\.....a.............................=.....G...........?.....4...........................................................B.....}.....>...........k...........X...........].............................q.....W...................................W...........S...........e.............................I.....m.....e..........._.....(.................9...........q.................p...........5.....X.....8...........Q...........M...........I.....u.....-...........!.....G............ ..... ..... .....!....P".....".....".....#.....%.....%.....&.....'.....'....^(.....(....;).....).........6.....+.....+....1,....],....E-................-/...../....x0.....0.....0.....1.....2.....2.....3...."4.....4....x5.....5.....6....78....*9....]9.....:.....;....;<.....<.....=....?>.....>.....>.....?....y@.....@.... A....&B.....B

C:\Users\user\AppData\Roaming\GamePall\locales\ca.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	537139
Entropy (8bit):	5.397688491907634
Encrypted:	false
SSDEEP:
MD5:	37B54705BD9620E69E7E9305CDFAC7AB
SHA1:	D9059289D5A4CAB287F1F877470605ED6BBDA2C8
SHA-256:	98B2B599C57675EFC1456B38B23CE5657B142E0547F89AB1530870652C8EB4BA
SHA-512:	42D667FEB59BB5FA619AC43DC94629ED1157CBE602643FB21378A2C524EF1F6E32098E7C62D3F3DE35D9FEDEF6607FE034908601AE3C49156CD0916E2514D2F9
Malicious:	false
Reputation:	unknown
Preview:	........%$..e.@...h.H...i.P...j.\...k.k...l.v...n.~...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}................... .....(.....0.....7.....>.....E.....F.....G.....I.....c.....\|................._...........[.....z...........O.................D...........(.....G.................B....._.................A.....T.................8.....I...........3.....u...........(.......................p.................,.......................1.................T.....o.............................v.......................b.......................@.......................@.......................O.......................<.............................`.......................P.........................................M.......................H......................._.........................................n.......................Q.......................[.............................1.................>.........................................6.............................\|...........".....>.

C:\Users\user\AppData\Roaming\GamePall\locales\cs.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	545011
Entropy (8bit):	5.844949195905198
Encrypted:	false
SSDEEP:
MD5:	65A2C2A73232AB1073E44E0FB6310A5F
SHA1:	F3158AA527538819C93F57E2C778198A94416C98
SHA-256:	E9A1610AFFCA9F69CD651C8D2EDD71B5A0F82CB3910A8A9D783F68E701DB5BB0
SHA-512:	20ED527F3BBBA2CECE03D7B251B19D6DCC9D345B5425291D8139FCDD5646EC34D585891160CC4BD96C668D18FFFFDD56F4D159880CFC0D538749F429F7F65512
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.&...i.....j.:...k.I...l.T...n.\...o.a...p.n...q.t...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................#.....$.....%.....'.....7.....I.....[.....p.............................\|.................%...........(.........................................3......................./.......................2.......................z...........I.....k...........R.......................v................./.......................z...........=.....W.................&.....=....................... .....o.......................^.......................r.......................m.......................b.......................z.................0...........%.....i.......................3.....G.......................(.......................1.................R................./.....J.....^...........A.....q.................`.................,...................................V.....w...........Z.......................O.....t.................b.......

C:\Users\user\AppData\Roaming\GamePall\locales\da.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	496165
Entropy (8bit):	5.446061543230436
Encrypted:	false
SSDEEP:
MD5:	A44EC6AAA456A6129FD820CA75E968BE
SHA1:	9B5B17AFD57ADB8513D2DA9A72223E8A003975A5
SHA-256:	F01F9C3E4E6204425F2969F77BF6241D1111CE86CDD169BDF27E5D2D4B86C91A
SHA-512:	947DB81EA64009CC301CD2DCE06384202E56446F6D75E62390334B91D09B564CB0681E06BF7A945033BD6C28C2171346A91EE16693262C4E373A31B51AD42A9E
Malicious:	false
Reputation:	unknown
Preview:	........,$..e.N...h.V...i.g...j.s...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}."........../.....7.....?.....G.....N.....U.....\.....].....^.....`.....n.....~.........................................Q..................................q.................].......................P.....w.................8.....b.....p...........9.....h.................n.................7.......................^............................. .....p...................................q.......................X.......................1...............................................".............................{.......................Z.......................C.....p.....~...........y.................4.............................l.......................I.....f.....v...........^.................................................................F.......................B...................................O.....~...........J.....z.................$.....@.....M.................F.

C:\Users\user\AppData\Roaming\GamePall\locales\de.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	534726
Entropy (8bit):	5.49306456316532
Encrypted:	false
SSDEEP:
MD5:	49CA708EBB7A4913C36F7461F094886B
SHA1:	13A6B5E8DC8B4DF7A976A0859684DC0AA70F1B12
SHA-256:	8AE7D6B77C51A4FE67459860ABDAE463F10766FAF2BA54F2BB85FD9E859D2324
SHA-512:	6908F96BFDF7499B33E76697AA96103E89ACB3E25EDBD6156B610564AF14D4ED474C547A760503490B6327A801478E223039836BEEF2B938AF76827A15C0F751
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.%...y.+...z.:...\|.@...}.R.....Z....._.....g.....o.....w.....~.................................................................X.................E...................................^.....x...........n................./.......................Z...................................U.....w.............................h...........&.....7...........9.....w........... ................. ..........._.................D.......................U.......................h...................................a.....x...........f.........................................F.......................u...........).....;...........j.................A.......................;.......................9.......................t...........,.....`...........-.....K.....b...........G.....s.................}.................T...........,.....6...........S................./.......................K.......................t...........*.

C:\Users\user\AppData\Roaming\GamePall\locales\el.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	950999
Entropy (8bit):	4.76377388695373
Encrypted:	false
SSDEEP:
MD5:	9CBC320E39CFF7C29F61BD367C0BF3BB
SHA1:	2AF07EFFF54A0CF916CF1C0A657F7B7ADF2029FF
SHA-256:	E8837DEFA908EB2FD8B4EB6344412C93403A4258F75EC63A69547EB06A8E53B3
SHA-512:	F7D84185F4520E7AAF3F3CACF38B53E9638BB7D5023FA244020EC8D141FFD5C10B198FF089824D69671FE8350F931B0BB19B6CAF14AF47B0838953367A146DD0
Malicious:	false
Reputation:	unknown
Preview:	........)$..e.H...h.P...i.X...j.b...k.q...l.\|...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................&...........6.....=.....D.....K.....L.....M.....O.....v.......................5...................................V.................h...........F.....i...........~...........{...........a...........'.................&.......................M.....U.....O............................./.....J.....1..........._...........{.....6................. .............................g.......................<.................J...........8.....t.....O.....).......................U............................................................ ..... .....!.....!.....".....#.....$.....$.....$.....%....\|&.....&.....'.....'....;(....t(.....(....M).....)....;....h....U+.....,.....,.....,.....-....8.....t...........f/....(0.....0.....0.....1....S2.....2.....3....64....Q5.....6....@6....A7....(8.....8.....8.....9.....:....o;.....;....[<....%=.....=.....=.....>.....?....6@

C:\Users\user\AppData\Roaming\GamePall\locales\en-GB.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	430665
Entropy (8bit):	5.517246002357965
Encrypted:	false
SSDEEP:
MD5:	0F1E2BC597771A8DB11D1D3AC59B84F3
SHA1:	C1F782C550AC733852C6BED9AD62AB79FC004049
SHA-256:	E4798E5FF84069C3BFD7D64734CCD9FF5C8A606315B44A714ACDCABDDAF3CA6E
SHA-512:	07E9B98357C880995576059AD4E91E0F145DC0F2FFF2DFDAD8649FA42EB46FA86F7F093503C41019EAD4550784E26C553D171518355FBBF995E38B1F6D7ABFF0
Malicious:	false
Reputation:	unknown
Preview:	.........$ .e.(...h.0...i.>...j.J...k.Y...l.d...n.l...o.q...p.~...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................%.....,.....3.....4.....5.....:.....G.....V.....f.....w...........J.......................H.....y.................I.......................@.....o.......................?.....M............................._.......................B.......................8.............................[............................V.....a................l............................. .....^.............................A.....b.....n.................H.....[.......................+.....t.......................5.....y.......................:.....c.....n...........'.....d.....y.................).....?.............................G.............................].......................4.....O.....^.................6.....F.................#.....;.................V.....d...........$.....[.....x.................F.....U.............................k.............

C:\Users\user\AppData\Roaming\GamePall\locales\en-US.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	434598
Entropy (8bit):	5.509004494756697
Encrypted:	false
SSDEEP:
MD5:	FEAB603B4C7520CCFA84D48B243B1EC0
SHA1:	E04138F1C2928D8EECE6037025B4DA2995F13CB4
SHA-256:	C5B8FBDBB26F390A921DCACC546715F5CC5021CD7C132FD77D8A1562758F21F4
SHA-512:	E6B3970A46D87BFD59E23743B624DA8116D0E1A9912D014557C38FD2664F513E56317AFA536DF52E7E703863FBD92136BE57EE759A2FFC2958AB028F6287E8B7
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.,...y.2...z.A...\|.G...}.Y.....a.....f.....n.....v.....~.................................................................G.......................\.......................Q.......................T......................./.....t.......................7.....^.....k.................".....9.................!.....9.............................i.......................7.......................!.............................K.....f.....u.............................Y.............................k.......................G.....t.......................7.....B.............................J.......................$.....~.......................^.............................=.....R.............................q.......................X.............................X.......................7.....o.................X.......................k.......................a.......................!.....C.....S.................,.

C:\Users\user\AppData\Roaming\GamePall\locales\es-419.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	524728
Entropy (8bit):	5.377464936206393
Encrypted:	false
SSDEEP:
MD5:	32A59B6D9C8CA99FBD77CAA2F586509A
SHA1:	7E8356D940D4D4CC2E673460483656915AA59893
SHA-256:	AA4A5AA83DD5F8476867005844F54664DB1F5464A855EF47EC3A821DAF08E8F2
SHA-512:	860BA06228BBA31EEC7EB8BD437DDB6E93BABD0129033FB6EFF168F2FB01B54E2B93D2AB50A5D4F5D2FB7B04A5D0DD5541999D708CC2613B74AADD17B3E98735
Malicious:	false
Reputation:	unknown
Preview:	........5$..e.`...h.h...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.,.....4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....j.....\|.......................J...........>.....Y...........1.....v..........."...................................L.....g.................4.....G.................,.....=...........7.....}...........6...................................6.....I.................\.....s..........._.................Z...........2.....Y.......................:.......................".......................0.................R.....e...........).....g.....s.................P.....[.................4.....>.................L.....\...........O.................!.....v.................+.....x.................i.................:.................2.......................!.......................0.................I.....c...........x.............................B.....p...........V.......................G.....j.....}...........n.............

C:\Users\user\AppData\Roaming\GamePall\locales\es.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	523181
Entropy (8bit):	5.356449408331279
Encrypted:	false
SSDEEP:
MD5:	3D1720FE1D801D54420438A54CBE1547
SHA1:	8B1B0735AE0E473858C59C54111697609831D65A
SHA-256:	AE32D66C0329104B9624BA0811FE79149D1680D28299440EC85835DBA41C7BD2
SHA-512:	C033BBB5261EC114DCB076EDB5E4B3293F37D60C813674A947F996606A6289204C04D2E4315356D92EEEB43FF41D534997DBEBBF960B17F2F24AA731AFE4B7E1
Malicious:	false
Reputation:	unknown
Preview:	........5$..e.`...h.h...i.p...j.\|...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.+.....3.....8.....@.....H.....P.....W.....^.....e.....f.....g.....i.....\|.......................O...........G.....b...........D.................0........... .....:.................Y.....t.........../.....^.....n...........0.....X.....i...........c.................W...................................I.....Z................f.....{...........o.................g...........+.....P.................8.....N.................".....1......................@.................?.....R.................;.....G.................%.....0.............................y...................................D.....^.................@.....].................5.....T...........;.....`.....s...........h.................M.......................A.......................W.............................&.................)...................................A.....U................. .....3.................D.

C:\Users\user\AppData\Roaming\GamePall\locales\et.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	475733
Entropy (8bit):	5.456553040437113
Encrypted:	false
SSDEEP:
MD5:	C00D66D3FD4FD9D777949E2F115F11FB
SHA1:	A8EAAD96CABCDFB7987AF56CB53FA5E16143EC48
SHA-256:	26C438935E3F666329EE8D1DABA66B39179BCF26EBAC902F9B957A784BDC9B4A
SHA-512:	E7E8C083B556DD05874AC669B58A4D1CD05D1E1B771EB4C32942869E387C6FA2B317B5F489138BD90135117DAEB051D96A7823B531DF0303BD4245A036F25A20
Malicious:	false
Reputation:	unknown
Preview:	........@$y.e.v...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...\|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................S...........J.....e...........4.....d.....w...........Y.......................u.......................m.......................\.......................[.........................................7.......................;.......................K.......................x...........;.....R.................9.....T................. .....,.............................w...........#......................./.....=.................'...../.................".....1.................$.....,.................O.....g.................4.....J.................,.....O.................4.....A.................=.....i.................&.....7.................#.....;.................?.....Z...........U.................C...................................@.....M...........................................

C:\Users\user\AppData\Roaming\GamePall\locales\fa.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	773397
Entropy (8bit):	5.04618630633187
Encrypted:	false
SSDEEP:
MD5:	C998140F7970B81117B073A87430A748
SHA1:	8A6662C3AABDAC68083A4D00862205689008110C
SHA-256:	182F18E4EFCA13CA59AFD1DF2A49B09733449D42526EE4700B11A9C5E6AAC357
SHA-512:	5A947A44F674F9556FDD44D2E4FF8CF0E0AAC4475FFA12480CA1BD07CFE7514961B7CACE6760189432B4B4BEB5EA5816701158EB3CB827A806F3063853C46D5E
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.#...s.4...t.=...v.R...w._...y.e...z.t...\|.z...}...............................................................................-.....T.....9.......................^...........u..........._.............................H.................a...........S.....f...................................?.................j..........._.............................'...........f.......................I.......................v.............................Q.....u...........}.................S...........).....@...........x.................m...........M.....d...........p.................H.................:...........`.................`...........l...............................................s...........C...........0.....P.......................;...........1 ....V ....q ....+!.....!....'"....I"....."....\|#.....#.....#.....$.....%.....&.....&....j'.....(....l(.....(....W).....)....M....p.....*....n+.....+.....+....d,.....-....P-....x-

C:\Users\user\AppData\Roaming\GamePall\locales\fi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	483378
Entropy (8bit):	5.428549632880935
Encrypted:	false
SSDEEP:
MD5:	1CFD31A6B740D95E4D5D53432743EBF1
SHA1:	20CEEEA204150BD2F7AAE5866C09A3B0AE72D4C5
SHA-256:	F821E06B4BACD9E7660A2D6912A049591FFD56C6D2A0A29B914648589B17B615
SHA-512:	C483B7347F91BE8EE515DCF352A1D7502B9A159EDE35EACCEBAA763B93A625BCE2D0C7D598C2A6111092257D6DAC7A167102E956697210D4694B9812D70C8A94
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.:...w.G...y.M...z.\...\|.b...}.t.....\|.....................................................................................................^.....q...........7.....j.....}...........Z.......................~.......................s.......................D.....d.....t........... .....F.....`...........C.......................Q.....}.................S.......................T.........................................E.............................k......................./.....P.....\.................).....3.............................p.......................L.......................0.......................%.......................B.............................g.......................e.......................d.......................M.....d.....s...........*.....T.....f...........".....[.....u...........x.................I.......................Y.......................4.....v.......................S.....~.

C:\Users\user\AppData\Roaming\GamePall\locales\fil.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	546749
Entropy (8bit):	5.197094281578282
Encrypted:	false
SSDEEP:
MD5:	6EDA0CD3C7D513AAB9856EC504C7D16F
SHA1:	BA24C4B994E7866F2C012CCEC6C22DFC1A4FCFF6
SHA-256:	3CD2BC9E887663C5E093E0334BC60CF684655A815E3DE7AD9A34BAD5EBB858B1
SHA-512:	47000F5EA882CB9EDDCF4FB42ED229423EE55AA18B4A4353D7EF85ADFA7E1B0BBB33C2469887224D7146B3E33FB2296749CD053D68D7DAF26980BC710A27C63E
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.@...h.H...i.^...j.j...k.y...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......!.....&...........6.....>.....E.....L.....S.....T.....U.....Z.....g.....\|.................K...........:.....X...........O.................Q...........>.....e...........Z.......................~.................%.......................h.................H...........^.................M.................!.................H.....b...........].................V...........B.....d...........#.....N.....k.................A.....N.................,.....;.................S.....i...........5.....k.....z...........=.....o.....}...........>.....o.....}...........@.....r...................................R.......................L.......................<.......................e.................U.................F.....`...........>.....q.........................................%.................4.................4.................J.....b.................B.....X...........N.......

C:\Users\user\AppData\Roaming\GamePall\locales\fr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	568277
Entropy (8bit):	5.380723339968972
Encrypted:	false
SSDEEP:
MD5:	D185162DF4CAC9DCE7D70926099D1CF1
SHA1:	46594ADB3FC06A090675CA48FFA943E299874BBD
SHA-256:	E40C07183A32B75930242F166C5AAE28F4CD769BB2268391BEAA241814E7D45A
SHA-512:	987D9CC6AD5F2ED6A87537FDADF105F6EB31A97B11156E70814FE021047E5D8D08398F008812038DF3CCDCB6254BF5B744D9982FE04F79D407AC2F53BB046E25
Malicious:	false
Reputation:	unknown
Preview:	.........$..e. ...h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}..................................... .....'.........../.....0.....2.....B.....P.....b.....q.................6.....X...........?.................'.................(.................W.................4.....`.....p...........D.........................................{...........(.....L...........*.....i.....{...........S.........................................}...........i.................N.......................H.....r.................N.......................f.......................}.......................x.......................e.......................d.................+.................&.......................8.....~.......................k.................0...........;.......................f.........................................d.................6...........4................."...................................R.....k.................G.....[...........G.......

C:\Users\user\AppData\Roaming\GamePall\locales\gu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1103776
Entropy (8bit):	4.336526106451521
Encrypted:	false
SSDEEP:
MD5:	44F704DB17F0203FA5195DC4572C946C
SHA1:	205CBCC20ADCCCF40E80AA53272FBA8CD07389CA
SHA-256:	4B073F08F0C8C035974B5EC43AA500F8BDD50E6CFE91A2FB972A39E0F15ECEDD
SHA-512:	3CFD4501556845141EE9B461C831CA59779AD99F0E83E8D03433DE78D774378E87DE752DD9711C112A0C584259AD1DA6DC891D92F3F447F63A4D84263CD5BFCE
Malicious:	false
Reputation:	unknown
Preview:	........4$..e.^...h.f...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.#...\|.)...}.;.....C.....H.....P.....X.....`.....g.....n.....u.....v.....w.....\|.......................&.....b....._.....0.....l....._..... ...............................................a.......................G.................r...........\.....\|....._...........z.......................V...........n.....B...................................7.....4...../.......................".......................4.....p...........P...........E.....m.......................................................................'...........}.......................C.................j .....!....u!.....!.....".....#....\$.....$....K%.....%....R&....{&.....'.....'.....'.....'.....(....b).....).....*....'+.....+....t,.....,.....-....9.....\|............/....W0.....0.....0.....1.....2....33....f3.....4.....5.....6.....6.....7.....8....<9.....9....\|:....H;.....;.....;.....<....s=.....=.....=.....?.....?.....@

C:\Users\user\AppData\Roaming\GamePall\locales\he.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	681555
Entropy (8bit):	4.658620623200349
Encrypted:	false
SSDEEP:
MD5:	E75086A24ECAA25CD18D547AB041C65A
SHA1:	C88CE46E6321E4A21032308DFD72C272FB267DBD
SHA-256:	55BE8A5ED9FB9C129AC45B7FC99574B9907350AFD024BAA5D07525F43E995F6B
SHA-512:	01D7FDD90B8D0D3779B8442250E2AA767481B2E581F880BF9C3DCBB15FCE52E477B1881F3704FBCB3172DB77DB10241BCB24851BFE30066D1E9B66244B3C6877
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.....j.'...k.6...l.A...n.I...o.N...p.[...q.a...r.m...s.~...t.....v.....w.....y.....z.....\|.....}.........................................................................+.....D.....].....z.....?...........~...........).............................O.................T...........#.....E...........:.......................w.................W................./...........F.................V...........5.....T...........K.................3.............................o...................................E.........../.....a.....t.............................z...........,.....?...........5.....v.................q.................5.......................r.................1...........X.................I.......................y.................$.................k...........).................!.......................#.................7.....P...........e.......................e.............................w...........W ..... ....$!....K!.....!....7"....g"....."....@#.....#....-$

C:\Users\user\AppData\Roaming\GamePall\locales\hi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1167065
Entropy (8bit):	4.308980564019689
Encrypted:	false
SSDEEP:
MD5:	1FF8A0B82218A956D2701A5E4BFA84EF
SHA1:	56BB8218963E14ADCC435F2455891F3A0453D053
SHA-256:	62E7C3ABC317931723BE11ADD3712DD15EAAB0A35A4D8E7DB0B6347104EC5733
SHA-512:	3330D983401953AA5ED4856A8D10FFCBEEFC2A4E594CF850566A0AD38837BC1164870BB1270B6BBE5D7DD6FB1ECA29CDE85869A5C51808B901CDC282E04764E4
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.%...n.-...o.2...p.?...q.E...r.Q...s.b...t.k...v.....w.....y.....z.....\|.....}...............................................................................?.....j.............................................../.....j.........................................N.....}.....P...........^...........F...........A.....d.....K...........N.............................L.....&...........V...........f...................................L.....~.................{.................A.................y..........}...........;........................................[.................,.....K...................................j ..... ..... .....!....J".....".....".....#.....$....T%.....%....@&.....&....8'....d'.....'.....(.....(.....(.....)....6..........*.....+.....,.....-....c-......................%/.....0.....0.....1.....1.....2....i3.....4....B4.....5.....6.....7.....7.....9.....9....S:.....:.....;.....<....F=.....=.....>....N?.....?.....@.....@.....A....LB

C:\Users\user\AppData\Roaming\GamePall\locales\hr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	526575
Entropy (8bit):	5.518614920030561
Encrypted:	false
SSDEEP:
MD5:	0BD2F9847C151F9A6FC0D59A0074770C
SHA1:	EA5313A194E9D99489E9F1D7B4DFC0BC986C8E17
SHA-256:	5F2F1AA2E2EC78F375084A9C35275E84692EE68A1E87BBEF5A12A2C0FCF7F37A
SHA-512:	0032C0B41FDF769DAA1AF23C443D4195B127DF9EA8621174F1AABDBAFAE4954383095FA1EEAD14FC458188B8837BBE9AECA0D5338E4D47F10D976FBED8609496
Malicious:	false
Reputation:	unknown
Preview:	........F$s.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.)...y./...z.>...\|.D...}.V.....^.....c.....k.....s.....{.................................................................k...........Y.....z...........F.....~...................................e.......................y.......................m.......................l................. .................q................._.........................................A.............................4.......................j.......................D.....f.....w.................*.....:.................4.....I.................&.....5.................8.....M................. .....0.........................................S.....n.................0.....M.......................3....................... .................E.....v...........!.....F.....\...........).....[.....t...........U.................M...........(.....:...........".....`.................G.....v.................$.....B.....T...........0.....n.

C:\Users\user\AppData\Roaming\GamePall\locales\hu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	566819
Entropy (8bit):	5.6387082185760935
Encrypted:	false
SSDEEP:
MD5:	4C27A1C79AB9A058C0A7DFFD22134AFD
SHA1:	5F0A1B34E808B91ADB1E431E462D9FCF82F4FFF2
SHA-256:	AD98C0A367B51EB217E69D66FA6A946946E85EC8452FC5A7AE0F179F35BE28C3
SHA-512:	0F066DB5905EB24B6CB4FBC7C81F017B43AFB7A6E975886644D871E979406B990509905D100653496EE2D20969A77434B702FF1EA5D348274AE54EA597A91D5E
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.!...j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................+.....A.....V.....j.................9.....W...........N.............................................".....X.....q...........K.....r.................Y.................?................."...........I.................7.......................k...........'.....7...........:................./.................:.................Z.....w...........O.....v.................f.................5.................(...........2.....u...................................M.................0...........6.....x...................................m.................)................. .....I.................O.....g...........c.................O.......................E.......................r...........'.....H...........v.............................l...........7.........................................5...........& ....q

C:\Users\user\AppData\Roaming\GamePall\locales\id.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	466959
Entropy (8bit):	5.379636778781472
Encrypted:	false
SSDEEP:
MD5:	1466C484179769A2263542E943742E59
SHA1:	18E45A08661FD6D34BADE01CDB1E1D5184BA2B67
SHA-256:	C331293D16B16B08DEF73BE73437845D58C593941320C547A377DB423749AEBB
SHA-512:	ABC54D5CAAA663578F064E43CC0465BEB97EFC46991936708EBF3FCD64BD007E47072AB4834A5361B21F064BB0F6527E247BC2C2F0DFB8336F50C2FF3E15A59C
Malicious:	false
Reputation:	unknown
Preview:	........ $..e.6...h.>...i.O...j.[...k.j...l.u...n.}...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................'...../.....6.....=.....D.....E.....F.....H.....V.....c.....s.................k................. .....l.......................l.................-.......................0.............................R.....s.................I.....x.................T.......................@.....j.....w.................L.....Y.................Z.....m...........H.......................%.....@.....Q.............................c.......................<.......................#.....t.......................L.....x.................%.....R.....^.................>.....K.................5.....G.............................J.......................".....h.......................L.....}.................#.....=.....K.................+.....:.................2.....K...........C.......................u.................,.....\|.......................C.....b.....r...........1.....h.

C:\Users\user\AppData\Roaming\GamePall\locales\it.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	522800
Entropy (8bit):	5.284113957149261
Encrypted:	false
SSDEEP:
MD5:	7767A70358D0AE6D408FF979DF9B2CD4
SHA1:	9C57A5B068DC12AAF1591778DEF5D3696377EDAB
SHA-256:	672908E77E9EACA793654C8E630442099DE3BE772FD3230A9C4045CAFBCC0B1E
SHA-512:	913AA8C49D04CD84706D08A88453D1ED36FDE6A00F7C1DF63DECEA99316A8A234924457C0C50937329B3979E437B1C2D7796E63ADF209505E212FDCEAE3BFDB5
Malicious:	false
Reputation:	unknown
Preview:	........-$..e.P...h.X...i.i...j.u...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.$.....,.....1.....9.....A.....I.....P.....W.....^....._.....`.....b.....u.......................E...........3.....O.................V.....g..........._.................o...........#.....L.............................k.......................n.................2..................................w.................5.......................R...................................c................./.....[.....y.................=.....K.............................x..............................................`.......................4.............................^.........................................B.............................F.....\.....r........... .....L.....a...........=.......................b.......................8.....c.....v...........[.................c...........S.....j...........d.................[.................).....v.......................X.............

C:\Users\user\AppData\Roaming\GamePall\locales\ja.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	634636
Entropy (8bit):	5.718480148171718
Encrypted:	false
SSDEEP:
MD5:	4A4AF69546DCF65F2D722A574E221BEA
SHA1:	EE51613F111CF5B06F5605B629952EFFE0350870
SHA-256:	7AD195AF107F2A394BAB527C3E84E08F3B7748076F23459F084CF0E05DD29655
SHA-512:	0E93F6B22F7C9176EFC9D49901BFBD281FA5AC3632780DFA76CE597CADD8C1CF570A9163A86BC320BBFBD354F48288DBEC5E36A6088999B00A3561D302A96D03
Malicious:	false
Reputation:	unknown
Preview:	........n#K.e.....h.....i.....j.....k.....l.....m.....o.%...p.2...q.8...v.D...w.Q...y.W...z.f...\|.l...}.~...............................................................................................6.....W...........}.................l........... .....8...........c.......................B.................W.......................x...................................7.....V...........e.................=.......................].......................{...........#.....2...........y.................`...................................<.....W...........j.................y...........e...................................h...........(.....:...........%.....a.....p...........{.................}...........m..................................._...................................Z.....x.............................o...................................:.....U................d.....z....."................?...........X.................`.................@.................g............ ..... ..... .....

C:\Users\user\AppData\Roaming\GamePall\locales\kn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1256908
Entropy (8bit):	4.247594585839553
Encrypted:	false
SSDEEP:
MD5:	6A41A5AB03A22BDAEC7985B9A75EC11A
SHA1:	6BB02DF557BD6522E02FE026C0243BEB9332B2E5
SHA-256:	E22873652AC7D9D18E47DAE838D121B5644EDA4C67F7B0BC110733BF7E931FEA
SHA-512:	BCA661D802D29463A847AC77EB8D5DFA41C31455E7314049CA26555957DCA3BE33701C074F7ED26D2C375A0A9C5F8A93461007B8D74F5ED3BD27C02E5DB170A5
Malicious:	false
Reputation:	unknown
Preview:	........O$j.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...\|.V...}.h.....p.....u.....}.................................................................W...........".....V.....W...................................n...........b............................._.......................<.....)...........s.......................).............................1.....7...................................[......................................................................u...........f...........K.....^........................ ..... .....!..../"....i"....=#.....#....r$.....$....I%.....%....l&.....&....p'....((.....(.....(.....)....N...............,.....-.....-................./.....0....W0.....0....z1.....1.....1.....2....Y3.....3.....4....@5.....6.....6.....7.....8.....8.....9....V9.....:....R;.....;....1<.....=....B>.....?....]?.....@....DB....BC....wC.....D.....E.....F....$G....\H....AI.....I....4J.....K.....K.....L....PL.....M....lN.....O

C:\Users\user\AppData\Roaming\GamePall\locales\ko.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	532715
Entropy (8bit):	6.0824169765918725
Encrypted:	false
SSDEEP:
MD5:	5FD9942F57FFC499481947DB0C3FDFA7
SHA1:	4D60AB21305902877467FF6151C1B7AB12553AAE
SHA-256:	09E279860E20E9E559945940E29446CAD4273D05C5F3F15D0BAD664A1D5749F2
SHA-512:	97953E580588C07769F1BD0002E2DF648FFCE5B246D2359E4475EDCFA1CD6E7286BAF168A115D7A65686B2151C313B6FD0C271E40B1F9DD4132F2F39904FE8D4
Malicious:	false
Reputation:	unknown
Preview:	........O#j.e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....y.#...z.2...\|.8...}.J.....R.....W....._.....j.....r.................................................................].................5.................O.....b...........F.......................p.................'.......................,.......................;.......................L.......................e.......................Y.......................X...................................Q.....h.................>.....U................. .....0.........................................-.....I.................A.....Q.................L....._.................K.....[.................J.....Z...........O.......................Z.....{.................U.....}.................`.................%.......................J.............................h.......................\.................+.......................m.........................................'.............................x.........................

C:\Users\user\AppData\Roaming\GamePall\locales\lt.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	573015
Entropy (8bit):	5.63016577624216
Encrypted:	false
SSDEEP:
MD5:	8745B87D09D9ECC1112C60F5DD934034
SHA1:	2F411E4EEF0E656CAC0C755FECE1AD2531CB689E
SHA-256:	D546C994C81510122E7B2359DA50F694E1F0CA4081830404E16187A5CF4D4E0D
SHA-512:	27B658C153A01AABB9595C5B1059567E535EDFC8F8187B89316D2C85694DE32696D209CFDD2A32C4826DFB1E50AC692937156563EE190E68DB358C40F9AAE15F
Malicious:	false
Reputation:	unknown
Preview:	........+$..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}. .....(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....^.....l.....y.................4...........".....=...........S.................M...........'.....A...........8.....p...................................A...................................B.....g...........z.................R...................................;.....K...........c.................T...........2.....P...........2.....Y.....t...........W.........................................E...................................D.....S...........Q.........................................S.............................B.................&.......................t...........1.....Y...........K.................+.........................................'...........N.................A.................,...........q.................d...........&.....F...........x.................(.......................H ..... .....!

C:\Users\user\AppData\Roaming\GamePall\locales\lv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	570683
Entropy (8bit):	5.624052036286866
Encrypted:	false
SSDEEP:
MD5:	E16B0B814074ACBD3A72AF677AC7BE84
SHA1:	10744490B3E40BEB939B3FDCA411075A85A34794
SHA-256:	46B5C09AA744AF0F660C79B0CDBDE8C8DBDD40A0BA1A23AAF28D37ECC4211DC5
SHA-512:	70EA9DFAC667C0992AE0E95815A47EB8E779BAAE1215E733AFE84EEE26D3BA754AD838C12E9AEE3114D7BBE11CD21B31C550F5CAFE6C5E838B69E54C6174EF18
Malicious:	false
Reputation:	unknown
Preview:	........O$j.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...\|.V...}.h.....p.....u.....}...................................................................................Z.................G.................%...........Z.................F.................6.................Q.....\...........Q.........................................\|.....#.....t...................................W.................0...........T.................B...........8.....Y...........$.....J.....`...........-.....V.....h...........;.....b.....v.............................G.......................r.........../.....>...........'.....Z.....k...........c.................@...........3.....K.................).....>...........=.....t.................c.................(.................2.......................8...........<.....q.........................................:.................8...................................N.....^...........0.....K.....m............ .....

C:\Users\user\AppData\Roaming\GamePall\locales\ml.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1307271
Entropy (8bit):	4.279854356980692
Encrypted:	false
SSDEEP:
MD5:	309E068B4E15157486D095301370B234
SHA1:	D962CDAF9361767045A928966F4323EAD22D9B37
SHA-256:	4F2C19B7E94B695C5C5CAB95DEE6E49AE53C3337C351B5C665BCB6BA4E6AE909
SHA-512:	6B1333946C7950D97D2DF29D063DB39A0EC5C0EEAA1ECA40743E4A6A0E4C972D897D3FF2BA837B53E31B8003F2C5C4BACCB7A4AB4B50C6CB47DF39AD7B8E05E7
Malicious:	false
Reputation:	unknown
Preview:	........N$k.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.,...w.9...y.?...z.N...\|.T...}.f.....n.....s.....{...........................................................$.....d.................Z.....C.......................W...........%.....r.....a.......................}.................n...........................................................I.................m.......................l.......................5.....y.............................^.............................j.......................\|............ ..... .....!.....!....".....#.....#....V$.....$....n%.....&.....&.....&.....'....n(.....(.....)..........*....W+.....+....c,....+-.....-.....-...........0.....0.....1.....1.....2....!3....Y3.....4.....4.....5....T5....06.....6.....7.....7.....9.....9.....:.....;.....;.....<.....=....Z=....\|>....s?.....@....T@.....A....UB.....C....SC.....D.....E....yF.....F.....G.....H.....I.....I....-K....(L.....L.....M.....N.....N....eO.....O.....P.....Q.....R

C:\Users\user\AppData\Roaming\GamePall\locales\mr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1075591
Entropy (8bit):	4.313573412022857
Encrypted:	false
SSDEEP:
MD5:	69C36C23D6D9841F4362FF3A0F86CFDF
SHA1:	C4C1F632EB8373107AEEBD6C26ECF036AEDA2B6B
SHA-256:	6A794C2B08F8B046BE771DF33719536BDAF2371E3825D49A0E556958B781832D
SHA-512:	8C1329BDB371677BC0A9D727A38591EDF32025BAE1E7EFE402D01C6A8BB5F647D827C59A18F40455D5C9C0482798525C98C3F1C8AC568AA886D7C1ED07D1580E
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i."...j.....k.=...l.H...n.P...o.U...p.b...q.h...r.t...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................@.....b.................%.....]...........W.................J.............................:.....@.....=...................................&.................&.....F.....P.......................h...........o...............................................c...................................R..........._.................i...............................................J.................. .....!.....!....(".....#.....#....O$....{$....B%.....&....c&.....&....F'.....(...._(.....(....R).........y.....*.....+.....-.....-................./...../...../.....0....61....l1.....1....Z2.... 3.....3.....3.....4.....5.....6.....6.....7.....8.....9....E9....u:....n;.....;....@<.....=....O>.....?....5?.....@.....A.....B.....B....MD....WE.....E....eF....nG....LH.....H.....H.....I.....J.....J.....K....5L....)M.....M

C:\Users\user\AppData\Roaming\GamePall\locales\ms.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	489457
Entropy (8bit):	5.250540323172458
Encrypted:	false
SSDEEP:
MD5:	A1253E64F8910162B15B56883798E3C0
SHA1:	68D402D94D2145704DC3760914BF616CC71FC65D
SHA-256:	E033BFAD6CD73EA7B001DFAF44B7102E3BBE2A1C418F005C149E4FB2565DB19F
SHA-512:	ABD63713093049ECC8E24FD8145EAE065340058A3C38758A59EE8796FBED7E6CFBC54982D650889F1CEB54797060C7DDA12EEE2A963B14C5E907A110C2057DBE
Malicious:	false
Reputation:	unknown
Preview:	........T$e.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...\|.W...}.i.....q.....v.....~........................................................................................._.....{...........:.....n.....~...........\.................#.......................=.......................1.......................3.......................Y.................*.....z.......................W.......................E.......................b.........../.....A.............................N.......................$.....x.......................r.......................z.......................p.......................^.......................Q.......................r.................!.....s.......................S.....w.................6....._.....p.................T.....w.......................#.......................$.................2.....K...........B.......................s.................,.............................P.....r.................0.....].

C:\Users\user\AppData\Roaming\GamePall\locales\nb.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	476208
Entropy (8bit):	5.4272499712806965
Encrypted:	false
SSDEEP:
MD5:	622ED80836E0EF3F949ED8A379CBE6DF
SHA1:	9A94CD80E747B88582470EF49B7337B9E5DE6C28
SHA-256:	560B2F09C1B6E6BB7E6A5A5F9BF85A88BD2ACA054B7D4A5955D9C91B6D7CA67C
SHA-512:	950627E74180E1451BB35AE4A7416AC14D42D67BBBB59DC51D7B69E4CEB61715F8F9B0EB9D7F35FCEFD4D43FABE5CE2103F1AF3709CAE6733C25AC19E6339A83
Malicious:	false
Reputation:	unknown
Preview:	........2$..e.Z...h.b...i.y...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....o.....p.....r.....}.......................N...........A.....V.................X.....k...........z.................K.......................L.......................:.......................;.......................g................./...........<.........................................R.................1...........Q.......................\.....u.................1.....V.....f.................9.....I.................H.....\.................J.....Z...........".....T.....d.................@.....P.................<.....J...........4.....y.................B.....h.....{...........&.....E.....^.................-.....?...........,.....k.................V.....\|.................b.......................i.................&.......................s...........9.....b...........*.....V.....i.................".....0.................).

C:\Users\user\AppData\Roaming\GamePall\locales\nl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	491139
Entropy (8bit):	5.362822162782947
Encrypted:	false
SSDEEP:
MD5:	C8378A81039DB6943F97286CC8C629F1
SHA1:	758D9AB331C394709F097361612C6D44BDE4E8FE
SHA-256:	318FB294CE025BDA7636B062CA7B6A1FB1E30C485D01856159CB5DB928782818
SHA-512:	6687FFE4DE0D5A2314743EB3134096292724163D4E0332D2F47922B4807B0CDE7C20E2D57D2662E403D801BC7A20BC247F5D0EDD787AB650E5766B49AF7D3C63
Malicious:	false
Reputation:	unknown
Preview:	.........$..e....h.2...i.C...j.O...k.^...l.i...n.q...o.v...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................#..........1.....8.....9.....:.....<.....H.....X.....i.....{.............................X.......................\|...........4.....J.................M.....d.................8.....G.......................).................8.....Y...........1.....h.................F.....{.................U.........................................\.................4.............................Y.......................-.....~.......................}.......................v.......................V.......................5.....a.....n...........*.....^.....m...........I.......................X.......................>....._.....v...........,.....T.....f...........8.....o.................=.....[.....o...........3.....e.....v...........H.....................................................E.....j...........5.....f.....{.................B.....R.................B.

C:\Users\user\AppData\Roaming\GamePall\locales\pl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	550453
Entropy (8bit):	5.757462673735937
Encrypted:	false
SSDEEP:
MD5:	80C5893068C1D6CE9AEF23525ECAD83C
SHA1:	A2A7ADEE70503771483A2500786BF0D707B3DF6B
SHA-256:	0069648995532EFD5E8D01CC6F7DD75BD6D072E86C3AE06791088A1A9B6DACC4
SHA-512:	3D1C41A851E1CF7247539B196AD7D8EE909B4F47C3CFB5BA5166D82CDA1C38049B81A109C23FA6D887490E42EE587CC2A6BD96A3EA890267C089AC74710C755F
Malicious:	false
Reputation:	unknown
Preview:	........6$..e.b...h.j...i.{...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....o.....p.....r.............................X...........S.....o...........=.....w...................................i...............................................z.................$.................1.....W...........M.................*.......................@.......................l...........0.....L...........].................9.....v.......................E.....h.....x.................,.....:.................<.....P.................>.....P.................6.....F.......................-.........................................e.....}.................4.....K.......................;.................+.....@.................a.................+.....I.....`.................9.....U...........2.....}...................................w...........'.....R.................9.....J.............................v.............

C:\Users\user\AppData\Roaming\GamePall\locales\pt-BR.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	516256
Entropy (8bit):	5.426294949123783
Encrypted:	false
SSDEEP:
MD5:	3BA426E91C34E1C33F13912974835F7D
SHA1:	467A1B05BAD23252A08EE22E6B9EBB4404F6A0F0
SHA-256:	CB66D88D3B3938FE1E42C50ECB85CEDB0D57E0F0AB2FA2A5FC0E4CDEA640E2B7
SHA-512:	824A4301DC4D935FF34CE88FAA0354440FC1A3A8E79B0F4B0B2DCC8F12542ECEF65828FB930EDF5B35BF16863296BBAE39E9306962B4D3CFA9F6495AC05BDEF4
Malicious:	false
Reputation:	unknown
Preview:	........9$..e.h...h.p...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.$...\|.*...}.<.....D.....I.....Q.....Y.....a.....h.....o.....v.....w.....x.....}.............................d...........L.....h.........../.....h.....x.............................w.................(.....y.......................^...................................:.....j..........._.................:......................._...................................K.....d...........p.................5.............................q.......................n.......................w.......................p.......................O.....}.................).....W.....a.................V.....g...........b................. .....j.......................;.....a.................=.....U...........N.................2.....W.....p...........8.....p.................S.................@.................0...........1.....{.................X.......................0.....V.....k...........C...................

C:\Users\user\AppData\Roaming\GamePall\locales\pt-PT.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	518861
Entropy (8bit):	5.4029194034596575
Encrypted:	false
SSDEEP:
MD5:	4D7D724BE592BD0280ED28388EAA8D43
SHA1:	8E3C46B77639EB480A90AD27383FBB14C4176960
SHA-256:	4724D82866C0A693C2B02D1FFA67D880B59CDB0D3334317B34EC0C91C3D3E2A2
SHA-512:	D05388F66C50E039F7D3393515740F6B2593F9C0EF8651F9CDE910C5FF06656E0D22FDB066B22665289EE495837EA16CC085ECB3F85B0F6FB498AECDAA19ADF7
Malicious:	false
Reputation:	unknown
Preview:	........I$p.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v."...w./...y.5...z.D...\|.J...}.\.....d.....i.....q.....y.......................................................................u...........Z.....u...........@.................).................$.................S.....w.................D.....T.................(.....:...........(.....j.................x.................H.......................g...................................9.....N...........D.......................p.......................^.......................a.......................q.......................r.......................U.............................[.....e.................P.....a...........?.......................O.....y.............................?.................0.....J...........#.....p.................9.....c.....u...........#.....Y.....n.........../.....}...............................................G.....k...........N.......................B.....g.....\|...........J.......

C:\Users\user\AppData\Roaming\GamePall\locales\ro.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	537125
Entropy (8bit):	5.4566742297332596
Encrypted:	false
SSDEEP:
MD5:	4F1C0A8632218F6FEF6BAB0917BEB84F
SHA1:	05E497C8525CB1ADE6A0DAEFE09370EC45176E35
SHA-256:	9C19835F237B1427000D72C93703311CFCBEFF6C2B709474B16DB93E629BC928
SHA-512:	A7CDF94F79CD888BB81FD167F6B09BF1BEF2C749218869E5A12A0A3B2C2506D1A63F64B63D8E48EA49375636041C639082563BF9D526FE44003FC5A5E8D50E9D
Malicious:	false
Reputation:	unknown
Preview:	........0$..e.V...h.^...i.o...j.y...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....f.....u.......................3.................+.................%.....9...........@.................1.......................Q.......................4.......................C...................................>.....b...........@.......................d.........................................p...........@.....n.................+.....H.............................h.......................M.......................J.......................7.............................].......................E.....t...................................?.............................W.....w.................\.................).......................f.......................W.........................................'...........$.....y...................................f.......................j.......................l...........+.

C:\Users\user\AppData\Roaming\GamePall\locales\ru.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	878725
Entropy (8bit):	4.848685093578222
Encrypted:	false
SSDEEP:
MD5:	3A3D0D865A78399306924D3ED058274E
SHA1:	AA1A42DB6021666B2297A65094D29978792CE29B
SHA-256:	EAB4C32FEBE084CC7A3A272CDA008B69D6617ED6D042376B0316BE185B9E66FE
SHA-512:	ACA8C87D0B2BB35A325726F7774F8A0232B99C8EFE0F948AB68210958E23B95E9D9026A9430D96FC2D5CEBA94815F4217896EF877C9A6E1D0E56F73533FB1D12
Malicious:	false
Reputation:	unknown
Preview:	.........#/.e.....h.....i.#...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................9.....V.....n...........V.......................g...........i...........l.....).................g...........,.....f.......................@.................6.....M......................./....."...........l..........._...........D.....y..... .................&.......................5.....9.....3.............................B.................r.................D...................................=.....b.........................................E.....\...........Y.................'...................................D.....n...........j.................9.......................a...........i...........v...........t...........a........................ ....,!....l!.....!....j"....."....R#....\|#....O$.....%.....%.....%.....&....x'.....(....Q(.....(....z).....).....)....]..........+....$+.....+.....,.....-

C:\Users\user\AppData\Roaming\GamePall\locales\sk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	553886
Entropy (8bit):	5.812150703289796
Encrypted:	false
SSDEEP:
MD5:	A9656846F66A36BB399B65F7B702B47D
SHA1:	4B2D6B391C7C2B376534C0AF9AA6779755B4B74E
SHA-256:	02B65F48375911C821786D91698E31D908A4C0F5F4F1460DE29980A71124480E
SHA-512:	7E23CAA89FF80BF799AC5353CEAF344CBED0393F23D15FCBE8DC24EE55757F417CEA3BFC30889FD2CB41951F9FA5629C2E64B46DD9617D4A85EFEF0A255246F6
Malicious:	false
Reputation:	unknown
Preview:	........5$..e.`...h.h...i.\|...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.%...}.7.....?.....D.....L.....T.....\.....c.....j.....q.....r.....s.....u.............................h...............................................[.........../.....I.................S.....j...........9.....h.....{...........4.....].....q...........J.................?.............................%.....`.....y...........\................./.............................%.....v.................G.....g.....\|...........=.....c.....u...........6.....].....o...........O.........................................".......................3.......................R.............................-.....x.................0.....K....._.................0.....E.................G.....W...........T.................).....w.................-.......................M.............................O.................J.........................................'.........................................E.

C:\Users\user\AppData\Roaming\GamePall\locales\sl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	532410
Entropy (8bit):	5.486224954097277
Encrypted:	false
SSDEEP:
MD5:	BE49BB186EF62F55E27FF6B5FD5933F4
SHA1:	84CFD05C52A09B4E6FA62ADCAF71585538CF688E
SHA-256:	833F2E1B13381AA874E90B747931945B1637E53F2396A7409CCDA0A19CBE7A84
SHA-512:	1808631559D3C28589D3F5A4B95554CEBC342DE3D71B05DDC213F34851BF802967BFFAC3D7668C487265EE245D1E26EFCE5D317EDBFBBEEB4BC2C9F122980585
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.6...i.G...j.Q...k.`...l.k...n.s...o.x...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................%.....,.....3.....:.....;.....<.....>.....P.....^.....n...................................y.................&...........2.....}.................h.......................g.......................Z.......................v.................O...................................3.....I.................T.....h...........b.................S...........$.....J.......................(.............................n.......................z...........$.....8.................2.....C...........).....j.................;.....i.....\|...........?.....q.................[.......................g.......................L.....j.................G.......................~.................I.......................B.......................b.............................^.............................o.........................................j.......................x.......

C:\Users\user\AppData\Roaming\GamePall\locales\sr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	818089
Entropy (8bit):	4.779985663253385
Encrypted:	false
SSDEEP:
MD5:	AFA2DFBA3BD71FE0307BFFB647CDCD98
SHA1:	CD7A5C54246E891981AEEEAA88D39EC9E3F2C594
SHA-256:	1375353837629A20102C69BF62701EE5401BED84D3DC4845BED5EE43E4D322CF
SHA-512:	CE8BBBDDC33CB6B8DF4AEE127A8987E6D8C1D0761AC5BD25D685310BAA2D377F239BDF06F2C04B54295CF8FD440697A69A040644D5A7C0395C4F71A0252B8E87
Malicious:	false
Reputation:	unknown
Preview:	........=$\|.e.p...h.x...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.,...\|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~.........................................).................W...........O...........\...........z.....E...................................3...........b.................a.................5.......................1.....1...........v...........\|...........{...........`...........Y.....~.....d...................................S........... .......................{...........(.....K...........H.................c...........d...........3.................)...........B.................D.................(...........W.......................E.................~...........'.....O...........^.................~ .....!....]!....z!....J"....."....=#.....#....0$.....$.....$.....%.....%....P&.....&.....&.....'....1(.....(.....(.....).....*....5+....S+....A,.....,....Z-.....-....^...........=/....^/...../....Y0.....0.....0.....1....'2.....2

C:\Users\user\AppData\Roaming\GamePall\locales\sv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	479512
Entropy (8bit):	5.541069475898216
Encrypted:	false
SSDEEP:
MD5:	09592A0D35100CD9707C278C9FFC7618
SHA1:	B23EEF11D7521721A7D6742202209E4FE0539566
SHA-256:	9C080A2F6D4EDF0E2E94F78550B9DB59ADF5B1B9166DE2BAE496E6ABB6733304
SHA-512:	E0760B3F227A3E7EAEB4816B8E02BEE51C62730D24403724D66B36BCCBC0BDCD56DF9EAB28B073AB727EE12C8856A858E52A9803E1A1C9164FCD3CF2F716D8AF
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...q._...r.k...s.\|...t.....v.....w.....y.....z.....\|.....}.........................................................................#.....5.....I.....]...........b.................).......................e...........2.....K.................T.....p...........&.....U.....e...........%.....V.....f...........J.........................................O.......................Y..................................._.....u.............................n.......................J.......................'...............................................(.............................z.......................j.......................h.......................\|.................$.....w.......................M.....k.......................?.....Q...........).....f.................J.....i.................;.....c.....x...........1.....l...................................q.................?.................;.....N.............................p.............

C:\Users\user\AppData\Roaming\GamePall\locales\sw.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	504856
Entropy (8bit):	5.34516819438501
Encrypted:	false
SSDEEP:
MD5:	9E038A0D222055FED6F1883992DCA5A8
SHA1:	8FA17648492D7F093F89E8E98BF29C3725E3B4B5
SHA-256:	DDCA575D659545D80E715EB4176BBBBFBD3F75E24B223537B53740B0DCB282BD
SHA-512:	FB70F97E08191DFEB18E8F1A09A3AB61687E326265B1349AB2EFF5055F57E177A496BF0EA3592B61C71FE1F73C9143CA1495B05226F36EB481024827CAE6DCC4
Malicious:	false
Reputation:	unknown
Preview:	........4$..e.^...h.f...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.,.....4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....m.............................?.................$.................2.....D...........7.......................P.......................A.....l.....{...........&.....U.....c...........0.....d..................................._.......................m.......................n.............................*.......................J.....r.......................>.....G.........................................A.....O.................4.....F.................G.....R.................).....6.................).....2.................\.....u...........(.....T.....p...........2.....c.................D.......................l.................B.............................j.................+.......................j...........?.....S...........5.....x...................................P.......................r...........%.

C:\Users\user\AppData\Roaming\GamePall\locales\ta.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1298313
Entropy (8bit):	4.058495187693592
Encrypted:	false
SSDEEP:
MD5:	36104CB0D5E26E0BBB313E529C14F4B4
SHA1:	69A509DEE8419DA719DCF6DE78BFE0A6737508C5
SHA-256:	DC28C869A143424F71EDCFDB08B56DA31C2EC96E9D608535FFA7DC0B0842B7D8
SHA-512:	D46ED1AA19EB298BC4C3D61EFC28D80753D6B551F01808E6158A0869FAAE8755DF61D4B4BAFF1310DD09FCFC385ABA67E1AA7D61BBE399DF7BB2D483EBE0FEFF
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.(...h.0...i.A...j.M...k.\...l.g...n.o...o.t...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................!.....(...../.....6.....7.....8.....=.....k.................:...........5...........$.....v...........`...........(...........Z.................%.............................O...........j.....L.........................................m...........u...................................;.....c...........7.................................................................8 ..... ....m!....I".....".....".....#.....$.....%....9%....d&....n'.....(....L(....C)....4..........*.....+.....,....3-....a-....Z.....J/...../...../.....0.....1....Z2.....2.....3....:5.....6....Z6....U7....=8.....8.....8.....9.....:.....:....F;.....<.....=.....=.....>....E?....S@.....@....[A....3B.....B....IC.....C.....D.....E....[F.....F....+H....>I.....J....pJ....\L....FN.....O.....O....DQ....QR.....S....{S.....T.....V.....V....'W....+X.....Y.....Y.....Y.....[....9\.....\

C:\Users\user\AppData\Roaming\GamePall\locales\te.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1199612
Entropy (8bit):	4.314031920337284
Encrypted:	false
SSDEEP:
MD5:	98714389748A98ECC536CD2F17859BDF
SHA1:	07761AA31588F30C2CED4A1E31FE99DDC43A5E8D
SHA-256:	8A81B1A5457407E49D6372677938E7A2D28DFCA69F555FEDC8A2C9C09C333A65
SHA-512:	38CC4F064BD874EEC9DBFAB4C2A83A487FBCD89CEFB40BE4213C42231BC48AF9255341C9D325EE059BC50EE533898C5FA22CD3B3927A8E045049DEF3C5DFB2C6
Malicious:	false
Reputation:	unknown
Preview:	........N$k.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t. ...v.5...w.B...y.H...z.W...\|.]...}.o.....w.....\|.......................................................................X...........J...........\|...............................................f.........................................~.............................Y.............................A.............................d.....X.........../.....k.....b...........5...............................................'.......................L.....u ....:!.....!.....!.....".....#....$....k$.....%.....&....6'.....'.....(.....)........._*.....+....P,.....,.....-....'...........m/...../.....0.....1...."2....f2.....3.....4....R5.....5.....6....G7.....7.....7.....8....I9.....9.....9....{:....0;.....;....)<.....=.....>.....?.....?.....@....bA.....A.....B....JC....(D.....D.....D....DF.....F.....G.....G.....I....@K....qL.....L....4N....EO.....O....pP.....Q.....R....?S.....S.....T....^U.....U.....V....`W....[X.....Y

C:\Users\user\AppData\Roaming\GamePall\locales\th.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1008989
Entropy (8bit):	4.356501290091745
Encrypted:	false
SSDEEP:
MD5:	56F29DE3465795E781A52FCF736BBE08
SHA1:	EAA406E5ED938468760A29D18C8C3F16CF142472
SHA-256:	529C561747BF8B6206BE4F8BCF287A1D15E1B14A33113242DDAD5E035CA37BE6
SHA-512:	519B5B3CC7032B2AF856456EEC25019B3A6A7F2A6DB7A0318CF87C41E08C6F6BFA73E239939B0DA16972C1D357FF06177765D875E19742D23E99A95FD4AC5416
Malicious:	false
Reputation:	unknown
Preview:	........i#P.e.....h.....i.....j.....k.....l.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...\|.v...}.....................................................................................'.....{.......................^...........e...........f.................s...........I...........]...........P...........r.................{...........D.....]...........;...........$.................,.....}.....K...........v...........e...........r...........m.....................................................E.......................P.......................:.......................B.......................b.......................s.......................X.......................S..................!.....".....".....".....#....0$....\|$.....$....j%.....%....5&....l&.....'....z'.....'....!(....A).....)...............+.....,....H,....x,....M-.....-....6.....l.....k/...../....o0.....0.....1.....2....>3...._3.....4.....5....c6.....6.....7....n8.....8.....9.....9....f:.....:.....:.....;.....<....D=

C:\Users\user\AppData\Roaming\GamePall\locales\tr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	515329
Entropy (8bit):	5.616482888977033
Encrypted:	false
SSDEEP:
MD5:	46CA9EE922C3C175DE466066F40B29CE
SHA1:	5563E236A15CD9CC44AE859165DF1E4E722936C7
SHA-256:	BD8B1441FD2057F0B61512CC0AA23DFD2619560CF886B4D453FA7472E7153A3F
SHA-512:	45AA2D6896568751C2F986ABD281EA07CB731880DF8F28F2F0AEFD95736F41B1E005D8DFB6F0AEF0CED6CEF94154D34FD0DA2CB7F0B0C66D9C085F5C47F32605
Malicious:	false
Reputation:	unknown
Preview:	........c$V.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...\|.\|...}...........................................................................................)...........L.................+.......................e........... .....;.................7.....J.......................)......................................... .....B...........5.....x.................Z.......................Q.....{.................w.................Q.................!.......................'.......................&....................... ................."...../.................5.....F.................9.....F.................2.....>.................7.....D...........I.......................v.......................i.......................P.......................q.................-.....z.......................m.................,.............................*.................B................."...........(.....n.................N.....~.................l.......

C:\Users\user\AppData\Roaming\GamePall\locales\uk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	876131
Entropy (8bit):	4.88404350774067
Encrypted:	false
SSDEEP:
MD5:	1365ABDD1EFB44720EA3975E4A472530
SHA1:	8421FC4905C592EB1269C5D524AA46866D617D3C
SHA-256:	29AB0F7EE69FB7A1E1E54DD2A3746D2CFEAAA71AE5971EE30AA8E2E0F6556FA5
SHA-512:	2E806A9BEA864E689BBD1D78B800DFDBC6E4109320F9A4790E52010BFDEC20C7644655A6FE3BABDE0B84D9580208CB78EF1FA0DB3476F8676C17A13D130296C7
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.'...s.8...t.A...v.V...w.c...y.i...z.x...\|.~...}.....................................................................................1.....s.....W.......................r...........x...........m.....!.......................<.............................n...........,.................-...........\|.............................=.....y.....+...........%.....K...................................w.............................N...................................r.................O...........N.................^...........\...............................................h...............................................R.....m.....f.....6.............................W.....y...........O.....x...........K...........j...........z .....!.....!.....".....".....#....R#.....#....&$.....$.....$.....%.....%....s&.....&.... '.....(.....(....~).....).....*....Q+.....+.....,.....,....Z-.....-.....-....[............/....4/.....0.....0....$1

C:\Users\user\AppData\Roaming\GamePall\locales\ur.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	765853
Entropy (8bit):	5.17061834928747
Encrypted:	false
SSDEEP:
MD5:	3FED15E64BEAFBA75DE61B08A45AE106
SHA1:	E24953271D8C0254AD011D3A65B2C2FA57903681
SHA-256:	B6E250C3F4FBAC3AF5FB8BB1C61CACAD8685D7F2A97063DE23BC22E91B7F2E27
SHA-512:	3948D080135AFEB240815D43F7B5B8D407BA2830FF701D9B8343F2A72E610827EDAAB643444CDCEB86812ADFC9FB3FBA3AAD6DB7488843C2A04E92A3E63FE40D
Malicious:	false
Reputation:	unknown
Preview:	........1$..e.X...h.`...i.h...j.t...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.#.....+.....0.....8.....@.....H.....O.....V.....].....^....._.....d.....\|.............................n.....................................................).....^.......................<...........G.................J.................9...........E.................~...........{...........\...........L.....k.......................,.................9.....e.....C.......................>...................................8.....Z...........C.................;.................-...........L.................N.................1...........-.....y.........................................s............................p........... .......................i...........).....J.......................L...........M ..... ..... ....Y!.....!....4"....Z"....,#.....#....&$....W$....'%.....%....^&.....&....f'.....(.....(.....(.....)....3..............]+.....+.....,....F,.....,....z-.....-

C:\Users\user\AppData\Roaming\GamePall\locales\vi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	609259
Entropy (8bit):	5.796202390024141
Encrypted:	false
SSDEEP:
MD5:	CD741C24AF7597E0DC11069D3AC324E0
SHA1:	2A883DFBCF48D5093D70D4B77BBFFFA521287334
SHA-256:	13E982DC4B2B1AEE093E96BA27E02258C2B815CBB062006A4396BB3A3E6A84B1
SHA-512:	6D27998E25B57FF0CE08C3590B69031038CBA390E68333A83514022B2C56B689AF8AD9715302824027864B5320852E9AB77D74E3B8A90DC66DF59F48CEB528C9
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r....s.;...t.D...v.Y...w.f...y.l...z.{...\|.....}...........................................................................................;.......................-...........A.................[...........O.....u...........v.................6.......................+.......................}...........G.....y.....9...........K.....y.............................z...........?.....V...................................T.................X.......................r...................................9.....J...........H.......................}.................'.......................<.......................O.............................Z................._..................................)........... .....V.....v.......................j...........N.................3...................................O.....v................./.....C.......................@...........) ....^ ....w ..... ....J!....}!.....!..../".....".....#....8#

C:\Users\user\AppData\Roaming\GamePall\locales\zh-CN.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	441207
Entropy (8bit):	6.685712707138377
Encrypted:	false
SSDEEP:
MD5:	99E6ACFB46923C4F8B29058E9EE6166B
SHA1:	AF06C42E5F3578ADBC4F0BD7262DC6775FDD351F
SHA-256:	9D8498875263B19552A982D1850F2F942FF44AF4E323BC5A3A67C34413994D95
SHA-512:	4FDF5186FC2FC68210C2BE91F5B821F0979CA67D6C9B8915C14E7A20D3CE2548EB2660D5F9F398CF6C585A5C0725FA34FD3670F416F7C8A4F009C729BCF02988
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.T...h.\...i.d...j.g...k.v...l.}...m.....o.....p.....q.....r.....s.....t.....v.....w.....\|.....}...............................(.....-.....5.....<.....C.....E.....J.....S....._.....q.................v.................1......................./.......................:.......................>.............................c.......................D.....j................._.......................n.......................T.....}.................@.....o.................V.......................5.....O.....i................."...........x.......................U.......................].......................=.......................".....s.......................L.....u.................g.......................W.....w.................3.....X.....o...........&.....J.....\.................=.....].............................y.......................y...................................N.....`...........,.....d.....y...........).....O.....^.............................\|.......................x.

C:\Users\user\AppData\Roaming\GamePall\locales\zh-TW.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	439630
Entropy (8bit):	6.6906570508767995
Encrypted:	false
SSDEEP:
MD5:	BB7C995F257B9125457381BB01856D72
SHA1:	21C55FF5CBC4F223C23D5A2FBCC9E051DB78A44C
SHA-256:	F2299E03E99B0E9A9CACE3B1C72E6C8C5FE089487CA1C82F2AAF4273B62E37A2
SHA-512:	5247C5DA6F00DF6241500524DDB162041A03649FA0AFCC11AD40E820814958768A2E11CE34E1250FDBF42B2459F8C06B00AE7442B537F0731A62C6724FC8D890
Malicious:	false
Reputation:	unknown
Preview:	.........#,.e.....h.....i.)...j.-...k.<...l.G...n.O...o.T...p.\...q.b...r.n...s.....t.....v.....w.....y.....z.....\|.....}...................................................................%.....4.....C...........3.....q.................+.....T.....`........... .....R.....d.................M.....b.................3.....?.............................g.......................[.......................S.......................;.......................*.......................@.......................F.............................D.....d.....p.................2.....A.............................q.......................T.......................<.............................i.......................f.......................A.....[.....o.................!.............................u.......................^.............................h.......................P.........................................H.......................Z.......................$.....e.....z.................1.....X.....j...........#.

C:\Users\user\AppData\Roaming\GamePall\log4net.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	275968
Entropy (8bit):	5.778490068583466
Encrypted:	false
SSDEEP:
MD5:	7EA1429E71D83A1CCAA0942C4D7F1C41
SHA1:	4CE6ACF4D735354B98F416B3D94D89AF0611E563
SHA-256:	EDEC54DA1901E649588E8CB52B001AB2AEC76ED0430824457A904FCC0ABD4299
SHA-512:	91C90845A12A377B617140B67639CFA71A0648300336D5EDD422AFC362E65C6CCD3A4FF4936D4262B0EAF7BAE2B9624BCD3C7EEC79F7E7CA18ABE1EC62C4C869
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.X...........!.....,..........~K... ...`....... ..............................H.....@.................................$K..W....`...............................I............................................... ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B................`K......H...........<x...............-..P .......................................i.)V.#c....e../.`...V....j>....?.LbrzKV.x.}...........[.f)..dD`..66.61[.z....W^....>F..r...#. ..g...T...P....Ss)ii.a.v.(0.....(1...o2...s....}.......0..7........{....-%~....r...p.{....r9..p(3...(.....(.......(4.............//........{...."..}......{........0..4..........%...(5....-.~....r?..p(....+...}.......,..(6............')........{......{...."..}.......{...."..}....*.0..........

C:\Users\user\AppData\Roaming\GamePall\log4net.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1547797
Entropy (8bit):	4.370092880615517
Encrypted:	false
SSDEEP:
MD5:	32AB4E0A9A82245EE3B474EF811F558F
SHA1:	9F2C4C9EEB5720D765F2321ACD0FF9F8DD11E6A4
SHA-256:	9BBF4D15F8FB11F7D2C032BD920D2A33B2C2CB8EF62E7E023049AF6132F5D6C1
SHA-512:	A0574A170F69F9926C32BAF6119A16A381FEC9E881B304082859EE7CFF463570C78984EE14369C59CDB19E532B3ABF193D02B462F1B40D07214B6244150CD63F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>log4net</name>.. </assembly>.. <members>.. <member name="T:log4net.Appender.AdoNetAppender">.. <summary>.. Appender that logs to a database... </summary>.. <remarks>.. <para>.. <see cref="T:log4net.Appender.AdoNetAppender"/> appends logging events to a table within a.. database. The appender can be configured to specify the connection .. string by setting the <see cref="P:log4net.Appender.AdoNetAppender.ConnectionString"/> property. .. The connection type (provider) can be specified by setting the <see cref="P:log4net.Appender.AdoNetAppender.ConnectionType"/>.. property. For more information on database connection strings for.. your specific database see <a href="http://www.connectionstrings.com/">http://www.connectionstrings.com/</a>... </para>.. <para>.. Record

C:\Users\user\AppData\Roaming\GamePall\natives_blob.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	342741
Entropy (8bit):	5.496697631795104
Encrypted:	false
SSDEEP:
MD5:	A58DB728B50E6B82CBDCAA0DB61D36B1
SHA1:	7CD76526CB29A0FF5350A2B52D48D1886360458B
SHA-256:	BA2F2AC6AE9BC67399728F25772A0EB3E840695395CC747ADF4B2F8B5D6D9A46
SHA-512:	0DB9AFBDADA44364521D89BAB6055458125F4F3C8C1B09048EAFA4055A194231CCFFD82FCDADA9360AB2B19F472B893330EBFCB027391E7A0C2B1100FC51E673
Malicious:	false
Reputation:	unknown
Preview:	..mirrors....(function(a,b){."use strict";.var c=a.Array;.var d=a.isNaN;.var e=a.JSON.stringify;.var f;.var g;.var h=b.ImportNow("promise_state_symbol");.var i=b.ImportNow("promise_result_symbol");.var j;.var k;.b.Import(function(l){.f=l.MapEntries;.g=l.MapIteratorNext;.j=l.SetIteratorNext;.k=l.SetValues;.});.var m={.UNDEFINED_TYPE:'undefined',.NULL_TYPE:'null',.BOOLEAN_TYPE:'boolean',.NUMBER_TYPE:'number',.STRING_TYPE:'string',.SYMBOL_TYPE:'symbol',.OBJECT_TYPE:'object',.FUNCTION_TYPE:'function',.REGEXP_TYPE:'regexp',.ERROR_TYPE:'error',.PROPERTY_TYPE:'property',.INTERNAL_PROPERTY_TYPE:'internalProperty',.FRAME_TYPE:'frame',.SCRIPT_TYPE:'script',.CONTEXT_TYPE:'context',.SCOPE_TYPE:'scope',.PROMISE_TYPE:'promise',.MAP_TYPE:'map',.SET_TYPE:'set',.ITERATOR_TYPE:'iterator',.GENERATOR_TYPE:'generator',.}.var n=0;.var o=-1;.var p=[];.var q=true;.function MirrorCacheIsEmpty(){.return n==0&&p.length==0;.}.function ToggleMirrorCache(r){.q=r;.ClearMirrorCache();.}.function ClearMirrorCache(r){.

C:\Users\user\AppData\Roaming\GamePall\resources.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	8226870
Entropy (8bit):	7.996842728494533
Encrypted:	true
SSDEEP:
MD5:	F7EC58AEA756F3FD8A055AC582103A78
SHA1:	086B63691F5E5375A537E99E062345F56512A22C
SHA-256:	517418184EA974C33FFE67B03732D19B1234DCB9E5C1C2E9E94ED41B3BC1D064
SHA-512:	C620C6E16BBCEE9BC607E6CA75D602C756276AC69E5F3761D82DE7728164133656A71A69043EB1A86CE3051FDE4327A47EFD41D1FF47C8385699CA67C423AD7B
Malicious:	false
Reputation:	unknown
Preview:	............f.6:..{..D..\|..G..~. K.....]....._....=.....c...........9.....B.............................F.....K/.....2....54....r5.....6.....?.....@....jB.....C....hD.....E.....H....nj.....k.....r....@~...."..........W.....................;..../;'...2;P...7;....8;....C;....D;U...E;....F;....G;A,..H;.;..I;gK..J;.Z..K;.h..L;.}..M;y...N;{...O;z...P;....Q;8...R;....S;....T;C'..U;.=..V;.W..W;.m..X;....Y;....Z;D...[;....\;....];.....<.....<x....<.....<-....<\....<.....<.....<.....<.....<*(...< /...<+3...<.3..I=.3..J=.7..K=.9..R= >..S=.G..T=}V..[=;w..\=.x..]=.}..^=R..._=....`=....a=....b=....c=....e=:...f=.....=....=.....=....=`....=p....=.....=.....=.....=.....=.....=K....=.....=t....=.....=.....=.....=\....=Z....=.....=T....=[....=x....=.....=.....=D....=.....=.....=.....=l....=F....=.'...=j)...>.+...>l,...>_0...>.2...>.6...>.8..N>.\..O>~^..P>._..Q>%d..R>.k..S>.l..T>Tn..U>.p..b>.u..c>/y..d>.\|..B@....C@....D@o...E@....F@W...L@Z...M@(...N@...O@....D.....D ....D ....D;....D.....D....D..

C:\Users\user\AppData\Roaming\GamePall\snapshot_blob.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	276319
Entropy (8bit):	4.242318669799302
Encrypted:	false
SSDEEP:
MD5:	8234983533FA47D2A1D7710FF8274299
SHA1:	E4C5793B6FE6A6C6C9D8E3921B3BC341AE3448D8
SHA-256:	F95553D8066144CBB8A05EED1735C94A4B97A2E44E49F624C2302990A13017C9
SHA-512:	1E7E201B0FF9AFA7821B5FFD0A36548A49CD4DBBABA5858E13DA35058670A5053723DD3544B2FD85C619F2B8FC9E5DB48DF977BB293E7BA7DE6F22CC8DAB28CA
Malicious:	false
Reputation:	unknown
Preview:	.........X./j1N.11.8.172.9.......................................................@...y...........@..`....`....`....`b...`....`............B..............b........."..............B..............b...(Jb...)L.....@..F^.1..5.`.....(Jb...-P.....@..F^..`.....H...IDa........Db............D`.....-.D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\start.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.8731406795131327
Encrypted:	false
SSDEEP:
MD5:	2C66F3C2190A84FAFD4449DAF6440EAC
SHA1:	7B9E4C94329FE26C34E63AB8336227FD5EB553E9
SHA-256:	58EB97E30289A3FCAE270DBCC01258A862936350CB0EF781AE76D6A9444C0155
SHA-512:	62713209575426CE503605C6F451E9DFB025BE0295F0A453614862CE390F5987F0E16BAE6B37B4B1A7330A7CB5AA31249F8CF58DE37B8B701C16881E4E4E61C1
Malicious:	false
Reputation:	unknown
Preview:	start GamePall.exe OuWe5kl

C:\Users\user\AppData\Roaming\GamePall\swiftshader\Xilium.CefGlue.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	MSVC program database ver 7.00, 512*4023 bytes
Category:	dropped
Size (bytes):	2059776
Entropy (8bit):	4.067542396670122
Encrypted:	false
SSDEEP:
MD5:	70F9EAEA8A2A604E59F72EDE66F83AB4
SHA1:	0AB9EA1BFFDFF471EC22AB289C7FBC5E0CDF48BF
SHA-256:	38A07BA75CC2BBDF715CA87D380A4E5A0DCFAF9C30C5ECD30F6107871D51825B
SHA-512:	47DE4DAD93385A4907FADE307040FE026ED66989C0C9915AFC96CB2BC93DE5E106DC1274E4AD2382021C758C60FEDE06D68998CF3591E23E2951778CE09D6D4C
Malicious:	false
Reputation:	unknown
Preview:	Microsoft C/C++ MSF 7.00...DS................J..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346624
Entropy (8bit):	6.54104466243173
Encrypted:	false
SSDEEP:
MD5:	7A53AD3E5D2E65C982450E7B7453DE8A
SHA1:	99F27E54F1F61207C02110CAC476405557A8AD54
SHA-256:	24FDDD6A367792A9D86D9060FC9AA459B5FB0F67804CB7D139A100D86BBDAFF8
SHA-512:	2B5E5DB46FDC787CB46CDAEBFFC01586E248FBB864677B27AF03CDC33E956DEF51B3F836597E7092C4175CF605C44728C6F96B74BB2C9870E9715D4AF4C531A1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......_.........."!.........T............................................................@A....................................P....p...........................3..4.......................8........G...............................................text............................... ..`.rdata..............................@..@.data....4..........................@....00cfg.......@......................@..@.tls.........P......................@....voltbl......`...........................rsrc........p......................@..@.reloc...3.......4..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2445312
Entropy (8bit):	6.750207745422387
Encrypted:	false
SSDEEP:
MD5:	334C3157E63A34B22CCE25A44A04835F
SHA1:	C6B05BD55BE9FED3B0C5077C5649E2A41C10DC08
SHA-256:	3E307570B574469EC8BCF1CE6D5291DF8D627CA3812F05AACFEBBD3F00B17F89
SHA-512:	11F538ADD05515861891892EBB90163B6540B72FEB380D64B4A0AA56C6415E3B71374557BF50D0B936712B1006F2B94D59BEBFBF18CBF93BB883D9055CAAEEE9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......_.........."!.....4 .................................................p*...........@A..........................#.. ....$.d....P)......................`).......#.......................#......."...............$.P............................text.../2 ......4 ................. ..`.rdata..\....P ......8 .............@..@.data...L....@$...... $.............@....00cfg....... )......>$.............@..@.tls.........0)......@$.............@....voltbl.M....@)......B$..................rsrc........P)......D$.............@..@.reloc.......`)......H$.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	631017
Entropy (8bit):	5.144793130466209
Encrypted:	false
SSDEEP:
MD5:	0794DF29DF8DFC3ECE5C443F864F5AEB
SHA1:	BFD4A9A34BEB9751BC4203FB9A9172F1F05E5B16
SHA-256:	3EE2237E9B14871165B051CCF892C8375E45B5F12841E02F4B9D37F5D5A03283
SHA-512:	0D34E36F7455B977F086F04840FBA679284A619A7164A56B5C7FC2ADCB23A231B67A62101540EB07CF5C8192790266B08D2CC232D291621C331FE77C1F5E52C0
Malicious:	false
Reputation:	unknown
Preview:	..........d..<..11.8.172.9......................................................@...]!...S..y...-[..........`....`....`T...`b...`....`............B..............b........."..............B..............b...(Jb...)L.....@..F^.1..5.`.....(Jb...-P.....@..F^..`.....H...IDa........Db............D`.....-.D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4400640
Entropy (8bit):	6.667314807988382
Encrypted:	false
SSDEEP:
MD5:	7F913E31D00082338F073EF60D67B335
SHA1:	AC831B45F2A32E23BA9046044508E47E04CDA3A4
SHA-256:	B60E9818C4EA9396D0D2D2A4AC79C7DC40D0DFF6BB8BC734D0AB14ADC30FBF30
SHA-512:	E1AC79C775CF9137283CD2C1AE1A45EC597E0351CDB9C11D483E2E1F8B00CC2BBC5807A50DED13A3A5E76F06C1A565EFF1233F4EC727B0C5F7AA3BEAEA906750
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....$5.........P.-......................................PD...........@A........................8=?.~....\?.P.... B......................0B.X.....?.....................H.?......@5.............._?..............................text...T#5......$5................. ..`.rdata...a...@5..b...(5.............@..@.data...@N....?..x....?.............@....00cfg........B.......A.............@..@.tls....5.....B.......A.............@....rsrc........ B.......A.............@..@.reloc..X....0B.......A.............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Reputation:	unknown
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	826368
Entropy (8bit):	6.78646032943732
Encrypted:	false
SSDEEP:
MD5:	A031EB19C61942A26EF74500AD4B42DF
SHA1:	FDC6EA473234F153639E963E8EFB8D028DA1BE20
SHA-256:	207706A3A3FAA8500F88CB034B26413074EFC67221A07C5F70558F3C40985A91
SHA-512:	80F843E47FC2B41B17EF6EA1BB2BB04119B2417311599EC52120D9F9DF316B4D7B1DAF97EE5CDF2AE78CDB9475E5C65255A7F2AB2A9231804F6A82C83303FD19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....\|..........@.....................................................@A...........................<!..$...P....p..............................l..............................................P................................text....z.......\|.................. ..`.rdata..tr.......t..................@..@.data....7..........................@....00cfg.......P......................@..@.tls.........`......................@....rsrc........p......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	211456
Entropy (8bit):	6.566524833521835
Encrypted:	false
SSDEEP:
MD5:	6D7FD214164C858BBCF4AA050C114E8C
SHA1:	B8868DA6BB9A79EE7C9901A9BFAC580D5BAFCC96
SHA-256:	3F58FB22BD1A1159C351D125BEE122A16BB97BABB5FCA67FDBD9AAAED3B302E6
SHA-512:	0F8F2523C3A616AC7C72A1239B7E353F6A684FF75DA79D1CAF9B98A47FF6FE06329165825704C67C04E92073BA2C17D0FF339C57731DDF0F1489C2E97D1D0A14
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^..._...^..._q..^..._..^..._..^..._..^..._..^k.._...^..._...^...^...^k.._...^k.._...^n..^...^k.._...^Rich...^........................PE..L...Ua.X.........."!.........(......c........0............................................@.................................x...<....@.......................P..T"......8...............................@............0..0............................text............................... ..`.rdata..`....0....... ..............@..@.data...............................@....gfids.......0......................@..@.rsrc........@......................@..@.reloc..T"...P...$..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\aggtjfs

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	191488
Entropy (8bit):	6.196142131713596
Encrypted:	false
SSDEEP:
MD5:	E337B912B6816939B56C2C03859CABB4
SHA1:	FBB4AD3E5C3CAC638D075B1ADD6DB11C55C50794
SHA-256:	9D7926DAC81C4F7200C84298C7839162A2996339262F58BD815D2A94C380A151
SHA-512:	C10A4C025D7C57BB9B05E1DFEB691CFB603FFC4576A9E7D3124AE4F07ED476581AB279B1C2F5DF2E56C6B876125181881730BBF77871D103A96CC2D0DE3B0B91
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].3s..] ..] ..] v.. ..] v.. ..] v.. P.] ... ..] ..\ }.] v.. ..] v.. ..] v.. ..] Rich..] ........................PE..L....hqe......................\|......"............@..........................p~.................................................x....0~..>..........................4...................................@...............x............................text............................... ..`.rdata...0.......2..................@..@.data.....\|.. ......................@....rsrc....>...0~..@..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\aggtjfs:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.196142131713596
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	191'488 bytes
MD5:	e337b912b6816939b56c2c03859cabb4
SHA1:	fbb4ad3e5c3cac638d075b1add6db11c55c50794
SHA256:	9d7926dac81c4f7200c84298c7839162a2996339262f58bd815d2a94c380a151
SHA512:	c10a4c025d7c57bb9b05e1dfeb691cfb603ffc4576a9e7d3124ae4f07ed476581ab279b1c2f5df2e56c6b876125181881730bbf77871d103a96cc2d0de3b0b91
SSDEEP:	3072:VQ/oCSIn5XYG4cGuZVCIZiXuy3LN3IQDEkkNmWKNMnOn9nD:VQlx5TrZ9ZiXV32gNMS9
TLSH:	B514C02176F19075E1B78A306D74C5A16E3BBC21AFB589AA238C067A5FB13C04F65373
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].3s..] ..] ..] v.. ..] v.. ..] v.. P.] ... ..] ..\ }.] v.. ..] v.. ..] v.. ..] Rich..] ........................PE..L....hqe...

File Icon


Icon Hash:	63396de961636e0f

Static PE Info

General

Entrypoint:	0x4022cb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x65716814 [Thu Dec 7 06:37:08 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	287cb3aec4ec689fed2ac9ee5222d26b

Entrypoint Preview

Instruction
call 00007F6A74E63ED4h
jmp 00007F6A74E6190Eh
push edi
mov eax, esi
and eax, 0Fh
test eax, eax
jne 00007F6A74E61B47h
mov edx, ecx
and ecx, 7Fh
shr edx, 07h
je 00007F6A74E61AE7h
jmp 00007F6A74E61A88h
lea ebx, dword ptr [ebx+00000000h]
movdqa xmm0, dqword ptr [esi]
movdqa xmm1, dqword ptr [esi+10h]
movdqa xmm2, dqword ptr [esi+20h]
movdqa xmm3, dqword ptr [esi+30h]
movdqa dqword ptr [edi], xmm0
movdqa dqword ptr [edi+10h], xmm1
movdqa dqword ptr [edi+20h], xmm2
movdqa dqword ptr [edi+30h], xmm3
movdqa xmm4, dqword ptr [esi+40h]
movdqa xmm5, dqword ptr [esi+50h]
movdqa xmm6, dqword ptr [esi+60h]
movdqa xmm7, dqword ptr [esi+70h]
movdqa dqword ptr [edi+40h], xmm4
movdqa dqword ptr [edi+50h], xmm5
movdqa dqword ptr [edi+60h], xmm6
movdqa dqword ptr [edi+70h], xmm7
lea esi, dword ptr [esi+00000080h]
lea edi, dword ptr [edi+00000080h]
dec edx
jne 00007F6A74E61A25h
test ecx, ecx
je 00007F6A74E61ACBh
mov edx, ecx
shr edx, 04h
test edx, edx
je 00007F6A74E61A99h
lea ebx, dword ptr [ebx+00000000h]
movdqa xmm0, dqword ptr [esi]
movdqa dqword ptr [edi], xmm0
lea esi, dword ptr [esi+10h]
lea edi, dword ptr [edi+10h]
dec edx
jne 00007F6A74E61A71h
and ecx, 0Fh
je 00007F6A74E61AA6h
mov eax, ecx
shr ecx, 02h
je 00007F6A74E61A8Fh
mov edx, dword ptr [esi]
mov dword ptr [edi], edx
lea esi, dword ptr [esi+04h]
lea edi, dword ptr [edi+04h]
dec ecx
jne 00007F6A74E61A75h
mov ecx, eax
and ecx, 00000000h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x207bc	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x27e3000	0x3e88	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x20834	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x20298	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x178	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1c4ae	0x1c600	e0932346998f72dd1d987624b540c316	False	0.8913305341409692	data	7.769292748906175	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1e000	0x3086	0x3200	6117e2d645080649e73f28a028a1d037	False	0.348984375	data	4.878528937072133	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x22000	0x27c0384	0xb000	3e317599cd3a6a15a01932337923fb93	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x27e3000	0x3e88	0x4000	76e86ac8a7bebebfa44c406f1c814bc6	False	0.4404296875	data	3.9944922097021043	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x27e31f0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Japanese	Japan	0.5316820276497696
RT_ICON	0x27e38b8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Japanese	Japan	0.41815352697095437
RT_ICON	0x27e5e60	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Japanese	Japan	0.45567375886524825
RT_STRING	0x27e6590	0x582	data	Japanese	Japan	0.4475177304964539
RT_STRING	0x27e6b18	0x108	data	Japanese	Japan	0.5795454545454546
RT_STRING	0x27e6c20	0x262	data	Japanese	Japan	0.48032786885245904
RT_GROUP_ICON	0x27e62c8	0x30	data	Japanese	Japan	0.9375
RT_VERSION	0x27e62f8	0x294	OpenPGP Secret Key			0.5227272727272727

Imports

DLL	Import
KERNEL32.dll	FindResourceA, IsBadStringPtrW, GetConsoleAliasesLengthW, SetEndOfFile, FindResourceW, InterlockedDecrement, CreateDirectoryW, WriteConsoleInputA, GetWindowsDirectoryA, TlsSetValue, GlobalFindAtomA, LoadLibraryW, ReplaceFileW, GlobalUnlock, SetLastError, GetProcAddress, RemoveVectoredExceptionHandler, LocalAlloc, GlobalGetAtomNameW, EnumResourceTypesW, GetModuleFileNameA, GetOEMCP, OpenFileMappingW, TerminateJobObject, HeapSize, HeapReAlloc, RtlUnwind, CreateFileA, LoadLibraryA, GetDateFormatW, Sleep, EnterCriticalSection, MultiByteToWideChar, GetCommandLineA, HeapSetInformation, GetStartupInfoW, IsProcessorFeaturePresent, GetCPInfo, InterlockedIncrement, GetACP, IsValidCodePage, EncodePointer, TlsAlloc, TlsGetValue, DecodePointer, TlsFree, GetModuleHandleW, GetCurrentThreadId, GetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, HeapAlloc, HeapFree, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameW, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, HeapCreate, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LCMapStringW, GetStringTypeW, LeaveCriticalSection, RaiseException
USER32.dll	SetMessageExtraInfo, GetCaretPos, GetKeyboardLayoutNameW, InsertMenuItemW, GetClassInfoW, CharUpperBuffW, DdeKeepStringHandle
GDI32.dll	GetTextMetricsA, GetCharWidthW
ole32.dll	CoSuspendClassObjects, CoMarshalHresult
WINHTTP.dll	WinHttpCheckPlatform, WinHttpWriteData

Possible Origin

Language of compilation system	Country where language is spoken	Map
Japanese	Japan

Target ID:	0
Start time:	14:56:51
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	191'488 bytes
MD5 hash:	E337B912B6816939B56C2C03859CABB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2079888304.0000000002D8E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.2079676068.0000000002C20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.2079676068.0000000002C20000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2079658197.0000000002C10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.2080052883.0000000004851000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.2080052883.0000000004851000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:56:59
Start date:	04/07/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	14:57:17
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\aggtjfs
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\aggtjfs
Imagebase:	0x400000
File size:	191'488 bytes
MD5 hash:	E337B912B6816939B56C2C03859CABB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.2324008509.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.2324008509.0000000002DA1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.2323963441.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.2323963441.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.2324083099.0000000002E1F000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000004.00000002.2323917643.0000000002D70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:57:34
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Local\Temp\23E4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\23E4.exe
Imagebase:	0xc30000
File size:	6'642'176 bytes
MD5 hash:	BD2EAC64CBDED877608468D86786594A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000003.2468539842.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000003.2484065314.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000003.2498316899.0000000000B59000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000003.2468539842.0000000000B43000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000003.2467985016.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000003.2457202713.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000003.2484065314.0000000000B43000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000003.2467985016.0000000000B43000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000003.2498215186.0000000000BA2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000003.2446354815.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000003.2498005958.0000000000B43000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:57:44
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Local\Temp\5371.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5371.exe
Imagebase:	0x400000
File size:	293'869 bytes
MD5 hash:	60172CA946DE57C3529E9F05CC502870
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 21%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:59:08
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Local\Temp\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\setup.exe"
Imagebase:	0x400000
File size:	107'232'830 bytes
MD5 hash:	FF2293FBFF53F4BD2BFF91780FABFD60
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:59:37
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Imagebase:	0x1a0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:59:41
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x2a0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:59:41
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3472 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
Imagebase:	0xab0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:59:41
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3660 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Imagebase:	0xde0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:59:41
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3592 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Imagebase:	0x7a0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:59:41
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1720115578234356 --launch-time-ticks=4603408239 --mojo-platform-channel-handle=3948 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Imagebase:	0x650000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:59:41
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1720115578234356 --launch-time-ticks=4603422960 --mojo-platform-channel-handle=4012 --field-trial-handle=3476,i,3252441317310229410,1173011674787013367,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Imagebase:	0xb10000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:59:42
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xc30000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:59:42
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x3a0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:59:43
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x700000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:59:44
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x890000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:59:45
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xef0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	14:59:45
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x300000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	14:59:46
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xa30000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	14:59:46
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x930000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	14:59:46
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xee0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	14:59:47
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x2c0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	14:59:47
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x550000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	14:59:48
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x390000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	14:59:48
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xf00000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	14:59:49
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xf90000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	14:59:49
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x280000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	14:59:49
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x8a0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	14:59:49
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x830000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	14:59:49
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x3c0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	14:59:49
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xae0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	14:59:49
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xfb0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	14:59:50
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xed0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	14:59:50
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x320000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	29.3%
Signature Coverage:	64.6%
Total number of Nodes:	99
Total number of Limit Nodes:	2

Executed Functions

Function 00401496 Relevance: 10.7, APIs: 7, Instructions: 247
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.2078561683.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 5edb7204c22a8cfb94061bf161a88c3eca98da374ec15d8cd8ba2bf42dcd3747
Instruction ID: 8e4940cc2d5d294876689a6a874cb0cc3c399929e81e9dec1e5d288c8cd9e9dd
Opcode Fuzzy Hash: 5edb7204c22a8cfb94061bf161a88c3eca98da374ec15d8cd8ba2bf42dcd3747
Instruction Fuzzy Hash: F481B375500244BBEB209F91CC44FAB7BB8FF85704F10412AF952BA2F1E7749901CB69

Function 00401538 Relevance: 10.7, APIs: 7, Instructions: 207
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.2078561683.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 4af5c640631db37ac51d1c1afd1ab74928840835cbc445bb96c3204467379d38
Instruction ID: 71a4d0092025beca94809e07d65936591d52f1bb8effc294688e3fcd05e54c36
Opcode Fuzzy Hash: 4af5c640631db37ac51d1c1afd1ab74928840835cbc445bb96c3204467379d38
Instruction Fuzzy Hash: E0615171900204FBEB209F95CC89FAF7BB8FF85700F10412AF912BA2E5D6759905DB65

Function 004014DE Relevance: 10.7, APIs: 7, Instructions: 204
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.2078561683.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: c3f6308678fe624b1287adcb7156a2cf5c07ee8b7810a15753646c5694e98bc6
Instruction ID: 6a824664258ffec6fdf95c516407446232c8a84219ad61b9fd4b8efeb52f3576
Opcode Fuzzy Hash: c3f6308678fe624b1287adcb7156a2cf5c07ee8b7810a15753646c5694e98bc6
Instruction Fuzzy Hash: 9B615C75900245BFEB219F91CC88FEBBBB8FF85710F10016AF951BA2A5E7749901CB24

Function 00401543 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.2078561683.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f4faf4f0efc4cc5c307795d20c298965336779ff7452863f8b2b81be2522acaa
Instruction ID: 1fc6fb52bb36dddf8f971a96ecfe927bdbae9887f6286775c14151e9c1d92244
Opcode Fuzzy Hash: f4faf4f0efc4cc5c307795d20c298965336779ff7452863f8b2b81be2522acaa
Instruction Fuzzy Hash: 13512B71900245BBEB209F91CC88FAF7BB8EF85B00F14416AF912BA2E5D6749945CB64

Function 00401565 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.2078561683.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 40d7219ce39e026dd98d18ec02294656054e4da488103e740ba1602fb3a5db7c
Instruction ID: d88667ffe02cbbb2798d41d5ad0cf6527765788d972b82ac88077c7d238bff09
Opcode Fuzzy Hash: 40d7219ce39e026dd98d18ec02294656054e4da488103e740ba1602fb3a5db7c
Instruction Fuzzy Hash: 54511A71900205BFEF209F91CC89FAFBBB8FF85B10F104259F911AA2A5D7759941CB64

Function 00401579 Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.2078561683.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 44bf211d5ecd49b3cfb3996dc98baa0f9fc545abe5e070ef87effc0df1f686f8
Instruction ID: 7169477154cf1621f4f222e223ad54e678f31395e99d0ffd613e12cb64d905d3
Opcode Fuzzy Hash: 44bf211d5ecd49b3cfb3996dc98baa0f9fc545abe5e070ef87effc0df1f686f8
Instruction Fuzzy Hash: 2B511A75900245BBEF209F91CC88FEF7BB8FF85B10F104119F911BA2A5D6759941CB64

Function 0040157C Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.2078561683.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c4110b1088d5ef41785dfe7ea8eaa09ab46741a105747cbb29c974859abd6495
Instruction ID: 14f4b29c405daff92d21e2b3eea283823ae405efc36948ac0d92101f557811aa
Opcode Fuzzy Hash: c4110b1088d5ef41785dfe7ea8eaa09ab46741a105747cbb29c974859abd6495
Instruction Fuzzy Hash: DE51F9B5900245BBEF209F91CC88FEFBBB8FF85B10F104259F911AA2A5D6709944CB64

Function 00402FE9 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040311D
NtTerminateProcess.NTDLL ref: 00403136

Memory Dump Source

Source File: 00000000.00000002.2078561683.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 3e1675bac70c022a4e457ffe6b5fa54937b73e0116388ba90aec32851b4d9964
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: A1412431228E088FD768EF5CA885762B7D5F798311F6643AAE809D7389EA34DC1183C5

Function 02D95716 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02D9573E
Module32First.KERNEL32(00000000,00000224), ref: 02D9575E

Memory Dump Source

Source File: 00000000.00000002.2079888304.0000000002D8E000.00000040.00000020.00020000.00000000.sdmp, Offset: 02D8E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d8e000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 611a67fb05a19d2b66d2adcd0cf59cae6a3cf10cd4f9e4c475d3cc27e8e81de2
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 40F06231100710ABDB313AF5B88DB6E76E8AF49625F600538F643915C0DBB1ED468A61

Function 02C1003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02C1024D

Strings

cess, xrefs: 02C1018D
kernel32.dll, xrefs: 02C1008F, 02C10095

Memory Dump Source

Source File: 00000000.00000002.2079658197.0000000002C10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c10000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 74ea1c40a21e0b81cc1bbc5df399dcc98523a282e362067ca4e3b6fdb7c0463c
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 82526974A01229DFDB64CF68C985BACBBB1BF09304F1480D9E94DAB351DB30AA85DF14

Function 02C10E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02C10223,?,?), ref: 02C10E19
SetErrorMode.KERNELBASE(00000000,?,?,02C10223,?,?), ref: 02C10E1E

Memory Dump Source

Source File: 00000000.00000002.2079658197.0000000002C10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c10000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 06908950eb26b2e6a6b5b84cf559d50182338b8c6ced12e7e9e7af41340c8f57
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 24D0123114512877DB002A95DC09BCD7B1CDF05B66F008011FB0DD9080C770964046E5

Function 00401918 Relevance: 1.3, APIs: 1, Instructions: 57
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.2078561683.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: be810bd81fc1513bf14dac74237aa616a3cfbc48422f9378a192f31e1e69cca3
Instruction ID: 41df8370e0b5f9a47a14a91e784646d83bdfa422f97ac69dcfec837627d5bcb0
Opcode Fuzzy Hash: be810bd81fc1513bf14dac74237aa616a3cfbc48422f9378a192f31e1e69cca3
Instruction Fuzzy Hash: 6D018CF520C148E7EB016A948DB1EBA36299B45324F300233B647B91F4C57C8A03E76F

Function 00401924 Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.2078561683.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 3ad2d4b3403b833ed421c634174be831538fe621ff724946387ec8f91c54f5fa
Instruction ID: 34fc3aff5e218d4630d956a4f9c4c41b7245144a44faa4fd8074b33eba8f9d72
Opcode Fuzzy Hash: 3ad2d4b3403b833ed421c634174be831538fe621ff724946387ec8f91c54f5fa
Instruction Fuzzy Hash: 43017CF5208145E7EB015A948DB0EBA26299B45314F300237B617BA1F4C57D8602E76F

Function 02D953D5 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02D95426

Memory Dump Source

Source File: 00000000.00000002.2079888304.0000000002D8E000.00000040.00000020.00020000.00000000.sdmp, Offset: 02D8E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d8e000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 25a5a6dc88b0a49bb319585926d49d4afb28ef58ef3225393afd800733429c66
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 23113C79A00208EFDB01DF98C985E98BBF5EF08351F0580A4F948AB361D371EA50DF90

Function 00401941 Relevance: 1.3, APIs: 1, Instructions: 44sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.2078561683.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 6acc595331c6a8be6e6657ef398eef7c869974a8ecae4d1fde63dfd35a725e44
Instruction ID: 53d82b158b021bc4b6cde56962adc0b8c8d23177238c0d6ee964112a53f005ae
Opcode Fuzzy Hash: 6acc595331c6a8be6e6657ef398eef7c869974a8ecae4d1fde63dfd35a725e44
Instruction Fuzzy Hash: 38F0AFB6308249F7DB01AA908DB1EBA36299B54315F300633B617B91F5C57C8A12E76F

Function 00401954 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.2078561683.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 0dfbee2e4a1c62836b2bd3ba6284fddb5b43d5507a7098400a51ac80bc720613
Instruction ID: f7568a5a22988f4b084f7ac8228f9b89e575eda69d31bfffabc36cd9cbe45c64
Opcode Fuzzy Hash: 0dfbee2e4a1c62836b2bd3ba6284fddb5b43d5507a7098400a51ac80bc720613
Instruction Fuzzy Hash: BDF0C2B6208144F7DB019AA18DB1FBA36299B44314F300233BA17B90F5C67C8612E76F

Function 0040194C Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.2078561683.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: f575feb9a37452ed4573e207967fb92b714552aa85f9b6ebf0a13cec3e485039
Instruction ID: 9d6088553fbd849a34ffa1589a5f9bffd683413c7e042594889390f4c4f3f426
Opcode Fuzzy Hash: f575feb9a37452ed4573e207967fb92b714552aa85f9b6ebf0a13cec3e485039
Instruction Fuzzy Hash: 08F0C2B2208144F7DB019A958DA0FBA36299B44314F300633B617B91F5C57C8A02E72F

Non-executed Functions

Function 02C1092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 02C1095F
l, xrefs: 02C10966
GetProcAddress., xrefs: 02C109DC, 02C109DF, 02C109E4

Memory Dump Source

Source File: 00000000.00000002.2079658197.0000000002C10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: f04ba6b7f4c4567404d6f7e7c4cb3b4588be87a0b5c1a8575a5f9040d41d7272
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 4A316AB6900609DFDB10CF99C881AAEBBF9FF49324F14404AD841AB314D771EA85DFA4

Function 02D94FF3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079888304.0000000002D8E000.00000040.00000020.00020000.00000000.sdmp, Offset: 02D8E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d8e000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 1bd76c0dde0ffc373d7b9f5faf89f19fea88db9e85e3455da07d8879b531994c
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 9D1182723401009FDB54DF55EC81FA673EAEB89320B698165ED08CB312E675EC41C7A0

Function 02C10D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079658197.0000000002C10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 9ec1d93bcb94526fd0a85b29982b231727efc209345e7258da298eaa3d141bbf
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 3601A276B106048FDF21DF24C806BAA33E5EFC7216F4544A5DD0A97285E774A981CB90

Analysis Process: aggtjfsPID: 5864, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	29.3%
Signature Coverage:	0%
Total number of Nodes:	99
Total number of Limit Nodes:	2

Executed Functions

Function 00401496 Relevance: 10.7, APIs: 7, Instructions: 247
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000004.00000002.2322789371.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_aggtjfs.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 5edb7204c22a8cfb94061bf161a88c3eca98da374ec15d8cd8ba2bf42dcd3747
Instruction ID: 8e4940cc2d5d294876689a6a874cb0cc3c399929e81e9dec1e5d288c8cd9e9dd
Opcode Fuzzy Hash: 5edb7204c22a8cfb94061bf161a88c3eca98da374ec15d8cd8ba2bf42dcd3747
Instruction Fuzzy Hash: F481B375500244BBEB209F91CC44FAB7BB8FF85704F10412AF952BA2F1E7749901CB69

Function 00401538 Relevance: 10.7, APIs: 7, Instructions: 207
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000004.00000002.2322789371.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_aggtjfs.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 4af5c640631db37ac51d1c1afd1ab74928840835cbc445bb96c3204467379d38
Instruction ID: 71a4d0092025beca94809e07d65936591d52f1bb8effc294688e3fcd05e54c36
Opcode Fuzzy Hash: 4af5c640631db37ac51d1c1afd1ab74928840835cbc445bb96c3204467379d38
Instruction Fuzzy Hash: E0615171900204FBEB209F95CC89FAF7BB8FF85700F10412AF912BA2E5D6759905DB65

Function 004014DE Relevance: 10.7, APIs: 7, Instructions: 204
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000004.00000002.2322789371.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_aggtjfs.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: c3f6308678fe624b1287adcb7156a2cf5c07ee8b7810a15753646c5694e98bc6
Instruction ID: 6a824664258ffec6fdf95c516407446232c8a84219ad61b9fd4b8efeb52f3576
Opcode Fuzzy Hash: c3f6308678fe624b1287adcb7156a2cf5c07ee8b7810a15753646c5694e98bc6
Instruction Fuzzy Hash: 9B615C75900245BFEB219F91CC88FEBBBB8FF85710F10016AF951BA2A5E7749901CB24

Function 00401543 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000004.00000002.2322789371.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_aggtjfs.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f4faf4f0efc4cc5c307795d20c298965336779ff7452863f8b2b81be2522acaa
Instruction ID: 1fc6fb52bb36dddf8f971a96ecfe927bdbae9887f6286775c14151e9c1d92244
Opcode Fuzzy Hash: f4faf4f0efc4cc5c307795d20c298965336779ff7452863f8b2b81be2522acaa
Instruction Fuzzy Hash: 13512B71900245BBEB209F91CC88FAF7BB8EF85B00F14416AF912BA2E5D6749945CB64

Function 00401565 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000004.00000002.2322789371.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_aggtjfs.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 40d7219ce39e026dd98d18ec02294656054e4da488103e740ba1602fb3a5db7c
Instruction ID: d88667ffe02cbbb2798d41d5ad0cf6527765788d972b82ac88077c7d238bff09
Opcode Fuzzy Hash: 40d7219ce39e026dd98d18ec02294656054e4da488103e740ba1602fb3a5db7c
Instruction Fuzzy Hash: 54511A71900205BFEF209F91CC89FAFBBB8FF85B10F104259F911AA2A5D7759941CB64

Function 00401579 Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000004.00000002.2322789371.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_aggtjfs.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 44bf211d5ecd49b3cfb3996dc98baa0f9fc545abe5e070ef87effc0df1f686f8
Instruction ID: 7169477154cf1621f4f222e223ad54e678f31395e99d0ffd613e12cb64d905d3
Opcode Fuzzy Hash: 44bf211d5ecd49b3cfb3996dc98baa0f9fc545abe5e070ef87effc0df1f686f8
Instruction Fuzzy Hash: 2B511A75900245BBEF209F91CC88FEF7BB8FF85B10F104119F911BA2A5D6759941CB64

Function 0040157C Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000004.00000002.2322789371.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_aggtjfs.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c4110b1088d5ef41785dfe7ea8eaa09ab46741a105747cbb29c974859abd6495
Instruction ID: 14f4b29c405daff92d21e2b3eea283823ae405efc36948ac0d92101f557811aa
Opcode Fuzzy Hash: c4110b1088d5ef41785dfe7ea8eaa09ab46741a105747cbb29c974859abd6495
Instruction Fuzzy Hash: DE51F9B5900245BBEF209F91CC88FEFBBB8FF85B10F104259F911AA2A5D6709944CB64

Function 00402FE9 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040311D
NtTerminateProcess.NTDLL ref: 00403136

Memory Dump Source

Source File: 00000004.00000002.2322789371.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_aggtjfs.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 3e1675bac70c022a4e457ffe6b5fa54937b73e0116388ba90aec32851b4d9964
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: A1412431228E088FD768EF5CA885762B7D5F798311F6643AAE809D7389EA34DC1183C5

Function 02D7003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02D7024D

Strings

kernel32.dll, xrefs: 02D7008F, 02D70095
cess, xrefs: 02D7018D

Memory Dump Source

Source File: 00000004.00000002.2323917643.0000000002D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d70000_aggtjfs.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 812c7047b637651cfe57936d190c6aea0a11fb53c0fbb91790050cd524f7a457
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: B4525975A012299FDB64CF58C984BACBBB1BF09305F1480D9E54DAB391EB34AE85CF14

Function 02E25CAE Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02E25CD6
Module32First.KERNEL32(00000000,00000224), ref: 02E25CF6

Memory Dump Source

Source File: 00000004.00000002.2324083099.0000000002E1F000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E1F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2e1f000_aggtjfs.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: f3ccfeb20d53fa94bc0d695c9888cedffded86deb9de7a8c3ffb9a8b9b540208
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: AEF0FC312407206BD7243BF59D8DBAE72E8BF45728F506528E553D10C0DB70E80D4A50

Function 02D70E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02D70223,?,?), ref: 02D70E19
SetErrorMode.KERNELBASE(00000000,?,?,02D70223,?,?), ref: 02D70E1E

Memory Dump Source

Source File: 00000004.00000002.2323917643.0000000002D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d70000_aggtjfs.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 1e332a13354e2b6ba836fca803a86de0039a6c13a583d90132fd488c4997e204
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: E4D0123114512877D7002A94DC09BCD7B1CDF09B67F008011FB0DD9180C774994046E5

Function 00401918 Relevance: 1.3, APIs: 1, Instructions: 57
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000004.00000002.2322789371.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_aggtjfs.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: be810bd81fc1513bf14dac74237aa616a3cfbc48422f9378a192f31e1e69cca3
Instruction ID: 41df8370e0b5f9a47a14a91e784646d83bdfa422f97ac69dcfec837627d5bcb0
Opcode Fuzzy Hash: be810bd81fc1513bf14dac74237aa616a3cfbc48422f9378a192f31e1e69cca3
Instruction Fuzzy Hash: 6D018CF520C148E7EB016A948DB1EBA36299B45324F300233B647B91F4C57C8A03E76F

Function 00401924 Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000004.00000002.2322789371.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_aggtjfs.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 3ad2d4b3403b833ed421c634174be831538fe621ff724946387ec8f91c54f5fa
Instruction ID: 34fc3aff5e218d4630d956a4f9c4c41b7245144a44faa4fd8074b33eba8f9d72
Opcode Fuzzy Hash: 3ad2d4b3403b833ed421c634174be831538fe621ff724946387ec8f91c54f5fa
Instruction Fuzzy Hash: 43017CF5208145E7EB015A948DB0EBA26299B45314F300237B617BA1F4C57D8602E76F

Function 02E2596D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02E259BE

Memory Dump Source

Source File: 00000004.00000002.2324083099.0000000002E1F000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E1F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2e1f000_aggtjfs.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 939d88459d7ef5c3f2fcb9b809fe8a2f87227bc5eee666c2c7d44d43e886a560
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 43113F79A40208EFDB01DF98CA85E98BBF5AF08350F45C094F949AB361D771EA50DF80

Function 00401941 Relevance: 1.3, APIs: 1, Instructions: 44sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000004.00000002.2322789371.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_aggtjfs.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 6acc595331c6a8be6e6657ef398eef7c869974a8ecae4d1fde63dfd35a725e44
Instruction ID: 53d82b158b021bc4b6cde56962adc0b8c8d23177238c0d6ee964112a53f005ae
Opcode Fuzzy Hash: 6acc595331c6a8be6e6657ef398eef7c869974a8ecae4d1fde63dfd35a725e44
Instruction Fuzzy Hash: 38F0AFB6308249F7DB01AA908DB1EBA36299B54315F300633B617B91F5C57C8A12E76F

Function 00401954 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000004.00000002.2322789371.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_aggtjfs.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 0dfbee2e4a1c62836b2bd3ba6284fddb5b43d5507a7098400a51ac80bc720613
Instruction ID: f7568a5a22988f4b084f7ac8228f9b89e575eda69d31bfffabc36cd9cbe45c64
Opcode Fuzzy Hash: 0dfbee2e4a1c62836b2bd3ba6284fddb5b43d5507a7098400a51ac80bc720613
Instruction Fuzzy Hash: BDF0C2B6208144F7DB019AA18DB1FBA36299B44314F300233BA17B90F5C67C8612E76F

Function 0040194C Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000004.00000002.2322789371.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_aggtjfs.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: f575feb9a37452ed4573e207967fb92b714552aa85f9b6ebf0a13cec3e485039
Instruction ID: 9d6088553fbd849a34ffa1589a5f9bffd683413c7e042594889390f4c4f3f426
Opcode Fuzzy Hash: f575feb9a37452ed4573e207967fb92b714552aa85f9b6ebf0a13cec3e485039
Instruction Fuzzy Hash: 08F0C2B2208144F7DB019A958DA0FBA36299B44314F300633B617B91F5C57C8A02E72F

Analysis Process: 5371.exePID: 6444, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	18.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.5%
Total number of Nodes:	1453
Total number of Limit Nodes:	32

Executed Functions

Function 004034CC Relevance: 94.9, APIs: 34, Strings: 20, Instructions: 417
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008001), ref: 004034EF
GetVersionExA.KERNEL32(?), ref: 00403518
GetVersionExA.KERNEL32(0000009C), ref: 0040352F
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004035F8
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 00403635
OleInitialize.OLE32(00000000), ref: 0040363C
SHGetFileInfoA.SHELL32(0041FD10,00000000,?,00000160,00000000,?,00000007,00000009,0000000B), ref: 0040365A
GetCommandLineA.KERNEL32(00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 0040366F
CharNextA.USER32(00000000,C:\Users\user\AppData\Local\Temp\5371.exe,00000020,C:\Users\user\AppData\Local\Temp\5371.exe,00000000,?,00000007,00000009,0000000B), ref: 004036A9
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000007,00000009,0000000B), ref: 004037A2
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 004037B3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 004037BF
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 004037D3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004037DB
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004037EC
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004037F4
DeleteFileA.KERNEL32(1033,?,00000007,00000009,0000000B), ref: 00403808
ExitProcess.KERNEL32(?,?,00000007,00000009,0000000B), ref: 004038AE
OleUninitialize.OLE32(?,?,00000007,00000009,0000000B), ref: 004038B3
ExitProcess.KERNEL32 ref: 004038D4
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Local\Temp\5371.exe,00000000,?,?,00000007,00000009,0000000B), ref: 004038E7
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A1B0,C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Local\Temp\5371.exe,00000000,?,?,00000007,00000009,0000000B), ref: 004038F6
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Local\Temp\5371.exe,00000000,?,?,00000007,00000009,0000000B), ref: 00403901
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp), ref: 0040390D
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 00403929
DeleteFileA.KERNEL32(0041F910,0041F910,?,00425000,?,?,00000007,00000009,0000000B), ref: 00403986
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\5371.exe,0041F910,00000001), ref: 0040399B
CloseHandle.KERNEL32(00000000,0041F910,0041F910,?,0041F910,00000000,?,00000007,00000009,0000000B), ref: 004039C8
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000009,0000000B), ref: 004039F6
OpenProcessToken.ADVAPI32(00000000), ref: 004039FD
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403A11
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403A30
ExitWindowsEx.USER32(00000002,80040002), ref: 00403A55
ExitProcess.KERNEL32 ref: 00403A76

Strings

Error launching installer, xrefs: 0040386C
.tmp, xrefs: 004038FB
TMP, xrefs: 004037EF
TEMP, xrefs: 004037E7
~nsu, xrefs: 004038DF
NSIS Error, xrefs: 00403660
C:\Users\user\AppData\Local\Temp\5371.exe, xrefs: 00403675, 0040367B, 0040382A
\Temp, xrefs: 004037B9
SeShutdownPrivilege, xrefs: 00403A0B
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403787, 00403886, 0040392F, 00403939
1033, xrefs: 00403803
C:\Users\user\AppData\Roaming\GamePall\update, xrefs: 00403891
UXTHEME, xrefs: 004035EC, 004035F1, 004035F7
C:\Users\user\AppData\Local\Temp, xrefs: 00403906, 0040390B, 00403938
A, xrefs: 0040356A
", xrefs: 004036CC
C:\Users\user\AppData\Local\Temp\, xrefs: 00403797, 0040379C, 004037B2, 004037BE, 004037CD, 004037DA, 004037E6, 004037EE, 004038E4, 004038F5, 00403900, 0040390C, 00403919, 00403928, 004039DD
C:\Users\user\AppData\Local\Temp\5371.exe, xrefs: 00403996
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034E1
Low, xrefs: 004037D5

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: "$.tmp$1033$A$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\5371.exe$C:\Users\user\AppData\Local\Temp\5371.exe$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\update$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2882342585-341403974
Opcode ID: d18186efe810cf451430c4e096b9aeccec46dfe8f60ebdd611bfa721823b35b5
Instruction ID: 1a4863036e4e50ed5e1acae1e6299f6db15da00d6e87979e5214c03ba8a99dba
Opcode Fuzzy Hash: d18186efe810cf451430c4e096b9aeccec46dfe8f60ebdd611bfa721823b35b5
Instruction Fuzzy Hash: 99E1D270A04354AADB21AF659D49B6F7EB89F86306F0540BFF441B61D2CB7C4A05CB2E

Function 100010D0 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?), ref: 100010F2

Strings

Process32Next, xrefs: 10001255
NTDLL.DLL, xrefs: 10001127
KERNEL32.DLL, xrefs: 10001225
CreateToolhelp32Snapshot, xrefs: 10001243
Process32First, xrefs: 1000124B
NtQuerySystemInformation, xrefs: 1000113B

Memory Dump Source

Source File: 00000008.00000002.4003779869.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4003730902.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4003860905.0000000010002000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4003911865.0000000010004000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_5371.jbxd

Similarity

API ID: Version
String ID: CreateToolhelp32Snapshot$KERNEL32.DLL$NTDLL.DLL$NtQuerySystemInformation$Process32First$Process32Next
API String ID: 1889659487-877962304
Opcode ID: 65e34132412926b77cd70352a95a1b322544ba155a4a88647b4c9b484df59334
Instruction ID: 3df706415bff85d1043f51983ae3f68c733976b3404a17f8fb4488dcc6387507
Opcode Fuzzy Hash: 65e34132412926b77cd70352a95a1b322544ba155a4a88647b4c9b484df59334
Instruction Fuzzy Hash: 19715871900659EFFB11DFA4CC88ADE3BEAEB483C4F250026FA19D2159E6358E49CB50

Function 00405B4A Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(?,?,75923410,75922EE0,C:\Users\user\AppData\Local\Temp\5371.exe), ref: 00405B73
lstrcatA.KERNEL32(00421D58,\*.*,00421D58,?,?,75923410,75922EE0,C:\Users\user\AppData\Local\Temp\5371.exe), ref: 00405BBB
lstrcatA.KERNEL32(?,0040A014,?,00421D58,?,?,75923410,75922EE0,C:\Users\user\AppData\Local\Temp\5371.exe), ref: 00405BDC
lstrlenA.KERNEL32(?,?,0040A014,?,00421D58,?,?,75923410,75922EE0,C:\Users\user\AppData\Local\Temp\5371.exe), ref: 00405BE2
FindFirstFileA.KERNEL32(00421D58,?,?,?,0040A014,?,00421D58,?,?,75923410,75922EE0,C:\Users\user\AppData\Local\Temp\5371.exe), ref: 00405BF3
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405CA0
FindClose.KERNEL32(00000000), ref: 00405CB1

Strings

\*.*, xrefs: 00405BB5
C:\Users\user\AppData\Local\Temp\5371.exe, xrefs: 00405B53

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user\AppData\Local\Temp\5371.exe$\*.*
API String ID: 2035342205-2804150188
Opcode ID: 2ba348f7f603991e7b2998a01f0f2af9ee039e7695cfc72fde993ee98a245b0d
Instruction ID: 9e5d3321e74a3647b1fb2cdcf4bec0a51507e3563529971eb59e862f6dba24c5
Opcode Fuzzy Hash: 2ba348f7f603991e7b2998a01f0f2af9ee039e7695cfc72fde993ee98a245b0d
Instruction Fuzzy Hash: 2B519130908B04AAEB316B61CC49BAF7AB8DF82755F14813FF851B51D2C73C5982DE69

Function 00406A88 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b420139e1bb7bdc71f93166ff3cf2c8d4b4e2e8bf29b11b667125d81af8f4237
Instruction ID: c2ee61ea0ab5e5811791f69f03c7ffba3fbd093a674906ee4b434ab4c587e2e9
Opcode Fuzzy Hash: b420139e1bb7bdc71f93166ff3cf2c8d4b4e2e8bf29b11b667125d81af8f4237
Instruction Fuzzy Hash: 0FF18A70D04269CBDF28CF98C8946ADBBB0FF44305F24816ED856BB281D7786A86DF45

Function 004066FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(75923410,004225A0,C:\,00405E4B,C:\,C:\,00000000,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0), ref: 0040670A
FindClose.KERNEL32(00000000), ref: 00406716

Strings

C:\, xrefs: 004066FF

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
Instruction ID: 083b1303d1f5dd1ba3b50291930e0491dd498af142a60d7bee4daa0eb941c193
Opcode Fuzzy Hash: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
Instruction Fuzzy Hash: B3D01231515120BBC3405B38AE0C95B7E589F093747618A36F066F22E4DB74CC6286AC

Function 00403B6E Relevance: 49.2, APIs: 13, Strings: 15, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406794: GetModuleHandleA.KERNEL32(?,00000000,?,0040360E,0000000B), ref: 004067A6
Part of subcall function 00406794: GetProcAddress.KERNEL32(00000000,?), ref: 004067C1

lstrcatA.KERNEL32(1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,75923410,C:\Users\user\AppData\Local\Temp\,?,C:\Users\user\AppData\Local\Temp\5371.exe,00000009,0000000B), ref: 00403BE9
lstrlenA.KERNEL32(C:\Windows\wininit.ini,?,?,?,C:\Windows\wininit.ini,00000000,C:\Users\user\AppData\Roaming\GamePall,1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,75923410), ref: 00403C5E
lstrcmpiA.KERNEL32(?,.exe), ref: 00403C71
GetFileAttributesA.KERNEL32(C:\Windows\wininit.ini,?,C:\Users\user\AppData\Local\Temp\5371.exe,00000009,0000000B), ref: 00403C7C
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\GamePall), ref: 00403CC5

Part of subcall function 004062E6: wsprintfA.USER32 ref: 004062F3

RegisterClassA.USER32(00423EE0), ref: 00403D02
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403D1A
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403D4F
ShowWindow.USER32(00000005,00000000,?,C:\Users\user\AppData\Local\Temp\5371.exe,00000009,0000000B), ref: 00403D85
GetClassInfoA.USER32(00000000,RichEdit20A,00423EE0), ref: 00403DB1
GetClassInfoA.USER32(00000000,RichEdit,00423EE0), ref: 00403DBE
RegisterClassA.USER32(00423EE0), ref: 00403DC7
DialogBoxParamA.USER32(?,00000000,00403F0B,00000000), ref: 00403DE6

Strings

C:\Windows\wininit.ini, xrefs: 00403C2C, 00403C34, 00403C41, 00403C8B, 00403C91
.exe, xrefs: 00403C6B
.DEFAULT\Control Panel\International, xrefs: 00403BD4
RichEdit, xrefs: 00403DB8
Control Panel\Desktop\ResourceLocale, xrefs: 00403BA2
RichEdit20A, xrefs: 00403DA9, 00403DAF
_Nb, xrefs: 00403CE1, 00403D49
C:\Users\user\AppData\Local\Temp\5371.exe, xrefs: 00403B71
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403BF8, 00403C00, 00403C98, 00403C9E, 00403CAE
RichEd20, xrefs: 00403D8B
>B, xrefs: 00403CD4
1033, xrefs: 00403B8E, 00403BE4
RichEd32, xrefs: 00403D99
PB, xrefs: 00403B9A
C:\Users\user\AppData\Local\Temp\, xrefs: 00403B73

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\5371.exe$C:\Users\user\AppData\Roaming\GamePall$C:\Windows\wininit.ini$Control Panel\Desktop\ResourceLocale$PB$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$>B
API String ID: 1975747703-2354055305
Opcode ID: dbde64bc3a376ab52a9cb3762a64ce6a0c2f330f4a95e62c6433b020d27b21d7
Instruction ID: 5836c5bb6a6ef8c4ff0aed12ec42ff3eebf2d58129c507535c8ab2622d1094a3
Opcode Fuzzy Hash: dbde64bc3a376ab52a9cb3762a64ce6a0c2f330f4a95e62c6433b020d27b21d7
Instruction Fuzzy Hash: 4F61D670204200AED620AF65AD45F3B3A7CEB8574AF41453FF951B62E2CB7D9D028B6D

Function 00402F5C Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F70
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\5371.exe,00000400), ref: 00402F8C

Part of subcall function 00405F1B: GetFileAttributesA.KERNEL32(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\5371.exe,80000000,00000003), ref: 00405F1F
Part of subcall function 00405F1B: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\5371.exe,C:\Users\user\AppData\Local\Temp\5371.exe,80000000,00000003), ref: 00402FD5
GlobalAlloc.KERNEL32(00000040,00000009), ref: 00403117

Strings

Error launching installer, xrefs: 00402FAC
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 004031AE
soft, xrefs: 0040304A
C:\Users\user\AppData\Local\Temp, xrefs: 00402FB7, 00402FBC, 00402FC2
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F66, 0040312F
C:\Users\user\AppData\Local\Temp\5371.exe, xrefs: 00402F76, 00402F85, 00402F99, 00402FB6
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403160
Null, xrefs: 00403053
Inst, xrefs: 00403041
C:\Users\user\AppData\Local\Temp\5371.exe, xrefs: 00402F65

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\5371.exe$C:\Users\user\AppData\Local\Temp\5371.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-2273052024
Opcode ID: 948897f0a7bf445ed3fd87f3f97ca94f99971360adfd1b44ac20b9f0a6b79c08
Instruction ID: 8a05da1d373fd2b3e089436e62a275652004ed3b6aa6cfe031be989f12afac8e
Opcode Fuzzy Hash: 948897f0a7bf445ed3fd87f3f97ca94f99971360adfd1b44ac20b9f0a6b79c08
Instruction Fuzzy Hash: 0771E231A01218ABDB20EF65DD85B9E7BACEB44356F10813BF910BA2C1D77C9E458B5C

Function 00405FF1 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 129
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00406182,?,?), ref: 00406022
GetShortPathNameA.KERNEL32(?,NUL,00000400), ref: 0040602B

Part of subcall function 00405E80: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E90
Part of subcall function 00405E80: lstrlenA.KERNEL32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EC2

GetShortPathNameA.KERNEL32(?,C:\Windows\wininit.ini,00000400), ref: 00406048
wsprintfA.USER32 ref: 00406066
GetFileSize.KERNEL32(00000000,00000000,C:\Windows\wininit.ini,C0000000,00000004,C:\Windows\wininit.ini,?,?,?,?,?), ref: 004060A1
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060B0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060E8
SetFilePointer.KERNEL32(0040A3F0,00000000,00000000,00000000,00000000,NUL=C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\,00000000,-0000000A,0040A3F0,00000000,[Rename],00000000,00000000,00000000), ref: 0040613E
GlobalFree.KERNEL32(00000000), ref: 0040614F
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406156

Part of subcall function 00405F1B: GetFileAttributesA.KERNEL32(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\5371.exe,80000000,00000003), ref: 00405F1F
Part of subcall function 00405F1B: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

Strings

NUL=C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\, xrefs: 00406061, 0040612D
NUL, xrefs: 00406010, 00406029, 0040605B
[Rename], xrefs: 004060D0, 004060E2
%s=%s, xrefs: 0040605C
C:\Windows\wininit.ini, xrefs: 0040603D, 00406043, 0040605A, 0040607C, 00406089

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$C:\Windows\wininit.ini$NUL$NUL=C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\$[Rename]
API String ID: 2171350718-520004643
Opcode ID: 2ac8773abaa14c2605e43abf0f292608002e21a2c197761b550c40717a00d302
Instruction ID: 7566a5a9e9d08134d14435fb5d3e1561ad96112206bac95af022f508aac3f812
Opcode Fuzzy Hash: 2ac8773abaa14c2605e43abf0f292608002e21a2c197761b550c40717a00d302
Instruction Fuzzy Hash: 68310531200715BBC2207B659D49F6B3A5DDF85754F15003EFE42BA2C3EA7CD8228AAD

Function 0040641B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(C:\Windows\wininit.ini,00000400), ref: 00406549
GetWindowsDirectoryA.KERNEL32(C:\Windows\wininit.ini,00000400,?,00420530,00000000,004054E1,00420530,00000000), ref: 0040655C
SHGetSpecialFolderLocation.SHELL32(004054E1,00000000,?,00420530,00000000,004054E1,00420530,00000000), ref: 00406598
SHGetPathFromIDListA.SHELL32(00000000,C:\Windows\wininit.ini), ref: 004065A6
CoTaskMemFree.OLE32(00000000), ref: 004065B2
lstrcatA.KERNEL32(C:\Windows\wininit.ini,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D6
lstrlenA.KERNEL32(C:\Windows\wininit.ini,?,00420530,00000000,004054E1,00420530,00000000,00000000,00000000,00000000), ref: 00406628

Strings

C:\Windows\wininit.ini, xrefs: 00406445, 00406515, 00406516, 00406517, 00406533, 00406548, 0040655B, 00406577, 004065A2, 004065D5, 004065DB, 004065F3, 00406606, 00406621, 00406627, 0040662F, 00406659
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D0
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406518

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: C:\Windows\wininit.ini$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1428620962
Opcode ID: 28fe3fa0c873c230fa859cbc890347587b683f5d94c1146f2a959db860f2b1f6
Instruction ID: f38e20b3a3e0c1a2470d5ac0c6d90f06be75126661b475aa23e0086d5b044b98
Opcode Fuzzy Hash: 28fe3fa0c873c230fa859cbc890347587b683f5d94c1146f2a959db860f2b1f6
Instruction Fuzzy Hash: 9F612370900114AEDF205F24EC90BBA3BA4EB52314F52403FE913B62D1D37D8A62DB4E

Function 00401759 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Roaming\GamePall\update,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,00000000,00000000,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Roaming\GamePall\update,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00406388: lstrcpynA.KERNEL32(0000000B,0000000B,00000400,0040366F,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406395

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Strings

C:\Users\user\AppData\Roaming\GamePall\update, xrefs: 00401786
C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\INetC.dll, xrefs: 00401826, 00401842
C:\Users\user\AppData\Local\Temp\setup.exe, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\INetC.dll$C:\Users\user\AppData\Local\Temp\setup.exe$C:\Users\user\AppData\Roaming\GamePall\update
API String ID: 1941528284-3750099715
Opcode ID: 531cf43c35c58c4dd4a4f90f95c8ebf7c3fa560a9c590302947909e1ab3ecca7
Instruction ID: 0d76be79c55a0237b493b10f9ec5be6125ba7ce9be49b25e4c886387d44134cc
Opcode Fuzzy Hash: 531cf43c35c58c4dd4a4f90f95c8ebf7c3fa560a9c590302947909e1ab3ecca7
Instruction Fuzzy Hash: E141B731900615BBCB107BB5CC45DAF3668EF45329B61833BF422F10E1D67C8A529AAE

Function 00406726 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040673D
wsprintfA.USER32 ref: 00406776
LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 0040678A

Strings

%s%s.dll, xrefs: 00406770
UXTHEME, xrefs: 0040672F
\, xrefs: 0040674E

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
Instruction ID: 0c3db372634d2cfba6f48721b0c795b31ebca02323a8b7d7371d162bf0ec7b9a
Opcode Fuzzy Hash: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
Instruction Fuzzy Hash: FBF0FC7050021966DB15A764DD0DFEA365CAB08309F1404BEA586E20C1D6B8D5258B69

Function 004068D9 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o be not permitted or dropped out!Please reconnect and click Retry to resume installation., xrefs: 004068E3

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID:
String ID: o be not permitted or dropped out!Please reconnect and click Retry to resume installation.
API String ID: 0-292220189
Opcode ID: 9b20245c0637e97ad79b0c04fd837c43a33b4178456ec09291c35722496dfe88
Instruction ID: 8182d74baebb800b0d472bca2432a1a472ea96a2662ae7b36db949844af6c4d7
Opcode Fuzzy Hash: 9b20245c0637e97ad79b0c04fd837c43a33b4178456ec09291c35722496dfe88
Instruction Fuzzy Hash: DF815971E04228DBEF24CFA8C844BADBBB1FF44305F10816AD956BB281C7786986DF45

Function 00403305 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403319

Part of subcall function 00403484: SetFilePointer.KERNEL32(00000000,00000000,00000000,00403182,?), ref: 00403492

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,0040322F,00000004,00000000,00000000,0000000B,?,004031A9,000000FF,00000000,00000000,00000009,?), ref: 0040334C
SetFilePointer.KERNEL32(?,00000000,00000000,o be not permitted or dropped out!Please reconnect and click Retry to resume installation.,00004000,?,00000000,0040322F,00000004,00000000,00000000,0000000B,?,004031A9,000000FF,00000000), ref: 00403447

Strings

o be not permitted or dropped out!Please reconnect and click Retry to resume installation., xrefs: 00403379, 0040337F

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: o be not permitted or dropped out!Please reconnect and click Retry to resume installation.
API String ID: 1092082344-292220189
Opcode ID: f3fd145fe371a3aefb2ec72eaaf4336e3a5ddfe71b6918c4f9f269c5704fa6fa
Instruction ID: 5f41a1ef9683aad456499e8308d87ccfcfa217f8aa92108fcff4f05b83e24891
Opcode Fuzzy Hash: f3fd145fe371a3aefb2ec72eaaf4336e3a5ddfe71b6918c4f9f269c5704fa6fa
Instruction Fuzzy Hash: 1F319F72A002059FC711BF2AFE849663BACE741356710C13BE814B62F0CB3859458FAD

Function 00405F4A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F5E
GetTempFileNameA.KERNEL32(0000000B,?,00000000,?,?,004034CA,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007), ref: 00405F78

Strings

nsa, xrefs: 00405F55
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F4D

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-44229769
Opcode ID: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
Instruction ID: 05c77450f8afc2c62a5a11a921c51d956a1ea51751b09822177720344b0c8500
Opcode Fuzzy Hash: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
Instruction Fuzzy Hash: 02F082363042087BDB109F55DD44BAB7B9CDF91750F14C03BFE48DA180D6B4D9988798

Function 004020A5 Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 004020D0

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 004020E0
GetProcAddress.KERNEL32(00000000,?), ref: 004020F0
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040215A

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 55027bfb1e7038bef75906a0c7732c3b75841ebb17574d5b7e2f6ee6ad6aef08
Instruction ID: efc1da79dccaef9ffb2761d2644f5cd4432d5c2edc08e83b6cf0327c91c21bf2
Opcode Fuzzy Hash: 55027bfb1e7038bef75906a0c7732c3b75841ebb17574d5b7e2f6ee6ad6aef08
Instruction Fuzzy Hash: 2B210832904214E7CF207FA58E4DAAE3A60AF44358F60413FF601B61E0DBBD49819A6E

Function 00403A7C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,004038B3,?,?,00000007,00000009,0000000B), ref: 00403A8E
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,004038B3,?,?,00000007,00000009,0000000B), ref: 00403AA2

Strings

C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\, xrefs: 00403AB2
C:\Users\user\AppData\Local\Temp\, xrefs: 00403A81

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\
API String ID: 2962429428-4161133411
Opcode ID: 860558c91a71a64e21cfc04441b923a48857e57a960d7bb4a44cdc910ceccc08
Instruction ID: f2bf129958ed6937e4157d035670f95a6da1e01cb45a681b65e96f9405f647bf
Opcode Fuzzy Hash: 860558c91a71a64e21cfc04441b923a48857e57a960d7bb4a44cdc910ceccc08
Instruction Fuzzy Hash: F4E08631640B1896C130EF7CAD4D8853B189B413357204726F1B9F20F0C738A9574EE9

Function 004031FD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000009,00000000,00000000,00000000,00000000,0000000B,?,004031A9,000000FF,00000000,00000000,00000009,?), ref: 00403222

Strings

o be not permitted or dropped out!Please reconnect and click Retry to resume installation., xrefs: 00403277, 0040328E, 004032A4

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: FilePointer
String ID: o be not permitted or dropped out!Please reconnect and click Retry to resume installation.
API String ID: 973152223-292220189
Opcode ID: 966fed337372371c4087f3b005d0b036fc883b56c67f04ec2e368497ceacb8e7
Instruction ID: 301e065564a74905a78554ad982773151ad037ba2d6e6f8d8cd401a7b941de18
Opcode Fuzzy Hash: 966fed337372371c4087f3b005d0b036fc883b56c67f04ec2e368497ceacb8e7
Instruction Fuzzy Hash: E2318D30200219FFDB109F95ED45A9A3FA8EB05755B20847EB914E61D0D738DB509FA9

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00405DB3: CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0,C:\Users\user\AppData\Local\Temp\5371.exe), ref: 00405DC1
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DC6
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DDA

GetFileAttributesA.KERNEL32(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 0040596F: CreateDirectoryA.KERNEL32(?,0000000B,C:\Users\user\AppData\Local\Temp\), ref: 004059B2

SetCurrentDirectoryA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\GamePall\update,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\AppData\Roaming\GamePall\update, xrefs: 00401631

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\GamePall\update
API String ID: 1892508949-2725132131
Opcode ID: f3ba161a3ac08c4a0fb9ad52a50d0308f78dcdedc211e6075dac0401aebdcf48
Instruction ID: f3b3600b6319d637c5497ea1020ed17c5aedac6227b62b2eaa768bc98e31f113
Opcode Fuzzy Hash: f3ba161a3ac08c4a0fb9ad52a50d0308f78dcdedc211e6075dac0401aebdcf48
Instruction Fuzzy Hash: 09115731508140EBCF306FA54D405BF23B09E96324B28453FF8D1B22E2DA3D0C42AA3E

Function 00405E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406388: lstrcpynA.KERNEL32(0000000B,0000000B,00000400,0040366F,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406395

Part of subcall function 00405DB3: CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0,C:\Users\user\AppData\Local\Temp\5371.exe), ref: 00405DC1
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DC6
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DDA

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0,C:\Users\user\AppData\Local\Temp\5371.exe), ref: 00405E5B
GetFileAttributesA.KERNEL32(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0), ref: 00405E6B

Strings

C:\, xrefs: 00405E0E, 00405E13, 00405E19, 00405E54, 00405E5A, 00405E62, 00405E6A

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 9b5a40e36fb6d6325312229f101030c034a2baba4673648e7d7a04b0a2ff685f
Instruction ID: eca821d8ca18e415d707ee210574ba5bb9731226a542ad11e9256983d04766a4
Opcode Fuzzy Hash: 9b5a40e36fb6d6325312229f101030c034a2baba4673648e7d7a04b0a2ff685f
Instruction Fuzzy Hash: F7F02831105D5116C6223336AD09AAF1644CE9732471A453FFCE1B52D2DB3C8A539CEE

Function 00406EBD Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3294aed7e6278100db64414b9f116292b07b09feaa7d8b5145f731feae0eba26
Instruction ID: 14484b0326c8a5630d33184448731c7578348ec986130544f859662fecd3ad08
Opcode Fuzzy Hash: 3294aed7e6278100db64414b9f116292b07b09feaa7d8b5145f731feae0eba26
Instruction Fuzzy Hash: 04A12471E04229CBDF28CFA8C844BADBBB1FF44305F14816AD956BB281C7786986DF45

Function 004070BE Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e067d77b8d7a9b68dd685dca04d3d71c5ee3b4c66787705bfaaaffb075589f
Instruction ID: 16a3963220edad981734dfbd86db7ae4535d0e52bcc7a87e0ef86c627c8cfaa4
Opcode Fuzzy Hash: 74e067d77b8d7a9b68dd685dca04d3d71c5ee3b4c66787705bfaaaffb075589f
Instruction Fuzzy Hash: 2D912370D04268CBDF28CF98C854BADBBB1FF44305F14816AD956BB281C7786986DF45

Function 00406DD4 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffa2499bf387f79f1209cac769e5c71ba3d3f6d53411ba5d370abef73c06fe0
Instruction ID: e981be8a744509f315cfd76b32476d9c10b76e0a4aa84739a8d113cb33934a41
Opcode Fuzzy Hash: 7ffa2499bf387f79f1209cac769e5c71ba3d3f6d53411ba5d370abef73c06fe0
Instruction Fuzzy Hash: 37812471E04228CBDF24CFA8C844BADBBB1FF45305F24816AD856BB291C7789986DF45

Function 00406D27 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d628358dfeac25ccb8ac491a47a372453481bb06581bffe716440ea5054c50f9
Instruction ID: 516ab04208dd2bc2fd7cdea6c41d3130492ff38fa800e35acf718bd73fbf6333
Opcode Fuzzy Hash: d628358dfeac25ccb8ac491a47a372453481bb06581bffe716440ea5054c50f9
Instruction Fuzzy Hash: A4712271E04228CBDF24CF98C844BADBBB1FF48305F14806AD856BB281C778A986DF45

Function 00406E45 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8eb04bd933ca205c297744f59a7b7035fe2e59d11d29800bf5f20fbdb1e525a
Instruction ID: 835baf8de871759411e2c74e4a47f0112f02d54065241c3c7dcda5dc236b3f46
Opcode Fuzzy Hash: e8eb04bd933ca205c297744f59a7b7035fe2e59d11d29800bf5f20fbdb1e525a
Instruction Fuzzy Hash: 92712571E04228CBEF28CF98C844BADBBB1FF44305F15816AD856BB281C7786996DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed70085a56e3aedeea153169e26c1aa9cf9d7e4654945abbe59913f8bdc615b9
Instruction ID: ccec74d0ee3a806077926e8984c2e201e8b1f3d886c73ab216be699138b2bca7
Opcode Fuzzy Hash: ed70085a56e3aedeea153169e26c1aa9cf9d7e4654945abbe59913f8bdc615b9
Instruction Fuzzy Hash: 39715771E04228CBEF28CF98C844BADBBB1FF44305F14806AD956BB281C778A946DF45

Function 0040247E Relevance: 4.6, APIs: 3, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0040AC20,00000023,00000011,00000002), ref: 004024C9
RegSetValueExA.KERNEL32(?,?,?,?,0040AC20,00000000,00000011,00000002), ref: 00402509
RegCloseKey.KERNEL32(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: CloseValuelstrlen
String ID:
API String ID: 2655323295-0
Opcode ID: ef8eeb58056491ee092ed80bef3546efe310264daaab0f586760f51b4d92765b
Instruction ID: e1e6ae2a7b536448810537a1ffa9a52b32d6c636ce9630cd27147c6707bb0a71
Opcode Fuzzy Hash: ef8eeb58056491ee092ed80bef3546efe310264daaab0f586760f51b4d92765b
Instruction Fuzzy Hash: 04116371E04208AFEB10AFA5DE49AAEBA74EB84714F21443BF504F71C1DAB94D409B68

Function 00402590 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025C2
RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 004025D5
RegCloseKey.KERNEL32(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 705f8b49631554dcec7b4eb98624595070a3904998d9344154508b49de78e75c
Instruction ID: 33ff3e85e785963e302667c06a3cb1355a7acd8bf142a31c2560ef5bcfc7d759
Opcode Fuzzy Hash: 705f8b49631554dcec7b4eb98624595070a3904998d9344154508b49de78e75c
Instruction Fuzzy Hash: 2C017571904104FFE7158F54DE88ABF7BACEF81358F20443EF101A61C0DAB44E449679

Function 00405B02 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405EF6: GetFileAttributesA.KERNEL32(?,?,00405B0E,?,?,00000000,00405CF1,?,?,?,?), ref: 00405EFB
Part of subcall function 00405EF6: SetFileAttributesA.KERNEL32(?,00000000), ref: 00405F0F

RemoveDirectoryA.KERNEL32(?,?,?,00000000,00405CF1), ref: 00405B1D
DeleteFileA.KERNEL32(?,?,?,00000000,00405CF1), ref: 00405B25
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405B3D

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: fdbfe47bebcd8a5232fcae5ebebd8a359ed736e28fe734178b51a2620122945d
Instruction ID: eeb49a2f717892c2e0964ab94aaac89db2a73fdd151ed94c70539e0cf44bba43
Opcode Fuzzy Hash: fdbfe47bebcd8a5232fcae5ebebd8a359ed736e28fe734178b51a2620122945d
Instruction Fuzzy Hash: 6CE0E531109A9097C62067349908A5B7AF8EF86314F094D3AF9A1F20D0DB38B9468EBD

Function 00406809 Relevance: 4.5, APIs: 3, Instructions: 27synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000064), ref: 0040681A
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 0040682F
GetExitCodeProcess.KERNEL32(?,?), ref: 0040683C

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: ObjectSingleWait$CodeExitProcess
String ID:
API String ID: 2567322000-0
Opcode ID: d1ff3f73a38d8d565191ded27fad29c52e1940f561348969c9200a5cb4687b78
Instruction ID: abee92fc01d0549169be82d64ea8a54f8020188e09ec540bf7ef67874f21f581
Opcode Fuzzy Hash: d1ff3f73a38d8d565191ded27fad29c52e1940f561348969c9200a5cb4687b78
Instruction Fuzzy Hash: 9DE0D832600118FBDB00AB54DD05E9E7F6EEB44704F114033F601B6190C7B59E21DB98

Function 00405F93 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000009,00000000,00000000,00000000,00000000,o be not permitted or dropped out!Please reconnect and click Retry to resume installation.,0040B8F8,00403481,00000009,00000009,00403385,o be not permitted or dropped out!Please reconnect and click Retry to resume installation.,00004000,?,00000000,0040322F), ref: 00405FA7

Strings

o be not permitted or dropped out!Please reconnect and click Retry to resume installation., xrefs: 00405F96

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: FileRead
String ID: o be not permitted or dropped out!Please reconnect and click Retry to resume installation.
API String ID: 2738559852-292220189
Opcode ID: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
Instruction ID: 61a6516da629700e98a59d605e8380186fb5f41ecf47873683bd74a9a2ef61d4
Opcode Fuzzy Hash: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
Instruction Fuzzy Hash: 8BE08C3220161EEBEF119E508C00AEBBB6CEB00360F004433FD25E3140E234E9218BA8

Function 0040251E Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,00000000,?,?,?,?), ref: 0040254E
RegCloseKey.KERNEL32(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: acecc3e732b5dbd74a9740bd21ea2b495ff764a52a6e8e2361329d984987feff
Instruction ID: 7c766f3f1fb2abd04e903467a79d83897fdaad9d0bba0580308fe752c8381985
Opcode Fuzzy Hash: acecc3e732b5dbd74a9740bd21ea2b495ff764a52a6e8e2361329d984987feff
Instruction Fuzzy Hash: 1B11BF71905205EFDB25CF64DA985AE7BB4AF11355F20483FE042B72C0D6B88A85DA1D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 04d136d289144069680b1fecce7da664cc2fd5e0b622116f853907ec40370e1b
Instruction ID: c6e23866af321c238b4b59365f681da1ab702c54c00e726fca3ee5b0521d1f72
Opcode Fuzzy Hash: 04d136d289144069680b1fecce7da664cc2fd5e0b622116f853907ec40370e1b
Instruction Fuzzy Hash: 5201D131B242109BE7194B38AE04B2A36A8E754315F51813AF851F61F1DB78CC129B4D

Function 00405A21 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422558,00000009,00000009,0000000B), ref: 00405A4A
CloseHandle.KERNEL32(?), ref: 00405A57

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
Instruction ID: 70dcd79ab4e1e9e84cc9ba673cd08f466e07e48f17d85ed3475224309c024e1a
Opcode Fuzzy Hash: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
Instruction Fuzzy Hash: A5E04FB4600209BFEB009B64ED09F7B77ACFB04244F808421BE40F2150D67899658A78

Function 00406794 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000000,?,0040360E,0000000B), ref: 004067A6
GetProcAddress.KERNEL32(00000000,?), ref: 004067C1

Part of subcall function 00406726: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040673D
Part of subcall function 00406726: wsprintfA.USER32 ref: 00406776
Part of subcall function 00406726: LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 0040678A

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: c54c0e861ed706937e547878721e8d44c7a1bbc080d115c20b20089ef5e69713
Instruction ID: 2a593beb9babc16b4b5ae8275dbdfb46ef4ebf17ea7291b62b5d373670c31446
Opcode Fuzzy Hash: c54c0e861ed706937e547878721e8d44c7a1bbc080d115c20b20089ef5e69713
Instruction Fuzzy Hash: B6E0863260421157D21067705E4897773ACAF94B54302043EF546F3144D7389C76966D

Function 00405F1B Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\5371.exe,80000000,00000003), ref: 00405F1F
CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
Instruction ID: c1cd633b288b309c16b37b55694bd397a2d2f3fd27c3ea135bedd35eac3c4d3c
Opcode Fuzzy Hash: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
Instruction Fuzzy Hash: D9D09E31254602AFEF0D8F20DE16F2E7AA2EB84B00F11952CB682944E2DA715819AB19

Function 00405EF6 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,00405B0E,?,?,00000000,00405CF1,?,?,?,?), ref: 00405EFB
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405F0F

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7db639ec3fc6e9a5b47d3eb1dfb332e917e8410632ca84ceba79978e33b6a3d0
Instruction ID: 2a9487917742c73a52daa6fa2dda6e447083e2efb983b62a69771bacbdb33add
Opcode Fuzzy Hash: 7db639ec3fc6e9a5b47d3eb1dfb332e917e8410632ca84ceba79978e33b6a3d0
Instruction Fuzzy Hash: E3D0C972504422ABD2102728AE0889BBB55DB94271702CA35FDA5A26F1DB304C569A9C

Function 004059EC Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000,004034BF,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004059F2
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 00405A00

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
Instruction ID: 42ce2bd36b25b14d2ed8d631edf33fc643f4c4eb5ed9af5e51ab4a49ffb09bba
Opcode Fuzzy Hash: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
Instruction Fuzzy Hash: 9BC04C303145419AD6505B309F4DB177A54AB50741F51553A638AE01A0DA348465DD2D

Function 10001426 Relevance: 2.5, APIs: 2, Instructions: 29stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,10003024,?,10003020,1000138F,10003020,00000400), ref: 10001454
GlobalFree.KERNELBASE(10003020), ref: 10001464

Memory Dump Source

Source File: 00000008.00000002.4003779869.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4003730902.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4003860905.0000000010002000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4003911865.0000000010004000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_5371.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID:
API String ID: 1459762280-0
Opcode ID: d37c7429f21efaa5103ac68eecef2f505b672404a3497301ec3293a1c9b8d6fd
Instruction ID: 61cff6a9ed434c6726c3e265b98623322506fe6e864b2b4fb358a1092e6d6a6c
Opcode Fuzzy Hash: d37c7429f21efaa5103ac68eecef2f505b672404a3497301ec3293a1c9b8d6fd
Instruction Fuzzy Hash: 8DF0F8312152209FE315DF24CC94B9777E9FB0A385F018429E691C7278D770E804CB22

Function 0040623C Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CEA,00000000,?,?), ref: 00406265

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction ID: 57b18be241489d6c3509c0f1b2cb500900bdd64e2c84313365475615acd8ae2e
Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction Fuzzy Hash: 16E0E672010109BEDF196F50DD0AD7B371DEB04341F01492EF916D4091E6B5A9309734

Function 00405FC2 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000009,00000000,00000000,00000000,00000000,004114F7,0040B8F8,00403405,0040B8F8,004114F7,o be not permitted or dropped out!Please reconnect and click Retry to resume installation.,00004000,?,00000000,0040322F,00000004), ref: 00405FD6

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: d5187e51ab0d96a1766449b5dbb93cac2cdd9e80b7d20ab2fc0b5d8c8d5322e8
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: 4AE0EC3221065BABDF109E659C04EEB7B6CEB05360F004437FA55E3150D675E8219BA4

Function 0040620E Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(00000000,?,00000000,?,?,00420530,?,?,0040629C,00420530,?,?,?,00000002,C:\Windows\wininit.ini), ref: 00406232

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction ID: e678259d492eddc69303d735af6c58fa5eb03465f078c5ba6a1a088e01eebb4c
Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction Fuzzy Hash: 64D0123244020DBBDF116F90ED01FAB3B1DEB18350F014826FE06A80A1D775D530A725

Function 00406161 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

MoveFileExA.KERNEL32(?,?,00000005(MOVEFILE_REPLACE_EXISTING|MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0040616B

Part of subcall function 00405FF1: CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00406182,?,?), ref: 00406022
Part of subcall function 00405FF1: GetShortPathNameA.KERNEL32(?,NUL,00000400), ref: 0040602B
Part of subcall function 00405FF1: GetShortPathNameA.KERNEL32(?,C:\Windows\wininit.ini,00000400), ref: 00406048
Part of subcall function 00405FF1: wsprintfA.USER32 ref: 00406066
Part of subcall function 00405FF1: GetFileSize.KERNEL32(00000000,00000000,C:\Windows\wininit.ini,C0000000,00000004,C:\Windows\wininit.ini,?,?,?,?,?), ref: 004060A1
Part of subcall function 00405FF1: GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060B0
Part of subcall function 00405FF1: lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060E8
Part of subcall function 00405FF1: SetFilePointer.KERNEL32(0040A3F0,00000000,00000000,00000000,00000000,NUL=C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\,00000000,-0000000A,0040A3F0,00000000,[Rename],00000000,00000000,00000000), ref: 0040613E
Part of subcall function 00405FF1: GlobalFree.KERNEL32(00000000), ref: 0040614F

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: File$GlobalNamePathShort$AllocCloseFreeHandleMovePointerSizelstrcpywsprintf
String ID:
API String ID: 299535525-0
Opcode ID: e5ed7b2843c229ea28ef8c1ce415cb2f1f2a9dfc0e88d0e1822b60b3228602b1
Instruction ID: 0556bd0dd0e376f9d1944fcc72f0db357db156cd0d89a75f2f72d3c973fa690a
Opcode Fuzzy Hash: e5ed7b2843c229ea28ef8c1ce415cb2f1f2a9dfc0e88d0e1822b60b3228602b1
Instruction Fuzzy Hash: F0D0C731108602FFDB111B10ED0591B7BA5FF90355F11943EF599940B1DB368461DF09

Function 00403484 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00403182,?), ref: 00403492

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction ID: eadcf480fe67690f272c505b4903882a1233053cb438a9b9796e5ea94341b5dd
Opcode Fuzzy Hash: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction Fuzzy Hash: 25B09231140200AADA215F409E09F057B21AB94700F208424B244280F086712025EA0D

Function 00401F7B Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Part of subcall function 00405A21: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422558,00000009,00000009,0000000B), ref: 00405A4A
Part of subcall function 00405A21: CloseHandle.KERNEL32(?), ref: 00405A57

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FC0

Part of subcall function 00406809: WaitForSingleObject.KERNEL32(?,00000064), ref: 0040681A
Part of subcall function 00406809: GetExitCodeProcess.KERNEL32(?,?), ref: 0040683C

Part of subcall function 004062E6: wsprintfA.USER32 ref: 004062F3

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 5a6c6c0fb7ef29f4985f4766a88127bea2ca1a19b834f4a1a12170b8a3b172af
Instruction ID: dce1314ccbc215d7d9c334b017be086f7c4cc40ba0f87dfe0d8145fd67a5eb82
Opcode Fuzzy Hash: 5a6c6c0fb7ef29f4985f4766a88127bea2ca1a19b834f4a1a12170b8a3b172af
Instruction Fuzzy Hash: 2DF0B432A05121DBDB20BFA59EC49EEB2A4DF41318B25463FF502B21D1CB7C4D418A6E

Non-executed Functions

Function 004055E7 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405646
GetDlgItem.USER32(?,000003EE), ref: 00405655
GetClientRect.USER32(?,?), ref: 00405692
GetSystemMetrics.USER32(00000002), ref: 00405699
SendMessageA.USER32(?,0000101B,00000000,?), ref: 004056BA
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004056CB
SendMessageA.USER32(?,00001001,00000000,?), ref: 004056DE
SendMessageA.USER32(?,00001026,00000000,?), ref: 004056EC
SendMessageA.USER32(?,00001024,00000000,?), ref: 004056FF
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405721
ShowWindow.USER32(?,00000008), ref: 00405735
GetDlgItem.USER32(?,000003EC), ref: 00405756
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405766
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040577F
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 0040578B
GetDlgItem.USER32(?,000003F8), ref: 00405664

Part of subcall function 0040443A: SendMessageA.USER32(00000028,?,00000001,0040426A), ref: 00404448

GetDlgItem.USER32(?,000003EC), ref: 004057A7
CreateThread.KERNEL32(00000000,00000000,Function_0000557B,00000000), ref: 004057B5
CloseHandle.KERNEL32(00000000), ref: 004057BC
ShowWindow.USER32(00000000), ref: 004057DF
ShowWindow.USER32(?,00000008), ref: 004057E6
ShowWindow.USER32(00000008), ref: 0040582C
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405860
CreatePopupMenu.USER32 ref: 00405871
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405886
GetWindowRect.USER32(?,000000FF), ref: 004058A6
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004058BF
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004058FB
OpenClipboard.USER32(00000000), ref: 0040590B
EmptyClipboard.USER32 ref: 00405911
GlobalAlloc.KERNEL32(00000042,?), ref: 0040591A
GlobalLock.KERNEL32(00000000), ref: 00405924
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405938
GlobalUnlock.KERNEL32(00000000), ref: 00405951
SetClipboardData.USER32(00000001,00000000), ref: 0040595C
CloseClipboard.USER32 ref: 00405962

Strings

PB, xrefs: 004058D7

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: PB
API String ID: 590372296-3196168531
Opcode ID: 463c74343dc9a7e994e8db0b260deb87a45ca3f66d4da0101cb89f9be381629f
Instruction ID: 44a2cb424ceca129f1c721a27905a8e57bc1109532c064cce4e419f7e60c3497
Opcode Fuzzy Hash: 463c74343dc9a7e994e8db0b260deb87a45ca3f66d4da0101cb89f9be381629f
Instruction Fuzzy Hash: 18A13971900608FFDB11AF64DE85AAE7BB9FB48355F00403AFA41BA1A0CB754E51DF58

Function 00404897 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004048E6
SetWindowTextA.USER32(00000000,?), ref: 00404910
SHBrowseForFolderA.SHELL32(?,00420128,?), ref: 004049C1
CoTaskMemFree.OLE32(00000000), ref: 004049CC
lstrcmpiA.KERNEL32(C:\Windows\wininit.ini,00420D50), ref: 004049FE
lstrcatA.KERNEL32(?,C:\Windows\wininit.ini), ref: 00404A0A
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404A1C

Part of subcall function 00405A82: GetDlgItemTextA.USER32(?,?,00000400,00404A53), ref: 00405A95

Part of subcall function 00406666: CharNextA.USER32(0000000B,*?|<>/":,00000000,?,75923410,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\5371.exe,004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066BE
Part of subcall function 00406666: CharNextA.USER32(0000000B,0000000B,0000000B,00000000,?,75923410,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\5371.exe,004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066CB
Part of subcall function 00406666: CharNextA.USER32(0000000B,?,75923410,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\5371.exe,004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066D0
Part of subcall function 00406666: CharPrevA.USER32(0000000B,0000000B,75923410,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\5371.exe,004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066E0

GetDiskFreeSpaceA.KERNEL32(0041FD20,?,?,0000040F,?,0041FD20,0041FD20,?,00000001,0041FD20,?,?,000003FB,?), ref: 00404ADA
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AF5

Part of subcall function 00404C4E: lstrlenA.KERNEL32(00420D50,00420D50,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404B69,000000DF,00000000,00000400,?), ref: 00404CEC
Part of subcall function 00404C4E: wsprintfA.USER32 ref: 00404CF4
Part of subcall function 00404C4E: SetDlgItemTextA.USER32(?,00420D50), ref: 00404D07

Strings

C:\Windows\wininit.ini, xrefs: 004049F8, 004049FD, 00404A08
C:\Users\user\AppData\Roaming\GamePall, xrefs: 004049E7
PB, xrefs: 00404994
A, xrefs: 004049BA

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Roaming\GamePall$C:\Windows\wininit.ini$PB
API String ID: 2624150263-292181263
Opcode ID: 246729fcc772db5bb1fe110679472811f76dfb67008edee7d622b3e588ee8d40
Instruction ID: 03633cdec68ae3b48ba4c7d33c4768738bfb21d85bfcf2e4b9185cba9ee35c0f
Opcode Fuzzy Hash: 246729fcc772db5bb1fe110679472811f76dfb67008edee7d622b3e588ee8d40
Instruction Fuzzy Hash: 7DA150B1A00208AADB11EFA5DD45BAFB6B8EF84315F10803BF601B62D1D77C99418F6D

Function 00402173 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408418,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F8
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004022AA

Strings

C:\Users\user\AppData\Roaming\GamePall\update, xrefs: 00402238

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Roaming\GamePall\update
API String ID: 123533781-2725132131
Opcode ID: 975ab102bccf2e3ea3487b48f3b75e49990d828168e5a332ce340ef805c2210c
Instruction ID: 4a55140eb955682c0845ac661669d1effe53c60cfc8a987c49de3bb9103baba8
Opcode Fuzzy Hash: 975ab102bccf2e3ea3487b48f3b75e49990d828168e5a332ce340ef805c2210c
Instruction Fuzzy Hash: B2513575A00208AFDF10DFE4CA88A9D7BB5EF48314F2045BAF505EB2D1DA799981CB54

Function 004027AA Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 004027B9

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 3697544f2be0618a58616ff40495ed399055e36512a5e022deae8fba2564a7e1
Instruction ID: 9767438fe71d1176ff9aac627a01f72906af616df08219c0cc944b63bddc0547
Opcode Fuzzy Hash: 3697544f2be0618a58616ff40495ed399055e36512a5e022deae8fba2564a7e1
Instruction Fuzzy Hash: CCF0A0726082049AD710EBA49A49AEEB7689F51324F60057BF142F20C1D6B889459B2A

Function 00404E0A Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 491windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404E21
GetDlgItem.USER32(?,00000408), ref: 00404E2E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E7D
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404E94
SetWindowLongA.USER32(?,000000FC,0040541D), ref: 00404EAE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404EC0
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404ED4
SendMessageA.USER32(?,00001109,00000002), ref: 00404EEA
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404EF6
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404F06
DeleteObject.GDI32(00000110), ref: 00404F0B
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404F36
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404F42
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404FDC
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 0040500C

Part of subcall function 0040443A: SendMessageA.USER32(00000028,?,00000001,0040426A), ref: 00404448

SendMessageA.USER32(?,00001100,00000000,?), ref: 00405020
GetWindowLongA.USER32(?,000000F0), ref: 0040504E
SetWindowLongA.USER32(?,000000F0,00000000), ref: 0040505C
ShowWindow.USER32(?,00000005), ref: 0040506C
SendMessageA.USER32(?,00000419,00000000,?), ref: 00405167
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 004051CC
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 004051E1
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00405205
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00405225
ImageList_Destroy.COMCTL32(?), ref: 0040523A
GlobalFree.KERNEL32(?), ref: 0040524A
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 004052C3
SendMessageA.USER32(?,00001102,?,?), ref: 0040536C
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 0040537B
InvalidateRect.USER32(?,00000000,00000001), ref: 004053A6
ShowWindow.USER32(?,00000000), ref: 004053F4
GetDlgItem.USER32(?,000003FE), ref: 004053FF
ShowWindow.USER32(00000000), ref: 00405406

Strings

N, xrefs: 004050A5
M, xrefs: 00404FC4
, xrefs: 004053DE

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 4bb258af210f6716591e45ffd85afba0d9fc7d499c01c39e68e435e5f0500988
Instruction ID: c306c4130ea67d8582adb4b0d0e706bf782d7aff15223233fd0d43401108afdf
Opcode Fuzzy Hash: 4bb258af210f6716591e45ffd85afba0d9fc7d499c01c39e68e435e5f0500988
Instruction Fuzzy Hash: 6C025CB0A00609AFDB209F94DD45AAE7BB5FB84354F10817AF610BA2E1D7789D42CF58

Function 00403F0B Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403F47
ShowWindow.USER32(?), ref: 00403F67
GetWindowLongA.USER32(?,000000F0), ref: 00403F79
ShowWindow.USER32(?,00000004), ref: 00403F92
DestroyWindow.USER32 ref: 00403FA6
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403FBF
GetDlgItem.USER32(?,?), ref: 00403FDE
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403FF2
IsWindowEnabled.USER32(00000000), ref: 00403FF9
GetDlgItem.USER32(?,00000001), ref: 004040A4
GetDlgItem.USER32(?,00000002), ref: 004040AE
SetClassLongA.USER32(?,000000F2,?), ref: 004040C8
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00404119
GetDlgItem.USER32(?,00000003), ref: 004041BF
ShowWindow.USER32(00000000,?), ref: 004041E0
EnableWindow.USER32(?,?), ref: 004041F2
EnableWindow.USER32(?,?), ref: 0040420D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404223
EnableMenuItem.USER32(00000000), ref: 0040422A
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00404242
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00404255
lstrlenA.KERNEL32(00420D50,?,00420D50,00000000), ref: 0040427F
SetWindowTextA.USER32(?,00420D50), ref: 0040428E
ShowWindow.USER32(?,0000000A), ref: 004043C2

Strings

PB, xrefs: 0040426F

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID: PB
API String ID: 1860320154-3196168531
Opcode ID: a84a76c7c437068317dea6ec38f5a19867a10701d7094664a652b1a8aea3850c
Instruction ID: 6b3c419a8b2de2434844e8cd53afab52d63163afb5b1bd925d395a768d9dd0e6
Opcode Fuzzy Hash: a84a76c7c437068317dea6ec38f5a19867a10701d7094664a652b1a8aea3850c
Instruction Fuzzy Hash: ECC1D2B1A00204BBCB206F61EE45E2B3A78EB85745F41053EF781B61F1CB3998929B5D

Function 00404570 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004045FB
GetDlgItem.USER32(00000000,000003E8), ref: 0040460F
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040462D
GetSysColor.USER32(?), ref: 0040463E
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040464D
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040465C
lstrlenA.KERNEL32(?), ref: 0040465F
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 0040466E
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404683
GetDlgItem.USER32(?,0000040A), ref: 004046E5
SendMessageA.USER32(00000000), ref: 004046E8
GetDlgItem.USER32(?,000003E8), ref: 00404713
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404753
LoadCursorA.USER32(00000000,00007F02), ref: 00404762
SetCursor.USER32(00000000), ref: 0040476B
LoadCursorA.USER32(00000000,00007F00), ref: 00404781
SetCursor.USER32(00000000), ref: 00404784
SendMessageA.USER32(00000111,00000001,00000000), ref: 004047B0
SendMessageA.USER32(00000010,00000000,00000000), ref: 004047C4

Strings

N, xrefs: 00404701
6B, xrefs: 0040476F

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$6B
API String ID: 3103080414-649610290
Opcode ID: c874497606b373bfbb3475a273ba326ab034ae9c38f8566fe8320349c510c150
Instruction ID: 424ea1d81b5f8fd67bb79b8421ee67f108f717641e3cc5fc4ea293435da972af
Opcode Fuzzy Hash: c874497606b373bfbb3475a273ba326ab034ae9c38f8566fe8320349c510c150
Instruction Fuzzy Hash: CE6190B1A40208BFDB109F61DD45B6A7B69FB84715F10843AFB01BB2D1C7B8A951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00423F40,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: db458c2aac7b07c9de4f1dfd54ee4cc10e0d46da2aaa9c20a0cc65b716daa4c3
Instruction ID: bc851ab26da2bb863bf3a2ee07eb2f950de800ada4cbee7b2d64f78586a04119
Opcode Fuzzy Hash: db458c2aac7b07c9de4f1dfd54ee4cc10e0d46da2aaa9c20a0cc65b716daa4c3
Instruction Fuzzy Hash: 2C419D71800249AFCF058FA5DE459AF7FB9FF45314F00802AF991AA1A0C734DA55DFA4

Function 004054A9 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
SetWindowTextA.USER32(00420530,00420530), ref: 00405517
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Strings

4/@, xrefs: 004054EF, 00405501

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: 4/@
API String ID: 2531174081-3101945251
Opcode ID: 17623ae6e76ffa783ca229a28a88b1e205e4a8d30cb80da27a9000df8195634c
Instruction ID: 7ab3267fb946cf8e7efc5916356ec1270af3577e2396c2c3629ce5ef3fcb69de
Opcode Fuzzy Hash: 17623ae6e76ffa783ca229a28a88b1e205e4a8d30cb80da27a9000df8195634c
Instruction Fuzzy Hash: 0F217A71E00118BBCF119FA5DD8099EBFB9EF09354F04807AF944A6291C7788A90CFA8

Function 00406666 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(0000000B,*?|<>/":,00000000,?,75923410,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\5371.exe,004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066BE
CharNextA.USER32(0000000B,0000000B,0000000B,00000000,?,75923410,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\5371.exe,004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066CB
CharNextA.USER32(0000000B,?,75923410,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\5371.exe,004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066D0
CharPrevA.USER32(0000000B,0000000B,75923410,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\5371.exe,004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066E0

Strings

*?|<>/":, xrefs: 004066AE
C:\Users\user\AppData\Local\Temp\, xrefs: 00406667
C:\Users\user\AppData\Local\Temp\5371.exe, xrefs: 00406666

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\5371.exe
API String ID: 589700163-2011039210
Opcode ID: 6bc0e94b7f234696628355ee2fbbbdde5b7464ab094feb853247d74dffcc646e
Instruction ID: 80d428334b402c3338f843ea799862c1973996ffb1638880579f4ae0c72fc655
Opcode Fuzzy Hash: 6bc0e94b7f234696628355ee2fbbbdde5b7464ab094feb853247d74dffcc646e
Instruction Fuzzy Hash: 7E1108518047902DEB3206340C04B7B7F894F977A0F2A087FD8C6722C2D67E5C62967D

Function 00402EBD Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402ED5
GetTickCount.KERNEL32 ref: 00402EF3
wsprintfA.USER32 ref: 00402F21

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

CreateDialogParamA.USER32(0000006F,00000000,00402E25,00000000), ref: 00402F45
ShowWindow.USER32(00000000,00000005), ref: 00402F53

Part of subcall function 00402EA1: MulDiv.KERNEL32(?,00000064,?), ref: 00402EB6

Strings

... %d%%, xrefs: 00402F1B
#Vh%.@, xrefs: 00402F34

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%$#Vh%.@
API String ID: 722711167-1706192003
Opcode ID: db62a3d36480f0b73892ce8a9fc69f21d0c49374a29e778f3850d420ffd5c07d
Instruction ID: ac0ca11ee9366edb0cc6a28cc5aeb329eacd7d00ab00b3c3670f6d564c8935e4
Opcode Fuzzy Hash: db62a3d36480f0b73892ce8a9fc69f21d0c49374a29e778f3850d420ffd5c07d
Instruction Fuzzy Hash: 3F01A170542225EBCB21BB50EF0CBAB3778EB40744B04443BF505B21D0C7F894469AEE

Function 0040446C Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404489
GetSysColor.USER32(00000000), ref: 004044C7
SetTextColor.GDI32(?,00000000), ref: 004044D3
SetBkMode.GDI32(?,?), ref: 004044DF
GetSysColor.USER32(?), ref: 004044F2
SetBkColor.GDI32(?,?), ref: 00404502
DeleteObject.GDI32(?), ref: 0040451C
CreateBrushIndirect.GDI32(?), ref: 00404526

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: d8b0c4ae085d5752a0ceb3fd9c96bfdfa4daadee6b5f884e1a531c3ceae13210
Instruction ID: 76b6fc4927f6120469f5ffa52701fcd3ddd76896e52d32ad6f55637f73cee333
Opcode Fuzzy Hash: d8b0c4ae085d5752a0ceb3fd9c96bfdfa4daadee6b5f884e1a531c3ceae13210
Instruction Fuzzy Hash: 9E2147B1501704AFCB31DF68ED08B5BBBF8AF41715B04892EEA96A26E0D734E904CB54

Function 00404D58 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404D73
GetMessagePos.USER32 ref: 00404D7B
ScreenToClient.USER32(?,?), ref: 00404D95
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404DA7
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404DCD

Strings

f, xrefs: 00404DA9

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction ID: de178be9688f757f82ef56a4cbeb6693d0582b60b2ea90e1a00f6814b48fd044
Opcode Fuzzy Hash: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction Fuzzy Hash: BB014871900219BADB01DBA4DD85BFEBBF8AF95B11F10016ABA40B61C0C6B499058BA4

Function 0040596F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,0000000B,C:\Users\user\AppData\Local\Temp\), ref: 004059B2
GetLastError.KERNEL32 ref: 004059C6
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004059DB
GetLastError.KERNEL32 ref: 004059E5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405995
!9@, xrefs: 00405984

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: !9@$C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3700438604
Opcode ID: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
Instruction ID: 4cd508ff09270142ca7a6984d66ae253fefa4e1f6983b248f3af4f59f5a14231
Opcode Fuzzy Hash: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
Instruction Fuzzy Hash: 610108B1D00259DAEF109BA0CA45BEFBBB8EB04354F00403AD645B6290D7789648CF99

Function 00402E25 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E40
wsprintfA.USER32 ref: 00402E74
SetWindowTextA.USER32(?,?), ref: 00402E84
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402E96

Strings

unpacking data: %d%%, xrefs: 00402E62
verifying installer: %d%%, xrefs: 00402E69, 00402E72

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a45d99d8fe85d32cf27a6b993dcd334edf2177b7a3e8b64a3b444c48cc752336
Instruction ID: 7ad4584a5e884be7344c254f70e0401137e7e46ce86c3cf658bb2ab9d23be74a
Opcode Fuzzy Hash: a45d99d8fe85d32cf27a6b993dcd334edf2177b7a3e8b64a3b444c48cc752336
Instruction Fuzzy Hash: 1DF01D7054020DBAEF219F60DE0ABAE3769EB44344F00803AFA16B91D0DBB899558F99

Function 004027E8 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402849
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 00402865
GlobalFree.KERNEL32(?), ref: 004028A4
GlobalFree.KERNEL32(00000000), ref: 004028B7
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028D3
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028E6

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 89df3cefb7dd421bed2d3b7eed546734cb5ae329452e645b4cc4e6c356db934a
Instruction ID: cd924008ac91bdcd896aacfcc8aadc4f9c7de1b4393fc14a433ce499bdbf1d56
Opcode Fuzzy Hash: 89df3cefb7dd421bed2d3b7eed546734cb5ae329452e645b4cc4e6c356db934a
Instruction Fuzzy Hash: D931AC32800128ABDF216FA5DE49D9E7A75FF08364F24423AF450B62D0CB7949419F68

Function 1000103F Relevance: 9.1, APIs: 6, Instructions: 55synchronizationCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00100401,00000000,?,0000025E,?,00000000,?), ref: 10001054
EnumWindows.USER32(10001007,?), ref: 10001074
GetExitCodeProcess.KERNEL32(00000000,?), ref: 10001084
WaitForSingleObject.KERNEL32(00000000,00000BB8), ref: 1000109D
TerminateProcess.KERNEL32(00000000,00000000), ref: 100010AE
CloseHandle.KERNEL32(00000000), ref: 100010C5

Memory Dump Source

Source File: 00000008.00000002.4003779869.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4003730902.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4003860905.0000000010002000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.4003911865.0000000010004000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_5371.jbxd

Similarity

API ID: Process$CloseCodeEnumExitHandleObjectOpenSingleTerminateWaitWindows
String ID:
API String ID: 3465249596-0
Opcode ID: 45a2251c50cfe7217ad4567bb79eedec0e3199e983198285888405aa9b7494a4
Instruction ID: 6b4dcd5717a232181223c093e4f4244ae1ce1555a3c8e15b92772d9ea2fb9ae7
Opcode Fuzzy Hash: 45a2251c50cfe7217ad4567bb79eedec0e3199e983198285888405aa9b7494a4
Instruction Fuzzy Hash: 5211E235A00299EFFB00DFA5CCC8AEE77BCEB456C5F014069FA4192149D7B49981CB62

Function 00404C4E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420D50,00420D50,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404B69,000000DF,00000000,00000400,?), ref: 00404CEC
wsprintfA.USER32 ref: 00404CF4
SetDlgItemTextA.USER32(?,00420D50), ref: 00404D07

Strings

PB, xrefs: 00404CDE
%u.%u%s%s, xrefs: 00404CD6

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$PB
API String ID: 3540041739-838025833
Opcode ID: 837710c020be2e613de14c6f4d6baa8c213068046cd931f6ce14c5213cbfad60
Instruction ID: 635705270cf82d3fa6c033b13715314544988666452c3f341a93ad76d23c3d90
Opcode Fuzzy Hash: 837710c020be2e613de14c6f4d6baa8c213068046cd931f6ce14c5213cbfad60
Instruction Fuzzy Hash: 5F11E77360512837EB00656D9D45EAE3298DB85374F26423BFE26F71D1E978CC1286E8

Function 00402D3B Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402D8F
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402DDB
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DE4
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402DFB
RegCloseKey.ADVAPI32(?,?,?), ref: 00402E06

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 6a17d2dfc8014f9998472e4bb2df9c50261cd009cc462a72ab7525fe56808e65
Instruction ID: 1f7d8097ab2fb743d310579a2b4365e3e31c1a4ec17ce584dda370d325fd3950
Opcode Fuzzy Hash: 6a17d2dfc8014f9998472e4bb2df9c50261cd009cc462a72ab7525fe56808e65
Instruction Fuzzy Hash: 1D214B7150010CBBDF129F90CE89EEB7B7DEF44344F11007AF955B11A0D7B49EA49AA8

Function 00401D65 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D7E
GetClientRect.USER32(?,?), ref: 00401DCC
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401DFC
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401E10
DeleteObject.GDI32(00000000), ref: 00401E20

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 593d1372a554d47c5dd87fed6cfd69f5edd78a04abfcab04570fffcca4b878a5
Instruction ID: cb7cd4706ec086029cb46641885d9617bace417a5341e65c45b3777010ef1041
Opcode Fuzzy Hash: 593d1372a554d47c5dd87fed6cfd69f5edd78a04abfcab04570fffcca4b878a5
Instruction Fuzzy Hash: 35212A72E00109AFDF15DFA4DD85AAEBBB5EB88300F24417EF911F62A0DB389941DB14

Function 00401E35 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E38
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E52
MulDiv.KERNEL32(00000000,00000000), ref: 00401E5A
ReleaseDC.USER32(?,00000000), ref: 00401E6B
CreateFontIndirectA.GDI32(0040B820), ref: 00401EBA

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: de4b304c9a389d7a08c3fe75b8b690b37b20fc1cb77e4e41693a04eab2cef683
Instruction ID: bfe7ce59390996d5b2ac71ca67757b7c78ff13e1b53bdd881068f9c0e557254e
Opcode Fuzzy Hash: de4b304c9a389d7a08c3fe75b8b690b37b20fc1cb77e4e41693a04eab2cef683
Instruction Fuzzy Hash: 66018072504340AEE7007BB0AF8AA9A7FE8E755701F109439F241B61E2CB790449CB6C

Function 00401C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C9E
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401CB6

Strings

!, xrefs: 00401C6A

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 1399452274c26c04b05c3e26325e61428879637001adb01d26c94ca9c19498ca
Instruction ID: a12cfbdd51ff26f17676da16b1bc06906883597644a76ef85f46b7bf1251d8d3
Opcode Fuzzy Hash: 1399452274c26c04b05c3e26325e61428879637001adb01d26c94ca9c19498ca
Instruction Fuzzy Hash: 2A218271948208BEEB059FF5DA8AAAD7FB4EF84304F20447EF101B61D1D7B989819B18

Function 00405D1A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004034B9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 00405D20
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004034B9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 00405D29
lstrcatA.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405D3A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405D1A

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 78cba1d5cb2474798914f87c9b537ab1510ee16986e2efd06177e80df85e38b2
Instruction ID: 6a6775ee8fa4d5d8d60a890cb1840bbff54d6a4bc9e312217f61a2b57c53a4e0
Opcode Fuzzy Hash: 78cba1d5cb2474798914f87c9b537ab1510ee16986e2efd06177e80df85e38b2
Instruction Fuzzy Hash: 82D0A7625015307AD20167154C09DDF29488F523017094027F501B7191C67C5C1187FD

Function 00405DB3 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0,C:\Users\user\AppData\Local\Temp\5371.exe), ref: 00405DC1
CharNextA.USER32(00000000), ref: 00405DC6
CharNextA.USER32(00000000), ref: 00405DDA

Strings

C:\, xrefs: 00405DB4

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: 39b5ed16b6dfe77c974b4e4dad13ac827778716fd50118a58326aa52b160bb8b
Instruction ID: a81d310af092f64b8c374c4571b8fed5a60269d48026fa3bbeeaae68e06855d2
Opcode Fuzzy Hash: 39b5ed16b6dfe77c974b4e4dad13ac827778716fd50118a58326aa52b160bb8b
Instruction Fuzzy Hash: 71F09661904F542BFB3293648C4CB776B8DCF55351F28947BE6807A6C1C27C59808FEA

Function 0040541D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040544C
CallWindowProcA.USER32(?,?,?,?), ref: 0040549D

Part of subcall function 00404451: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00404463

Strings

, xrefs: 0040542D

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 14b3d6ef5c2a84fc52750bef5e2e8b29c93878db9a0e482e1958f3e7559ce471
Instruction ID: ce4d6245f7a5538c18ae28323cba1b5bdda0ccdff68052f186ad3da5f1ae13b7
Opcode Fuzzy Hash: 14b3d6ef5c2a84fc52750bef5e2e8b29c93878db9a0e482e1958f3e7559ce471
Instruction Fuzzy Hash: 2A015E31200608AFDF216F51DD80BAF3A66EB84716F104537FA05761D2C7799CD29F6A

Function 0040626F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,00000400,C:\Windows\wininit.ini,00420530,?,?,?,00000002,C:\Windows\wininit.ini,?,00406527,80000002), ref: 004062B5
RegCloseKey.ADVAPI32(?,?,00406527,80000002,Software\Microsoft\Windows\CurrentVersion,C:\Windows\wininit.ini,C:\Windows\wininit.ini,C:\Windows\wininit.ini,?,00420530), ref: 004062C0

Strings

C:\Windows\wininit.ini, xrefs: 00406272, 004062A6

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: CloseQueryValue
String ID: C:\Windows\wininit.ini
API String ID: 3356406503-2725141966
Opcode ID: b5b3bad3c76d40b2ede80ce474e794f1db4bf40d8bfbb80b5b2804fbfeedd4a0
Instruction ID: 5c8aa4f59809ec7c4ed175be077f356401e74c3ba082423fbe1b6bbc42bea5f4
Opcode Fuzzy Hash: b5b3bad3c76d40b2ede80ce474e794f1db4bf40d8bfbb80b5b2804fbfeedd4a0
Instruction Fuzzy Hash: 8101BC72100209ABDF229F60CC09FDB3FA8EF45364F01407AFD56A6190D638C974CBA8

Function 00405D61 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,00402FC8,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\5371.exe,C:\Users\user\AppData\Local\Temp\5371.exe,80000000,00000003), ref: 00405D67
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,00402FC8,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\5371.exe,C:\Users\user\AppData\Local\Temp\5371.exe,80000000,00000003), ref: 00405D75

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00405D61

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 2709904686-1943935188
Opcode ID: 46bbde6159133eac16457addd6c3fa88623ef59ff022f94c34d6ba2180d3974b
Instruction ID: 27c40c0738421aba4af956c8f0f705930dfe744a77a65273bf6dbb66402e0641
Opcode Fuzzy Hash: 46bbde6159133eac16457addd6c3fa88623ef59ff022f94c34d6ba2180d3974b
Instruction Fuzzy Hash: CBD0A772409D706EE31353208C04B8F6A48CF13300F0D4063E481A6190C2785C424BFD

Function 00405E80 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E90
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405EA8
CharNextA.USER32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EB9
lstrlenA.KERNEL32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EC2

Memory Dump Source

Source File: 00000008.00000002.4001628927.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.4001601390.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001659528.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4001683756.0000000000434000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000439000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000446000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000454000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.000000000045B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.4002127172.0000000000462000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5371.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
Instruction ID: 98ea32bb50e75ca8be10b873c57fc005eda9f523d07111d413316ed06cfa332a
Opcode Fuzzy Hash: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
Instruction Fuzzy Hash: 5FF06235104918AFCB129BA5DD4099EBFA8EF55350B2540B9E880F7211D674DF019BA9

Analysis Process: setup.exePID: 1712, Parent PID: 6444COMMON

Execution Graph

Execution Coverage:	17.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1368
Total number of Limit Nodes:	27

Executed Functions

Function 004034CC Relevance: 94.9, APIs: 34, Strings: 20, Instructions: 417
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008001), ref: 004034EF
GetVersionExA.KERNEL32(?), ref: 00403518
GetVersionExA.KERNEL32(0000009C), ref: 0040352F
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004035F8
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 00403635
OleInitialize.OLE32(00000000), ref: 0040363C
SHGetFileInfoA.SHELL32(0041FD10,00000000,?,00000160,00000000,?,00000007,00000009,0000000B), ref: 0040365A
GetCommandLineA.KERNEL32(00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 0040366F
CharNextA.USER32(00000000,"C:\Users\user\AppData\Local\Temp\setup.exe",00000020,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,00000007,00000009,0000000B), ref: 004036A9
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000007,00000009,0000000B), ref: 004037A2
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 004037B3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 004037BF
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 004037D3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004037DB
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004037EC
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004037F4
DeleteFileA.KERNELBASE(1033,?,00000007,00000009,0000000B), ref: 00403808
ExitProcess.KERNEL32(?,?,00000007,00000009,0000000B), ref: 004038AE
OleUninitialize.OLE32(?,?,00000007,00000009,0000000B), ref: 004038B3
ExitProcess.KERNEL32 ref: 004038D4
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,?,00000007,00000009,0000000B), ref: 004038E7
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A1B0,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,?,00000007,00000009,0000000B), ref: 004038F6
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,?,00000007,00000009,0000000B), ref: 00403901
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp), ref: 0040390D
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 00403929
DeleteFileA.KERNEL32(0041F910,0041F910,?,00425000,?,?,00000007,00000009,0000000B), ref: 00403986
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\setup.exe,0041F910,00000001), ref: 0040399B
CloseHandle.KERNEL32(00000000,0041F910,0041F910,?,0041F910,00000000,?,00000007,00000009,0000000B), ref: 004039C8
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000009,0000000B), ref: 004039F6
OpenProcessToken.ADVAPI32(00000000), ref: 004039FD
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403A11
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403A30
ExitWindowsEx.USER32(00000002,80040002), ref: 00403A55
ExitProcess.KERNEL32 ref: 00403A76

Strings

SeShutdownPrivilege, xrefs: 00403A0B
", xrefs: 004036CC
~nsu, xrefs: 004038DF
TEMP, xrefs: 004037E7
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00403675, 0040367B, 0040382A
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034E1
NSIS Error, xrefs: 00403660
.tmp, xrefs: 004038FB
C:\Users\user\AppData\Local\Temp\setup.exe, xrefs: 00403996
Low, xrefs: 004037D5
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403787, 00403886, 0040392F, 00403939
Error launching installer, xrefs: 0040386C
TMP, xrefs: 004037EF
A, xrefs: 0040356A
UXTHEME, xrefs: 004035EC, 004035F1, 004035F7
1033, xrefs: 00403803
\Temp, xrefs: 004037B9
C:\Users\user\AppData\Local\Temp\, xrefs: 00403797, 0040379C, 004037B2, 004037BE, 004037CD, 004037DA, 004037E6, 004037EE, 004038E4, 004038F5, 00403900, 0040390C, 00403919, 00403928, 004039DD
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403891
C:\Users\user\AppData\Local\Temp, xrefs: 00403906, 0040390B, 00403938

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: "$"C:\Users\user\AppData\Local\Temp\setup.exe"$.tmp$1033$A$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\setup.exe$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2882342585-4217013349
Opcode ID: 52eec0119052631d70130b9923c1eece19bfae2d8fd8cd18d56f0b379d03721e
Instruction ID: 1a4863036e4e50ed5e1acae1e6299f6db15da00d6e87979e5214c03ba8a99dba
Opcode Fuzzy Hash: 52eec0119052631d70130b9923c1eece19bfae2d8fd8cd18d56f0b379d03721e
Instruction Fuzzy Hash: 99E1D270A04354AADB21AF659D49B6F7EB89F86306F0540BFF441B61D2CB7C4A05CB2E

Function 00405B4A Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405B73
lstrcatA.KERNEL32(00421D58,\*.*,00421D58,?,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BBB
lstrcatA.KERNEL32(?,0040A014,?,00421D58,?,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BDC
lstrlenA.KERNEL32(?,?,0040A014,?,00421D58,?,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BE2
FindFirstFileA.KERNELBASE(00421D58,?,?,?,0040A014,?,00421D58,?,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BF3
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405CA0
FindClose.KERNEL32(00000000), ref: 00405CB1

Strings

"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00405B53
\*.*, xrefs: 00405BB5

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$\*.*
API String ID: 2035342205-2936579034
Opcode ID: 2ba348f7f603991e7b2998a01f0f2af9ee039e7695cfc72fde993ee98a245b0d
Instruction ID: 9e5d3321e74a3647b1fb2cdcf4bec0a51507e3563529971eb59e862f6dba24c5
Opcode Fuzzy Hash: 2ba348f7f603991e7b2998a01f0f2af9ee039e7695cfc72fde993ee98a245b0d
Instruction Fuzzy Hash: 2B519130908B04AAEB316B61CC49BAF7AB8DF82755F14813FF851B51D2C73C5982DE69

Function 00406A88 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b420139e1bb7bdc71f93166ff3cf2c8d4b4e2e8bf29b11b667125d81af8f4237
Instruction ID: c2ee61ea0ab5e5811791f69f03c7ffba3fbd093a674906ee4b434ab4c587e2e9
Opcode Fuzzy Hash: b420139e1bb7bdc71f93166ff3cf2c8d4b4e2e8bf29b11b667125d81af8f4237
Instruction Fuzzy Hash: 0FF18A70D04269CBDF28CF98C8946ADBBB0FF44305F24816ED856BB281D7786A86DF45

Function 004066FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(75923410,004225A0,C:\,00405E4B,C:\,C:\,00000000,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0), ref: 0040670A
FindClose.KERNEL32(00000000), ref: 00406716

Strings

C:\, xrefs: 004066FF

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
Instruction ID: 083b1303d1f5dd1ba3b50291930e0491dd498af142a60d7bee4daa0eb941c193
Opcode Fuzzy Hash: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
Instruction Fuzzy Hash: B3D01231515120BBC3405B38AE0C95B7E589F093747618A36F066F22E4DB74CC6286AC

Function 00403B6E Relevance: 49.2, APIs: 13, Strings: 15, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406794: GetModuleHandleA.KERNEL32(?,00000000,?,0040360E,0000000B), ref: 004067A6
Part of subcall function 00406794: GetProcAddress.KERNEL32(00000000,?), ref: 004067C1

lstrcatA.KERNEL32(1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,75923410,C:\Users\user\AppData\Local\Temp\,?,"C:\Users\user\AppData\Local\Temp\setup.exe",00000009,0000000B), ref: 00403BE9
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,?,?,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000000,C:\Users\user\AppData\Roaming\GamePall,1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,75923410), ref: 00403C5E
lstrcmpiA.KERNEL32(?,.exe), ref: 00403C71
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,"C:\Users\user\AppData\Local\Temp\setup.exe",00000009,0000000B), ref: 00403C7C
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\GamePall), ref: 00403CC5

Part of subcall function 004062E6: wsprintfA.USER32 ref: 004062F3

RegisterClassA.USER32(00423EE0), ref: 00403D02
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403D1A
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403D4F
ShowWindow.USER32(00000005,00000000,?,"C:\Users\user\AppData\Local\Temp\setup.exe",00000009,0000000B), ref: 00403D85
GetClassInfoA.USER32(00000000,RichEdit20A,00423EE0), ref: 00403DB1
GetClassInfoA.USER32(00000000,RichEdit,00423EE0), ref: 00403DBE
RegisterClassA.USER32(00423EE0), ref: 00403DC7
DialogBoxParamA.USER32(?,00000000,00403F0B,00000000), ref: 00403DE6

Strings

RichEdit20A, xrefs: 00403DA9, 00403DAF
RichEd20, xrefs: 00403D8B
.DEFAULT\Control Panel\International, xrefs: 00403BD4
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00403B71
RichEdit, xrefs: 00403DB8
_Nb, xrefs: 00403CE1, 00403D49
>B, xrefs: 00403CD4
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403BF8, 00403C00, 00403C98, 00403C9E, 00403CAE
1033, xrefs: 00403B8E, 00403BE4
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00403C2C, 00403C34, 00403C41, 00403C8B, 00403C91
RichEd32, xrefs: 00403D99
PB, xrefs: 00403B9A
C:\Users\user\AppData\Local\Temp\, xrefs: 00403B73
.exe, xrefs: 00403C6B
Control Panel\Desktop\ResourceLocale, xrefs: 00403BA2

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$Control Panel\Desktop\ResourceLocale$PB$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$>B
API String ID: 1975747703-1349787809
Opcode ID: e590d0c5fa98f393744fb4f016bdb4800495c857999addaceec8a385476c3f6f
Instruction ID: 5836c5bb6a6ef8c4ff0aed12ec42ff3eebf2d58129c507535c8ab2622d1094a3
Opcode Fuzzy Hash: e590d0c5fa98f393744fb4f016bdb4800495c857999addaceec8a385476c3f6f
Instruction Fuzzy Hash: 4F61D670204200AED620AF65AD45F3B3A7CEB8574AF41453FF951B62E2CB7D9D028B6D

Function 00402F5C Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F70
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\setup.exe,00000400), ref: 00402F8C

Part of subcall function 00405F1B: GetFileAttributesA.KERNELBASE(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405F1F
Part of subcall function 00405F1B: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00402FD5
GlobalAlloc.KERNEL32(00000040,00000009), ref: 00403117

Strings

C:\Users\user\AppData\Local\Temp\setup.exe, xrefs: 00402F76, 00402F85, 00402F99, 00402FB6
Error launching installer, xrefs: 00402FAC
Inst, xrefs: 00403041
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00402F65
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403160
soft, xrefs: 0040304A
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 004031AE
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F66, 0040312F
C:\Users\user\AppData\Local\Temp, xrefs: 00402FB7, 00402FBC, 00402FC2
Null, xrefs: 00403053

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\setup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-1586733961
Opcode ID: 948897f0a7bf445ed3fd87f3f97ca94f99971360adfd1b44ac20b9f0a6b79c08
Instruction ID: 8a05da1d373fd2b3e089436e62a275652004ed3b6aa6cfe031be989f12afac8e
Opcode Fuzzy Hash: 948897f0a7bf445ed3fd87f3f97ca94f99971360adfd1b44ac20b9f0a6b79c08
Instruction Fuzzy Hash: 0771E231A01218ABDB20EF65DD85B9E7BACEB44356F10813BF910BA2C1D77C9E458B5C

Function 0040641B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000400), ref: 00406549
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000400,?,00420530,00000000,004054E1,00420530,00000000), ref: 0040655C
SHGetSpecialFolderLocation.SHELL32(004054E1,00000000,?,00420530,00000000,004054E1,00420530,00000000), ref: 00406598
SHGetPathFromIDListA.SHELL32(00000000,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe), ref: 004065A6
CoTaskMemFree.OLE32(00000000), ref: 004065B2
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D6
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,00420530,00000000,004054E1,00420530,00000000,00000000,00000000,00000000), ref: 00406628

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D0
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406518
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00406445, 00406515, 00406516, 00406517, 00406533, 00406548, 0040655B, 00406577, 004065A2, 004065D5, 004065DB, 004065F3, 00406606, 00406621, 00406627, 0040662F, 00406659

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1374779285
Opcode ID: 28fe3fa0c873c230fa859cbc890347587b683f5d94c1146f2a959db860f2b1f6
Instruction ID: f38e20b3a3e0c1a2470d5ac0c6d90f06be75126661b475aa23e0086d5b044b98
Opcode Fuzzy Hash: 28fe3fa0c873c230fa859cbc890347587b683f5d94c1146f2a959db860f2b1f6
Instruction Fuzzy Hash: 9F612370900114AEDF205F24EC90BBA3BA4EB52314F52403FE913B62D1D37D8A62DB4E

Function 00401759 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000000,00000000,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00406388: lstrcpynA.KERNEL32(0000000B,0000000B,00000400,0040366F,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406395

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Strings

C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe, xrefs: 00401826, 00401842
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00401786

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe
API String ID: 1941528284-3318693634
Opcode ID: 531cf43c35c58c4dd4a4f90f95c8ebf7c3fa560a9c590302947909e1ab3ecca7
Instruction ID: 0d76be79c55a0237b493b10f9ec5be6125ba7ce9be49b25e4c886387d44134cc
Opcode Fuzzy Hash: 531cf43c35c58c4dd4a4f90f95c8ebf7c3fa560a9c590302947909e1ab3ecca7
Instruction Fuzzy Hash: E141B731900615BBCB107BB5CC45DAF3668EF45329B61833BF422F10E1D67C8A529AAE

Function 00406726 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040673D
wsprintfA.USER32 ref: 00406776
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040678A

Strings

%s%s.dll, xrefs: 00406770
UXTHEME, xrefs: 0040672F
\, xrefs: 0040674E

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
Instruction ID: 0c3db372634d2cfba6f48721b0c795b31ebca02323a8b7d7371d162bf0ec7b9a
Opcode Fuzzy Hash: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
Instruction Fuzzy Hash: FBF0FC7050021966DB15A764DD0DFEA365CAB08309F1404BEA586E20C1D6B8D5258B69

Function 004027E8 Relevance: 9.1, APIs: 6, Instructions: 91
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402849
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 00402865
GlobalFree.KERNEL32(?), ref: 004028A4
GlobalFree.KERNEL32(00000000), ref: 004028B7
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028D3
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028E6

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: Global$AllocFree$ChangeCloseDeleteFileFindNotification
String ID:
API String ID: 2989416154-0
Opcode ID: 89df3cefb7dd421bed2d3b7eed546734cb5ae329452e645b4cc4e6c356db934a
Instruction ID: cd924008ac91bdcd896aacfcc8aadc4f9c7de1b4393fc14a433ce499bdbf1d56
Opcode Fuzzy Hash: 89df3cefb7dd421bed2d3b7eed546734cb5ae329452e645b4cc4e6c356db934a
Instruction Fuzzy Hash: D931AC32800128ABDF216FA5DE49D9E7A75FF08364F24423AF450B62D0CB7949419F68

Function 00405F4A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F5E
GetTempFileNameA.KERNELBASE(0000000B,?,00000000,?,?,004034CA,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007), ref: 00405F78

Strings

nsa, xrefs: 00405F55
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F4D

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-44229769
Opcode ID: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
Instruction ID: 05c77450f8afc2c62a5a11a921c51d956a1ea51751b09822177720344b0c8500
Opcode Fuzzy Hash: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
Instruction Fuzzy Hash: 02F082363042087BDB109F55DD44BAB7B9CDF91750F14C03BFE48DA180D6B4D9988798

Function 004020A5 Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 004020D0

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 004020E0
GetProcAddress.KERNEL32(00000000,?), ref: 004020F0
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040215A

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 55027bfb1e7038bef75906a0c7732c3b75841ebb17574d5b7e2f6ee6ad6aef08
Instruction ID: efc1da79dccaef9ffb2761d2644f5cd4432d5c2edc08e83b6cf0327c91c21bf2
Opcode Fuzzy Hash: 55027bfb1e7038bef75906a0c7732c3b75841ebb17574d5b7e2f6ee6ad6aef08
Instruction Fuzzy Hash: 2B210832904214E7CF207FA58E4DAAE3A60AF44358F60413FF601B61E0DBBD49819A6E

Function 00403A7C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,004038B3,?,?,00000007,00000009,0000000B), ref: 00403A8E
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,004038B3,?,?,00000007,00000009,0000000B), ref: 00403AA2

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A81
C:\Users\user\AppData\Local\Temp\nsr4CB.tmp\, xrefs: 00403AB2

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsr4CB.tmp\
API String ID: 2962429428-4136119377
Opcode ID: 860558c91a71a64e21cfc04441b923a48857e57a960d7bb4a44cdc910ceccc08
Instruction ID: f2bf129958ed6937e4157d035670f95a6da1e01cb45a681b65e96f9405f647bf
Opcode Fuzzy Hash: 860558c91a71a64e21cfc04441b923a48857e57a960d7bb4a44cdc910ceccc08
Instruction Fuzzy Hash: F4E08631640B1896C130EF7CAD4D8853B189B413357204726F1B9F20F0C738A9574EE9

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405DB3: CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405DC1
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DC6
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DDA

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 0040596F: CreateDirectoryA.KERNEL32(?,0000000B,C:\Users\user\AppData\Local\Temp\), ref: 004059B2

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\GamePall,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\AppData\Roaming\GamePall, xrefs: 00401631

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\GamePall
API String ID: 1892508949-4021349974
Opcode ID: f3ba161a3ac08c4a0fb9ad52a50d0308f78dcdedc211e6075dac0401aebdcf48
Instruction ID: f3b3600b6319d637c5497ea1020ed17c5aedac6227b62b2eaa768bc98e31f113
Opcode Fuzzy Hash: f3ba161a3ac08c4a0fb9ad52a50d0308f78dcdedc211e6075dac0401aebdcf48
Instruction Fuzzy Hash: 09115731508140EBCF306FA54D405BF23B09E96324B28453FF8D1B22E2DA3D0C42AA3E

Function 00405E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406388: lstrcpynA.KERNEL32(0000000B,0000000B,00000400,0040366F,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406395

Part of subcall function 00405DB3: CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405DC1
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DC6
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DDA

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405E5B
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0), ref: 00405E6B

Strings

C:\, xrefs: 00405E0E, 00405E13, 00405E19, 00405E54, 00405E5A, 00405E62, 00405E6A

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 9b5a40e36fb6d6325312229f101030c034a2baba4673648e7d7a04b0a2ff685f
Instruction ID: eca821d8ca18e415d707ee210574ba5bb9731226a542ad11e9256983d04766a4
Opcode Fuzzy Hash: 9b5a40e36fb6d6325312229f101030c034a2baba4673648e7d7a04b0a2ff685f
Instruction Fuzzy Hash: F7F02831105D5116C6223336AD09AAF1644CE9732471A453FFCE1B52D2DB3C8A539CEE

Function 00406EBD Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3294aed7e6278100db64414b9f116292b07b09feaa7d8b5145f731feae0eba26
Instruction ID: 14484b0326c8a5630d33184448731c7578348ec986130544f859662fecd3ad08
Opcode Fuzzy Hash: 3294aed7e6278100db64414b9f116292b07b09feaa7d8b5145f731feae0eba26
Instruction Fuzzy Hash: 04A12471E04229CBDF28CFA8C844BADBBB1FF44305F14816AD956BB281C7786986DF45

Function 004070BE Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e067d77b8d7a9b68dd685dca04d3d71c5ee3b4c66787705bfaaaffb075589f
Instruction ID: 16a3963220edad981734dfbd86db7ae4535d0e52bcc7a87e0ef86c627c8cfaa4
Opcode Fuzzy Hash: 74e067d77b8d7a9b68dd685dca04d3d71c5ee3b4c66787705bfaaaffb075589f
Instruction Fuzzy Hash: 2D912370D04268CBDF28CF98C854BADBBB1FF44305F14816AD956BB281C7786986DF45

Function 00406DD4 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffa2499bf387f79f1209cac769e5c71ba3d3f6d53411ba5d370abef73c06fe0
Instruction ID: e981be8a744509f315cfd76b32476d9c10b76e0a4aa84739a8d113cb33934a41
Opcode Fuzzy Hash: 7ffa2499bf387f79f1209cac769e5c71ba3d3f6d53411ba5d370abef73c06fe0
Instruction Fuzzy Hash: 37812471E04228CBDF24CFA8C844BADBBB1FF45305F24816AD856BB291C7789986DF45

Function 004068D9 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b20245c0637e97ad79b0c04fd837c43a33b4178456ec09291c35722496dfe88
Instruction ID: 8182d74baebb800b0d472bca2432a1a472ea96a2662ae7b36db949844af6c4d7
Opcode Fuzzy Hash: 9b20245c0637e97ad79b0c04fd837c43a33b4178456ec09291c35722496dfe88
Instruction Fuzzy Hash: DF815971E04228DBEF24CFA8C844BADBBB1FF44305F10816AD956BB281C7786986DF45

Function 00406D27 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d628358dfeac25ccb8ac491a47a372453481bb06581bffe716440ea5054c50f9
Instruction ID: 516ab04208dd2bc2fd7cdea6c41d3130492ff38fa800e35acf718bd73fbf6333
Opcode Fuzzy Hash: d628358dfeac25ccb8ac491a47a372453481bb06581bffe716440ea5054c50f9
Instruction Fuzzy Hash: A4712271E04228CBDF24CF98C844BADBBB1FF48305F14806AD856BB281C778A986DF45

Function 00406E45 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8eb04bd933ca205c297744f59a7b7035fe2e59d11d29800bf5f20fbdb1e525a
Instruction ID: 835baf8de871759411e2c74e4a47f0112f02d54065241c3c7dcda5dc236b3f46
Opcode Fuzzy Hash: e8eb04bd933ca205c297744f59a7b7035fe2e59d11d29800bf5f20fbdb1e525a
Instruction Fuzzy Hash: 92712571E04228CBEF28CF98C844BADBBB1FF44305F15816AD856BB281C7786996DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed70085a56e3aedeea153169e26c1aa9cf9d7e4654945abbe59913f8bdc615b9
Instruction ID: ccec74d0ee3a806077926e8984c2e201e8b1f3d886c73ab216be699138b2bca7
Opcode Fuzzy Hash: ed70085a56e3aedeea153169e26c1aa9cf9d7e4654945abbe59913f8bdc615b9
Instruction Fuzzy Hash: 39715771E04228CBEF28CF98C844BADBBB1FF44305F14806AD956BB281C778A946DF45

Function 00403305 Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403319

Part of subcall function 00403484: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403182,?), ref: 00403492

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,0040322F,00000004,00000000,00000000,0000000B,?,004031A9,000000FF,00000000,00000000,00000009,?), ref: 0040334C
SetFilePointer.KERNELBASE(155C335B,00000000,00000000,004138F8,00004000,?,00000000,0040322F,00000004,00000000,00000000,0000000B,?,004031A9,000000FF,00000000), ref: 00403447

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: f3fd145fe371a3aefb2ec72eaaf4336e3a5ddfe71b6918c4f9f269c5704fa6fa
Instruction ID: 5f41a1ef9683aad456499e8308d87ccfcfa217f8aa92108fcff4f05b83e24891
Opcode Fuzzy Hash: f3fd145fe371a3aefb2ec72eaaf4336e3a5ddfe71b6918c4f9f269c5704fa6fa
Instruction Fuzzy Hash: 1F319F72A002059FC711BF2AFE849663BACE741356710C13BE814B62F0CB3859458FAD

Function 0040247E Relevance: 4.6, APIs: 3, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0040AC20,00000023,00000011,00000002), ref: 004024C9
RegSetValueExA.KERNELBASE(?,?,?,?,0040AC20,00000000,00000011,00000002), ref: 00402509
RegCloseKey.KERNELBASE(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: CloseValuelstrlen
String ID:
API String ID: 2655323295-0
Opcode ID: ef8eeb58056491ee092ed80bef3546efe310264daaab0f586760f51b4d92765b
Instruction ID: e1e6ae2a7b536448810537a1ffa9a52b32d6c636ce9630cd27147c6707bb0a71
Opcode Fuzzy Hash: ef8eeb58056491ee092ed80bef3546efe310264daaab0f586760f51b4d92765b
Instruction Fuzzy Hash: 04116371E04208AFEB10AFA5DE49AAEBA74EB84714F21443BF504F71C1DAB94D409B68

Function 00402590 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025C2
RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 004025D5
RegCloseKey.KERNELBASE(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 039baf7d42ae34e4e7f4f0d82c42536c565db7a64b10d6b3f593835efb4c20b6
Instruction ID: 33ff3e85e785963e302667c06a3cb1355a7acd8bf142a31c2560ef5bcfc7d759
Opcode Fuzzy Hash: 039baf7d42ae34e4e7f4f0d82c42536c565db7a64b10d6b3f593835efb4c20b6
Instruction Fuzzy Hash: 2C017571904104FFE7158F54DE88ABF7BACEF81358F20443EF101A61C0DAB44E449679

Function 00405B02 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405EF6: GetFileAttributesA.KERNELBASE(?,?,00405B0E,?,?,00000000,00405CF1,?,?,?,?), ref: 00405EFB
Part of subcall function 00405EF6: SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405F0F

RemoveDirectoryA.KERNELBASE(?,?,?,00000000,00405CF1), ref: 00405B1D
DeleteFileA.KERNELBASE(?,?,?,00000000,00405CF1), ref: 00405B25
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405B3D

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: fdbfe47bebcd8a5232fcae5ebebd8a359ed736e28fe734178b51a2620122945d
Instruction ID: eeb49a2f717892c2e0964ab94aaac89db2a73fdd151ed94c70539e0cf44bba43
Opcode Fuzzy Hash: fdbfe47bebcd8a5232fcae5ebebd8a359ed736e28fe734178b51a2620122945d
Instruction Fuzzy Hash: 6CE0E531109A9097C62067349908A5B7AF8EF86314F094D3AF9A1F20D0DB38B9468EBD

Function 004031FD Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000009,00000000,00000000,00000000,00000000,0000000B,?,004031A9,000000FF,00000000,00000000,00000009,?), ref: 00403222

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 966fed337372371c4087f3b005d0b036fc883b56c67f04ec2e368497ceacb8e7
Instruction ID: 301e065564a74905a78554ad982773151ad037ba2d6e6f8d8cd401a7b941de18
Opcode Fuzzy Hash: 966fed337372371c4087f3b005d0b036fc883b56c67f04ec2e368497ceacb8e7
Instruction Fuzzy Hash: E2318D30200219FFDB109F95ED45A9A3FA8EB05755B20847EB914E61D0D738DB509FA9

Function 0040251E Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 0040254E
RegCloseKey.KERNELBASE(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 6617ca3d26eaa2170afdc71dc748124b2257766e2e1ea0df1a2f7a4cdc0ba340
Instruction ID: 7c766f3f1fb2abd04e903467a79d83897fdaad9d0bba0580308fe752c8381985
Opcode Fuzzy Hash: 6617ca3d26eaa2170afdc71dc748124b2257766e2e1ea0df1a2f7a4cdc0ba340
Instruction Fuzzy Hash: 1B11BF71905205EFDB25CF64DA985AE7BB4AF11355F20483FE042B72C0D6B88A85DA1D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 04d136d289144069680b1fecce7da664cc2fd5e0b622116f853907ec40370e1b
Instruction ID: c6e23866af321c238b4b59365f681da1ab702c54c00e726fca3ee5b0521d1f72
Opcode Fuzzy Hash: 04d136d289144069680b1fecce7da664cc2fd5e0b622116f853907ec40370e1b
Instruction Fuzzy Hash: 5201D131B242109BE7194B38AE04B2A36A8E754315F51813AF851F61F1DB78CC129B4D

Function 00405A21 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422558,00000009,00000009,0000000B), ref: 00405A4A
CloseHandle.KERNEL32(?), ref: 00405A57

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
Instruction ID: 70dcd79ab4e1e9e84cc9ba673cd08f466e07e48f17d85ed3475224309c024e1a
Opcode Fuzzy Hash: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
Instruction Fuzzy Hash: A5E04FB4600209BFEB009B64ED09F7B77ACFB04244F808421BE40F2150D67899658A78

Function 00406794 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000000,?,0040360E,0000000B), ref: 004067A6
GetProcAddress.KERNEL32(00000000,?), ref: 004067C1

Part of subcall function 00406726: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040673D
Part of subcall function 00406726: wsprintfA.USER32 ref: 00406776
Part of subcall function 00406726: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040678A

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 6cfaa89c8510a3ae83a05a93334a7968bfc88d7e7cb527baf598ad9b980e56cb
Instruction ID: 2a593beb9babc16b4b5ae8275dbdfb46ef4ebf17ea7291b62b5d373670c31446
Opcode Fuzzy Hash: 6cfaa89c8510a3ae83a05a93334a7968bfc88d7e7cb527baf598ad9b980e56cb
Instruction Fuzzy Hash: B6E0863260421157D21067705E4897773ACAF94B54302043EF546F3144D7389C76966D

Function 00405F1B Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405F1F
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
Instruction ID: c1cd633b288b309c16b37b55694bd397a2d2f3fd27c3ea135bedd35eac3c4d3c
Opcode Fuzzy Hash: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
Instruction Fuzzy Hash: D9D09E31254602AFEF0D8F20DE16F2E7AA2EB84B00F11952CB682944E2DA715819AB19

Function 00405EF6 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,00405B0E,?,?,00000000,00405CF1,?,?,?,?), ref: 00405EFB
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405F0F

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7db639ec3fc6e9a5b47d3eb1dfb332e917e8410632ca84ceba79978e33b6a3d0
Instruction ID: 2a9487917742c73a52daa6fa2dda6e447083e2efb983b62a69771bacbdb33add
Opcode Fuzzy Hash: 7db639ec3fc6e9a5b47d3eb1dfb332e917e8410632ca84ceba79978e33b6a3d0
Instruction Fuzzy Hash: E3D0C972504422ABD2102728AE0889BBB55DB94271702CA35FDA5A26F1DB304C569A9C

Function 004059EC Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004034BF,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004059F2
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 00405A00

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
Instruction ID: 42ce2bd36b25b14d2ed8d631edf33fc643f4c4eb5ed9af5e51ab4a49ffb09bba
Opcode Fuzzy Hash: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
Instruction Fuzzy Hash: 9BC04C303145419AD6505B309F4DB177A54AB50741F51553A638AE01A0DA348465DD2D

Function 0040623C Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CEA,00000000,?,?), ref: 00406265

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction ID: 57b18be241489d6c3509c0f1b2cb500900bdd64e2c84313365475615acd8ae2e
Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction Fuzzy Hash: 16E0E672010109BEDF196F50DD0AD7B371DEB04341F01492EF916D4091E6B5A9309734

Function 00405FC2 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000009,00000000,00000000,00000000,00000000,0040C475,0040B8F8,00403405,0040B8F8,0040C475,004138F8,00004000,?,00000000,0040322F,00000004), ref: 00405FD6

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: d5187e51ab0d96a1766449b5dbb93cac2cdd9e80b7d20ab2fc0b5d8c8d5322e8
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: 4AE0EC3221065BABDF109E659C04EEB7B6CEB05360F004437FA55E3150D675E8219BA4

Function 00405F93 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000009,00000000,00000000,00000000,00000000,004138F8,0040B8F8,00403481,00000009,00000009,00403385,004138F8,00004000,?,00000000,0040322F), ref: 00405FA7

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
Instruction ID: 61a6516da629700e98a59d605e8380186fb5f41ecf47873683bd74a9a2ef61d4
Opcode Fuzzy Hash: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
Instruction Fuzzy Hash: 8BE08C3220161EEBEF119E508C00AEBBB6CEB00360F004433FD25E3140E234E9218BA8

Function 00403484 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403182,?), ref: 00403492

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction ID: eadcf480fe67690f272c505b4903882a1233053cb438a9b9796e5ea94341b5dd
Opcode Fuzzy Hash: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction Fuzzy Hash: 25B09231140200AADA215F409E09F057B21AB94700F208424B244280F086712025EA0D

Function 00401F7B Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Part of subcall function 00405A21: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422558,00000009,00000009,0000000B), ref: 00405A4A
Part of subcall function 00405A21: CloseHandle.KERNEL32(?), ref: 00405A57

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FC0

Part of subcall function 00406809: WaitForSingleObject.KERNEL32(?,00000064), ref: 0040681A
Part of subcall function 00406809: GetExitCodeProcess.KERNEL32(?,?), ref: 0040683C

Part of subcall function 004062E6: wsprintfA.USER32 ref: 004062F3

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: b93a315dc59908fe351c40803e733eeda605d55301c746aa3fa59235fa4bc662
Instruction ID: dce1314ccbc215d7d9c334b017be086f7c4cc40ba0f87dfe0d8145fd67a5eb82
Opcode Fuzzy Hash: b93a315dc59908fe351c40803e733eeda605d55301c746aa3fa59235fa4bc662
Instruction Fuzzy Hash: 2DF0B432A05121DBDB20BFA59EC49EEB2A4DF41318B25463FF502B21D1CB7C4D418A6E

Non-executed Functions

Function 004055E7 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405646
GetDlgItem.USER32(?,000003EE), ref: 00405655
GetClientRect.USER32(?,?), ref: 00405692
GetSystemMetrics.USER32(00000002), ref: 00405699
SendMessageA.USER32(?,0000101B,00000000,?), ref: 004056BA
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004056CB
SendMessageA.USER32(?,00001001,00000000,?), ref: 004056DE
SendMessageA.USER32(?,00001026,00000000,?), ref: 004056EC
SendMessageA.USER32(?,00001024,00000000,?), ref: 004056FF
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405721
ShowWindow.USER32(?,00000008), ref: 00405735
GetDlgItem.USER32(?,000003EC), ref: 00405756
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405766
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040577F
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 0040578B
GetDlgItem.USER32(?,000003F8), ref: 00405664

Part of subcall function 0040443A: SendMessageA.USER32(00000028,?,00000001,0040426A), ref: 00404448

GetDlgItem.USER32(?,000003EC), ref: 004057A7
CreateThread.KERNEL32(00000000,00000000,Function_0000557B,00000000), ref: 004057B5
CloseHandle.KERNEL32(00000000), ref: 004057BC
ShowWindow.USER32(00000000), ref: 004057DF
ShowWindow.USER32(?,00000008), ref: 004057E6
ShowWindow.USER32(00000008), ref: 0040582C
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405860
CreatePopupMenu.USER32 ref: 00405871
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405886
GetWindowRect.USER32(?,000000FF), ref: 004058A6
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004058BF
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004058FB
OpenClipboard.USER32(00000000), ref: 0040590B
EmptyClipboard.USER32 ref: 00405911
GlobalAlloc.KERNEL32(00000042,?), ref: 0040591A
GlobalLock.KERNEL32(00000000), ref: 00405924
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405938
GlobalUnlock.KERNEL32(00000000), ref: 00405951
SetClipboardData.USER32(00000001,00000000), ref: 0040595C
CloseClipboard.USER32 ref: 00405962

Strings

PB, xrefs: 004058D7

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: PB
API String ID: 590372296-3196168531
Opcode ID: 463c74343dc9a7e994e8db0b260deb87a45ca3f66d4da0101cb89f9be381629f
Instruction ID: 44a2cb424ceca129f1c721a27905a8e57bc1109532c064cce4e419f7e60c3497
Opcode Fuzzy Hash: 463c74343dc9a7e994e8db0b260deb87a45ca3f66d4da0101cb89f9be381629f
Instruction Fuzzy Hash: 18A13971900608FFDB11AF64DE85AAE7BB9FB48355F00403AFA41BA1A0CB754E51DF58

Function 00404E0A Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 491windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404E21
GetDlgItem.USER32(?,00000408), ref: 00404E2E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E7D
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404E94
SetWindowLongA.USER32(?,000000FC,0040541D), ref: 00404EAE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404EC0
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404ED4
SendMessageA.USER32(?,00001109,00000002), ref: 00404EEA
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404EF6
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404F06
DeleteObject.GDI32(00000110), ref: 00404F0B
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404F36
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404F42
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404FDC
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 0040500C

Part of subcall function 0040443A: SendMessageA.USER32(00000028,?,00000001,0040426A), ref: 00404448

SendMessageA.USER32(?,00001100,00000000,?), ref: 00405020
GetWindowLongA.USER32(?,000000F0), ref: 0040504E
SetWindowLongA.USER32(?,000000F0,00000000), ref: 0040505C
ShowWindow.USER32(?,00000005), ref: 0040506C
SendMessageA.USER32(?,00000419,00000000,?), ref: 00405167
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 004051CC
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 004051E1
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00405205
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00405225
ImageList_Destroy.COMCTL32(?), ref: 0040523A
GlobalFree.KERNEL32(?), ref: 0040524A
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 004052C3
SendMessageA.USER32(?,00001102,?,?), ref: 0040536C
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 0040537B
InvalidateRect.USER32(?,00000000,00000001), ref: 004053A6
ShowWindow.USER32(?,00000000), ref: 004053F4
GetDlgItem.USER32(?,000003FE), ref: 004053FF
ShowWindow.USER32(00000000), ref: 00405406

Strings

N, xrefs: 004050A5
, xrefs: 004053DE
M, xrefs: 00404FC4

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 4bb258af210f6716591e45ffd85afba0d9fc7d499c01c39e68e435e5f0500988
Instruction ID: c306c4130ea67d8582adb4b0d0e706bf782d7aff15223233fd0d43401108afdf
Opcode Fuzzy Hash: 4bb258af210f6716591e45ffd85afba0d9fc7d499c01c39e68e435e5f0500988
Instruction Fuzzy Hash: 6C025CB0A00609AFDB209F94DD45AAE7BB5FB84354F10817AF610BA2E1D7789D42CF58

Function 00403F0B Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403F47
ShowWindow.USER32(?), ref: 00403F67
GetWindowLongA.USER32(?,000000F0), ref: 00403F79
ShowWindow.USER32(?,00000004), ref: 00403F92
DestroyWindow.USER32 ref: 00403FA6
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403FBF
GetDlgItem.USER32(?,?), ref: 00403FDE
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403FF2
IsWindowEnabled.USER32(00000000), ref: 00403FF9
GetDlgItem.USER32(?,00000001), ref: 004040A4
GetDlgItem.USER32(?,00000002), ref: 004040AE
SetClassLongA.USER32(?,000000F2,?), ref: 004040C8
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00404119
GetDlgItem.USER32(?,00000003), ref: 004041BF
ShowWindow.USER32(00000000,?), ref: 004041E0
EnableWindow.USER32(?,?), ref: 004041F2
EnableWindow.USER32(?,?), ref: 0040420D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404223
EnableMenuItem.USER32(00000000), ref: 0040422A
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00404242
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00404255
lstrlenA.KERNEL32(00420D50,?,00420D50,00000000), ref: 0040427F
SetWindowTextA.USER32(?,00420D50), ref: 0040428E
ShowWindow.USER32(?,0000000A), ref: 004043C2

Strings

PB, xrefs: 0040426F

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID: PB
API String ID: 1860320154-3196168531
Opcode ID: a84a76c7c437068317dea6ec38f5a19867a10701d7094664a652b1a8aea3850c
Instruction ID: 6b3c419a8b2de2434844e8cd53afab52d63163afb5b1bd925d395a768d9dd0e6
Opcode Fuzzy Hash: a84a76c7c437068317dea6ec38f5a19867a10701d7094664a652b1a8aea3850c
Instruction Fuzzy Hash: ECC1D2B1A00204BBCB206F61EE45E2B3A78EB85745F41053EF781B61F1CB3998929B5D

Function 00404570 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004045FB
GetDlgItem.USER32(00000000,000003E8), ref: 0040460F
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040462D
GetSysColor.USER32(?), ref: 0040463E
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040464D
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040465C
lstrlenA.KERNEL32(?), ref: 0040465F
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 0040466E
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404683
GetDlgItem.USER32(?,0000040A), ref: 004046E5
SendMessageA.USER32(00000000), ref: 004046E8
GetDlgItem.USER32(?,000003E8), ref: 00404713
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404753
LoadCursorA.USER32(00000000,00007F02), ref: 00404762
SetCursor.USER32(00000000), ref: 0040476B
LoadCursorA.USER32(00000000,00007F00), ref: 00404781
SetCursor.USER32(00000000), ref: 00404784
SendMessageA.USER32(00000111,00000001,00000000), ref: 004047B0
SendMessageA.USER32(00000010,00000000,00000000), ref: 004047C4

Strings

N, xrefs: 00404701
6B, xrefs: 0040476F

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$6B
API String ID: 3103080414-649610290
Opcode ID: c874497606b373bfbb3475a273ba326ab034ae9c38f8566fe8320349c510c150
Instruction ID: 424ea1d81b5f8fd67bb79b8421ee67f108f717641e3cc5fc4ea293435da972af
Opcode Fuzzy Hash: c874497606b373bfbb3475a273ba326ab034ae9c38f8566fe8320349c510c150
Instruction Fuzzy Hash: CE6190B1A40208BFDB109F61DD45B6A7B69FB84715F10843AFB01BB2D1C7B8A951CF98

Function 00405FF1 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00406182,?,?), ref: 00406022
GetShortPathNameA.KERNEL32(?,00422AE0,00000400), ref: 0040602B

Part of subcall function 00405E80: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E90
Part of subcall function 00405E80: lstrlenA.KERNEL32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EC2

GetShortPathNameA.KERNEL32(?,00422EE0,00000400), ref: 00406048
wsprintfA.USER32 ref: 00406066
GetFileSize.KERNEL32(00000000,00000000,00422EE0,C0000000,00000004,00422EE0,?,?,?,?,?), ref: 004060A1
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060B0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060E8
SetFilePointer.KERNEL32(0040A3F0,00000000,00000000,00000000,00000000,004226E0,00000000,-0000000A,0040A3F0,00000000,[Rename],00000000,00000000,00000000), ref: 0040613E
GlobalFree.KERNEL32(00000000), ref: 0040614F
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406156

Part of subcall function 00405F1B: GetFileAttributesA.KERNELBASE(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405F1F
Part of subcall function 00405F1B: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

Strings

[Rename], xrefs: 004060D0, 004060E2
*B, xrefs: 00406010
.B, xrefs: 0040603D
%s=%s, xrefs: 0040605C
.B, xrefs: 00406044

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]$*B$.B$.B
API String ID: 2171350718-3836630945
Opcode ID: 2ac8773abaa14c2605e43abf0f292608002e21a2c197761b550c40717a00d302
Instruction ID: 7566a5a9e9d08134d14435fb5d3e1561ad96112206bac95af022f508aac3f812
Opcode Fuzzy Hash: 2ac8773abaa14c2605e43abf0f292608002e21a2c197761b550c40717a00d302
Instruction Fuzzy Hash: 68310531200715BBC2207B659D49F6B3A5DDF85754F15003EFE42BA2C3EA7CD8228AAD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00423F40,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: db458c2aac7b07c9de4f1dfd54ee4cc10e0d46da2aaa9c20a0cc65b716daa4c3
Instruction ID: bc851ab26da2bb863bf3a2ee07eb2f950de800ada4cbee7b2d64f78586a04119
Opcode Fuzzy Hash: db458c2aac7b07c9de4f1dfd54ee4cc10e0d46da2aaa9c20a0cc65b716daa4c3
Instruction Fuzzy Hash: 2C419D71800249AFCF058FA5DE459AF7FB9FF45314F00802AF991AA1A0C734DA55DFA4

Function 00404897 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004048E6
SetWindowTextA.USER32(00000000,?), ref: 00404910
SHBrowseForFolderA.SHELL32(?,00420128,?), ref: 004049C1
CoTaskMemFree.OLE32(00000000), ref: 004049CC
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00420D50), ref: 004049FE
lstrcatA.KERNEL32(?,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe), ref: 00404A0A
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404A1C

Part of subcall function 00405A82: GetDlgItemTextA.USER32(?,?,00000400,00404A53), ref: 00405A95

Part of subcall function 00406666: CharNextA.USER32(0000000B,*?|<>/":,00000000,?,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066BE
Part of subcall function 00406666: CharNextA.USER32(0000000B,0000000B,0000000B,00000000,?,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066CB
Part of subcall function 00406666: CharNextA.USER32(0000000B,?,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066D0
Part of subcall function 00406666: CharPrevA.USER32(0000000B,0000000B,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066E0

GetDiskFreeSpaceA.KERNEL32(0041FD20,?,?,0000040F,?,0041FD20,0041FD20,?,00000001,0041FD20,?,?,000003FB,?), ref: 00404ADA
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AF5

Part of subcall function 00404C4E: lstrlenA.KERNEL32(00420D50,00420D50,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404B69,000000DF,00000000,00000400,?), ref: 00404CEC
Part of subcall function 00404C4E: wsprintfA.USER32 ref: 00404CF4
Part of subcall function 00404C4E: SetDlgItemTextA.USER32(?,00420D50), ref: 00404D07

Strings

PB, xrefs: 00404994
C:\Users\user\AppData\Roaming\GamePall, xrefs: 004049E7
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 004049F8, 004049FD, 00404A08
A, xrefs: 004049BA

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$PB
API String ID: 2624150263-4118966266
Opcode ID: 246729fcc772db5bb1fe110679472811f76dfb67008edee7d622b3e588ee8d40
Instruction ID: 03633cdec68ae3b48ba4c7d33c4768738bfb21d85bfcf2e4b9185cba9ee35c0f
Opcode Fuzzy Hash: 246729fcc772db5bb1fe110679472811f76dfb67008edee7d622b3e588ee8d40
Instruction Fuzzy Hash: 7DA150B1A00208AADB11EFA5DD45BAFB6B8EF84315F10803BF601B62D1D77C99418F6D

Function 004054A9 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
SetWindowTextA.USER32(00420530,00420530), ref: 00405517
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Strings

4/@, xrefs: 004054EF, 00405501

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: 4/@
API String ID: 2531174081-3101945251
Opcode ID: 17623ae6e76ffa783ca229a28a88b1e205e4a8d30cb80da27a9000df8195634c
Instruction ID: 7ab3267fb946cf8e7efc5916356ec1270af3577e2396c2c3629ce5ef3fcb69de
Opcode Fuzzy Hash: 17623ae6e76ffa783ca229a28a88b1e205e4a8d30cb80da27a9000df8195634c
Instruction Fuzzy Hash: 0F217A71E00118BBCF119FA5DD8099EBFB9EF09354F04807AF944A6291C7788A90CFA8

Function 00406666 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(0000000B,*?|<>/":,00000000,?,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066BE
CharNextA.USER32(0000000B,0000000B,0000000B,00000000,?,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066CB
CharNextA.USER32(0000000B,?,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066D0
CharPrevA.USER32(0000000B,0000000B,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066E0

Strings

*?|<>/":, xrefs: 004066AE
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00406666
C:\Users\user\AppData\Local\Temp\, xrefs: 00406667

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3087229427
Opcode ID: 6bc0e94b7f234696628355ee2fbbbdde5b7464ab094feb853247d74dffcc646e
Instruction ID: 80d428334b402c3338f843ea799862c1973996ffb1638880579f4ae0c72fc655
Opcode Fuzzy Hash: 6bc0e94b7f234696628355ee2fbbbdde5b7464ab094feb853247d74dffcc646e
Instruction Fuzzy Hash: 7E1108518047902DEB3206340C04B7B7F894F977A0F2A087FD8C6722C2D67E5C62967D

Function 00402EBD Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402ED5
GetTickCount.KERNEL32 ref: 00402EF3
wsprintfA.USER32 ref: 00402F21

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

CreateDialogParamA.USER32(0000006F,00000000,00402E25,00000000), ref: 00402F45
ShowWindow.USER32(00000000,00000005), ref: 00402F53

Part of subcall function 00402EA1: MulDiv.KERNEL32(00000000,00000064,0000D822), ref: 00402EB6

Strings

... %d%%, xrefs: 00402F1B
#Vh%.@, xrefs: 00402F34

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%$#Vh%.@
API String ID: 722711167-1706192003
Opcode ID: db62a3d36480f0b73892ce8a9fc69f21d0c49374a29e778f3850d420ffd5c07d
Instruction ID: ac0ca11ee9366edb0cc6a28cc5aeb329eacd7d00ab00b3c3670f6d564c8935e4
Opcode Fuzzy Hash: db62a3d36480f0b73892ce8a9fc69f21d0c49374a29e778f3850d420ffd5c07d
Instruction Fuzzy Hash: 3F01A170542225EBCB21BB50EF0CBAB3778EB40744B04443BF505B21D0C7F894469AEE

Function 0040446C Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404489
GetSysColor.USER32(00000000), ref: 004044C7
SetTextColor.GDI32(?,00000000), ref: 004044D3
SetBkMode.GDI32(?,?), ref: 004044DF
GetSysColor.USER32(?), ref: 004044F2
SetBkColor.GDI32(?,?), ref: 00404502
DeleteObject.GDI32(?), ref: 0040451C
CreateBrushIndirect.GDI32(?), ref: 00404526

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: d8b0c4ae085d5752a0ceb3fd9c96bfdfa4daadee6b5f884e1a531c3ceae13210
Instruction ID: 76b6fc4927f6120469f5ffa52701fcd3ddd76896e52d32ad6f55637f73cee333
Opcode Fuzzy Hash: d8b0c4ae085d5752a0ceb3fd9c96bfdfa4daadee6b5f884e1a531c3ceae13210
Instruction Fuzzy Hash: 9E2147B1501704AFCB31DF68ED08B5BBBF8AF41715B04892EEA96A26E0D734E904CB54

Function 00404D58 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404D73
GetMessagePos.USER32 ref: 00404D7B
ScreenToClient.USER32(?,?), ref: 00404D95
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404DA7
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404DCD

Strings

f, xrefs: 00404DA9

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction ID: de178be9688f757f82ef56a4cbeb6693d0582b60b2ea90e1a00f6814b48fd044
Opcode Fuzzy Hash: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction Fuzzy Hash: BB014871900219BADB01DBA4DD85BFEBBF8AF95B11F10016ABA40B61C0C6B499058BA4

Function 0040596F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,0000000B,C:\Users\user\AppData\Local\Temp\), ref: 004059B2
GetLastError.KERNEL32 ref: 004059C6
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004059DB
GetLastError.KERNEL32 ref: 004059E5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405995
!9@, xrefs: 00405984

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: !9@$C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3700438604
Opcode ID: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
Instruction ID: 4cd508ff09270142ca7a6984d66ae253fefa4e1f6983b248f3af4f59f5a14231
Opcode Fuzzy Hash: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
Instruction Fuzzy Hash: 610108B1D00259DAEF109BA0CA45BEFBBB8EB04354F00403AD645B6290D7789648CF99

Function 00402E25 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E40
wsprintfA.USER32 ref: 00402E74
SetWindowTextA.USER32(?,?), ref: 00402E84
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402E96

Strings

verifying installer: %d%%, xrefs: 00402E69, 00402E72
unpacking data: %d%%, xrefs: 00402E62

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a45d99d8fe85d32cf27a6b993dcd334edf2177b7a3e8b64a3b444c48cc752336
Instruction ID: 7ad4584a5e884be7344c254f70e0401137e7e46ce86c3cf658bb2ab9d23be74a
Opcode Fuzzy Hash: a45d99d8fe85d32cf27a6b993dcd334edf2177b7a3e8b64a3b444c48cc752336
Instruction Fuzzy Hash: 1DF01D7054020DBAEF219F60DE0ABAE3769EB44344F00803AFA16B91D0DBB899558F99

Function 00404C4E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420D50,00420D50,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404B69,000000DF,00000000,00000400,?), ref: 00404CEC
wsprintfA.USER32 ref: 00404CF4
SetDlgItemTextA.USER32(?,00420D50), ref: 00404D07

Strings

%u.%u%s%s, xrefs: 00404CD6
PB, xrefs: 00404CDE

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$PB
API String ID: 3540041739-838025833
Opcode ID: 837710c020be2e613de14c6f4d6baa8c213068046cd931f6ce14c5213cbfad60
Instruction ID: 635705270cf82d3fa6c033b13715314544988666452c3f341a93ad76d23c3d90
Opcode Fuzzy Hash: 837710c020be2e613de14c6f4d6baa8c213068046cd931f6ce14c5213cbfad60
Instruction Fuzzy Hash: 5F11E77360512837EB00656D9D45EAE3298DB85374F26423BFE26F71D1E978CC1286E8

Function 00402D3B Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402D8F
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402DDB
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DE4
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402DFB
RegCloseKey.ADVAPI32(?,?,?), ref: 00402E06

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: e74c2f698c9890700b4790f2c47d05d8785518f345c631b22f69380fd2d26fe8
Instruction ID: 1f7d8097ab2fb743d310579a2b4365e3e31c1a4ec17ce584dda370d325fd3950
Opcode Fuzzy Hash: e74c2f698c9890700b4790f2c47d05d8785518f345c631b22f69380fd2d26fe8
Instruction Fuzzy Hash: 1D214B7150010CBBDF129F90CE89EEB7B7DEF44344F11007AF955B11A0D7B49EA49AA8

Function 00401D65 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D7E
GetClientRect.USER32(?,?), ref: 00401DCC
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401DFC
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401E10
DeleteObject.GDI32(00000000), ref: 00401E20

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 593d1372a554d47c5dd87fed6cfd69f5edd78a04abfcab04570fffcca4b878a5
Instruction ID: cb7cd4706ec086029cb46641885d9617bace417a5341e65c45b3777010ef1041
Opcode Fuzzy Hash: 593d1372a554d47c5dd87fed6cfd69f5edd78a04abfcab04570fffcca4b878a5
Instruction Fuzzy Hash: 35212A72E00109AFDF15DFA4DD85AAEBBB5EB88300F24417EF911F62A0DB389941DB14

Function 00401E35 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E38
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E52
MulDiv.KERNEL32(00000000,00000000), ref: 00401E5A
ReleaseDC.USER32(?,00000000), ref: 00401E6B
CreateFontIndirectA.GDI32(0040B820), ref: 00401EBA

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: de4b304c9a389d7a08c3fe75b8b690b37b20fc1cb77e4e41693a04eab2cef683
Instruction ID: bfe7ce59390996d5b2ac71ca67757b7c78ff13e1b53bdd881068f9c0e557254e
Opcode Fuzzy Hash: de4b304c9a389d7a08c3fe75b8b690b37b20fc1cb77e4e41693a04eab2cef683
Instruction Fuzzy Hash: 66018072504340AEE7007BB0AF8AA9A7FE8E755701F109439F241B61E2CB790449CB6C

Function 00401C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C9E
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401CB6

Strings

!, xrefs: 00401C6A

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 1399452274c26c04b05c3e26325e61428879637001adb01d26c94ca9c19498ca
Instruction ID: a12cfbdd51ff26f17676da16b1bc06906883597644a76ef85f46b7bf1251d8d3
Opcode Fuzzy Hash: 1399452274c26c04b05c3e26325e61428879637001adb01d26c94ca9c19498ca
Instruction Fuzzy Hash: 2A218271948208BEEB059FF5DA8AAAD7FB4EF84304F20447EF101B61D1D7B989819B18

Function 00405D1A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004034B9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 00405D20
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004034B9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 00405D29
lstrcatA.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405D3A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405D1A

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 78cba1d5cb2474798914f87c9b537ab1510ee16986e2efd06177e80df85e38b2
Instruction ID: 6a6775ee8fa4d5d8d60a890cb1840bbff54d6a4bc9e312217f61a2b57c53a4e0
Opcode Fuzzy Hash: 78cba1d5cb2474798914f87c9b537ab1510ee16986e2efd06177e80df85e38b2
Instruction Fuzzy Hash: 82D0A7625015307AD20167154C09DDF29488F523017094027F501B7191C67C5C1187FD

Function 00405DB3 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,75923410,?,75922EE0,00405B6A,?,75923410,75922EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405DC1
CharNextA.USER32(00000000), ref: 00405DC6
CharNextA.USER32(00000000), ref: 00405DDA

Strings

C:\, xrefs: 00405DB4

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: 39b5ed16b6dfe77c974b4e4dad13ac827778716fd50118a58326aa52b160bb8b
Instruction ID: a81d310af092f64b8c374c4571b8fed5a60269d48026fa3bbeeaae68e06855d2
Opcode Fuzzy Hash: 39b5ed16b6dfe77c974b4e4dad13ac827778716fd50118a58326aa52b160bb8b
Instruction Fuzzy Hash: 71F09661904F542BFB3293648C4CB776B8DCF55351F28947BE6807A6C1C27C59808FEA

Function 00402173 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408418,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F8
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004022AA

Strings

C:\Users\user\AppData\Roaming\GamePall, xrefs: 00402238

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Roaming\GamePall
API String ID: 123533781-4021349974
Opcode ID: 975ab102bccf2e3ea3487b48f3b75e49990d828168e5a332ce340ef805c2210c
Instruction ID: 4a55140eb955682c0845ac661669d1effe53c60cfc8a987c49de3bb9103baba8
Opcode Fuzzy Hash: 975ab102bccf2e3ea3487b48f3b75e49990d828168e5a332ce340ef805c2210c
Instruction Fuzzy Hash: B2513575A00208AFDF10DFE4CA88A9D7BB5EF48314F2045BAF505EB2D1DA799981CB54

Function 0040541D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040544C
CallWindowProcA.USER32(?,?,?,?), ref: 0040549D

Part of subcall function 00404451: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00404463

Strings

, xrefs: 0040542D

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 14b3d6ef5c2a84fc52750bef5e2e8b29c93878db9a0e482e1958f3e7559ce471
Instruction ID: ce4d6245f7a5538c18ae28323cba1b5bdda0ccdff68052f186ad3da5f1ae13b7
Opcode Fuzzy Hash: 14b3d6ef5c2a84fc52750bef5e2e8b29c93878db9a0e482e1958f3e7559ce471
Instruction Fuzzy Hash: 2A015E31200608AFDF216F51DD80BAF3A66EB84716F104537FA05761D2C7799CD29F6A

Function 0040626F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,00000400,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00420530,?,?,?,00000002,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,00406527,80000002), ref: 004062B5
RegCloseKey.ADVAPI32(?,?,00406527,80000002,Software\Microsoft\Windows\CurrentVersion,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,00420530), ref: 004062C0

Strings

C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00406272, 004062A6

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: CloseQueryValue
String ID: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
API String ID: 3356406503-1702744724
Opcode ID: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
Instruction ID: 5c8aa4f59809ec7c4ed175be077f356401e74c3ba082423fbe1b6bbc42bea5f4
Opcode Fuzzy Hash: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
Instruction Fuzzy Hash: 8101BC72100209ABDF229F60CC09FDB3FA8EF45364F01407AFD56A6190D638C974CBA8

Function 00405D61 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,00402FC8,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405D67
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,00402FC8,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405D75

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00405D61

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 2709904686-1943935188
Opcode ID: 46bbde6159133eac16457addd6c3fa88623ef59ff022f94c34d6ba2180d3974b
Instruction ID: 27c40c0738421aba4af956c8f0f705930dfe744a77a65273bf6dbb66402e0641
Opcode Fuzzy Hash: 46bbde6159133eac16457addd6c3fa88623ef59ff022f94c34d6ba2180d3974b
Instruction Fuzzy Hash: CBD0A772409D706EE31353208C04B8F6A48CF13300F0D4063E481A6190C2785C424BFD

Function 00405E80 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E90
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405EA8
CharNextA.USER32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EB9
lstrlenA.KERNEL32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EC2

Memory Dump Source

Source File: 00000009.00000002.3995599068.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3995566062.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995632910.0000000000408000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000040A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.0000000000422000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3995862076.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3996076230.000000000042E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_setup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
Instruction ID: 98ea32bb50e75ca8be10b873c57fc005eda9f523d07111d413316ed06cfa332a
Opcode Fuzzy Hash: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
Instruction Fuzzy Hash: 5FF06235104918AFCB129BA5DD4099EBFA8EF55350B2540B9E880F7211D674DF019BA9

Analysis Process: GamePall.exePID: 6676, Parent PID: 1712COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	14
Total number of Limit Nodes:	2

Executed Functions

Function 0099D3F0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0099D46E
GetCurrentThread.KERNEL32 ref: 0099D4AB
GetCurrentProcess.KERNEL32 ref: 0099D4E8
GetCurrentThreadId.KERNEL32 ref: 0099D541

Memory Dump Source

Source File: 0000000A.00000002.3876224374.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_990000_GamePall.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 99fd2ac20ae926942f8ea171d366f7ba1ff4a99ac06eb088a22b645c0104ef4d
Instruction ID: 639de0c895a66062be5b93e27814df824de7fe8dc888ef1b71a10972efb05411
Opcode Fuzzy Hash: 99fd2ac20ae926942f8ea171d366f7ba1ff4a99ac06eb088a22b645c0104ef4d
Instruction Fuzzy Hash: D0515BB09013098FDB14DFA9D588B9EBBF5FF49304F208459E409A7360D778A944CF66

Function 0099D3EF Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0099D46E
GetCurrentThread.KERNEL32 ref: 0099D4AB
GetCurrentProcess.KERNEL32 ref: 0099D4E8
GetCurrentThreadId.KERNEL32 ref: 0099D541

Memory Dump Source

Source File: 0000000A.00000002.3876224374.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_990000_GamePall.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9d4811361b87a5a739c984a8a1acd03e1fb91445a62c0ff40529e9831da4893c
Instruction ID: 148d6dcddd096d2fc3e75a19b02dcbde3c60c977d94f5357e2e79d744c5bf507
Opcode Fuzzy Hash: 9d4811361b87a5a739c984a8a1acd03e1fb91445a62c0ff40529e9831da4893c
Instruction Fuzzy Hash: C85158B09013498FDB14DFA9D588BAEBBF5FF49304F208459E009A73A0C778A944CF66

Function 0099D630 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0099D6BF

Memory Dump Source

Source File: 0000000A.00000002.3876224374.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_990000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e311d29c50b2966b512680c8ea89d4747bb8d12be7492ce06dfd17af85592744
Instruction ID: 52fe9d34027cb66b78a55cf8861a9bc1589ec669d954584fd9fa278e7d1c48c8
Opcode Fuzzy Hash: e311d29c50b2966b512680c8ea89d4747bb8d12be7492ce06dfd17af85592744
Instruction Fuzzy Hash: A521E3B5D012489FDB10CFAAD984AEEBFF5FB48320F14841AE918A7350D379A944CF61

Function 0099D638 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0099D6BF

Memory Dump Source

Source File: 0000000A.00000002.3876224374.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_990000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fbe45d2863835e3f2464b20b82acf8e00712c616a42fe9cdebca382e6190375a
Instruction ID: 35c55cf1d9da21291bf8cbcd16e191a62e2a2f077042719f84dd2418a951277d
Opcode Fuzzy Hash: fbe45d2863835e3f2464b20b82acf8e00712c616a42fe9cdebca382e6190375a
Instruction Fuzzy Hash: 1721C4B59012489FDB10CFAAD984ADEBFF9FB48310F14841AE918A3350D379A954CFA5

Function 0099E020 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(?,?,?,?), ref: 0099E090

Memory Dump Source

Source File: 0000000A.00000002.3876224374.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_990000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 31846f78618d0c9cbb1b358ac203d7366294289907279da6ccb7fe158206c72b
Instruction ID: a957a6c4429893e16131d687db6678ec81dbdba44526fa4f12f4e04dc48e32cb
Opcode Fuzzy Hash: 31846f78618d0c9cbb1b358ac203d7366294289907279da6ccb7fe158206c72b
Instruction Fuzzy Hash: E91104B18002498FDB20DF9AD444BEEBBF5FB48320F208429E558A7650D379A945CFA1

Function 0099E028 Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(?,?,?,?), ref: 0099E090

Memory Dump Source

Source File: 0000000A.00000002.3876224374.0000000000990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_990000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: ad6706ab6238fa2b9d17d344a13c2194a6cd800f875cc6f242ffab0ad5758916
Instruction ID: 31d01282209bc7f20966903c37395c276d985ddbc6bd25074e17e5c8ddd5fed8
Opcode Fuzzy Hash: ad6706ab6238fa2b9d17d344a13c2194a6cd800f875cc6f242ffab0ad5758916
Instruction Fuzzy Hash: 1D1113B18002499FCB20DF9AC845BDEBFF8FF48320F108429E558A3250D379A944CFA1

Function 007CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58bbef3f55fa914ca7395401f8f936b91e0392b38238fa7f0f4adad34d62cafd
Instruction ID: 6348e5348a1b88242b4e9d25f82062d8288ecf988c1fc0e4a34abcd167e76cec
Opcode Fuzzy Hash: 58bbef3f55fa914ca7395401f8f936b91e0392b38238fa7f0f4adad34d62cafd
Instruction Fuzzy Hash: 2421D1716042449FDB25DF18D984F26BB65FB88324F24C57DE9490B246C37EDC87CAA2

Function 007CE700 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4450cc09c80f2ee0398bd0eadab9f1a5dedec99b9412f9f31c9794dbeb1c251
Instruction ID: 222da313d2438f7f76ce1fac091df9b60a409849a2c2aca0f741c392df46dd33
Opcode Fuzzy Hash: c4450cc09c80f2ee0398bd0eadab9f1a5dedec99b9412f9f31c9794dbeb1c251
Instruction Fuzzy Hash: 91210475504204DFDB14DF24D9C0F26BB65FB98314F20C96DE90A4B296C33ED846CB61

Function 007CD1CC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67418c08dc6994de153310cd7aeecb0fdb7ee90f5a5813120b2d090c4ce637e
Instruction ID: 055ecad51b8141292e6ba466407de2ce52822ac41039c7d52041c84f4b06681b
Opcode Fuzzy Hash: b67418c08dc6994de153310cd7aeecb0fdb7ee90f5a5813120b2d090c4ce637e
Instruction Fuzzy Hash: 3A2122B15042049FDB24DF24C9C0F26BBA5FB88314F24C57DD8094B296C33EDC06DA61

Function 007CE2D8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7c513065ac28c56e8f3afa48a5ba08e8698d5bda07327c79c94290b5aa6e37
Instruction ID: 92e3bd3893fa56e9eec81a76d6fbed0fb325ebf7752d4f30d5fb5d153536d100
Opcode Fuzzy Hash: ce7c513065ac28c56e8f3afa48a5ba08e8698d5bda07327c79c94290b5aa6e37
Instruction Fuzzy Hash: FE21C2B1504284DFDB04DF24D984F26BFA5FB94314F24C56DD9094B396C33EE846C662

Function 007CFEFC Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16fad4735e4ef7b817ea0c32e1a8252c37a5fad70affa01984e7da14f0451ee9
Instruction ID: cc7c66790c13b1757040c8be543a4970d83f118551710daf558613d7b87e61f0
Opcode Fuzzy Hash: 16fad4735e4ef7b817ea0c32e1a8252c37a5fad70affa01984e7da14f0451ee9
Instruction Fuzzy Hash: B621D1716042449FDB04DF24D984F26BBA6FB95314F20C57DE9094B395C33ED806C6A1

Function 007CE3B8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a0588b440da2ed9b805ff7044d248c2db73f5c3aa291427588275705a4e77e
Instruction ID: 0731b68401d8137f9dea0be54b64ab5dba5edca402313ba4b94598e2d3bdaf1f
Opcode Fuzzy Hash: 01a0588b440da2ed9b805ff7044d248c2db73f5c3aa291427588275705a4e77e
Instruction Fuzzy Hash: 5C21CFB1604280DFDB08DF24D584F26BBA5EB94314F20C56DE9494B291C33ED906C6A2

Function 007CEE68 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7b2b310945c23fcc8f8d2fae5677815a2951f67bb75ab3fc0e9332496d3d13b
Instruction ID: 847ead900c51affec1fadadeff90e7e6b1e6a17132a8abde4ca0d1f3d863609c
Opcode Fuzzy Hash: a7b2b310945c23fcc8f8d2fae5677815a2951f67bb75ab3fc0e9332496d3d13b
Instruction Fuzzy Hash: E721D2B1644244DFEB14DF28D5C4F26BBA5EB94314F20C66DD94A4B392C33ED846C6A2

Function 007CF8F8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847a173409c3d81a0a476f652ac28cc9bb6051721f1eacec44fc856eccee45bd
Instruction ID: df83c0f83b4d66ef8d4534a13f21a3cd391e88374b04a0da7fffe3ff6f2aa555
Opcode Fuzzy Hash: 847a173409c3d81a0a476f652ac28cc9bb6051721f1eacec44fc856eccee45bd
Instruction Fuzzy Hash: F22102B1604344AFDB14DF24D5C0F26BBAAEB94314F20C57DD94A8B391C33EE806C6A2

Function 007CE7E8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a0d780d2b398fe6ad45341c2d1b5e434ddd7806dd6827fb5e14981b3e1159ba
Instruction ID: 46d0d1af20be09bc108a47eb08996de7038ffc832aafad04447fa43690cbce76
Opcode Fuzzy Hash: 3a0d780d2b398fe6ad45341c2d1b5e434ddd7806dd6827fb5e14981b3e1159ba
Instruction Fuzzy Hash: 1621FDB16042409FDB14DF28D5C4F26BBE9EB94314F20CA7DD90A4B292C33ED846C6A2

Function 007CF5B8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e06941311d3522c587fbb63b5480404c1c29b079a3abe0be5b57a036836bc19
Instruction ID: 234d2c669e69af6cd3c37e119aa90f37fc41feb0332aff02ebc27224cfe08411
Opcode Fuzzy Hash: 5e06941311d3522c587fbb63b5480404c1c29b079a3abe0be5b57a036836bc19
Instruction Fuzzy Hash: B721F3B16442409FD704DF24D9C4F26BBA6EB94314F30C57ED94A5B361C33E9806C662

Function 007CDF98 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec2f1a7060fe66372bb03cc56d68c69ce99899d10880fbb5de1f3cebdc8fd9d4
Instruction ID: 54016d42b2b9bbc69544805f6a0df654517944a9b5bd9d27dde681f87155c7af
Opcode Fuzzy Hash: ec2f1a7060fe66372bb03cc56d68c69ce99899d10880fbb5de1f3cebdc8fd9d4
Instruction Fuzzy Hash: 8B21F0B16446409FDB24DF24D9C4F26BBA5FB94314F30C56DD90A4B291C37ED886C6A2

Function 007CF688 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6dea59b9e2b39520ab394b80a0eba310e1b1e151cb9bd93789a57e6d37ae9f
Instruction ID: 7679a8a1be962f6a76991f6531600b5fc8c60948d9e8489365313ced8032c5af
Opcode Fuzzy Hash: fd6dea59b9e2b39520ab394b80a0eba310e1b1e151cb9bd93789a57e6d37ae9f
Instruction Fuzzy Hash: B42102B5604240DFDB14DF24D9C4F26BBA6EB94714F60C57DD90A4B391C73ED806CAA2

Function 007CD003 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce9a54ccd5d4595b1a4f0ecb9e6f778be7c26e4655e0e30e2d11315ec1e7b91
Instruction ID: 04dfd10e1b86de8d5e3f2f24da30f0341c77649c160514ed7d459c4e95461997
Opcode Fuzzy Hash: 3ce9a54ccd5d4595b1a4f0ecb9e6f778be7c26e4655e0e30e2d11315ec1e7b91
Instruction Fuzzy Hash: B52192755083809FCB128F14D984B16BF71FB96314F29C5EED8858B253C33A9C4ACB62

Function 007CE6FB Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: b079375265dc93a10c3fd19540d9e6d8ddc18d0ebfc9d778d0a11d9362f69502
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 5A11DD79504280CFDB02CF10D5C4B15BFA2FB84314F24C6AEDC494B696C33AD84ACB62

Function 007CD1C7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 82753d8d6c98633a9d442258c08ccb8d76b3d5849fb5c0693177a11bbe993ad1
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: FD11DD75504280DFDB12CF10D5C4B15BFA2FB88314F24C6ADD8494B256C33AD80ACB62

Function 007CE2D3 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212b96ca827b798fa91ccd41c0eac3b093082415815754ec50078a914fdf967d
Instruction ID: 50ba3d335236cdddb84164712d68af7b7bb9eb5363ffbf2155012eb398d54d26
Opcode Fuzzy Hash: 212b96ca827b798fa91ccd41c0eac3b093082415815754ec50078a914fdf967d
Instruction Fuzzy Hash: 4E11BF75504280CFDB16CF14D6C4B19BFA2FB95314F24C6ADD8494B6A6C33AE84ACB52

Function 007CFEF7 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d49e4a1442b6ae817b54e6d01109cf66e3cf9bb30be93c629efda23a912acd
Instruction ID: 11cfa27dca9d8a56362daca8e34ccfa4f4848bd06d945082e015e5ad9413aa75
Opcode Fuzzy Hash: 93d49e4a1442b6ae817b54e6d01109cf66e3cf9bb30be93c629efda23a912acd
Instruction Fuzzy Hash: 7211BF75504280CFDB15CF14D5C4B15BFA2FB85314F24C6ADD8494B652C33AD80ACB92

Function 007CE3B3 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d49e4a1442b6ae817b54e6d01109cf66e3cf9bb30be93c629efda23a912acd
Instruction ID: 8309d1d95d403d486d464447e9af2e331c6235608496a014f9b7e6d2b24f536c
Opcode Fuzzy Hash: 93d49e4a1442b6ae817b54e6d01109cf66e3cf9bb30be93c629efda23a912acd
Instruction Fuzzy Hash: 7711CE75504680CFDB19CF14D6C4B15BFA2FB94314F24C6ADE8494B752C33AD90ACBA2

Function 007CEE63 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561e0040fa13a4c8f15330505c2ec777d2b9bad7fdc99719fcd56c8bdcde1cea
Instruction ID: 4ae561421f6b7557ad62b5e5766b6cfd6488bbb554c2281ab3fd7f6e07fbee58
Opcode Fuzzy Hash: 561e0040fa13a4c8f15330505c2ec777d2b9bad7fdc99719fcd56c8bdcde1cea
Instruction Fuzzy Hash: C711ECB5508280CFDB15DF24D5C4B25BBA1FB94314F24C6ADD8494B692C33AE84ACBA2

Function 007CF8F3 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561e0040fa13a4c8f15330505c2ec777d2b9bad7fdc99719fcd56c8bdcde1cea
Instruction ID: e18674547b65c3227b6dd0e1f1a4ae4d1f7716db46e893d7669a0ed3ae985ead
Opcode Fuzzy Hash: 561e0040fa13a4c8f15330505c2ec777d2b9bad7fdc99719fcd56c8bdcde1cea
Instruction Fuzzy Hash: DA11CEB55042809FDB15CF24D5C4B15BBA2FB54314F24C6ADC8898B792C33AA84ACB92

Function 007CF5B3 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561e0040fa13a4c8f15330505c2ec777d2b9bad7fdc99719fcd56c8bdcde1cea
Instruction ID: 390fc74fdb369a6ec8877206aad1e6828ea2909c6232494ed521aba4276f07b3
Opcode Fuzzy Hash: 561e0040fa13a4c8f15330505c2ec777d2b9bad7fdc99719fcd56c8bdcde1cea
Instruction Fuzzy Hash: 8911CE755046808FDB05DF24D5C4B15BBA2FB54314F24C6BEC9494B662C33A984ACB92

Function 007CF683 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3746099788.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561e0040fa13a4c8f15330505c2ec777d2b9bad7fdc99719fcd56c8bdcde1cea
Instruction ID: 53e0cafe5689464e8db02fb656b7aa2f77306e7b8f1c06ba1d152b197212d92c
Opcode Fuzzy Hash: 561e0040fa13a4c8f15330505c2ec777d2b9bad7fdc99719fcd56c8bdcde1cea
Instruction Fuzzy Hash: 14119E75504680CFDB15DF24D5C4B15BFB2FB54314F24C6ADD8494B652C33AD84ACB92

Analysis Process: GamePall.exePID: 3440, Parent PID: 6676COMMON

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	22
Total number of Limit Nodes:	2

Executed Functions

Function 050272A8 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4764355865.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5020000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ec1b92cdeac093fa8836d6758834f9e50ff9ff0f22ee031b8d3e00d90492f8
Instruction ID: 5561405859dddb763b4da1cd1fff37359a8e05bab8da0f8eb559b5ba10ce30d3
Opcode Fuzzy Hash: 62ec1b92cdeac093fa8836d6758834f9e50ff9ff0f22ee031b8d3e00d90492f8
Instruction Fuzzy Hash: 0541F072E043658FCB14DFA9E8447AEBBF5EF89310F04856AD808E7241EB789845CB91

Function 022DD630 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 022DD6BF

Memory Dump Source

Source File: 0000000C.00000002.4164540907.00000000022D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_22d0000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7804fda5c15bce4a2c6245358bf4daf4cdc91182d35286d2c444b52175a198b2
Instruction ID: a787e7d6b123f60889d1091d0f2fa8b38ef83c0d8e281074f66d6d19b227bef9
Opcode Fuzzy Hash: 7804fda5c15bce4a2c6245358bf4daf4cdc91182d35286d2c444b52175a198b2
Instruction Fuzzy Hash: 6B21E4B5900209AFDB10DFAAD584ADEBFF4FF48320F14845AE918A7310D378A945CFA4

Function 022DD638 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 022DD6BF

Memory Dump Source

Source File: 0000000C.00000002.4164540907.00000000022D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_22d0000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f87b4efb152481bb62f38a6ee707b4226917c8177f6772a4abda09fbfd98031b
Instruction ID: 35c98b65f44f7d3233b316738c2bae15bf32a4271df7ebee4df99f202e7693cf
Opcode Fuzzy Hash: f87b4efb152481bb62f38a6ee707b4226917c8177f6772a4abda09fbfd98031b
Instruction Fuzzy Hash: C821F5B59002089FDB10CF9AD984ADEFFF8FB48310F14841AE918A3310D378A944CFA4

Function 022DE020 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(?,?,?,?), ref: 022DE090

Memory Dump Source

Source File: 0000000C.00000002.4164540907.00000000022D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_22d0000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 4aadfb24497daa1495041390a0e2ccb94ca2df1b24ffc3fd3ff60667de3074a3
Instruction ID: d9e36b71f6b753132db9fbb28a35c8ec9d79a76dd72d58b1db438a4aa4523533
Opcode Fuzzy Hash: 4aadfb24497daa1495041390a0e2ccb94ca2df1b24ffc3fd3ff60667de3074a3
Instruction Fuzzy Hash: AA1137758002498FDB10DF99D984BDEBBF4FF58310F208429E558A7251D339A945CFA0

Function 05027390 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 050273F7

Memory Dump Source

Source File: 0000000C.00000002.4764355865.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5020000_GamePall.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 1f3aa33d1090a78617c9adeeaef8deea5bd894a88e7dc758c88d7ca1dbf7c377
Instruction ID: 2709ee03604367bfd938b7f37722bc23740ac1f064d774a91fbd11f70d102c48
Opcode Fuzzy Hash: 1f3aa33d1090a78617c9adeeaef8deea5bd894a88e7dc758c88d7ca1dbf7c377
Instruction Fuzzy Hash: 9111EFB1C0066A9BCB10DF9AD544B9EFBF4FF48320F14816AD918A7240D778A944CFE5

Function 022DE028 Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(?,?,?,?), ref: 022DE090

Memory Dump Source

Source File: 0000000C.00000002.4164540907.00000000022D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_22d0000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: cd4c362af1fc5df9735b07ecf5e71b2be9e47e9208c9254729b9466798531c37
Instruction ID: a98c36eb1c28b102c80fc5ba8b4e6c8746a25c983c2ff07cb41468897fe5fe44
Opcode Fuzzy Hash: cd4c362af1fc5df9735b07ecf5e71b2be9e47e9208c9254729b9466798531c37
Instruction Fuzzy Hash: 6C1116B59002499FCB20DF9AD884BDEBFF8FF48320F108419E558A7251D379A544CFA1

Analysis Process: GamePall.exePID: 3220, Parent PID: 6676COMMON

Executed Functions

Function 011E4F58 Relevance: 11.9, Strings: 9, Instructions: 614COMMON

Download Yara Rule

Strings

(aq, xrefs: 011E55CF
(aq, xrefs: 011E51CD
(aq, xrefs: 011E589B
(aq, xrefs: 011E5056
(aq, xrefs: 011E5655
(aq, xrefs: 011E5082
(aq, xrefs: 011E51F9
(aq, xrefs: 011E55A3
(aq, xrefs: 011E586F

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq$(aq$(aq$(aq$(aq$(aq$(aq
API String ID: 0-416939441
Opcode ID: 8b2ec5a6f3c601a6ed57557301f2fd2fe339fe4e3709bf45c8a72b21f8fd838b
Instruction ID: 19cbc9a90765c41e76b467e770aa306d817e5357e1e3951a42b013274ea28001
Opcode Fuzzy Hash: 8b2ec5a6f3c601a6ed57557301f2fd2fe339fe4e3709bf45c8a72b21f8fd838b
Instruction Fuzzy Hash: 3E329E34A006158FCB49DFA9C4586AEBBF3BF89314F15806AE505EB3A5DF349C42CB91

Function 011E3750 Relevance: 3.8, Strings: 3, Instructions: 88COMMON

Download Yara Rule

Strings

(aq, xrefs: 011E37B2
(aq, xrefs: 011E3786
(aq, xrefs: 011E3820

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq
API String ID: 0-2593664646
Opcode ID: 69ec21f9980ecad91ce9c6aa024eec15a5977667642b8646fba3d020763b4bc6
Instruction ID: 8b36d04cf448a9cd4ca76735098a677879ad3cf73c3b8408f73e18b6c6e2593b
Opcode Fuzzy Hash: 69ec21f9980ecad91ce9c6aa024eec15a5977667642b8646fba3d020763b4bc6
Instruction Fuzzy Hash: 83213B31B182510FD31A6B7A541407E7EE7ABD6221759826EE909C73D5DF388D0743A2

Function 011E3BE0 Relevance: 3.0, Strings: 2, Instructions: 465COMMON

Download Yara Rule

Strings

(aq, xrefs: 011E419C
(aq, xrefs: 011E3DE5

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: cd8c3b7583fac73382d1565f52ce14b70068fde7f846f17a6e2449e76274c171
Instruction ID: 026a29f06dbeeb349685ed3fd9d53a96375fe67da9067941669d80318b59ffd1
Opcode Fuzzy Hash: cd8c3b7583fac73382d1565f52ce14b70068fde7f846f17a6e2449e76274c171
Instruction Fuzzy Hash: 38F16F30B002159FCB09ABAAD45466E7BFBEFC8300B148569E916DB3A9DF74DC06CB51

Function 011E385A Relevance: 1.6, Strings: 1, Instructions: 303COMMON

Download Yara Rule

Strings

(aq, xrefs: 011E3BA1

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: a4a3e8d9df4455ac6084b3ae84568bbc1805dc7a27a9d7c99992f430dcd5ff41
Instruction ID: 914d1cd1e14ae5228d4dbabaf1a642a3b4e2b31ee9c949395ba9553fea78a956
Opcode Fuzzy Hash: a4a3e8d9df4455ac6084b3ae84568bbc1805dc7a27a9d7c99992f430dcd5ff41
Instruction Fuzzy Hash: B5C15174B102199FDB09EFA9E954AAE7BF6FFC8700F108169E805A7365DB349C01CB91

Function 011EBEAF Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Te]q, xrefs: 011EBF75

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 1a341329ace98198ef5e1036fe68f6b582d219abb635e55541e927e2a7cbc331
Instruction ID: 715fe4c15abb98fe21e9ea9053b2cefb5311c46d206946cdfe8604e59350ce4f
Opcode Fuzzy Hash: 1a341329ace98198ef5e1036fe68f6b582d219abb635e55541e927e2a7cbc331
Instruction Fuzzy Hash: 624151347106158FC744EF6DC498A6EBBE6FF89714B6584A8E406DB3B1DB70DC028B91

Function 011E2B10 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

LR]q, xrefs: 011E2B35

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: f6ba111cd094ac2f7f0ba4e2ce2199aa675871e330c61548b22479193580af78
Instruction ID: 957e7f9de513ed34e19f3932046b4f5bff5975afee78993c3b6683ee0bb28143
Opcode Fuzzy Hash: f6ba111cd094ac2f7f0ba4e2ce2199aa675871e330c61548b22479193580af78
Instruction Fuzzy Hash: 2F312F307102118FDB19AB39D45466E33B3EBC9A187208179D14ACB3A5DF39DC43CBA6

Function 011EBEC0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Te]q, xrefs: 011EBF75

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: bd09433e4b50669312fb770a9dec6f427a35524905ba13bde5592f9e66eed7f1
Instruction ID: ff9e129f9ccea839cbd2b88e814a4cb94eaf04a980fcf4dd0a1ae5ddf8a6a415
Opcode Fuzzy Hash: bd09433e4b50669312fb770a9dec6f427a35524905ba13bde5592f9e66eed7f1
Instruction Fuzzy Hash: AD3163347105158FC744EF6DC498E1EBBE6BF88710B658568E406DB3B5CB70DC018B81

Function 011E4237 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

(aq, xrefs: 011E4295

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: f2f99abe8774eeec93d3d1789487015b3d07c629a032d2723fe4d629afed8071
Instruction ID: 223259f04dc761830844d3c72900c28bd4fcd478d5bea445bcdc295238af9b8a
Opcode Fuzzy Hash: f2f99abe8774eeec93d3d1789487015b3d07c629a032d2723fe4d629afed8071
Instruction Fuzzy Hash: 091129316083414FC31A9B7964241AE3FA2EFD252070841EEC485CB656CF788C47C792

Function 011E1049 Relevance: .8, Instructions: 842COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb50e5fc8edf8135460b25b277c6857c207d844631ff173764ed31e182cc15f2
Instruction ID: a094e96d406bcd5714d6b85ea6f188f9a8dc6f78d67f183c18cfb995161693c8
Opcode Fuzzy Hash: bb50e5fc8edf8135460b25b277c6857c207d844631ff173764ed31e182cc15f2
Instruction Fuzzy Hash: BE8223B8640219DFDB06EBA6E654B6E7B7BEFC8300F104514E900233ADCB796D45DB26

Function 011E1058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08f5ee3441febb299fcfef2b96b10e5d405ff568ba494db4a78d8526b53d465
Instruction ID: f89e0c1e72f2b03783f4a8dccb68afb2d860dda614be9ca31ca01d43432d3562
Opcode Fuzzy Hash: b08f5ee3441febb299fcfef2b96b10e5d405ff568ba494db4a78d8526b53d465
Instruction Fuzzy Hash: 5D8223B8640219DFDB06EBA6E654B6E7B7BEFC8300F104514E900233ADCB796D45DB26

Function 011EB0B0 Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 486726d0ce70a3af4051fbd7229263164baa0b80c60398943870d52f5bd0b586
Instruction ID: d1c6161a0e7f8b35437dfc84ef18461f1a0293722446010daf62f8d9fd337a24
Opcode Fuzzy Hash: 486726d0ce70a3af4051fbd7229263164baa0b80c60398943870d52f5bd0b586
Instruction Fuzzy Hash: FD526834A01611CFCB1AEF69E54892C7BB3FF84305B648569D41A9B3A9DB71EC42CF81

Function 011EBB99 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e479cf9177a6b64369e6d25711c614e42a3471b5a9a1f8286c3e194bd3e2decc
Instruction ID: 8fb80b6d1943e0290f75eefa9b044f2c0ae412a1e218f678e65d4340b24f7634
Opcode Fuzzy Hash: e479cf9177a6b64369e6d25711c614e42a3471b5a9a1f8286c3e194bd3e2decc
Instruction Fuzzy Hash: 04812978602125CFCB1AEF69E689D297BB6FBC0305B15C2A9D1148B22DC7B1EC49CF40

Function 011E5A91 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c9633c199c210df732abbb1500f3c9ce77864bfcdae2e7bd2f23e8e4c237f6
Instruction ID: b5f6af1118b9e5b37cbaced98793d21b48cdb582035d214d9f795f02a2350293
Opcode Fuzzy Hash: 87c9633c199c210df732abbb1500f3c9ce77864bfcdae2e7bd2f23e8e4c237f6
Instruction Fuzzy Hash: 79516E74B006068FCB48DFA9D59896EBBF6FF88314B1141A9E509DB365DB70DC06CB60

Function 011E5240 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3891932144885469c66da556b21ed85854a8bd163b9fd10770650d6b49f68a
Instruction ID: 652f076f56adc5430d6497ffd2aa84d298566739d60f17ad01a30cbfeb606e70
Opcode Fuzzy Hash: 7e3891932144885469c66da556b21ed85854a8bd163b9fd10770650d6b49f68a
Instruction Fuzzy Hash: 26516C34A00619DFCB49DFA9D488AADBBF3BF88319F158165E505AB364DB709C41CF90

Function 011E2850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d642219a9e0784abb9aa49c553c481dd37bddf8d5c49cd269c7115c843b3a052
Instruction ID: d430c65d684bb986d73e9cd50ee069859b15f12f13d18a9368f25a4472b5576a
Opcode Fuzzy Hash: d642219a9e0784abb9aa49c553c481dd37bddf8d5c49cd269c7115c843b3a052
Instruction Fuzzy Hash: A7412B34E00218CFDB19EFA6D9949ADBBF6FF88340F104529E905A7369EB749845CF10

Function 011EB0A0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72cd0097f65691b5793958e74da250a49b3810d8ee99844764dcec852d7aeeef
Instruction ID: a0b37db4901b22cd9cc87ce042c3a9e35af24836bb3d0ebfa35d5dbf26715e58
Opcode Fuzzy Hash: 72cd0097f65691b5793958e74da250a49b3810d8ee99844764dcec852d7aeeef
Instruction Fuzzy Hash: 7631F630A006158FC709EB79E94469DBBAAFFC5310F148529C019DB7A9DB74AD0ACB81

Function 011E5308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9689a5ed62d6c67f8d5562132e6fc703418090bdd3a8df4b9845361cd09729
Instruction ID: 3dfcc554732a58bcdf30aa1774d05ae54a2251daebd4cd1b687c867963536a1a
Opcode Fuzzy Hash: 5e9689a5ed62d6c67f8d5562132e6fc703418090bdd3a8df4b9845361cd09729
Instruction Fuzzy Hash: BA411A34A005199FCB48EFA5E498AADBBF3FF88305F158165E806A7364DB749D42CF50

Function 011E2842 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6356906208e59d18f9890ecb8dcdc870bdfd8b8da431e5777c687908964e1021
Instruction ID: 9ded41ae0890834a5a57006a0259fc92fc68be374c70eecb04bee47f99956344
Opcode Fuzzy Hash: 6356906208e59d18f9890ecb8dcdc870bdfd8b8da431e5777c687908964e1021
Instruction Fuzzy Hash: 72314B31A00218CFDB19EFA6D9989EDBBFAFF88344F104539D505A7268EB749845CB11

Function 011E2C48 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac83df9e5f7dcb9a2fadc0497277f23b51824e421fd353957f0bb695c581daa
Instruction ID: 2a2e99b68cab0b2313c0b0fdd7fc6a53c0490f25e195d81ab8763c87a34b16a3
Opcode Fuzzy Hash: fac83df9e5f7dcb9a2fadc0497277f23b51824e421fd353957f0bb695c581daa
Instruction Fuzzy Hash: 9E419D7490021ACFDB09EFA9D584AEE7BF5FF88314F104229E505A7369DB749941CFA0

Function 011E4B50 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9504215ef833956b42081f29474997103cd2691c0122c955b4c12e6ecfa7c581
Instruction ID: 1f090e7da673ff0f2e79d2d1f0e35b6c4428d15d5b067fec0de25867231738b3
Opcode Fuzzy Hash: 9504215ef833956b42081f29474997103cd2691c0122c955b4c12e6ecfa7c581
Instruction Fuzzy Hash: E821B9302443015FC71AEF79E890A5E7BAAFFC1314B048A79D4558B279DB78EC4ACB91

Function 011E2C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d102050f46fceb08944ca7686385b200a2040ae842c2ff38b83ce387ca82f581
Instruction ID: 071dda178eae59a24de738c74668af7bf23c08cb52737c66feb5cfa2aa0eed38
Opcode Fuzzy Hash: d102050f46fceb08944ca7686385b200a2040ae842c2ff38b83ce387ca82f581
Instruction Fuzzy Hash: 88316D7490021ACFDB08EFAAD584AEE7BF6FF88314F104225E505A7368DB759941CFA0

Function 011E288D Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 086272db29caaefb8c66888aa272362bb235bcf7ede15aa057a8681b9a5d0687
Instruction ID: be318639e775a136540e0547fd5f2f80347c6455eeb71cde18ff56464bdc74d3
Opcode Fuzzy Hash: 086272db29caaefb8c66888aa272362bb235bcf7ede15aa057a8681b9a5d0687
Instruction Fuzzy Hash: 92314030E10218CFDB19EFA6E994AADBBF6FFC8344F105129D505A7268EB749845CF21

Function 011E4B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 488694901b0468bdfd9676ad88b306b56fd447df98a5629a614ce033393ae8ba
Instruction ID: 9e7b6106a3b21abef15640a10c1dca57ec4ab38fc09803206af84c95a6a0756d
Opcode Fuzzy Hash: 488694901b0468bdfd9676ad88b306b56fd447df98a5629a614ce033393ae8ba
Instruction Fuzzy Hash: CB2145312002025FC719FB69E980E5E779AFFC4214B448A39D4158B668DF74ED4A8B95

Function 011E5C42 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e124b80d75e1f4bf88ac2412f9f3e83c2c04dcdc30d4298e4f28ee05041b7e7f
Instruction ID: 558fdd83c015fa65a945d5447426ef13b8063dcc7a3f8e1392bbc396be188c77
Opcode Fuzzy Hash: e124b80d75e1f4bf88ac2412f9f3e83c2c04dcdc30d4298e4f28ee05041b7e7f
Instruction Fuzzy Hash: A021BD34A44259CFDB59CFA9C598ADC7BF2BF48310F1501AAD405FB262CB7A5C41CB60

Function 011E2908 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32f7d055f8edec152f33745a6fd757e096d55f4f8419aff76a586bed125c0686
Instruction ID: 912399b7851dc5ef21186486bb12be7c0094206091ea4ec680b02e9b3ba81fef
Opcode Fuzzy Hash: 32f7d055f8edec152f33745a6fd757e096d55f4f8419aff76a586bed125c0686
Instruction Fuzzy Hash: C421ED34E10218DFDB19EFE9D9949ADBBB6FF88340F108129D91567268DB749805CF21

Function 011E6888 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f86c7a947b52ea2d7c548ce1a74bea9844a71118a462ad155ddf76fc5d438e
Instruction ID: 962daad397899a3e662d947930dfe7910f4cc338998baf9fd0ddc50a49d50f8b
Opcode Fuzzy Hash: 53f86c7a947b52ea2d7c548ce1a74bea9844a71118a462ad155ddf76fc5d438e
Instruction Fuzzy Hash: 5621DF71A00606CFDB18CFA4CA4CBEEBBF1EF54309F95806AD445A7252EB718A05CB52

Function 011E5C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527a76a6f768f8a196430e6a8d3e23924eceee35c5582e23a4f49ee328a08be9
Instruction ID: 63fc83917bacc7a0ed15cb80b95bdb8aa3e860a7624358fbb205d6406ed2e85b
Opcode Fuzzy Hash: 527a76a6f768f8a196430e6a8d3e23924eceee35c5582e23a4f49ee328a08be9
Instruction Fuzzy Hash: C8216A35A002188FDB58CBA9D598BDDBBF6BF4C314F2000A5E505BB361DB36AD44CBA0

Function 011E296A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489544a24c370524cf11e82737a01dac5b1e1d256dacdb67e1f0366f3c1ac02c
Instruction ID: 489bdcb6a4286dc01765258134808f8990d819518c93d48841beddd1acf2c241
Opcode Fuzzy Hash: 489544a24c370524cf11e82737a01dac5b1e1d256dacdb67e1f0366f3c1ac02c
Instruction Fuzzy Hash: 3721FA34900218CFCF19EFA9D99499CBBF6FF88340F204129E905A7368DB74A945CF11

Function 011E41A2 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93810c5ec24678d0c92628f9514eac95a7b66f5624876a71da03902300c603b3
Instruction ID: 0acbd4fecfe87793657b3621b45cffa9e719e8e0adf0e4e7711c889491226dd9
Opcode Fuzzy Hash: 93810c5ec24678d0c92628f9514eac95a7b66f5624876a71da03902300c603b3
Instruction Fuzzy Hash: 9101F5317083815FC70AAB7598A01AE3FBAFF8622571844AFD445D7292CF354C0BC766

Function 011E32E0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d66843c5e59e650bb5e1522307523bf102fa20e6c04ac04131e30542e371d669
Instruction ID: 29951af9b2975e19a2fa48d288b48940a5de5c5d72d59ed66e75f7cd198a38cd
Opcode Fuzzy Hash: d66843c5e59e650bb5e1522307523bf102fa20e6c04ac04131e30542e371d669
Instruction Fuzzy Hash: EF115E74A102048FCB19DFB5EA68BAE7BF2EBC8305F004468D58297265DB754801CF50

Function 011E5940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dee13e3d37d748dc80979bee3a8f294046bebd78713532169a9735f44b9d688a
Instruction ID: 787de7f0c50af0a862c2cd6a54bd10ccab0fec37054dd615c477dc9809fc93fb
Opcode Fuzzy Hash: dee13e3d37d748dc80979bee3a8f294046bebd78713532169a9735f44b9d688a
Instruction Fuzzy Hash: 1101A4767002208F8719BAAEE49485EB7B6FBC9665314857AE605C7354CF71DC068BA0

Function 011E2A80 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8448071b2b4e7bd44775706fb360067880c7f1f02ceb80de50605e51e9d17c35
Instruction ID: 438cecad70b76b58f5e545ca3512c144b5cb90c0999995ec26d57c8ba9169284
Opcode Fuzzy Hash: 8448071b2b4e7bd44775706fb360067880c7f1f02ceb80de50605e51e9d17c35
Instruction Fuzzy Hash: B0018C316107018FC716AF78C55489A7BF5FF85624324C9AAC09ADB325DB75EC068FC1

Function 011E32F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63509e0d1afc5d222dffaf6a92cae22ce1090b2c693f93965124e20073a6535a
Instruction ID: 0d8561e6715a87e4820e8b339fa1b14cfc0bf08f9af4087fd15e09d0445c6618
Opcode Fuzzy Hash: 63509e0d1afc5d222dffaf6a92cae22ce1090b2c693f93965124e20073a6535a
Instruction Fuzzy Hash: BF014C74A10208CFCB19EFB6EA68B9E7BF6ABC8305F004568D506973A9DF755804CB50

Function 011E6388 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a54d7c5a19fec4e17d2cd804932685e6f08ef7bb2a81042bc5015f4b98c7b295
Instruction ID: dd53024e99426a99ceb0c12e0472abd8807ae14ca5e28001e395f2961b702329
Opcode Fuzzy Hash: a54d7c5a19fec4e17d2cd804932685e6f08ef7bb2a81042bc5015f4b98c7b295
Instruction Fuzzy Hash: 12F06930D00309AFCB45EFB8E95459DBBB1EF85210B1081AAD404A7250E7358E06DF41

Function 011E593E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c920c7ceb3d1e1c8590f5ab4c33d6a2c94aa753d7538b5503ea0013dbc238b6
Instruction ID: 0383a04492eb88b715d00f06a49545e00e10a1e89023c766615b2e6af352e13d
Opcode Fuzzy Hash: 1c920c7ceb3d1e1c8590f5ab4c33d6a2c94aa753d7538b5503ea0013dbc238b6
Instruction Fuzzy Hash: 5AF0BE353002108F8319EFAAE088C6EBBF6FBC9265324817EE905C3324CB70CC028B60

Function 011E41E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2cacc7430a3812708d8fbea48f886ee3010b8b099cf4ea2e827b0efdd39ce9
Instruction ID: 527f86ec7c96109138249414cbf40814cfad9341b6f7bc023abf48c181bad64f
Opcode Fuzzy Hash: 9e2cacc7430a3812708d8fbea48f886ee3010b8b099cf4ea2e827b0efdd39ce9
Instruction Fuzzy Hash: CFE0E5317042056F870CB6AAB89096F769EFBC8564758482DE419D7344CF35AC0647A5

Function 011E2D92 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68142ba8a92270a24f0fdc7e106d676d6835ee659774d2f63d6b3b262acfba4e
Instruction ID: 57b5887dad9e24d02012c4faba620f718b7a3c3943579c8fd03859591673757c
Opcode Fuzzy Hash: 68142ba8a92270a24f0fdc7e106d676d6835ee659774d2f63d6b3b262acfba4e
Instruction Fuzzy Hash: 6EF01231E202198FC798EFAC85556DA7BF4FF48324B1140BAD649E7221E7308A018B92

Function 011E1FF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b6360b3f03ecf3890fb64e71dc1f5da1a9e55d02aa7d41db7071f07d25f2c7
Instruction ID: 875b2224985cd97b30e2f0ca2135ccd79561bcd0fc176c28c1c70ee635d0d228
Opcode Fuzzy Hash: a0b6360b3f03ecf3890fb64e71dc1f5da1a9e55d02aa7d41db7071f07d25f2c7
Instruction Fuzzy Hash: 08E065353443514FC7115BBED5688467BE9EF8A62530504BAE44AC7331D975CC068761

Function 011E6398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1e5d01dfc5dacb5719540d3716d80268f0f2abd69e357afe30ff447184b8eab
Instruction ID: eab2f8bca095f9ba83bd42a3ffe6f4f798b9878d588c903ad54f20476f71cddd
Opcode Fuzzy Hash: d1e5d01dfc5dacb5719540d3716d80268f0f2abd69e357afe30ff447184b8eab
Instruction Fuzzy Hash: D7F08230E00209EF8B04FFF8D94455DBBF5EF84200F1081A99408E7294DB309E05DF91

Function 011E2DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f352f6ffa1ed9a97d1007aa9985e63c6b2c168d7d6df21d98668e43352e3cb93
Instruction ID: ee558fc08d881a19e27a80295fc56ce92e384be119b4f04cd1483c41a6b7b3fb
Opcode Fuzzy Hash: f352f6ffa1ed9a97d1007aa9985e63c6b2c168d7d6df21d98668e43352e3cb93
Instruction Fuzzy Hash: DBE0C971E101198F8B88EFBD95056DE7BF5EB48210B1141BAD619E7351EB709D018B91

Function 011E374E Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8992ba08e9fe8a7fe1874785dcd2d3158b283196bc6819f7203de4d1cbde1ae6
Instruction ID: 87eae16844b29bf97c6b0df8e687ff98cf0a719a84d3362725890c13fab3403e
Opcode Fuzzy Hash: 8992ba08e9fe8a7fe1874785dcd2d3158b283196bc6819f7203de4d1cbde1ae6
Instruction Fuzzy Hash: 82E08635B506205B872D556961044BE76E7ABC82A1758413AED19C3308DF744C474791

Function 011E6469 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9645ff07fe9ef294199300fb77c6ae5b2222d9949264bb537876ac329ad6885d
Instruction ID: c97132dca64691f2a89e67b62f5fe60f7bcf9d371865a74b219528695957eaa8
Opcode Fuzzy Hash: 9645ff07fe9ef294199300fb77c6ae5b2222d9949264bb537876ac329ad6885d
Instruction Fuzzy Hash: DAE0EC74A846018FC748DA64D15185477A5EB8936171145BAD109CB275CA35CC42CA04

Function 011E66D2 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a69428ab2a899922b84b7cb86da19bf1a9d089a4cb66c5a297edf731ad771b0
Instruction ID: 41b2f267ad7315a5005977267b868ccc66ce8b939cd0d143604f89161b716128
Opcode Fuzzy Hash: 3a69428ab2a899922b84b7cb86da19bf1a9d089a4cb66c5a297edf731ad771b0
Instruction Fuzzy Hash: D0D012727043218B8749BAADB1040ECB7D2EBC8571308857FE115D7364CF748C135795

Function 011E6478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1442015f4017f6a296aaf2b23c378d877d9e72248772f32d2aa9db351a8bc7b8
Instruction ID: b810bd25a073e5356ec6681ed48cf81c7ad2af9138e78340dd9841745057e152
Opcode Fuzzy Hash: 1442015f4017f6a296aaf2b23c378d877d9e72248772f32d2aa9db351a8bc7b8
Instruction Fuzzy Hash: C0C01274B802048F8608EB6DE190C2573EAFBCC75071001B9E609CB379CE30EC82CA18

Function 011E5640 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3714481386.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0085278d19974babb16815882b79c56b51f3e693ec0b1d19bee802608df19c1
Instruction ID: 8c974d89d49db459c7dad7b6c35cb09799ea906dc990eff7c5a2964cf62d9f71
Opcode Fuzzy Hash: f0085278d19974babb16815882b79c56b51f3e693ec0b1d19bee802608df19c1
Instruction Fuzzy Hash: 5BB02B3450030D579611095ABC0C8113B1EEB4001C3104194AD0801110AE33C4100580

Analysis Process: GamePall.exePID: 2140, Parent PID: 6676COMMON

Executed Functions

Function 01464F58 Relevance: 7.9, Strings: 6, Instructions: 389COMMON

Download Yara Rule

Strings

(aq, xrefs: 014655CF
(aq, xrefs: 01465082
(aq, xrefs: 014651CD
(aq, xrefs: 01465056
(aq, xrefs: 014651F9
(aq, xrefs: 014655A3

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq$(aq$(aq$(aq
API String ID: 0-2219660067
Opcode ID: 1d3fc46b888119e791825d4f6b3306674ed03e406f09dbef3bcc9c3386049789
Instruction ID: f9d425b0c61ba2e1ee75b8096440696b6197ac9f1d382c8cc89f8534081cc2d3
Opcode Fuzzy Hash: 1d3fc46b888119e791825d4f6b3306674ed03e406f09dbef3bcc9c3386049789
Instruction Fuzzy Hash: 45E18C70F012198FDB05DF69D4546AEBBF2BF88354F14C06AD805AB3A5DB389D42CB92

Function 01465640 Relevance: 4.0, Strings: 3, Instructions: 215COMMON

Download Yara Rule

Strings

(aq, xrefs: 0146589B
(aq, xrefs: 0146586F
(aq, xrefs: 01465655

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq
API String ID: 0-2593664646
Opcode ID: cd51930ee843353ab03f8fbf1c4a5134ed2bea6e8c32696eca5487e34f2d2a4f
Instruction ID: 5cd3a9c38f7417841939fa7c6b78eb02d0d9d03eb7c18c5578838d4e2e1264b3
Opcode Fuzzy Hash: cd51930ee843353ab03f8fbf1c4a5134ed2bea6e8c32696eca5487e34f2d2a4f
Instruction Fuzzy Hash: F581DF74B012058FC705EF69D594A6EBFFAAF89600F24806AE406EB365CF34DD06CB91

Function 01463750 Relevance: 3.8, Strings: 3, Instructions: 88COMMON

Download Yara Rule

Strings

(aq, xrefs: 01463786
(aq, xrefs: 01463820
(aq, xrefs: 014637B2

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq
API String ID: 0-2593664646
Opcode ID: df0f1b906cd06f85237a902c227a21833790dbe1b76b0ee6c49fbcc4502704be
Instruction ID: 5fad10fc044ad4cfb55db16e929c4a36b5eb62844ddc77a475acc92a195fe1fa
Opcode Fuzzy Hash: df0f1b906cd06f85237a902c227a21833790dbe1b76b0ee6c49fbcc4502704be
Instruction Fuzzy Hash: 20216B317062554FD316AF3D541007F3AE7ABD622131981BEE90AC73D5CE388D074392

Function 01463BE0 Relevance: 3.0, Strings: 2, Instructions: 460COMMON

Download Yara Rule

Strings

(aq, xrefs: 01463DE5
(aq, xrefs: 0146419C

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: 03e968c871f28aa75ad7cdfe21f5401ee194e267e9f8ac10462e0d75583c319d
Instruction ID: 7ce2250880e0d5312a32a058905171871cb461c589753c4f26c4af334cdfc8d0
Opcode Fuzzy Hash: 03e968c871f28aa75ad7cdfe21f5401ee194e267e9f8ac10462e0d75583c319d
Instruction Fuzzy Hash: E3F16070B002059FDB05DF69E854A6E7BBBEFD8300F14846AE909D73A9DE389C46CB51

Function 0146B0B0 Relevance: 1.9, Strings: 1, Instructions: 680COMMON

Download Yara Rule

Strings

edq^, xrefs: 0146B23E

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID: edq^
API String ID: 0-4039055810
Opcode ID: cc8b5a9dfe0d95e00eb47e1dbf74b11fe64f2710dc7e87bc3fe9dee4d348e224
Instruction ID: 47364f002bead1e88a489808f251e50eb97f0e6ee6d8be5f94e434e76da05a31
Opcode Fuzzy Hash: cc8b5a9dfe0d95e00eb47e1dbf74b11fe64f2710dc7e87bc3fe9dee4d348e224
Instruction Fuzzy Hash: 7A523834B01200CFC719EF28E55896D7BA6FF89345B64846AD80ADB365DB39EC45CF82

Function 0146BEAF Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0146BF75

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 0687f37a787d50485adb8489c7fda1571197e5b23fe6793ffb7ba4ca9b550303
Instruction ID: 5c4c0469ade0ec4940938430b3a242d880695eb5a18a08ffad0e78d7db8b46b0
Opcode Fuzzy Hash: 0687f37a787d50485adb8489c7fda1571197e5b23fe6793ffb7ba4ca9b550303
Instruction Fuzzy Hash: 54415C747106019FC754DF2EC898A6EBBE6FF99710B2584ADE406DB3B5CA70DC028B91

Function 0146BEC0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0146BF75

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 33f00e2017d0713d14aa7c4f929b673375ecae1fd44975d55714138c5478c807
Instruction ID: 0eba9357571fe70c6790102b73cc50c6aa2c96e6663f62d9ff6a314979eadc2a
Opcode Fuzzy Hash: 33f00e2017d0713d14aa7c4f929b673375ecae1fd44975d55714138c5478c807
Instruction Fuzzy Hash: 03316D747105018FC744DF2EC898E2EBBE6FF98B10B6584A9E406DB3B5CA70EC018B81

Function 01462B10 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01462B35

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: c04fe9e357a38e62a919b45d1a28201d587c2d58fa0f3f09971b8973195d57e6
Instruction ID: 983d1f284e8ec292fba23d156b2313f564378f1752a745b4bca9ba98c740306b
Opcode Fuzzy Hash: c04fe9e357a38e62a919b45d1a28201d587c2d58fa0f3f09971b8973195d57e6
Instruction Fuzzy Hash: CD313A707112158FD709DB39D498A2E37B2EBC9A59B208179D10ACB3A4DE39DC43CB96

Function 01464237 Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

(aq, xrefs: 01464295

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: ab23c17e37b3f0d8acd2453a82a0f6ad5ccec9aee8020db891010413102645a1
Instruction ID: 3f400b78cc5c1016c1727770cc207c7f5e6d807ff33d65d08897ce349d124e1d
Opcode Fuzzy Hash: ab23c17e37b3f0d8acd2453a82a0f6ad5ccec9aee8020db891010413102645a1
Instruction Fuzzy Hash: 04016B726051400FD30A9B79A8116AE3F93EFD2511B4881BFC481CB795DF78990BC381

Function 01461049 Relevance: .8, Instructions: 838COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a54d0a94a51bac069a0363c5eaabd401b7ed137109d43eced0c75726dff3ace
Instruction ID: 2c2d91a6701143b4742b8785c0f6670355b14b8af77f6d1c01127f93d647ddbd
Opcode Fuzzy Hash: 5a54d0a94a51bac069a0363c5eaabd401b7ed137109d43eced0c75726dff3ace
Instruction Fuzzy Hash: E782CCB4740209DFDB06DBA9F658B6E7B7AEF88300F104454E801237A9CA3D6D55DB3A

Function 01461058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f98a2bba3686aeee8506fdaf564c4eb878f56a9c7b3feb503bcf6b7c44d508
Instruction ID: 2816f77de24148f732dfe4e130a4d96c1288e03216647431844a0d66734adcc1
Opcode Fuzzy Hash: 87f98a2bba3686aeee8506fdaf564c4eb878f56a9c7b3feb503bcf6b7c44d508
Instruction Fuzzy Hash: C382CCB4740209DFDB06DBA9F658B6E7B7AEF88300F104454E801237A9CA3D6D55DB3A

Function 0146BB99 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ef4d1b76ebbc467ba586c054bef5fd30d0b26431b94ef241ed956004074047
Instruction ID: d2f60f0747885dfb19bc63acf2faddd9732a55ac6266156edcac4994b901c1ed
Opcode Fuzzy Hash: 44ef4d1b76ebbc467ba586c054bef5fd30d0b26431b94ef241ed956004074047
Instruction Fuzzy Hash: 9881F270B02205CFC314DF18FA8995A7BBAFB88344B14C569D9048B329C738EC49EF85

Function 014638EB Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e0c779ae879591287f4a1f0785c7c73a3b65cab18f4418dc8e7e4baadeed227
Instruction ID: 8bbb21f3fb458f398c339432088b43bfafefc17bffa3cde0afac95004e418b19
Opcode Fuzzy Hash: 0e0c779ae879591287f4a1f0785c7c73a3b65cab18f4418dc8e7e4baadeed227
Instruction Fuzzy Hash: 68516E74B01219EFDB05DFA9E954AAEBBBAFF88700F104019E805A73A5CB399D41CB51

Function 01465A91 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 672e491d3883ec087b88d6e3023c9c7b0c1ade9ff49fe3d0514865e39f462603
Instruction ID: 08a873a89ce890841d3aa93c7cb5fd5b679ef78ea270b1cb25fbc143443a81a4
Opcode Fuzzy Hash: 672e491d3883ec087b88d6e3023c9c7b0c1ade9ff49fe3d0514865e39f462603
Instruction Fuzzy Hash: 5C514CB5B002068FCB04DF69D994A6EBBF5EF88204B1141A9E509DB375DB30ED05CB61

Function 01465240 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee53d705b732ba2d0dbefb36c52fea5c6ab03991331cb58de1b07def1a25c5b6
Instruction ID: 534c9768a4577d8d1a0cd0298c29f471d34dc95c16d3a50687fad3d844cdd1ac
Opcode Fuzzy Hash: ee53d705b732ba2d0dbefb36c52fea5c6ab03991331cb58de1b07def1a25c5b6
Instruction Fuzzy Hash: FE514E70A00219DFDB04DFA9D484AAEBBF6FF88755F14816AE405AB364DB349C42CF91

Function 01462850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25babd1a07c4e9f640dab692ebf12148ae3565f2a52e01bb62000c9a384b3c6
Instruction ID: 457e6d4a185d0faebd9dab92768243ca6ef78aab04245bd9a1ceae439af237f4
Opcode Fuzzy Hash: e25babd1a07c4e9f640dab692ebf12148ae3565f2a52e01bb62000c9a384b3c6
Instruction Fuzzy Hash: FC411874A01208DFDB14EFA9E98499EBBB6FF88340F10413AD901A7368DB789945CF51

Function 01465308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c150c671261422d91c72adec5061a09aafc38ba819eee9301dc712dde783609
Instruction ID: 5638cbd9902a3680ba2a3ee741d48d40e801b61de115d6075a8e79b74702d3f7
Opcode Fuzzy Hash: 7c150c671261422d91c72adec5061a09aafc38ba819eee9301dc712dde783609
Instruction Fuzzy Hash: 40412C74B01214DFDB04DF69E498AADBBB6FF88355F10806AE805AB364DB349D42CF51

Function 01462842 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d9bf08dc309636b811825355dfa81cd12317e65b6dbe139ab84a587aa1505a
Instruction ID: 641fbb1fa003d842df50fa184308744369f6aea2864507a65be74f3cfeee0c09
Opcode Fuzzy Hash: 61d9bf08dc309636b811825355dfa81cd12317e65b6dbe139ab84a587aa1505a
Instruction Fuzzy Hash: 23315E70E01209DFDB14DFA9E984AEEBBB6FF88340F14413AD501A7268EB789945CB11

Function 0146B0A0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71085d22d16ae4f84ff7ccddc94055cd80c5833b729c002f044cbf441b322e8a
Instruction ID: 8d02d2e55e07d14fb0b0cb9f0d0bb8ac0cf706453ad5e93bfa0cb46cd3941cd3
Opcode Fuzzy Hash: 71085d22d16ae4f84ff7ccddc94055cd80c5833b729c002f044cbf441b322e8a
Instruction Fuzzy Hash: EA31E431B102088FC718DB79E8446EDBBAAFF86300F04852ED416DB3A5DB749D09CB92

Function 01462C48 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d8fa80beca13df29083a0bdd72050295bbc5522adb8e55e73fd033fd9f4b253
Instruction ID: 2c05eeb51f4f1e39c86086a1ca0db6d5608c209f2fb46e58f96cdc2908018215
Opcode Fuzzy Hash: 1d8fa80beca13df29083a0bdd72050295bbc5522adb8e55e73fd033fd9f4b253
Instruction Fuzzy Hash: 12410D74A002099FDB05DF68E588AAE7BB6FF48314F104539D511A7364EB38AE81CF91

Function 01466388 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe808c82083d6fa15925a7fccab393fc38cb6c6b036af4330b2be50331357164
Instruction ID: 410c83b36ee48f4bf445c116a08f9edb7c58249836521cd4081f6c3fca485210
Opcode Fuzzy Hash: fe808c82083d6fa15925a7fccab393fc38cb6c6b036af4330b2be50331357164
Instruction Fuzzy Hash: 6A212970C561089FCF19EB6D9980978BBADEF65314F424CB6C6048712ED53C591AC753

Function 01464B50 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f24f144448b5635a5b34edd3205c367bed78f74c58a645970b539809c61333d6
Instruction ID: e9fc4cdcbf63e74822af4f0fbb4702b5ea308755069088eda700673db5685317
Opcode Fuzzy Hash: f24f144448b5635a5b34edd3205c367bed78f74c58a645970b539809c61333d6
Instruction Fuzzy Hash: A421D6712062015FD70AEF39EC90A5E7BAAEFC1200B048A7AC4058B269DB74ED49CB95

Function 01462C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c02dac3b8e8c650f62f1db3641a426994f221d983849bd947208b8fe0db9ad
Instruction ID: 0f8e34d9b19a881a2a8c3577f4f0f14a7584b4b8bda096a6ee84122f7d4d4b01
Opcode Fuzzy Hash: 65c02dac3b8e8c650f62f1db3641a426994f221d983849bd947208b8fe0db9ad
Instruction Fuzzy Hash: 5131EF74A00209DFDB04DF68E588AAE7BB6FF88314F104535D515A7364EB38AD85CF91

Function 01464B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5aa83f84e694ec2917574e48ce9c5c9e97e7fbea6ce16ad43522155ad9bfd3
Instruction ID: f3cc41c88f8b0399b3ce5eef75ebb5cb249c3edc7d98c30ee5442dfddeb0271d
Opcode Fuzzy Hash: 2c5aa83f84e694ec2917574e48ce9c5c9e97e7fbea6ce16ad43522155ad9bfd3
Instruction Fuzzy Hash: 582184712112066FD709EF7AF980E5E7BAEFFC0210B048A39D4058B668DF74ED498794

Function 01466888 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 464170286875ed9f5fefc1ae7091fb9a67b1728767df4931009d300f6e1ecea5
Instruction ID: 7b4b52f30184a731a244c32b0c1c54f802644cfc408e565b17fdb082ef5f4ddf
Opcode Fuzzy Hash: 464170286875ed9f5fefc1ae7091fb9a67b1728767df4931009d300f6e1ecea5
Instruction Fuzzy Hash: 6A2190B1900205CFDB10CFA5C9487EEBBF9EF45308F11806AC805AB261DB759A09CB52

Function 01465C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0bd1675197c81413ee045c750b479bed45576e76ce7823d4b9322f9b23e386
Instruction ID: 0e66bbee966b940ede5e9c497f3477dd29f77d0b16a850462926dc2704d3ed44
Opcode Fuzzy Hash: dc0bd1675197c81413ee045c750b479bed45576e76ce7823d4b9322f9b23e386
Instruction Fuzzy Hash: 57216A35A002188FDB14DFA9D588ADDBBF5AF4C314F2040A6D505FB3A1DB35AD45CBA0

Function 01465C5A Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64df12bedc4a1aa747f0f1ca933fa9cd571efbcab733cb63e2cb94853203ed8b
Instruction ID: 4f55249dd69408787784b381fc57ee199830c87c7b11d141362d677bbd5461aa
Opcode Fuzzy Hash: 64df12bedc4a1aa747f0f1ca933fa9cd571efbcab733cb63e2cb94853203ed8b
Instruction Fuzzy Hash: 0A216A31A002188FDB14CFA9D598BDEBBF5AF48314F2441A6D401BB3A5CB75AD41CBA1

Function 014641A2 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf45f3f20fbb83b5a6c743efc3c2847ea016b34017646c58e2a1dcef8efeaa8
Instruction ID: 1b7d4ebe4d3a0d6d85159b51515687063a0a90cdcf4031de46c99498d1024781
Opcode Fuzzy Hash: bdf45f3f20fbb83b5a6c743efc3c2847ea016b34017646c58e2a1dcef8efeaa8
Instruction Fuzzy Hash: 9E0141B120B2812FD30AEB769C605AE3FBAEF9211071944ABD401D7286CF304D0A8366

Function 01465940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb24c703cad3b91c4fd8e6155968039b077649bc5aae438f916e4bd3880bb3bc
Instruction ID: e67f7fa9404832047149baa6db955734c8066cf7f12d1e068e4423b1d62bd53f
Opcode Fuzzy Hash: bb24c703cad3b91c4fd8e6155968039b077649bc5aae438f916e4bd3880bb3bc
Instruction Fuzzy Hash: 2B0181B63122108F8704EF6EF49881EB7AAEBD96A5310857FE605C7355DA35AC0187A0

Function 014632E0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f257080b1b5de2828bdde9706eed11c5673cd42166e5c78dc7942fbd6dbb1c7
Instruction ID: 0e9ba2007ec191af9e7fc67e581ce09f25a7c8e59ed792c051e97e4083b07266
Opcode Fuzzy Hash: 9f257080b1b5de2828bdde9706eed11c5673cd42166e5c78dc7942fbd6dbb1c7
Instruction Fuzzy Hash: 2A1182B9A012009FEB04EFB8F558B9E7BB2EBD8305F004429D40293344DB795901CB50

Function 01462A80 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e49fdabda2e95b2014397725e520b26c309cfcba4dfedc2dcf575ac469b82c
Instruction ID: 63225039570388ace77b47953deaf79e067c265e91dc5351a2a6e79aff84df9d
Opcode Fuzzy Hash: e0e49fdabda2e95b2014397725e520b26c309cfcba4dfedc2dcf575ac469b82c
Instruction Fuzzy Hash: 8E0196B16206004FC305EF79C44494ABBE9FF9461471489AAD08ADB368EB71EC048BC2

Function 01465931 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b8de1c1c5198d515087212d32e2822a46ae695d404ae2cd5a054b0c67bf6d5
Instruction ID: a42cfe125ad7ca665b38e2a3c7a8c879311254fb459dd39fd0d6ddb79dca4d41
Opcode Fuzzy Hash: 55b8de1c1c5198d515087212d32e2822a46ae695d404ae2cd5a054b0c67bf6d5
Instruction Fuzzy Hash: B401A4B63022108FC305DF69E89495ABBB5EFCA25431480ABE505CB365DA34AC05CBA1

Function 014632F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 666c6fb4df97f9c954537a47e5dafc7c5752d1de23eaaf0acfe5ebedb13dda30
Instruction ID: 4854371024d9bb8182aa512b5854152a24415f9b379c11e1675ff706988f98ea
Opcode Fuzzy Hash: 666c6fb4df97f9c954537a47e5dafc7c5752d1de23eaaf0acfe5ebedb13dda30
Instruction Fuzzy Hash: 26018078A012049BEB08FFB8E658B9E7BB6ABD8305F004429D50293344DF795901CB51

Function 014641E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 012cac026e8b80bf40c581f10957eb929ba6e9e5f67f9a8c8ac8f22b1931260d
Instruction ID: 2c0ab4b1b23772b12621937c7c797c53ea92ddff0d688dd6a7867f2dd0452afb
Opcode Fuzzy Hash: 012cac026e8b80bf40c581f10957eb929ba6e9e5f67f9a8c8ac8f22b1931260d
Instruction Fuzzy Hash: CAE0A0B16162052F9708EBABA89096F6A9EFBC8560754483EE40997348DF316D0143A9

Function 01466398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96b17c5b782bc55dc986048aff4a38f432df9ebf05cf41e9731ed8d42b1f055c
Instruction ID: 8288159a933a9ecccfcf22f307d289bd5ee7f22ce891e4a3ec9e1ec1a3e2d330
Opcode Fuzzy Hash: 96b17c5b782bc55dc986048aff4a38f432df9ebf05cf41e9731ed8d42b1f055c
Instruction Fuzzy Hash: 4AF08274A0220DEFCB00EFB9E54465D7BF5EF98200F5041B99408A7355DB305F04CB51

Function 01462D92 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7575a18510963532c5097df27e0c8f4431f43c0c4ed3fb049ae58866c9dcc43f
Instruction ID: 1c868ff0266892b54ceb01795c4c97a3f9408bad7579763cee6c00bcc4372a94
Opcode Fuzzy Hash: 7575a18510963532c5097df27e0c8f4431f43c0c4ed3fb049ae58866c9dcc43f
Instruction Fuzzy Hash: AFF058B1E100098FCB44EFBCC40169A7BF0EF49310B1240BAD919E7321EB709A218B92

Function 01462DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03e8a5e8bb89f9f53f7004b41d8e044f9f7a1e0a0a86859e52824cf19da2a7f
Instruction ID: 8cd04cd72a060e76af23cbb4c39ec3a0e52aa1aa28d0526ae4d07e1fce6fda8a
Opcode Fuzzy Hash: a03e8a5e8bb89f9f53f7004b41d8e044f9f7a1e0a0a86859e52824cf19da2a7f
Instruction Fuzzy Hash: 75E06571E101188F8B84EFBDC404ADE7BF9EF48310B2180BAD609E7310EB709E018B92

Function 0146374E Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c919c3d00dbeb5f867ca82644b7b413510436e052ecf357a85e7ebf834138a
Instruction ID: 3911f8708efab474a2fac54616bf85c1d70c4b8bcb2c16dc4fe5f5c8c217b05b
Opcode Fuzzy Hash: f1c919c3d00dbeb5f867ca82644b7b413510436e052ecf357a85e7ebf834138a
Instruction Fuzzy Hash: F7E08C767001141753355D2AB40446BB7ABABC85663588026EE0DC3328EE788D034392

Function 01461FF8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3c9c7dc5bd68a84f9604be2ba1ec4ac108eb567f6fae1526a5b8aab7cf1112
Instruction ID: 095981823c148325aef234a5e37fc358e832c32852a77c36c18fa2fe4d34654e
Opcode Fuzzy Hash: 8c3c9c7dc5bd68a84f9604be2ba1ec4ac108eb567f6fae1526a5b8aab7cf1112
Instruction Fuzzy Hash: E4E026BA7011104FCB105B78D42CA9E3BEAEFC521670608BAE406C7321CE39DC02C751

Function 014666C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8217eba93ae082e5a1cf8ad21dd281dcdf5faf597dd018945a007571aeb5cd04
Instruction ID: b05145e50674b23f961fc23489798f9c80907ad79ed18979ad6de31be0cd84b8
Opcode Fuzzy Hash: 8217eba93ae082e5a1cf8ad21dd281dcdf5faf597dd018945a007571aeb5cd04
Instruction Fuzzy Hash: 7ED02EB230A2A04FCB02A71CEC901483BE6EF8A21130E81B7F100CB35ACA308D018392

Function 01466469 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91af5af21035f6b148085fcba40010ab81216036af480daa343625760ae70ecd
Instruction ID: 3a9cb96a8cd0e9ee390582709a6cd46a607ef94fef5c56fa60e967623ca4e05d
Opcode Fuzzy Hash: 91af5af21035f6b148085fcba40010ab81216036af480daa343625760ae70ecd
Instruction Fuzzy Hash: 63E0E2B56442048FC705DB68E4959113BEAEF8A21070204A5E508CB36ADA24ED41862A

Function 01465631 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c20f21d0414650eb76433f20c3fb64d118a540ad175d8fe3c2200569381772f
Instruction ID: 5ed1f05a6dd879655323468c1755bb6d181e420956a84c94c23197c466fa221f
Opcode Fuzzy Hash: 7c20f21d0414650eb76433f20c3fb64d118a540ad175d8fe3c2200569381772f
Instruction Fuzzy Hash: 59D0A7245092845FC702477CEC956513F7DDE5720430844D1D8488F216D922A8279762

Function 01466478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3734213208.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1460000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2df46f8997135b4245f0744893a4c35aa26f0fc2837849e524c5c01ea8d9acc8
Instruction ID: 8013703ce46ec73c4cfe36924c05593310fa9069811bb5b22e389f16870fd078
Opcode Fuzzy Hash: 2df46f8997135b4245f0744893a4c35aa26f0fc2837849e524c5c01ea8d9acc8
Instruction Fuzzy Hash: 3EC012747803088F8208EB6CE088C2573EAEBCC71071044B8EA09CB339CE21FC82CA18

Analysis Process: GamePall.exePID: 2364, Parent PID: 6676COMMON

Executed Functions

Function 01164F58 Relevance: 11.9, Strings: 9, Instructions: 602COMMON

Download Yara Rule

Strings

(aq, xrefs: 011651CD
(aq, xrefs: 01165056
(aq, xrefs: 011655CF
(aq, xrefs: 01165082
(aq, xrefs: 011655A3
(aq, xrefs: 011651F9
(aq, xrefs: 0116586F
(aq, xrefs: 0116589B
(aq, xrefs: 01165655

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq$(aq$(aq$(aq$(aq$(aq$(aq
API String ID: 0-416939441
Opcode ID: cd8cdecfa4524cf18f98edd1ab85805601944b1fa6706079113e9de2dfb94106
Instruction ID: ac21a0a5b9a69d574a95aa2e71e3dfe87bd9206a7b344deb91dbf83ca0294d09
Opcode Fuzzy Hash: cd8cdecfa4524cf18f98edd1ab85805601944b1fa6706079113e9de2dfb94106
Instruction Fuzzy Hash: 9C32AF30B002158FCB49EF69D5546AEBBF7AF89340F2481A9E906EB355DF359C02CB91

Function 01163750 Relevance: 3.8, Strings: 3, Instructions: 88COMMON

Download Yara Rule

Strings

(aq, xrefs: 01163786
(aq, xrefs: 011637B2
(aq, xrefs: 01163820

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq
API String ID: 0-2593664646
Opcode ID: 53a3644ffb37c90cb488a5b9f60e37c277a4bae8c5807a83db3899b67c8d52ad
Instruction ID: 3c69b277c23b2c99f6707649ad06549e7d38fef1d7e3cb03916bbd3f6787bbda
Opcode Fuzzy Hash: 53a3644ffb37c90cb488a5b9f60e37c277a4bae8c5807a83db3899b67c8d52ad
Instruction Fuzzy Hash: 0E216032B181550FD71A673D542417F3BE7ABD662075881ADF90AC73C5DE298C074392

Function 01163BE0 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

(aq, xrefs: 01163DE5
(aq, xrefs: 0116419C

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: 2ad12668eaac43e34b681e97cca6b6c44e5cc24356f06919eaa1e6cf8cbe7149
Instruction ID: 4c74c32cba812ff2159e4b6516674d3d4402122c6473a0204edcd0fe038b7a7e
Opcode Fuzzy Hash: 2ad12668eaac43e34b681e97cca6b6c44e5cc24356f06919eaa1e6cf8cbe7149
Instruction Fuzzy Hash: 38F1A330B002058FCB09AB69D95466E7BBBEFC8300F148469E906DB3A9DF75DC06CB55

Function 0116385B Relevance: 1.5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

Strings

(aq, xrefs: 01163BA1

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 7ec74d00017215d0ed1d025d1f9e66abd344dfcdeca3a6101549688ef1108bb3
Instruction ID: b4f3ec8cdd4556d6692d0f966ba2093eb5d6adcb3f4edfd20b58842df264fdb7
Opcode Fuzzy Hash: 7ec74d00017215d0ed1d025d1f9e66abd344dfcdeca3a6101549688ef1108bb3
Instruction Fuzzy Hash: 96A18334B102199FDB09DFA9D954AAE7BBBFF88300F108069E905A73A5DF359C11CB51

Function 0116BEAF Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0116BF75

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: ea97bb92db06bf7c752bac06801a2db372b466adb0147484dc743c2b5c29ce10
Instruction ID: 44b1d5fccd5a06507a9509b6f51cc082c505546585bb2df82ba9fa0527d20e93
Opcode Fuzzy Hash: ea97bb92db06bf7c752bac06801a2db372b466adb0147484dc743c2b5c29ce10
Instruction Fuzzy Hash: CC417C347105118FC748DF2DC998A6EBBE6BF88B10B2585A9E406DF3B1CB71DC018B91

Function 01162B10 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01162B35

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 78b05ca99d736b6b843909732eeece03aea558498a2fb7199122f2790a7de510
Instruction ID: 2d99a4c5e9eace83e715c022dfd42a0c56579303218fb262bec7dc0dfd96a6ef
Opcode Fuzzy Hash: 78b05ca99d736b6b843909732eeece03aea558498a2fb7199122f2790a7de510
Instruction Fuzzy Hash: 1B3118317506058FD709AB39D55496E33B2EFC9A09720856CD10ACB3A4EF3ADC038B96

Function 0116BEC0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0116BF75

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 5aa6fbc5389d7010544bb31c32a9baccc3b3ef7cacbf265a2c714f3580af3043
Instruction ID: 345fc24304946546d2b8b88acf5ccab80d86ab231c97b070780d157a2472785d
Opcode Fuzzy Hash: 5aa6fbc5389d7010544bb31c32a9baccc3b3ef7cacbf265a2c714f3580af3043
Instruction Fuzzy Hash: 5F315C347105118FC744DF2EC898A6EBBE6BF88B10B6585A8E506DB3B5CB71EC018B81

Function 01164237 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

(aq, xrefs: 01164295

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 934ca6ca43b65a313b0c3ce4fb5318c7ca5f972af03ce2dead924f689c127d85
Instruction ID: a7d573cca525fe5fd1d12df11d6785f103ee90ba089e74b98a438d81b6fdb921
Opcode Fuzzy Hash: 934ca6ca43b65a313b0c3ce4fb5318c7ca5f972af03ce2dead924f689c127d85
Instruction Fuzzy Hash: A81148326081404FC31A5B7868245BE3BA3EFD261175985EFD4868FA96CE28884BC792

Function 01161049 Relevance: .8, Instructions: 839COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4973ee6dda9b21f9cc0d2399740f81005cb6632a7c3f1141d0e6269fcaf9b501
Instruction ID: 186cb46b1f99ec04e0e1d9513495a5b1589d5265492dd755943e1bfbf06f46f4
Opcode Fuzzy Hash: 4973ee6dda9b21f9cc0d2399740f81005cb6632a7c3f1141d0e6269fcaf9b501
Instruction Fuzzy Hash: 2F825378640209CFDB06EBA4E754B6E7B7AEF88304F104814E80027BADDF796945DB36

Function 01161058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff196da02c79a4e501b3ebd92ca97ed9527c4415e2e642aa9ff4579621a31688
Instruction ID: aae01d3ad1adce3dcdcfdfee13055f0ecf9eb88e32195df38882021675c9e5b1
Opcode Fuzzy Hash: ff196da02c79a4e501b3ebd92ca97ed9527c4415e2e642aa9ff4579621a31688
Instruction Fuzzy Hash: 5B825378640209DFDB06EBA4E754B6E7B7AEF88304F104814E80027BADDF796945DB36

Function 0116B0B0 Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c1ccd63c543c42c2eced08438b2a33f43c8b42b546867af127500fc17ff9b7f
Instruction ID: 6d31721fa6848cbfa36240fced5b220568403adf6ac30e4c1daee38344fe26d8
Opcode Fuzzy Hash: 8c1ccd63c543c42c2eced08438b2a33f43c8b42b546867af127500fc17ff9b7f
Instruction Fuzzy Hash: 5E524934711200CFD719EF28E65896C7BB6FF84309B548569D80A8B2A9EF76EC41CF41

Function 0116BB99 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14cd93b7123e9bb6c9f1cfb341f3b28c2435ca68d9c32af27ef2274c68c4ab55
Instruction ID: f1fe1a151adc840e7814520b957ae34c662d35bea0c881b501c0cb9b989bc042
Opcode Fuzzy Hash: 14cd93b7123e9bb6c9f1cfb341f3b28c2435ca68d9c32af27ef2274c68c4ab55
Instruction Fuzzy Hash: 2A81E538602105CFC71AEF18EA89D197BFAFB44308B15C569D5098B62DEBB5EC49CF40

Function 01165A91 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fb7a04d0cf4feb39fed2245fa51ee70aa4f08f8477641d075af44b02d2e7796
Instruction ID: 0a20a360334d63d97380002098e93f19ef467d64499d5e763d584a172e3437b4
Opcode Fuzzy Hash: 8fb7a04d0cf4feb39fed2245fa51ee70aa4f08f8477641d075af44b02d2e7796
Instruction Fuzzy Hash: 93515E75B002068FCB48EF69D99496EBBFAFF8C204B1181A9E509DB365DB31DC01CB61

Function 01165240 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 631d547e3355486f1743c910c7f6977f84494edccd19da9083ac7f43b3452b65
Instruction ID: aa1526cc7cfe8bc470c60a428e07824dc6c97ea3731a4d90f895626f0d8abedb
Opcode Fuzzy Hash: 631d547e3355486f1743c910c7f6977f84494edccd19da9083ac7f43b3452b65
Instruction Fuzzy Hash: FE518B30A00218DFCB48DFA9D484AADBBB7BF88755F148169E805AB254DB719C51CF90

Function 01162850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a57634daa8f4a6592267ef1be380d7b69be9835b030b9d38472c1b69f597f386
Instruction ID: bfc4a5272c9e982c6d39676d5e160999d1bc1a6bd30d235c5a99eaeb919392d6
Opcode Fuzzy Hash: a57634daa8f4a6592267ef1be380d7b69be9835b030b9d38472c1b69f597f386
Instruction Fuzzy Hash: 10410A34E40208CFDB18DFA5EA849ADBBBAFF88340F104529D901A7268EF759855CF20

Function 01162843 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe53eefe08e713fabf75ff7239446f6f0aa1223e138d76cabfbacd87d41cfa6
Instruction ID: 67b5c9e9aec14b34e748f1dec5a2b73a7eb8e947112ed5df3fe4a5cf284c5faa
Opcode Fuzzy Hash: 3fe53eefe08e713fabf75ff7239446f6f0aa1223e138d76cabfbacd87d41cfa6
Instruction Fuzzy Hash: B1315E70E40208CFDB08DFA8EA849EDBBBAFF88340F144529D501A7264EF759955CF61

Function 01165308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0cf8e97e4572db17e7e9a60262a7451f71d9cd0078b2541bfce9e4d4bbc5d5
Instruction ID: 152acf2550d8d248a8a704b2e2cc3e0adca13a934b2942c88629d0e2f4cb22e6
Opcode Fuzzy Hash: 7e0cf8e97e4572db17e7e9a60262a7451f71d9cd0078b2541bfce9e4d4bbc5d5
Instruction Fuzzy Hash: 8A411834A001149FCB48EFA5E5949ADBBB7BF88345F108069E906A73A4EB759C52CB50

Function 01162C48 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0cfa741e62bb4eba12a1189d9573a79674e77d22f23ce69aa59071fce8c11fb
Instruction ID: 440fac332f22daed29b000eacd99879fa01e6a60ff28e5fbb53477e2a4d16fca
Opcode Fuzzy Hash: a0cfa741e62bb4eba12a1189d9573a79674e77d22f23ce69aa59071fce8c11fb
Instruction Fuzzy Hash: 2D413834D00209CFDB04EFA8D684AAE7BB6FF89304F104569D901A7768EF759941CF90

Function 0116B0A0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069f449347f41b5a74ecc73fb8695e0d802cda9cb3b20d857288518adc1e0d2a
Instruction ID: 15184e9e1048db19d3d40b79b0eb26eb5dcb51dcc81c53cb112299d3c3e231b7
Opcode Fuzzy Hash: 069f449347f41b5a74ecc73fb8695e0d802cda9cb3b20d857288518adc1e0d2a
Instruction Fuzzy Hash: C131D631610204CBCB08DB78E99469DBBFAFF84210F54852DD419DB3A5EF759909CB91

Function 01162C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d50a129ccbc91885cbe2666996aa717a78f375904f76641b0ca455054872c72
Instruction ID: 4fa7228ad9f1ab616115248eea35f48f0f4b05577b5d222b8fd248f47a10edbf
Opcode Fuzzy Hash: 0d50a129ccbc91885cbe2666996aa717a78f375904f76641b0ca455054872c72
Instruction Fuzzy Hash: A631F834D00209CFDB04EFA8D685AAE7BB6FF88318F104529D901A7758EF759945CF90

Function 01164B5E Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 604771a415865d3512267c3755e92052bfd706d083d36705a3666d08c0c70e36
Instruction ID: a3124479c780de2d623039bcf38be38e8a6e2b81ebe4442bd41d33ed1a46a2a4
Opcode Fuzzy Hash: 604771a415865d3512267c3755e92052bfd706d083d36705a3666d08c0c70e36
Instruction Fuzzy Hash: 482192312042025FC70AEB78F990E6E7BAAFFC5200B148A79D0458B669DF74AD49CB95

Function 0116288D Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0cd18bb0d8a4087d159967bf2710b265877c3595f2a29d76150f438d5f4cd6a
Instruction ID: 2acd36159a0f2e42117ce2bd6f693418cb29dcbbf37bf1e02909a2f45f81dfe2
Opcode Fuzzy Hash: e0cd18bb0d8a4087d159967bf2710b265877c3595f2a29d76150f438d5f4cd6a
Instruction Fuzzy Hash: 3D312E30E50218CFDB18DFA4EA849ADBBBAFFC8340F148529D501A7258EF759855CF21

Function 01164B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 270094d174df058b5c69cd2d88e278f5ae4b017e2fe988ceb3bef0494a751f09
Instruction ID: cca20586a22cd45ab1458f76b13db699413887cd752ba8c9d2bb7f2fd5d76d91
Opcode Fuzzy Hash: 270094d174df058b5c69cd2d88e278f5ae4b017e2fe988ceb3bef0494a751f09
Instruction Fuzzy Hash: FB219F312002025FC709EB69F990E6E7BAAFFC4210B108A39D0458B628DFB4AD498B95

Function 01162908 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e013d1a0038cbf9ad74981e348763e7f30c06cf423b6e76fa2bac4ef9b128668
Instruction ID: 340f5ca0462d320505505431bcf7a73b7ecd1a785e5659813cf28b65b7662fb9
Opcode Fuzzy Hash: e013d1a0038cbf9ad74981e348763e7f30c06cf423b6e76fa2bac4ef9b128668
Instruction Fuzzy Hash: 3F210A34E502189FDF18DFA9D9809ADBBBAFF88340F108129D91567268EF759815CF21

Function 01165C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01169b0a87d2f013ff30179285a888d40220dafd2f1e1b2b1c75b8357e9171c2
Instruction ID: be094878d32747ded2a6774c6349ae1dac5cf719b6768dab8598c3d82a5f65a2
Opcode Fuzzy Hash: 01169b0a87d2f013ff30179285a888d40220dafd2f1e1b2b1c75b8357e9171c2
Instruction Fuzzy Hash: 8D216D35A002188FDB58CF99D584BDDBBF6AF4C350F2000A5D505BB364DB769D44CBA0

Function 0116296A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf4a365e60b8670219f9240a4efe5cd3b9ae0a3b224b10cb79030bd78da8d08c
Instruction ID: 25e2a5d0076e9d83cd4df5bb0feeb86eeaf1dcbe3e9c68505d475b485e774dcc
Opcode Fuzzy Hash: bf4a365e60b8670219f9240a4efe5cd3b9ae0a3b224b10cb79030bd78da8d08c
Instruction Fuzzy Hash: 5D21E934E40208DFCF08DFA8EA8099DBBBAFF88340F204129D505A7364EB759955CF11

Function 01166888 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 674bd70feae6452d5267c1a0f96380f15d4a189e8f81d10110de06e42b0e884c
Instruction ID: 2d41b62cee912188c8c35137e93a85be15f1ac346ba7e8d0cef7337d82053bc0
Opcode Fuzzy Hash: 674bd70feae6452d5267c1a0f96380f15d4a189e8f81d10110de06e42b0e884c
Instruction Fuzzy Hash: 98119371A00206CFDB18DFA4CA487EEBBF9EF44305F10806AD405B7251DB769A65CB62

Function 01165C5A Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05a95e3f17c4ec442cced6c552cbc8746a2f89dde9e789d4176956e77cdb875d
Instruction ID: e54626993aee5014267edbd088c037ffaeb9478930d63d7e8990169a902559b7
Opcode Fuzzy Hash: 05a95e3f17c4ec442cced6c552cbc8746a2f89dde9e789d4176956e77cdb875d
Instruction Fuzzy Hash: 19218C30A002598FDB59DFA9C598BEDBBF6BF4C340F2441A9D401BB2A5CB769D41CB60

Function 011641A2 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca9b3880a940667fcca74d94344e16bb4f2adb153afbb0b071fe7e41dbc6b67b
Instruction ID: 0cac214d50a071bcac91027b4adec835456268e35a6058b5ce11e96de664d4c2
Opcode Fuzzy Hash: ca9b3880a940667fcca74d94344e16bb4f2adb153afbb0b071fe7e41dbc6b67b
Instruction Fuzzy Hash: 860128327082415FC70A6B7468705AF3F7AFF8611176944EFD445DB352CE214C0AC766

Function 011632E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e203d2a48e011849c1555fc807a1ad0fe8ee3883bce3328056e4b22b8978c2c
Instruction ID: 5bef577cfa85c349f9193e6a332c9202a889ac5c3f8d7b002b0050bca6dace2a
Opcode Fuzzy Hash: 0e203d2a48e011849c1555fc807a1ad0fe8ee3883bce3328056e4b22b8978c2c
Instruction Fuzzy Hash: 62116D34E50244CFDB08EFB4E6587AE7BB2ABDC345F004829D90697381EF3A5825CB60

Function 01165940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e48241a2643c8088b2129ee2b93c4373d0cfc7c36bb5dec55e4436885f8b49a
Instruction ID: df2935ab539818aae3779bd01bc9324f67ed6f261eee66a0e221fc98ef42119e
Opcode Fuzzy Hash: 4e48241a2643c8088b2129ee2b93c4373d0cfc7c36bb5dec55e4436885f8b49a
Instruction Fuzzy Hash: 8001A4773001108F8704AB7AF59485EB7AAFBC96A5320857EE605C7314DE76DC01C7A0

Function 01162A80 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00551efdbba513554dd8fe1842af20d392f8f76af7170285e7296ec3e0fde00c
Instruction ID: c01c607495f4d9be35f276753d47a2f4a9daa69d53dc25681186b7f548a353a3
Opcode Fuzzy Hash: 00551efdbba513554dd8fe1842af20d392f8f76af7170285e7296ec3e0fde00c
Instruction Fuzzy Hash: A90188352202008FC715AB28D55889ABBF6FF85600324C9AED18ADF325DB71EC048B81

Function 011632F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6883d6db139edbbff4e89f7d5484f29299513a16cd8ddbf77f255de2bc0f9ec1
Instruction ID: 3fd7ccd6b08416c40180cbba27a8813b8691cde8b0fb7ad2dc4433096fdede36
Opcode Fuzzy Hash: 6883d6db139edbbff4e89f7d5484f29299513a16cd8ddbf77f255de2bc0f9ec1
Instruction Fuzzy Hash: B1017134E502048FDB48EFB4E6587AE7BF6AB9D345F004829D90297380EF765824CB60

Function 01166388 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd59154796d444379555fa2d235842cf1c29f86df0e490ff032147cf326e7ab
Instruction ID: dcf3e26c9d56c92329dc9797903ef39ba7f6cf0b27293fb295edd4de025d5b4a
Opcode Fuzzy Hash: fcd59154796d444379555fa2d235842cf1c29f86df0e490ff032147cf326e7ab
Instruction Fuzzy Hash: DDF0C230D04289AFCF40EFB8A9515DDBFB1EF96200B2081EDD484EB216DA314E16DF02

Function 011641E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e450882b1cb0912658708b3b20eeb4b8d23b94e76dd505ea298b74427962514
Instruction ID: 8e45e25b8982ffe184bf4e7b6a4ebcd18773ae47e51eeb14a114cc29930b02fd
Opcode Fuzzy Hash: 6e450882b1cb0912658708b3b20eeb4b8d23b94e76dd505ea298b74427962514
Instruction Fuzzy Hash: 2EE0E5337041052F8708A7AA78609AF7A9EFBC8560764493DF009DB300CF216C0147AA

Function 0116593E Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5626c5159a10f9d0765f8b6fc73177274086bfcefcaf53e66ea4fac659d15ec3
Instruction ID: 8a6004cf482f793a048b2646c1d93ce854820e6fbfd406a7cb6237c4e344395f
Opcode Fuzzy Hash: 5626c5159a10f9d0765f8b6fc73177274086bfcefcaf53e66ea4fac659d15ec3
Instruction Fuzzy Hash: 65F05E763001108F8708AF2AE69486EB7A6EBC9665324856EE50AC7354DF75CC018B60

Function 01166398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8fde9b083dcc9ab3b13137f3c2aae2a46fedec4464ac0cba8976e36dc772bd3
Instruction ID: 88f28a97a8e9f785fa3c083cc4ce42c9351e016bf23e55275ac9b0a595c0c75d
Opcode Fuzzy Hash: b8fde9b083dcc9ab3b13137f3c2aae2a46fedec4464ac0cba8976e36dc772bd3
Instruction Fuzzy Hash: 30F08230E0020AEFCF04FFB8E54559DBBB9EF84200F2081E8D448A7244EA305E05DB51

Function 01162D9B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a228f6e608c68faddf61ede5273c1394e8699e6940970441ee1c0b0a122ecfac
Instruction ID: ceab8c9c880464c6d8fd9ce6609583ee76e1fc1cb5d7e47548e3cf67c919a831
Opcode Fuzzy Hash: a228f6e608c68faddf61ede5273c1394e8699e6940970441ee1c0b0a122ecfac
Instruction Fuzzy Hash: 66E03071F100198F8B44EFBC89055DE77F5EF49301B1140AAD109E7350DB308D118B91

Function 01162DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a12dababfa6c26dc1e2e928384ddd28f514e1a0b040d6ebad054e5a62ab3cf
Instruction ID: df0af68ba762a4869c3ce2684b0ae3cc115c5343bafadd80f2af812717c8ef9d
Opcode Fuzzy Hash: 55a12dababfa6c26dc1e2e928384ddd28f514e1a0b040d6ebad054e5a62ab3cf
Instruction Fuzzy Hash: 4BE06D71E101188F8B84EFBCC4056DE7BF4EF49310B1140BAD609E7300EB309D008B92

Function 01161FF8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63243861fb8b1ac2a85bb1a8ff3d24b87d35eefe4e64342ecf94d21eea4fda7
Instruction ID: 90d190553f9aedf7a9b4c5cf7928c65e3ade2eeadec810f3040016078263a9f1
Opcode Fuzzy Hash: f63243861fb8b1ac2a85bb1a8ff3d24b87d35eefe4e64342ecf94d21eea4fda7
Instruction Fuzzy Hash: E4E09235B451508FC7245BB9D1288593BB5EF8A65531604EFE006CB722CE30DC16CB51

Function 0116374E Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5579df813e4ed8a42a53111cf39357e4f707bff36ba496d864ad8a56213e94
Instruction ID: af4809cff2844b5071112c926dff884daf69de2edd9a405a8b2d5047e494191c
Opcode Fuzzy Hash: 8f5579df813e4ed8a42a53111cf39357e4f707bff36ba496d864ad8a56213e94
Instruction Fuzzy Hash: 53D0C23671141047832D562AA20447A26ABABC8622718802AFE0EC330CEF798D064391

Function 011666C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff91613a31cb960ef2680febe6063e696e4f5b86480fb8d594c30dfb34a85cdc
Instruction ID: 1b35d29c7d3e0c1d48a8a7b3f425fd7a058f6fe7c9812710cbbc2d3f8c17f27a
Opcode Fuzzy Hash: ff91613a31cb960ef2680febe6063e696e4f5b86480fb8d594c30dfb34a85cdc
Instruction Fuzzy Hash: 81D05E223191A01B8646226C78200DD6FD1DE8B55031846FBF188CB242CC1048435751

Function 01166469 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b408fee5151e12cf2bc5a204ecef50fd48e6e2b9b591e54b00b88f314bface
Instruction ID: 083fa78f3a8bb59a87a9bdb69ad6c869567ea6a67b239a8bb558f144a32d4fd2
Opcode Fuzzy Hash: 68b408fee5151e12cf2bc5a204ecef50fd48e6e2b9b591e54b00b88f314bface
Instruction Fuzzy Hash: 1BD017796482408FC3499728D2A69243BA6EB8A21070445F9E089CF379DD24CC468614

Function 01166478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f50d842aba04feb95e2f974708ad85a5529593229a57bb53f8613e7a9dc9677
Instruction ID: 56313f7430cf98eaa40b687a91ce97c430950f94c52d3fc4dffb2d9b1acf3cc4
Opcode Fuzzy Hash: 3f50d842aba04feb95e2f974708ad85a5529593229a57bb53f8613e7a9dc9677
Instruction Fuzzy Hash: 65C01236B842048FC608EB6CE181D2673EAEFCD71471044B8E609CB339DE20EC82CA18

Function 01165640 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3761006283.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1160000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca0941b002e105815acfac5d6dccdf3c1e28250299c6e1cebb6e96e9b59c66c6
Instruction ID: cf4a0ae3439233cba9e426a55fc2411fa9526dc73b5cd59640276f5a5510040e
Opcode Fuzzy Hash: ca0941b002e105815acfac5d6dccdf3c1e28250299c6e1cebb6e96e9b59c66c6
Instruction Fuzzy Hash: 50B02B3054020957D6000519BC094113B1EEB400583000194ED0801110EE23D8304080

Analysis Process: GamePall.exePID: 3452, Parent PID: 6676COMMON

Executed Functions

Function 02CA4F58 Relevance: 7.9, Strings: 6, Instructions: 388COMMON

Download Yara Rule

Strings

(aq, xrefs: 02CA51CD
(aq, xrefs: 02CA55A3
(aq, xrefs: 02CA55CF
(aq, xrefs: 02CA5082
(aq, xrefs: 02CA5056
(aq, xrefs: 02CA51F9

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq$(aq$(aq$(aq
API String ID: 0-2219660067
Opcode ID: 7fea7d6db145f42ed7a6e1ea27a628da89f8e7b931c661a9879ae94fa8264945
Instruction ID: 3732138d4c23be0c62b19d7a6dee12f8894726185a8a0640c8bddc94149c9a5d
Opcode Fuzzy Hash: 7fea7d6db145f42ed7a6e1ea27a628da89f8e7b931c661a9879ae94fa8264945
Instruction Fuzzy Hash: 0DE17134E0021A8FCB04DF69D8A46AEBBF2EF88355F54C169D805AB395DF349D42CB91

Function 02CA1049 Relevance: .8, Instructions: 838COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01cbeacd5f8fbe41210651c5fcd2f7990e1e83670a508d7fe525a73a5a15219e
Instruction ID: d426a913bd51237e4df04faf885788744c4bee702c0d23b4843a61db246fd999
Opcode Fuzzy Hash: 01cbeacd5f8fbe41210651c5fcd2f7990e1e83670a508d7fe525a73a5a15219e
Instruction Fuzzy Hash: 298262B8641209CFDB06EBA6F654B6E7B7BEF84300F104514AD00237ADCB396965DB36

Function 02CAC060 Relevance: 11.4, Strings: 9, Instructions: 185COMMON

Download Yara Rule

Strings

K/, xrefs: 02CAC0C6
K., xrefs: 02CAC094
KVo^, xrefs: 02CAC18E
;Vo^, xrefs: 02CAC1C0
[Vo^, xrefs: 02CAC15C
Uo^, xrefs: 02CAC2BA
kVo^, xrefs: 02CAC12A
{Vo^, xrefs: 02CAC0F8
+Vo^, xrefs: 02CAC1F2

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID: +Vo^$;Vo^$K.$K/$KVo^$[Vo^$kVo^${Vo^$Uo^
API String ID: 0-865127795
Opcode ID: 6bc9057631c4664dac2a12374576f2cef729c94512ab31cf190f5640069a2911
Instruction ID: 1cf9b858474656b40340d76e6fb8ce31e53f3a8228d9f7b4ecd6b8f0b41a044f
Opcode Fuzzy Hash: 6bc9057631c4664dac2a12374576f2cef729c94512ab31cf190f5640069a2911
Instruction Fuzzy Hash: C4713A715007059BC359DF24D95099BBBB6FF80204350CA2EC58A8BA64EF72FD0ACBC1

Function 02CAC070 Relevance: 11.4, Strings: 9, Instructions: 180COMMON

Download Yara Rule

Strings

K/, xrefs: 02CAC0C6
K., xrefs: 02CAC094
KVo^, xrefs: 02CAC18E
;Vo^, xrefs: 02CAC1C0
[Vo^, xrefs: 02CAC15C
Uo^, xrefs: 02CAC2BA
kVo^, xrefs: 02CAC12A
{Vo^, xrefs: 02CAC0F8
+Vo^, xrefs: 02CAC1F2

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID: +Vo^$;Vo^$K.$K/$KVo^$[Vo^$kVo^${Vo^$Uo^
API String ID: 0-865127795
Opcode ID: 1934588b4abd03e7cd7cdc45f21303960fe93ac41b8bede9de47e1a6fe8aab7f
Instruction ID: 5cdacbc64f5e558fca48b422e7a53500f65c9e54ea04787ac0cb29904313fe81
Opcode Fuzzy Hash: 1934588b4abd03e7cd7cdc45f21303960fe93ac41b8bede9de47e1a6fe8aab7f
Instruction Fuzzy Hash: 7B712A716407059BC359DF24DA5095BBBB6FF84204350CA2EC58A8BA64EF76FD0ACBC1

Function 02CA5640 Relevance: 4.0, Strings: 3, Instructions: 206COMMON

Download Yara Rule

Strings

(aq, xrefs: 02CA5655
(aq, xrefs: 02CA586F
(aq, xrefs: 02CA589B

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq
API String ID: 0-2593664646
Opcode ID: 8a5aa588dfc38858153402b6a25d74508ab73e7e2c549fbe033d2aadcbfbe18f
Instruction ID: 88d5fbedddad0525f8f794be0894f9a568957ed94c5be7bdd2eec416726a6d76
Opcode Fuzzy Hash: 8a5aa588dfc38858153402b6a25d74508ab73e7e2c549fbe033d2aadcbfbe18f
Instruction Fuzzy Hash: F871AF74B102068FC704DF69D5A8AAEBBF6AFC9215F558069E806EB361DF30DD06CB50

Function 02CA3BE0 Relevance: 3.0, Strings: 2, Instructions: 459COMMON

Download Yara Rule

Strings

(aq, xrefs: 02CA3DE5
(aq, xrefs: 02CA419C

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: 2917e3f966f3572f1d846dd4cd2f06489fa3f07e7e0fd2dd7499b923ae971a60
Instruction ID: 059c5ce29f4f44b36fb495c57ccf6d71a3c3790b8449b00dd417c30aef553121
Opcode Fuzzy Hash: 2917e3f966f3572f1d846dd4cd2f06489fa3f07e7e0fd2dd7499b923ae971a60
Instruction Fuzzy Hash: 73F17174B002159FCB05AB69E864A6E7BBBEFC8300F148569E806DB3A9DF34DC05CB55

Function 02CA3750 Relevance: 2.6, Strings: 2, Instructions: 50COMMON

Download Yara Rule

Strings

(aq, xrefs: 02CA3786
(aq, xrefs: 02CA37B2

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: 15885368313b7cdbf0f732a3fe05c26fe777148bd5ff4d8b7e3fcc0ffef453d4
Instruction ID: 7b9fbd5b784236d06da2a02c78cb3ddaf9e5df03ded4fdedd900728791dcf3fa
Opcode Fuzzy Hash: 15885368313b7cdbf0f732a3fe05c26fe777148bd5ff4d8b7e3fcc0ffef453d4
Instruction Fuzzy Hash: 0B019925B040260BD359AB39A42427F39E7EBC6271BA8827CEC0AD33C5DE24CD0743D6

Function 02CAB0B0 Relevance: 1.9, Strings: 1, Instructions: 680COMMON

Download Yara Rule

Strings

eo^, xrefs: 02CAB23E

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID: eo^
API String ID: 0-1237877400
Opcode ID: e68ab45a2731bce16b00f11282618d1bfd1aad63022e9a18c131ec54ff688c1c
Instruction ID: ec3d777cc8c2b78df8d5c9ba59bdadffb584eb6fcc96ecd3332df3cf96d0a874
Opcode Fuzzy Hash: e68ab45a2731bce16b00f11282618d1bfd1aad63022e9a18c131ec54ff688c1c
Instruction Fuzzy Hash: 50527938A12211CFCB19EF35E56896D7BB2FF84309B208669D40A8B269DF31ED45CF41

Function 02CA385A Relevance: 1.6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

Strings

(aq, xrefs: 02CA3BA1

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 20a787ecf217c1b38672eeac7bd273f3c96d9bfc7bb22657b0ab57f2bdc5b851
Instruction ID: 46b114583d1bb30591170ec4dc08ed559cc34436d01d0a24a7dc7421947e46ac
Opcode Fuzzy Hash: 20a787ecf217c1b38672eeac7bd273f3c96d9bfc7bb22657b0ab57f2bdc5b851
Instruction Fuzzy Hash: 8DB19774B012199FCB05DFA9E864AAEBBB7FF88300F104165E805A7365DF359C41CB90

Function 02CA35E1 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

(aq, xrefs: 02CA36B6

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 26bbcd972bfa820c21b0bbd9f484cd22aa73716c2a984ca6bad2e348524c6be0
Instruction ID: cfaf9009d510e35c88c331a3ccf0e73dd887569f06b257aa49072991edc05561
Opcode Fuzzy Hash: 26bbcd972bfa820c21b0bbd9f484cd22aa73716c2a984ca6bad2e348524c6be0
Instruction Fuzzy Hash: 6A41F8327041011BD719BB39EC60A3F26ABEFC526475849B8D80ACB358EE34DD4B83D2

Function 02CABEAF Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

Te]q, xrefs: 02CABF75

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 5766132d032ff91593c0385bb2776a46b4beef7466178da6dbaa7fcb2b90264f
Instruction ID: eb993ee9dcd70ce259789cfc66aa8cb5a6062c270833be6f3081b69461ebe0fa
Opcode Fuzzy Hash: 5766132d032ff91593c0385bb2776a46b4beef7466178da6dbaa7fcb2b90264f
Instruction Fuzzy Hash: 6E418F74B105118FC754DF6DC898A6EBBF6FF88710B2585A9E806DB3B1CA70DC068B91

Function 02CABEC0 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Te]q, xrefs: 02CABF75

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: b10dfab801d2f17be3ffa8c6bc2ec63498c28e3e748262e3d04b002317feff1b
Instruction ID: 2eec05aaf2bd989f834dc88008cf5601c22a371e5f39cfc3dc2e2c5146a42353
Opcode Fuzzy Hash: b10dfab801d2f17be3ffa8c6bc2ec63498c28e3e748262e3d04b002317feff1b
Instruction Fuzzy Hash: 21419E747001158FC744DF6DC898A6EBBE6FF88710B2584A8E506DB3B1CA70EC018B81

Function 02CA2B10 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

LR]q, xrefs: 02CA2B35

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 8f764efe2d4cdf3bada4ef67bcaf0b221ad71ba260f51ec17ac5cde048eb6a80
Instruction ID: 9e515eb55983f046b90a49b634451b10704e7ff7f0df1d8df1224723ccc1eba2
Opcode Fuzzy Hash: 8f764efe2d4cdf3bada4ef67bcaf0b221ad71ba260f51ec17ac5cde048eb6a80
Instruction Fuzzy Hash: 2E3140357112158FDB09EB35D454A1E33B2EBC9A19B208178E50ACB3A4DF39DC03CBA6

Function 02CA4237 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

(aq, xrefs: 02CA4295

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 312745882e1b58f3448772e57cb2694505f1bd2ecb3cfca19cdd22959d2ba397
Instruction ID: bd5394da9cedf86aeeab53c5f5b5c0307d8a49153f456eaeb0c5cdfaaeb20a8c
Opcode Fuzzy Hash: 312745882e1b58f3448772e57cb2694505f1bd2ecb3cfca19cdd22959d2ba397
Instruction Fuzzy Hash: 1E014E327081401FD3199779A86177E3F66DFD2621B8845AED845CB745CE589D0BC3D2

Function 02CA37F0 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

(aq, xrefs: 02CA3820

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: ffd9585e835eeed3f6e0e640413f02b401689756a71ca29d1c6a461775803d6b
Instruction ID: 00a77ed59f0fb08184c8004d0c3fd81a564357fc1fbe321343cf0749280cee50
Opcode Fuzzy Hash: ffd9585e835eeed3f6e0e640413f02b401689756a71ca29d1c6a461775803d6b
Instruction Fuzzy Hash: E8F059317142511BD3056B79A81057E7AAB9BC9231B48426AF919C73C1DE558C074391

Function 02CA1058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 783bf3db32e59973445871eb159d10e7cb372a3b14d7a95f9232d920bd11dae9
Instruction ID: b33b0f883a11a23b79c0f80a13de319b76a5b3e4dde98413af84949a6bafde53
Opcode Fuzzy Hash: 783bf3db32e59973445871eb159d10e7cb372a3b14d7a95f9232d920bd11dae9
Instruction Fuzzy Hash: 988262B4641209CFDB06EBA6F654B6E7B7BEF84300F104514AD00237ADCB396965DB36

Function 02CABB99 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a0f86b4cade78656cb89e232528329e5238a75f90fd836fdd768d7c7978c9d1
Instruction ID: 3f8408d33b33a900abcc392236a867c96487fbb2fdcb20b4437c703f2e71c8a7
Opcode Fuzzy Hash: 8a0f86b4cade78656cb89e232528329e5238a75f90fd836fdd768d7c7978c9d1
Instruction Fuzzy Hash: 01811378602215CFCB26EF55F699D19BBB6FB80309B14C268D5048B22DCB70ED19CF82

Function 02CAC5BD Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0d006d063812c5a8763770d20e4dc7a4e352abff4d39c848b253404411c695
Instruction ID: 66a3d7c7b9a601d023e5a7ea4e7026f6c3ace02116d6611c9388a54304c9bb2c
Opcode Fuzzy Hash: bb0d006d063812c5a8763770d20e4dc7a4e352abff4d39c848b253404411c695
Instruction Fuzzy Hash: 70514A716006059FC319EF38D95095ABBE6EF84204310CA2ED54A9B754EF76EA0ACFC0

Function 02CAC579 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aec69e5208bc4ab63fca250bd53bd312975dce78e8ff6580c8d07c4316cb420
Instruction ID: 0fbfd8c21a1f743190b00ab71e9201dd0cadfc8093f41d0960afaf577fc43878
Opcode Fuzzy Hash: 6aec69e5208bc4ab63fca250bd53bd312975dce78e8ff6580c8d07c4316cb420
Instruction Fuzzy Hash: 6F513B716006059FC319EF38D55059BBBE6EF85204754CA2ED18A8F664EB75EA0ACFC0

Function 02CAC5E0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d97e91c42b8761d131b1742bf7e6b0121c4985fafa372d27eca15e1e2f6f86ff
Instruction ID: cc37a7b6a8fa09038b7b15a8dae545f68c55d4a1db18947989f1f02003e4de86
Opcode Fuzzy Hash: d97e91c42b8761d131b1742bf7e6b0121c4985fafa372d27eca15e1e2f6f86ff
Instruction Fuzzy Hash: 43513A716006059FC319EF38D55099BBBE6EF84204750CA2ED54A8F754EB76EA0ACFC0

Function 02CA5A31 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb5570dd287308c7fc19e0c5a50b238fa384d4f177e9a04606570074f268f88
Instruction ID: be129971a4dd611e57e8e5b6850f18a9351ec3ca72f5d4c2eea0140deab588f3
Opcode Fuzzy Hash: ceb5570dd287308c7fc19e0c5a50b238fa384d4f177e9a04606570074f268f88
Instruction Fuzzy Hash: 995190B5B002068FCB04DF69D594A6ABBF5FF8C318B514168E50ADB365DB30DD05CB51

Function 02CAC798 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db3b8af6b8168bfccacb7bd09add6712bf5d8952ab7df1c383584b972583e8e
Instruction ID: e978854134d9efa7a5ec89ad87a2495fc556365584c08bd34ee07123f9ee7ec7
Opcode Fuzzy Hash: 4db3b8af6b8168bfccacb7bd09add6712bf5d8952ab7df1c383584b972583e8e
Instruction Fuzzy Hash: B95128715007059BC319DF24D99085BBBE6EF85204314CA2EC18A9B664EF36FA0ACFC0

Function 02CA2850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77ae36294139123a7b070970af1beae23d3d29e9410ec438bf3c046da928b394
Instruction ID: f246e2e7a7d520b3eab59dcb13eec141d80be689927d7c19b9fea71f167f4dde
Opcode Fuzzy Hash: 77ae36294139123a7b070970af1beae23d3d29e9410ec438bf3c046da928b394
Instruction Fuzzy Hash: CB414934E10219CFDB04DFB5E994AADBBB6FF88304F105629E906AB268DF349945CF11

Function 02CA5A91 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd9cb34a038a6bbed05dba437c8766d30d453ea6800eeccf9c0d776103e38b62
Instruction ID: 3be00cecc0c6245cef91c9f90d114981b9d15fc65b9c8de6fd0340113ac9505d
Opcode Fuzzy Hash: fd9cb34a038a6bbed05dba437c8766d30d453ea6800eeccf9c0d776103e38b62
Instruction Fuzzy Hash: D73189B5B102068FC704DF69D994D6ABBF6FF88214B5180A9E50ADB321DB30ED05CBA0

Function 02CAB0A0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3aad191f8cd5ab1f795334a9ad12863e8584ec0d2d8dc278b398badf0549699
Instruction ID: 3ae701a2183e0583d3e51950041691cf32971e29132090d7ba504f8b5670f532
Opcode Fuzzy Hash: a3aad191f8cd5ab1f795334a9ad12863e8584ec0d2d8dc278b398badf0549699
Instruction Fuzzy Hash: BA3137306102058FC705EB79F9556ADBBBAFF85308F04862DC409DB2A6DF74AD09CB91

Function 02CA5A9D Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3decad7be44e662cfb08f49536a32d13875131c786595808b735256022bf57d8
Instruction ID: 8b226d4b77acc77acc8b1c151c895585c36fcbaa9d347c2d206bbb1cf7a1ef35
Opcode Fuzzy Hash: 3decad7be44e662cfb08f49536a32d13875131c786595808b735256022bf57d8
Instruction Fuzzy Hash: 5C314AB5B006068FC704DF69D594E6ABBF6FF88215B518168E50ADB325DB30ED05CB60

Function 02CA2842 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3aaed86699fcc956246ca682bbeefafead104a5b25f869524451f3df3a5bc33
Instruction ID: a9a2a970ede7c62ee86ed959714b0da6ddee204dffebc32b2d7074dddcadf59e
Opcode Fuzzy Hash: d3aaed86699fcc956246ca682bbeefafead104a5b25f869524451f3df3a5bc33
Instruction Fuzzy Hash: 8331AE31E10219CFDB04DFB5E894AEDBBB6FF88304F105629D905A7264EF349944CB11

Function 02CA5308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59cff2cbc381088a507e7244bf4b5a400eee6ce96a68c3c821e332c5ed4afc76
Instruction ID: 71b55f8d33470c2f296f99d2b470659eca31e6b9df26255e79c1e4a341836995
Opcode Fuzzy Hash: 59cff2cbc381088a507e7244bf4b5a400eee6ce96a68c3c821e332c5ed4afc76
Instruction Fuzzy Hash: 3D410934E01119DFCB04EFA5E8A49ADBBB3BF88315F508165E806A7365DB349D42CF50

Function 02CA67F8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e3df4fff3934751878a29429e40e3f7ab33bccbbb1a7c0a1c4887be35d0318
Instruction ID: 35b8ac05d330d96bae7a2c853474ef6abf75182e60e27be1592fd2ca8983e287
Opcode Fuzzy Hash: d9e3df4fff3934751878a29429e40e3f7ab33bccbbb1a7c0a1c4887be35d0318
Instruction Fuzzy Hash: 56310631A00206CFCB14DF70D9646EE7BBBFF85318F28866AC40557255DB749A06DB90

Function 02CA2C48 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9899aa8858737af8480643066ac5920e0f377822b476a53b24dd3b43c0976481
Instruction ID: ca633b87cb37a006d11d4b315acf55c7cb68a7fae275247310e59ed02baeaa67
Opcode Fuzzy Hash: 9899aa8858737af8480643066ac5920e0f377822b476a53b24dd3b43c0976481
Instruction Fuzzy Hash: 10318174D0021ACFCB04EFA5E984AEEBBB5FF48314F104225E905A7358DB349A51CF91

Function 02CA2C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f23197e8deca7b997567107edfa685b8cc046d91e87a5ea96bf551bb95f321ee
Instruction ID: a76df9f206090e2492c1cb7232b4ba395068265674d5d6dd1882d4754177da25
Opcode Fuzzy Hash: f23197e8deca7b997567107edfa685b8cc046d91e87a5ea96bf551bb95f321ee
Instruction Fuzzy Hash: 95317074D0121ACFCB04EFA5E984AEEBBB6FF48314F104225E905A7358DB349951CFA1

Function 02CA5695 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3614f445e4a2c41b6d21a6513f5c40854194daa361124a5868e169b1ce729471
Instruction ID: d935824a20c31c4aa414808b7e5d87cb109784c323f562842e82264e32c544ea
Opcode Fuzzy Hash: 3614f445e4a2c41b6d21a6513f5c40854194daa361124a5868e169b1ce729471
Instruction Fuzzy Hash: E1218974B002018FC718DF29D5A8AAEBBF6AFC8615F648469E406EB360DF71DD05CB50

Function 02CA4B70 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b05cd9d13436d37da1d3b5d97c251aaa7edc16a573dce243b9c7d266985e7cf
Instruction ID: f8196c9c78e95fef64026fa2cc732661da82446e94ca3d92ab24d60862b4b613
Opcode Fuzzy Hash: 8b05cd9d13436d37da1d3b5d97c251aaa7edc16a573dce243b9c7d266985e7cf
Instruction Fuzzy Hash: 102192312042055FC719EB39F880E6EBBAAFF80215F444A28D4098B268DF74ED4DC795

Function 012ED0EC Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3816747322.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_12ed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca228f82e97c862de68e3e2d5327cfa9a6344d046648b179169f62077e79c18
Instruction ID: 7b0a1cc12df7f9ce733a9975f1deb43eb6d3cc14e298761bfe546f14241fab0f
Opcode Fuzzy Hash: 3ca228f82e97c862de68e3e2d5327cfa9a6344d046648b179169f62077e79c18
Instruction Fuzzy Hash: A92135B06242489FDB05EF68D9C8B26BBE5EB84314F60C66DDA094F352C37AD406C662

Function 012EE1DC Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3816747322.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_12ed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 628f9591b3a30d2cf951fde0ccae4966788d854aaaf4bfc4eaae1e4d0fb3157a
Instruction ID: 6f29318120fa1cea5d9885d278ec26d7352d0cacd142033dcf8f8ed0f0c36c0c
Opcode Fuzzy Hash: 628f9591b3a30d2cf951fde0ccae4966788d854aaaf4bfc4eaae1e4d0fb3157a
Instruction Fuzzy Hash: 2E2135B06142409FDB15DF28D5C8F26BFE5EB84314F60CA6DDA094B382C37AD846C662

Function 02CACEC0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67bc2f3f8b247a460a8c5e49ab6deb35c6fe68832c3bcb716eee67f63c47666c
Instruction ID: 6ab3fc59518b3e108c44995c272203bc5e6de515431197c13d1f838b9edd80e8
Opcode Fuzzy Hash: 67bc2f3f8b247a460a8c5e49ab6deb35c6fe68832c3bcb716eee67f63c47666c
Instruction Fuzzy Hash: 72219C70C0124DDFDB11DFA9D559B9DBFF5AB48318F14806AE805A7340CB7AAA44CF90

Function 02CA4B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e877495d50180f5ea9790ff3582bc4ecaed1efc5c8acb3c8bc2f3196d182826d
Instruction ID: 788ada0a2789437faf1cf4512e118a5418b3846b41ca098c9924b948fe49ad28
Opcode Fuzzy Hash: e877495d50180f5ea9790ff3582bc4ecaed1efc5c8acb3c8bc2f3196d182826d
Instruction Fuzzy Hash: 0F2184312103065FC709EB79F980E6EB7AEFF80214B448A38D4098B668DF74ED4D8795

Function 02CACED0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c4b04d7de0a1ad71caeb258890e6e2b8ada46a5dd4fb596043f2134ce9a0b7
Instruction ID: 5efe126143041ae7f512b0434a52ac6f8b7510e9b560fbb364a350e610de9be3
Opcode Fuzzy Hash: 48c4b04d7de0a1ad71caeb258890e6e2b8ada46a5dd4fb596043f2134ce9a0b7
Instruction Fuzzy Hash: 37214870D00249DFDB10DFA8D559B9EBFF6AB48314F10805AE805A7340CB7AAA45CF90

Function 02CA5C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da315a7c5c444782d548ada9ee33e937d6e8ba849c84aaab84fdfd1913add05e
Instruction ID: a57229679d96f7bf3384f0666d44a3e2c56a6af1ac79e02b705818f6f1c97a34
Opcode Fuzzy Hash: da315a7c5c444782d548ada9ee33e937d6e8ba849c84aaab84fdfd1913add05e
Instruction Fuzzy Hash: 06215B35E002198FDB14CB99D598BDDBBF1AF8C314F6040A5D405BB360DB359E44CBA0

Function 02CA5C59 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff1da9d2c5ee5c2836d1271f27039b6ccb459f172d929a7ae57f959f03f79c5
Instruction ID: 2adf5c0c3a917d34f2f6a732e6267304e6ed6a902e3cffa3f555c4afdfe182fc
Opcode Fuzzy Hash: dff1da9d2c5ee5c2836d1271f27039b6ccb459f172d929a7ae57f959f03f79c5
Instruction Fuzzy Hash: A9118C74E002198FDB14DBA5C6A8BDDBBF1AF4C318F6440A9D402BB365DB359E44CB60

Function 02CA5C64 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1c817feb75e1c1cdd822400232f2a81ac79eb1c44cefcb01b5047b12646f8d3
Instruction ID: 8aa47e13628c69fb46c3136783efbb11849fe43a47e2ce4a65721b7bc6218b66
Opcode Fuzzy Hash: a1c817feb75e1c1cdd822400232f2a81ac79eb1c44cefcb01b5047b12646f8d3
Instruction Fuzzy Hash: 42113A75E002198FDB14CBA9C698BDDBBF2AF8C314F6440A9D402BB364DB759E44CB60

Function 02CA41A2 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85da63b21dfea99435e8ee5dec67aaf863b875a0f9cadd0b71ef03817fe6af4d
Instruction ID: 9508b0599734351e4cb67e561e6a31c5be89e8ed7ff27115aec415166e389e4f
Opcode Fuzzy Hash: 85da63b21dfea99435e8ee5dec67aaf863b875a0f9cadd0b71ef03817fe6af4d
Instruction Fuzzy Hash: 8601283630C2846FC309A774ECA066E7FBAEBC6121794049AE809D7381CE255C0AC3B6

Function 012ED0E7 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3816747322.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_12ed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561e0040fa13a4c8f15330505c2ec777d2b9bad7fdc99719fcd56c8bdcde1cea
Instruction ID: 4b7e41156dcf24255f58afdadeb16fc465575b00115b4d045e1f347e6c6f7821
Opcode Fuzzy Hash: 561e0040fa13a4c8f15330505c2ec777d2b9bad7fdc99719fcd56c8bdcde1cea
Instruction Fuzzy Hash: C411E0B5504284CFDB16DF18D5C8B15BFB1FB84314F24C6ADD9494B652C33AD44ACB62

Function 012EE1D7 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3816747322.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_12ed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561e0040fa13a4c8f15330505c2ec777d2b9bad7fdc99719fcd56c8bdcde1cea
Instruction ID: dd46d283ac7b9213fb45ffdb55cc80cebe7ba0f004ddb8ae69bd38be142afb15
Opcode Fuzzy Hash: 561e0040fa13a4c8f15330505c2ec777d2b9bad7fdc99719fcd56c8bdcde1cea
Instruction Fuzzy Hash: 3E11A0B5504280CFDB16DF28D5C8B25BFA1FB54314F24C6ADC9494B692C33AD44ACB52

Function 02CAC000 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc612d6ffa1b0a3bcbfa4de11cf59ad3b75d940058f6282ccc9a432f93b86516
Instruction ID: df826a93009cf2560c2c303a34dcb65b79452ed7570f5aac17a1d2a890c6ba43
Opcode Fuzzy Hash: cc612d6ffa1b0a3bcbfa4de11cf59ad3b75d940058f6282ccc9a432f93b86516
Instruction Fuzzy Hash: 1D1169303106258FCB05EF2DF884D9ABBB9FF85618B1081A9E4058B276DB71ED19CB90

Function 02CA688D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dc243101928a31a23709e2933760a4862749e087ffca0c01f09858d0589d513
Instruction ID: 2666009c7e94d879b1d2b5bb04670eb43d3a6feec511ca4ba2f567b96b0ea58c
Opcode Fuzzy Hash: 5dc243101928a31a23709e2933760a4862749e087ffca0c01f09858d0589d513
Instruction Fuzzy Hash: 28115E70A00206CFDF54DBB4CA587EDB7FABF45309F288069C406AB261CB759A49DF11

Function 02CA6888 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69256d10555e56b9d22f4404bf610052c490d05c9cd20752a1b329d32b05167f
Instruction ID: 8b948d7388728d72b97295254f32d63c60f6dbcb136e670212ab39557bc6c19e
Opcode Fuzzy Hash: 69256d10555e56b9d22f4404bf610052c490d05c9cd20752a1b329d32b05167f
Instruction Fuzzy Hash: 8E115271900206CFDF14DBB5C6687ADB7FABF4530DF288069C006AB151DB719A45DF52

Function 02CA32E0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cca9f5857a5d360a84c2c7210224cfa6c86222468bab7efb376733a18e2962e
Instruction ID: 74aa6e23ce0829305c589aa89debcc667c8de7ffa70ee75b1babf87f6eb08f99
Opcode Fuzzy Hash: 2cca9f5857a5d360a84c2c7210224cfa6c86222468bab7efb376733a18e2962e
Instruction Fuzzy Hash: A9115E39A203488FCB44EFB4E96979EBFBAEB88305F406429E8069B341DF355814DF51

Function 02CA5940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd161513fb3e2b9acde1df042bf7d7f45065aa18766517a01f3305f614d84b4b
Instruction ID: 4a94ca23aa9be820e9551c5524af8e9c2cc2fd4fb5b5a600ef539faa02a5cb46
Opcode Fuzzy Hash: fd161513fb3e2b9acde1df042bf7d7f45065aa18766517a01f3305f614d84b4b
Instruction Fuzzy Hash: 690131763102209B8704EF79F49486DBBAAFBD9666350957EEA0AC7350CE319C0687A1

Function 02CA2A80 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802a7737a82599a4577846c3e5f83b382a6be04b83e14d9e59701977e3bb5084
Instruction ID: c968dde9698499f7acdd3da060302a91a4ec548bcf87d2140f26745b7427d267
Opcode Fuzzy Hash: 802a7737a82599a4577846c3e5f83b382a6be04b83e14d9e59701977e3bb5084
Instruction Fuzzy Hash: D0018BB56203108FC314EB38C445A9B7BF5FF44624B14896AD54ACF764EB36EC088BC2

Function 02CA32F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ab5a6e0ba21ce343e955af8718301ff5fe4640835736ac83d3e4e6c316b3631
Instruction ID: 7017736cd6a04ef522391060dcbda99690ac08103cc48ab45b3d4c073a6023b4
Opcode Fuzzy Hash: 1ab5a6e0ba21ce343e955af8718301ff5fe4640835736ac83d3e4e6c316b3631
Instruction Fuzzy Hash: 97012935A203488FCB44EBB5E56979EBFBAAB88305F005469E8029B281EF355815DF51

Function 02CA5931 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598543d1368f7d288093a1cca7cfd2b4cb42c7095ff8c8c1ecaaf14daa71a3a3
Instruction ID: b00c5cf675f9a24e2f93c749900a9e97632f54ed1f9ce0a0920f973f33aa52ab
Opcode Fuzzy Hash: 598543d1368f7d288093a1cca7cfd2b4cb42c7095ff8c8c1ecaaf14daa71a3a3
Instruction Fuzzy Hash: 4BF09676315210DFC3149F39E49486ABBB6FBC9265354856EE505CB351DA30CC06C761

Function 02CA6388 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2137f4bed9d54e547ff6cd154efa1ac38da3434034c2530e8129c5240dbd821
Instruction ID: be9cd4959564664ac1b3e1c8726d59dd7a8820240de8a0b162d5f5ca374be594
Opcode Fuzzy Hash: e2137f4bed9d54e547ff6cd154efa1ac38da3434034c2530e8129c5240dbd821
Instruction Fuzzy Hash: 56F02474915249EFCB00EFB8E9549ADBFF1EF45200B2045E9D80CE7250DA305F09DB52

Function 02CA6398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53a768cc47c7fb1834f0a0e634ba6bf57a68d3ae12d6b9634feb0918f001e467
Instruction ID: 8e1eb3f91a276d0fc631570117fb2ede3385e737099a38a59a1cb3898a531497
Opcode Fuzzy Hash: 53a768cc47c7fb1834f0a0e634ba6bf57a68d3ae12d6b9634feb0918f001e467
Instruction Fuzzy Hash: A8F0A774E00209EFCB04EFB8E5449ADBBF5EF84200F6045A89808E7340DA305F05DB52

Function 02CA2DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1d3e6a4b779a0d604ab40f09993862ae21333485b1f3c5ab68a3e0fb93e02ae
Instruction ID: 6b40c2f72d8f207165ffb182527afcb4f78580c87b205720808e4056da5ab51f
Opcode Fuzzy Hash: b1d3e6a4b779a0d604ab40f09993862ae21333485b1f3c5ab68a3e0fb93e02ae
Instruction Fuzzy Hash: 01E06D71E10119CF8B84EFBCC4056DE7BF4EF48310B2040AAD509E7301EB309D008B92

Function 02CA1FF8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ad5b2201a530bad885d3fb7f1be21cb43b540130e58d3629f7a0b91635ff7a
Instruction ID: fa31d392d9b688e55320db00ccccc1c9d18a33f01baf18df010d0b9378f73dbc
Opcode Fuzzy Hash: 03ad5b2201a530bad885d3fb7f1be21cb43b540130e58d3629f7a0b91635ff7a
Instruction Fuzzy Hash: D9E08C367002049FCB046A79D41AA8AFBEDEBC9662F951466F40ACB320ED75CC0287A1

Function 02CA37EE Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2513d48f58d55f7870c8ea3c798f7860707d227b23881d85a96d61e4b7045697
Instruction ID: 2558e546d238ed76563c8c34ea67239744833f5f0f6527aa3b388be9c8bc1913
Opcode Fuzzy Hash: 2513d48f58d55f7870c8ea3c798f7860707d227b23881d85a96d61e4b7045697
Instruction Fuzzy Hash: C7D05B3271011057D714569A791497767AF9BC8326B08462BF919C7650FF61D8115390

Function 02CADD40 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e4e6e5bbebf08b298b551953d2eb19dcac7d2e2cdcea24a838c70760bb6ab73
Instruction ID: 8e58efbc4446454bee8ec17bfe51d80368fdfc5d2a3d22e8ccc75bb8587a3b21
Opcode Fuzzy Hash: 5e4e6e5bbebf08b298b551953d2eb19dcac7d2e2cdcea24a838c70760bb6ab73
Instruction Fuzzy Hash: C6D05B367509248F8751D778F544856B7F8EF496653004195F90EC7B20DB71FC0087D0

Function 02CA66C8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 865fb98c9d71e249711cf922add011d456aaed7d3fb54a8b6239b7cd16061920
Instruction ID: 386e31eb2f58b1947c4e1c2577c77cc1afaec8a887ea125eafe8d59fefbd0e17
Opcode Fuzzy Hash: 865fb98c9d71e249711cf922add011d456aaed7d3fb54a8b6239b7cd16061920
Instruction Fuzzy Hash: 36D02232B1C2A1C74B41136CF02007C9BEEE7C20B235900E3F20BCB355CE600D09A382

Function 02CA5631 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9010552a16fa7aa94d12ec60b2b2c65c91e9fb7ed2ff955e3be1762d046393
Instruction ID: eb6e1e0314eb9b49d07a1b3a8b5d70bfa8f61927ac44613d42aee83b60555cd5
Opcode Fuzzy Hash: 5d9010552a16fa7aa94d12ec60b2b2c65c91e9fb7ed2ff955e3be1762d046393
Instruction Fuzzy Hash: 28D022204642415FD30207281C3A2923F3EDE4302B34801C6AC0C8B622E92BE82FAB10

Function 02CA6469 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c240c00fa84d44e5f11846c23a303540e6e92fb663c001676cad1034eec5280
Instruction ID: 7da34c96756fc4f3d67645916f4b9643a6c3859a5f702dc70f7f1802cc583d7f
Opcode Fuzzy Hash: 0c240c00fa84d44e5f11846c23a303540e6e92fb663c001676cad1034eec5280
Instruction Fuzzy Hash: 3CD0A7787481408FC304CB24E2908157777EB8D31071504A6E40DCB379CA24CC41CB15

Function 02CACFFE Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 305728e9095adc6f893e7a28118d87afa9d9627ba3292b48fe8194ad9b32cc66
Instruction ID: 152aa84eacf366ba9e330d7758aa86e617f0517ad054e6f59e1aa43148ead812
Opcode Fuzzy Hash: 305728e9095adc6f893e7a28118d87afa9d9627ba3292b48fe8194ad9b32cc66
Instruction Fuzzy Hash: AAD0A93841A30687EF200612B16F3743E559FC031EF18C06AB80B06A94CBFAD18AEF90

Function 02CA66D4 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 899fcc2ea051d6e5e25f3a6112330529c99ebf2087da4da25bcd2b806187b17e
Instruction ID: 9656fa3d51fa3b826fb8f16c57c90fab71098230a4efb73436a96ae1a2085ba0
Opcode Fuzzy Hash: 899fcc2ea051d6e5e25f3a6112330529c99ebf2087da4da25bcd2b806187b17e
Instruction Fuzzy Hash: 29C08C32320020030504219CF4004ADCBCECAC826235811BBF605D7304CC508E022382

Function 02CA6478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 879a8773100bb66eca3b58d232b0959bfee64550ecda65c99a792fa7a4880edf
Instruction ID: 3497544bd8e7120751e693326f3c581fc0f78aa7928070683e7179b7478609cb
Opcode Fuzzy Hash: 879a8773100bb66eca3b58d232b0959bfee64550ecda65c99a792fa7a4880edf
Instruction Fuzzy Hash: 4AC012747402144F8208DB5CE080C1573EAEB8C71071001A4F50DC7339CD20EC41C618

Function 02CA6474 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe2b8dd43c14f5523291325abaa2b9b71d6d07fe84c398ac7892d44ee74a4e9
Instruction ID: 67658c84818a87d014948f3176f6216b40db0d8fb6c7a937779ff429901485e0
Opcode Fuzzy Hash: ffe2b8dd43c14f5523291325abaa2b9b71d6d07fe84c398ac7892d44ee74a4e9
Instruction Fuzzy Hash: 8AD0C97A7401108FC208DB58E180C1577FAEF8C31471151A9E50DCB339CA30DC82C619

Function 02CACAA0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3818012179.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ca0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347ba105000cf90d3709d5f1bbdd615cc0e0e4c6fc129454f32e785bd71c6efe
Instruction ID: 628725554ca6d45283f04b6bfe5d39da7c2cc36e8c322e17af4d795539c35072
Opcode Fuzzy Hash: 347ba105000cf90d3709d5f1bbdd615cc0e0e4c6fc129454f32e785bd71c6efe
Instruction Fuzzy Hash: 3EB09273AA8AC41BEE039BA4598A380ABA0A350202F440151E5AE88982E65090068646

Analysis Process: GamePall.exePID: 5168, Parent PID: 6676COMMON

Executed Functions

Function 012E4F58 Relevance: 7.9, Strings: 6, Instructions: 391COMMON

Download Yara Rule

Strings

(aq, xrefs: 012E5082
(aq, xrefs: 012E5056
(aq, xrefs: 012E55A3
(aq, xrefs: 012E51F9
(aq, xrefs: 012E51CD
(aq, xrefs: 012E55CF

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq$(aq$(aq$(aq
API String ID: 0-2219660067
Opcode ID: fcea8f0ee2161c8fe1a9aaab31823ce46dea07f0222f784f4d813faf8e7bd95a
Instruction ID: 48211e8008ff663249e6abc91e34cb19b1be9a6c189835c16e38056b2cb1f263
Opcode Fuzzy Hash: fcea8f0ee2161c8fe1a9aaab31823ce46dea07f0222f784f4d813faf8e7bd95a
Instruction Fuzzy Hash: 66E18034B202158FDB09DFA8D4586AEBBF2FF88305F548069D906EB395DB349D42CB91

Function 012E1049 Relevance: .8, Instructions: 843COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59dd4b94ab5261f8478b00559e44afe28e4617e24eed2c612c2f13914c97994d
Instruction ID: f90696d1296900e34afefe2043d0200c91e2e96bbf2031ebef95863b6d34b9ff
Opcode Fuzzy Hash: 59dd4b94ab5261f8478b00559e44afe28e4617e24eed2c612c2f13914c97994d
Instruction Fuzzy Hash: A68224B4640209DFDB16DFA5E754B6E7B7AEF88300F2044689800337E9CA3E6D55DB26

Function 012E5640 Relevance: 4.0, Strings: 3, Instructions: 211COMMON

Download Yara Rule

Strings

(aq, xrefs: 012E586F
(aq, xrefs: 012E5655
(aq, xrefs: 012E589B

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq
API String ID: 0-2593664646
Opcode ID: 3bdbb1b86951eb5113eedd8111262112c89372babb78027288cfb0d55dc9fbea
Instruction ID: 7281f638515b7c4c23eda3d30bacbc1734d8fe527088c91c0dce916fbb91b17f
Opcode Fuzzy Hash: 3bdbb1b86951eb5113eedd8111262112c89372babb78027288cfb0d55dc9fbea
Instruction Fuzzy Hash: 6471B234B202058FCB09DF69D598A6EBFF6AF89604F5480A9E506EB361DF70DC42CB50

Function 012E3750 Relevance: 3.8, Strings: 3, Instructions: 88COMMON

Download Yara Rule

Strings

(aq, xrefs: 012E3820
(aq, xrefs: 012E3786
(aq, xrefs: 012E37B2

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq
API String ID: 0-2593664646
Opcode ID: 53b980b451523ed48475f7c2b00eb84d26da7af3c1b68a96ebdf5a455fbd284e
Instruction ID: 0e8650f7285a1095994515e047bde22513de4212cde926d15b1a916ef2590198
Opcode Fuzzy Hash: 53b980b451523ed48475f7c2b00eb84d26da7af3c1b68a96ebdf5a455fbd284e
Instruction Fuzzy Hash: 5D214D31B082550FD71BAB7D181417F3FE79FC622175941AAE906D73C6DE288C074392

Function 012E3BE0 Relevance: 3.0, Strings: 2, Instructions: 465COMMON

Download Yara Rule

Strings

(aq, xrefs: 012E3DE5
(aq, xrefs: 012E419C

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: 53329ebaa7235e9073295b7f8bfb012585bdbb0b52cc232f30e799aa01292c56
Instruction ID: 905f517a05877fdeee4c1b118adb5432dc5c827dae9a263ce343668ecd7d2491
Opcode Fuzzy Hash: 53329ebaa7235e9073295b7f8bfb012585bdbb0b52cc232f30e799aa01292c56
Instruction Fuzzy Hash: 0DF16F707002058FDB19DF79D95866E7BEBEFC8300F248469E906AB3A5DE399C06CB51

Function 012EB0B0 Relevance: 1.9, Strings: 1, Instructions: 680COMMON

Download Yara Rule

Strings

e|q^, xrefs: 012EB23E

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID: e|q^
API String ID: 0-3800754954
Opcode ID: 7280c0b8ec4131b88d76e858948fe6e9aba82cfa53f55bc01608ca03ecc6e473
Instruction ID: 592ab985a556831d8fbfcb7bac24ddc6222ea9b05113afd6ab78624ee5bb8376
Opcode Fuzzy Hash: 7280c0b8ec4131b88d76e858948fe6e9aba82cfa53f55bc01608ca03ecc6e473
Instruction Fuzzy Hash: 3C525830A11212CFC728EF38E5589297BF2FF84305B64857DD91A9B2A5DB3ADC85CB41

Function 012E385B Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

(aq, xrefs: 012E3BA1

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: f3b1040ad1e3084e8f553c829acec1502b09a40efc86b568fd77aea1712e158f
Instruction ID: 443578a6b219b50c66b8ac8369e0e4a06fe205eb923d7a1afa1d5100bc25b740
Opcode Fuzzy Hash: f3b1040ad1e3084e8f553c829acec1502b09a40efc86b568fd77aea1712e158f
Instruction Fuzzy Hash: 84A18274B102199FDF05DFA9D954AAEBBF6FF88310F204029E905A73A4DB399C01CB90

Function 012E35E1 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

(aq, xrefs: 012E36B6

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 38978428b3de5fc28dde7a0acb0e9315fa4059aa4b0188b116c72ef0c38ef8c3
Instruction ID: d005b06ee23e638637f7f295c98ff8c5d0c6165d7f76b043e95c32a184061905
Opcode Fuzzy Hash: 38978428b3de5fc28dde7a0acb0e9315fa4059aa4b0188b116c72ef0c38ef8c3
Instruction Fuzzy Hash: 0841E0313042021FD71EAB79A85453F7BEBFFC625076988A9D906CB394DE24DC0787A2

Function 012EBEAF Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Te]q, xrefs: 012EBF75

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: ffc8900203cfe23928661bb82110952c538e81b672f6654975934628a91f4060
Instruction ID: dfea06abb68becc694574387f7414330a392167e2be4baa1158639d999aa94f9
Opcode Fuzzy Hash: ffc8900203cfe23928661bb82110952c538e81b672f6654975934628a91f4060
Instruction Fuzzy Hash: A8418D347106018FC758DF6DC898A6EBBE6FF88710B6585A9E406DB3B1CB70EC018B80

Function 012E2B10 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

LR]q, xrefs: 012E2B35

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 2d14ace92e1e0c1e662c09f95f72a682729a7779591dcc5ecade67ef6439b2f0
Instruction ID: b354438fa1eb73663222c8483104a269707d3d7bff415ac4faf1c9f9612ae578
Opcode Fuzzy Hash: 2d14ace92e1e0c1e662c09f95f72a682729a7779591dcc5ecade67ef6439b2f0
Instruction Fuzzy Hash: A43121707102158FD719AF35C55852E37B2EBC9A19720817DD10ACB3A4DE3ADC43CB96

Function 012EBEC0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Te]q, xrefs: 012EBF75

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 9266b17e43ffe722b1b4507811d3d865f842b73ec363f6a3d39704cc6163e446
Instruction ID: 4daf642e958ebd96204115fa74070debe1b0aa3c276fec44c0e5681c25f06b1d
Opcode Fuzzy Hash: 9266b17e43ffe722b1b4507811d3d865f842b73ec363f6a3d39704cc6163e446
Instruction Fuzzy Hash: A4316C347106158FC758DF6EC498E2EBBE6BF88710B6584A8E406DB3B1CB71EC018B81

Function 012E4237 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

(aq, xrefs: 012E4295

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: ac67070d46e6760c1eb32fcf121143ea4ace598288a87d3baef67d92bb105c79
Instruction ID: eec059b789e9bb55f0d3fd4061940d2bdb7953f2c7fa4dc7f08c60f6da0d963f
Opcode Fuzzy Hash: ac67070d46e6760c1eb32fcf121143ea4ace598288a87d3baef67d92bb105c79
Instruction Fuzzy Hash: 232175327082815FC70EABB9682417E7FA6EFC615074948AFD946CF341CF649C0AC3A6

Function 012E1058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e66e8902ad9cf4f59fb7d7d84a8eac3b88dbabce073565499d2cad044324a82
Instruction ID: 2cf3e3f2cbf074a589c5e5869f14b38459d631409857cfeed84c6c82e75196a0
Opcode Fuzzy Hash: 7e66e8902ad9cf4f59fb7d7d84a8eac3b88dbabce073565499d2cad044324a82
Instruction Fuzzy Hash: C08214B4640209DFDB16DFA5E754B6E7B7AEF88300F2044689800337E9CA3E6D55DB26

Function 012EBB99 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4822e02bff0d64d77ebbe42dd82db037c85d76359562d8296254f83e773aed8
Instruction ID: cfc49897463368a64e633a5f9efb7df1164fe209955d1293a2978df4960b6281
Opcode Fuzzy Hash: c4822e02bff0d64d77ebbe42dd82db037c85d76359562d8296254f83e773aed8
Instruction Fuzzy Hash: BC811E70A01116CFC724EF28E689D197BB6FB44304BA5C678D9189B2A9C77EEC49CF40

Function 012E38E5 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8554a39e3566316886c627caca4482c8bc54d2c3e70ea6679781aad6757d4555
Instruction ID: 04f9d46ca2c6450476ae794b12ed4d106a648c1793bb43ec9ee3f1703ffd2761
Opcode Fuzzy Hash: 8554a39e3566316886c627caca4482c8bc54d2c3e70ea6679781aad6757d4555
Instruction Fuzzy Hash: 1B512E74B10219EFDF15DFA4E958AADBBF6FF88310F204029E905A73A4DA399C41CB50

Function 012E5A91 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40dde9f13c8b6105a5c502578f8111fbb6f03adfa8715fa917c48001bc97a8a9
Instruction ID: 421aa7a4e9fdd8ebcbefdb1f37f9eeb66220db44acea06e500f3507efeffdf38
Opcode Fuzzy Hash: 40dde9f13c8b6105a5c502578f8111fbb6f03adfa8715fa917c48001bc97a8a9
Instruction Fuzzy Hash: EC515C74B202068FCB09DF68D998D6EBBF5FF88204B5141A9E50ADB365DB30DC05CBA0

Function 012E5240 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f6bde5c0b2bc082ac39bd71f60aba3ba1bae2b26c838c90453fd2a3202f81b
Instruction ID: a58bbf471dec4f7fc1522068fcaeb9482731cb1a66ed36018d1433498f00b7b1
Opcode Fuzzy Hash: 69f6bde5c0b2bc082ac39bd71f60aba3ba1bae2b26c838c90453fd2a3202f81b
Instruction Fuzzy Hash: FB516C34A20219DFDF15DFA8D588AADBBF2FF88315F648065E506AB350DB749C41CB90

Function 012E2850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c927c455e3895d0b63742fbba67eb4f60bea9aa3db4ebf7d670e53f152936712
Instruction ID: 6e8efb878a353b19e1dde0dc2cdae29aef7daaa542676d0083634d82bbca8d13
Opcode Fuzzy Hash: c927c455e3895d0b63742fbba67eb4f60bea9aa3db4ebf7d670e53f152936712
Instruction Fuzzy Hash: 89410570E50209CFDB15DFA8D9849ADBBB6FF88340F604529D906AB264DB799845CF20

Function 012EB0A0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa77d5b56f3932f1282e80b22622261ff2b50fd10d708c79c4f6e8c9ed6188e9
Instruction ID: fa4637903d2f0c096e1ab7a38b67b1ef0ce590b8be7e00fe532323c2a551b57f
Opcode Fuzzy Hash: aa77d5b56f3932f1282e80b22622261ff2b50fd10d708c79c4f6e8c9ed6188e9
Instruction Fuzzy Hash: 333124316102058FCB19DB78E9546ADBBFAFF85200F54853DC1199B2A5EF789C09CB81

Function 012E5308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 233d8b9de5cee1a383b30cb6615ea10e201ef2e3141f384e6e627548d72c86de
Instruction ID: 70c36c4eb1fe34ce9acfd947d377fe9b39678d2fc2f27eec9a216a503cf601a6
Opcode Fuzzy Hash: 233d8b9de5cee1a383b30cb6615ea10e201ef2e3141f384e6e627548d72c86de
Instruction Fuzzy Hash: 6B413E74B21115DFCB04DF64E5989ADBBF2FF88305F608065E506A73A0DB399D42CB50

Function 012E2843 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c616090b30e9e7d8719a5b361447a33c7069f5f331b0f29296d957f2f835640c
Instruction ID: 702c7d967d0202fcacfc02d938c464abdd630d493ac56b1d4acf8961033da95b
Opcode Fuzzy Hash: c616090b30e9e7d8719a5b361447a33c7069f5f331b0f29296d957f2f835640c
Instruction Fuzzy Hash: 73315E30E50209CFDF15DFA8D9989EDBBF6FF88340F604529D902AB264DB799845CB20

Function 012E2C48 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b35709a6f3f476f01895987eedca423d94dc85a753b1177ef14c671ef04be9d2
Instruction ID: 275d71f01f80046ef8de694ae0ea08b0573a5cabb8e2f55d0e40d151acd12fe6
Opcode Fuzzy Hash: b35709a6f3f476f01895987eedca423d94dc85a753b1177ef14c671ef04be9d2
Instruction Fuzzy Hash: 38412774A0020ACFCB15DFA8DA84AAEBBB5FF48304F204565D501B7390DB3A9D45CFA0

Function 012E2C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39be256e1624c8206c14e83ba340ccbe021cb557b2aeb095def7f4828649180c
Instruction ID: 72389755ef51d45c98662f55a639bc6fb83cbdc50f4e5d1d4784dc2fc6854cbb
Opcode Fuzzy Hash: 39be256e1624c8206c14e83ba340ccbe021cb557b2aeb095def7f4828649180c
Instruction Fuzzy Hash: 9A31E574A0020ACFCB15DFA8D684AAEBBB6FB48314F204529D505A7394DB7A9D45CBA0

Function 012E4B70 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f0e90100382bee567df50148f54297b9325397e591fd3f22705fbb9b1c95de
Instruction ID: e794199b88943c6e896d72c95bee987b73ec9d37c1a262795f472ba1cfef1e3e
Opcode Fuzzy Hash: d6f0e90100382bee567df50148f54297b9325397e591fd3f22705fbb9b1c95de
Instruction Fuzzy Hash: 9A21E5302407029FC71DEF78E990A6EBBAAFF80204B044E79D0168B264DB74ED49C794

Function 012E4B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6226817ec7290bee2bea9b7c86c8fe3c4fc8ad6b02905b507770c538435c095
Instruction ID: 6ead028f465b58ea12241140adbd6bd0ed16597bd76b76a575081bea298ecbae
Opcode Fuzzy Hash: c6226817ec7290bee2bea9b7c86c8fe3c4fc8ad6b02905b507770c538435c095
Instruction Fuzzy Hash: BC21A4312007025FC71DEB78E990E6EBBAEFFC0254B048A39D4158B268DF75ED498794

Function 012E6888 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a36d155ffe7c8e7c8ad3fcc0aa189e533eba2f461fc6b77ca4ffed9c1b6aa6
Instruction ID: 48406d97d334fe84475c1a7851d645218f16d460de20fb38504fdcaed826e421
Opcode Fuzzy Hash: b3a36d155ffe7c8e7c8ad3fcc0aa189e533eba2f461fc6b77ca4ffed9c1b6aa6
Instruction Fuzzy Hash: 55219371E10206CFDB10DBA4DA4C7EEBBF1EF55305F54806AD109AB252DB758A05CB51

Function 012E5C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e647e8a36663612805d6c03da49602395b18cd393ceee6c5f744f9d9d46aa9f
Instruction ID: c9592c60acc7845a73dfe39c26cbb26a50c00f70ebfcf2855a4ed1444cbab700
Opcode Fuzzy Hash: 2e647e8a36663612805d6c03da49602395b18cd393ceee6c5f744f9d9d46aa9f
Instruction Fuzzy Hash: EA216A35A102198FDF14CBA9D598ADDBBF1AF4C314F6000A5E505BB361DB76AD44CBA0

Function 012E5C59 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ca4b43c41be4f4a85b074c7861510f558ec290e91c179ff63f5bbc44af0f5f0
Instruction ID: 703976c9f52817bd4a47c82a42ee5ee1bb62a419e14fe03cd79cac014c334e30
Opcode Fuzzy Hash: 5ca4b43c41be4f4a85b074c7861510f558ec290e91c179ff63f5bbc44af0f5f0
Instruction Fuzzy Hash: 75218C34A102598FDB15CFA9C598BEDBBF2AF4C314F6401A9E501BB361CB769D41CB60

Function 012E41A2 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d8dfe0b72525e22c0a77afc330ee94f849b958e85bccccb88456ac6ef473ef
Instruction ID: 68ed46b7b4c615c5852735ea2dc974ef7018fd5105172f834a8c68d0f30634c3
Opcode Fuzzy Hash: f7d8dfe0b72525e22c0a77afc330ee94f849b958e85bccccb88456ac6ef473ef
Instruction Fuzzy Hash: 7201F53170C3865FC70AAB759C644BF7FBAEF8615175904ABD806DB243CE214C0683A6

Function 012E32E0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9244ab4d2b33d01b80685b996257b7a6d4b4073f16ac2e8702bc6e8f1d1b761
Instruction ID: 0d1b5190540a625717129391673d1764f2187ace27dcc1c2fe15ae96122b8761
Opcode Fuzzy Hash: f9244ab4d2b33d01b80685b996257b7a6d4b4073f16ac2e8702bc6e8f1d1b761
Instruction Fuzzy Hash: 15115E74E50248DBCF05EFB4E5586ADBBF2EB89351F404829D9029B381DB7A1815CB60

Function 012E2A80 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35180e4fd492ec566818ba035e766633cb00594c38e7836558f9c19ffa9521f0
Instruction ID: 399ce3a10a59773f207d578a9e97daf97d50be6cea06d9c09b00db68a30afeb0
Opcode Fuzzy Hash: 35180e4fd492ec566818ba035e766633cb00594c38e7836558f9c19ffa9521f0
Instruction Fuzzy Hash: 51019E312207018FC316AF78C54886ABBF5FF4661831589AAD19ADF322DB75EC05CBD1

Function 012E5940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7355bac248e203d1708afd22865f7b100044fbf143ad83c9c34caee7d65577d
Instruction ID: ef1ddd908fafd311b7536f3d09b76093bbba2ac581604c393fd1c969df3b1206
Opcode Fuzzy Hash: f7355bac248e203d1708afd22865f7b100044fbf143ad83c9c34caee7d65577d
Instruction Fuzzy Hash: 2201A9767112148F4715DF6DF49886EB7EAFBC96A5320453AEA06C7340DE35DC01C7A0

Function 012E32F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8536dbe5127fde641d1d82976f6f1a6efa5bd62970e6842bde002ca7b76673b5
Instruction ID: c2b207389e11e3f03d4b2fb5c0e847adf8f03bc05353dc8c571e0bf89e4bfb55
Opcode Fuzzy Hash: 8536dbe5127fde641d1d82976f6f1a6efa5bd62970e6842bde002ca7b76673b5
Instruction Fuzzy Hash: 8F012D74E50208DBCF05EFB4E55CAADBBF6AB88351F404829D902AB380DF7A5814CB50

Function 012E6388 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d98c149752bf547f4c5e3542879847eb1b9289d7105d59ecde34e1c0b1a4f81
Instruction ID: 3e3d571357ebf5dff22a4af311173b2988e6a6975f7e19324bf63169d308bce5
Opcode Fuzzy Hash: 7d98c149752bf547f4c5e3542879847eb1b9289d7105d59ecde34e1c0b1a4f81
Instruction Fuzzy Hash: BDF0AF30904388AFCF45EFB8A4595ADBFF1EF86200B2041E9C449E7241D6315E06DB42

Function 012E593F Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84bfc88147267a0f34bba1a78ea624f8a304b95fecf672df00db091180ba18bb
Instruction ID: d13e5d704c32129fb14ac992c121acff1fc492a79e1e0dc32ff9fce36faceb95
Opcode Fuzzy Hash: 84bfc88147267a0f34bba1a78ea624f8a304b95fecf672df00db091180ba18bb
Instruction Fuzzy Hash: A7F054757112108F8715DF69E498CADBBB6EBC9665324457AE905D7350CA358C02CB50

Function 012E6398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a299e389d9bd5c8d7c0a305dcc17c3204f6cc2fbc3afc6eb045c1b45210cd926
Instruction ID: 06cd5b1a0286f79de2f09601b7673eddfde43e8bfa1095aec78244e88c1f4f5f
Opcode Fuzzy Hash: a299e389d9bd5c8d7c0a305dcc17c3204f6cc2fbc3afc6eb045c1b45210cd926
Instruction Fuzzy Hash: 2DF01C34E0030DEF8F48EFB8E95996DBBF9EF94204F6045A8D909E7240EA316E05DB51

Function 012E1FF8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 239be58135859ed96608bd12244f0b1fe8113e0c4bd972496919cb2a1b2c7721
Instruction ID: 11da79425429ff04df143c9c7534b538cd76a359ff40cf2b07933c3605cab545
Opcode Fuzzy Hash: 239be58135859ed96608bd12244f0b1fe8113e0c4bd972496919cb2a1b2c7721
Instruction Fuzzy Hash: C4E092347412808FCB065B3DE018895BBB5EF8765631509EFE007CB322C9708C0ACB21

Function 012E2D97 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16e986dfabe86c6d63fd27669e2f92ddd5a793aff0937a4f4d96e6e092199d9
Instruction ID: 6fa93a30edb14a07e60eb1b3ae774ee36e74420c33634a982ee44493a118531c
Opcode Fuzzy Hash: a16e986dfabe86c6d63fd27669e2f92ddd5a793aff0937a4f4d96e6e092199d9
Instruction Fuzzy Hash: 04F08C30E24009CFCB45EFBCC0056DD7BF0EF89210B1040A5D609E7312D77089018B91

Function 012E2DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 686c2cb0e4c05788cdc08f9b465f36763e3cf8007923df46042e6077e0ba0df9
Instruction ID: 1d0205603ab76114fc5d612f433e1dc80aa996075b47b77a1b3a14951639ac5c
Opcode Fuzzy Hash: 686c2cb0e4c05788cdc08f9b465f36763e3cf8007923df46042e6077e0ba0df9
Instruction Fuzzy Hash: 25E0E571E20119CF8B84EFBDD5096DE7BF9EF48310B6141AAD61AE7311EB709E018B91

Function 012E66C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bb8e335fbd1ba2796db53b7e610ea77a949bd065d0c6e4a7394a259af839c3d
Instruction ID: 8ad37c68d62ddf3aae16498992bcee06adb62da41c0712d5d160f386d00eae4c
Opcode Fuzzy Hash: 4bb8e335fbd1ba2796db53b7e610ea77a949bd065d0c6e4a7394a259af839c3d
Instruction Fuzzy Hash: 57D05E2272A1905BCB0A26AC74640A9ABD1CE8A0A030905A7F245DB252CD1848475351

Function 012E6469 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db17c4663f3e00cc68adf437ecc3d1fa7a54942305a69f7d409900a5b790a3a
Instruction ID: a26fe07dec42b0ecbabb22922b8d5c61240c5a9cfe6cb9216dcf56da7c401648
Opcode Fuzzy Hash: 5db17c4663f3e00cc68adf437ecc3d1fa7a54942305a69f7d409900a5b790a3a
Instruction Fuzzy Hash: 21D0C7702482800FC30A9B28C285828BFAAEB8A260B0000F5E149CB372C928EC42C725

Function 012E5631 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa795b1863c847fe9708f5aea6904ca90cf32f7d10ce84cb9b5707bce5f5f4c3
Instruction ID: e22a6b5defd1a8db32ccca79428aa18a3caa01899fc523d9c3b1229aaa22d134
Opcode Fuzzy Hash: fa795b1863c847fe9708f5aea6904ca90cf32f7d10ce84cb9b5707bce5f5f4c3
Instruction Fuzzy Hash: 6ED023109193859FC70307BC5C4E1907F7DDE1746830C00D2EE454B013F817846F4B90

Function 012E6478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3711761799.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12e0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a678653beaba52af65ece3826b82a73c3c2078ffab5880420de78dd8c56fd9b0
Instruction ID: 8f4a96b5d1befc07325812a2bd801f55aacc13abcf048f474ba925e52dc1452c
Opcode Fuzzy Hash: a678653beaba52af65ece3826b82a73c3c2078ffab5880420de78dd8c56fd9b0
Instruction Fuzzy Hash: A4C012347402044F8608DB5CD141C1577EAEB8C75071000B5E609C7375CE25FC41C619

Analysis Process: GamePall.exePID: 5692, Parent PID: 6676COMMON

Executed Functions

Function 00BF4F58 Relevance: 7.9, Strings: 6, Instructions: 392COMMON

Download Yara Rule

Strings

(aq, xrefs: 00BF5056
(aq, xrefs: 00BF55CF
(aq, xrefs: 00BF55A3
(aq, xrefs: 00BF5082
(aq, xrefs: 00BF51F9
(aq, xrefs: 00BF51CD

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq$(aq$(aq$(aq
API String ID: 0-2219660067
Opcode ID: 0b1fd73ed45f2a0af867396f00809a299cfe9cccdf3bd8be124b5671f9dabbcb
Instruction ID: 2b97c7df15e94c8b0c5d4c446a1332c3f5b501c25129f53c75f7f0d0239cf907
Opcode Fuzzy Hash: 0b1fd73ed45f2a0af867396f00809a299cfe9cccdf3bd8be124b5671f9dabbcb
Instruction Fuzzy Hash: ACE17030A006198FCB14EF69C8546BEBBF2EF89310F25C1A9D605EB395DB349D46CB91

Function 00BF1049 Relevance: .8, Instructions: 840COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9039df6f3861522d99c6223db2b2dee00d6ac4a857aec14804bb7193a7ee2ba2
Instruction ID: 5f519b79e45ef1629d838651b081d06d7189949c7d7f0f26e5933d25232e69cd
Opcode Fuzzy Hash: 9039df6f3861522d99c6223db2b2dee00d6ac4a857aec14804bb7193a7ee2ba2
Instruction Fuzzy Hash: AA821578680209DFDB06EBA5E654B6E7B7AEF88301F208414D805237AECB3D6D45DB35

Function 00BFB0B0 Relevance: 1.9, Strings: 1, Instructions: 680COMMON

Download Yara Rule

Strings

eq^, xrefs: 00BFB23E

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID: eq^
API String ID: 0-2643049799
Opcode ID: ea8e8b37a123d5592a1d4d512ead3b6682a898dd91d819d8149f77e1204199e0
Instruction ID: 7dbc6d867fcf6a7febeaa7ac95a47776c7dd4b46048abddb9f71157274febb02
Opcode Fuzzy Hash: ea8e8b37a123d5592a1d4d512ead3b6682a898dd91d819d8149f77e1204199e0
Instruction Fuzzy Hash: 69525938602204CFD719EF38E458A6D7BB2FF84705B20C4A9D51A9B36ADB39EC45CB41

Function 00BF2B10 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00BF2B35

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 3451609c16d338fbda3cfd7525f9a4792d3f167cc7e620401c1d8967a5c9d1d3
Instruction ID: 62939bacf578b87df9f02843be039fd7249826a6a088757c6b218b66618f8606
Opcode Fuzzy Hash: 3451609c16d338fbda3cfd7525f9a4792d3f167cc7e620401c1d8967a5c9d1d3
Instruction Fuzzy Hash: 633130307512058FD709AB39C454A2E37B2EBCAA19B21817DD10ACB3A5DF39DC03CB96

Function 00BF4237 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

(aq, xrefs: 00BF4295

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 9d4b8554449175b703f3c72beaafa8535a694c0addf25a328c050a906451d504
Instruction ID: 24064eb7d7727ec2dee79328b9d3298543e6486b801e88db204162a67374da3f
Opcode Fuzzy Hash: 9d4b8554449175b703f3c72beaafa8535a694c0addf25a328c050a906451d504
Instruction Fuzzy Hash: 9C1155326082800FD30A673C681067E3F92DFC3610B0941EFD485CB696CE689D0AC392

Function 00BF1058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb06f0e7b815bd2abff08104505f7a72c72db7eae2473c9f560b0a1b9a696d08
Instruction ID: 564afb65a05251c0f4ad2a8ea6a2cffc69dc8f47f0eea4f8e307ddb4f3147e1f
Opcode Fuzzy Hash: bb06f0e7b815bd2abff08104505f7a72c72db7eae2473c9f560b0a1b9a696d08
Instruction Fuzzy Hash: 79821578680209DFDB06EBA5E654B6E7B7AEF88301F208414D805237AECB3D6D45DB35

Function 00BF2850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835d7ba21c97c02dd2f1e3834061ff8db09446a3d91c868ead20719b0aa67935
Instruction ID: 48c3770dcd7b4751d677788014415168806275a31fcc9e50951e4d2febd56fee
Opcode Fuzzy Hash: 835d7ba21c97c02dd2f1e3834061ff8db09446a3d91c868ead20719b0aa67935
Instruction Fuzzy Hash: 0B41EB74E41208DFCB18EFA5E984AADBBB6FF88300F20857AD516A7364DB349945CF50

Function 00BFB0A0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e4be23748dc1290f2001946d438edf35e679df750336aa0a21e5e1113ae781b
Instruction ID: 217881ad4c8e14dddd6e46524cbaeb89bebf99151aeb1ccc9c5b4092466493a3
Opcode Fuzzy Hash: 4e4be23748dc1290f2001946d438edf35e679df750336aa0a21e5e1113ae781b
Instruction Fuzzy Hash: 4C31F4346002058FD705EB7DE854AADBBBAFF85304F148569D0199B3AAEF74AD09CB81

Function 00BF2843 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc2e77c709ca22d5b16bb91be982a1649d1b0429053bc240a77191c2ec9da7c8
Instruction ID: a125e951c1caf88c88744bf5153bf5dbfd9f9740b1feafa1f08d10a5ff344ab2
Opcode Fuzzy Hash: fc2e77c709ca22d5b16bb91be982a1649d1b0429053bc240a77191c2ec9da7c8
Instruction Fuzzy Hash: F6314374E41208DFDB18DFA5E9846EDBBB6FF88300F208179D501A7264DB749945CB11

Function 00BF2C48 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d3bc6b4b27f5f477a9474f493c2766f4b0ee2fbdcd324cc5ec0fd7bb30001d
Instruction ID: 535310aa9ca9d057cab1c6ccf63f99e46139d90105e96cb353f8bfceab953321
Opcode Fuzzy Hash: 03d3bc6b4b27f5f477a9474f493c2766f4b0ee2fbdcd324cc5ec0fd7bb30001d
Instruction Fuzzy Hash: 9A413034A40209CFDB05EF64D984AEEBBB5FF49314F208165D505A7368EB389945CF91

Function 00BF2C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35ce5efa97e0a0e0df2248c8794b2b73e85b398d5e0b997cf299361cd7868be
Instruction ID: cc45f32531f90684444ce9a9f743c97578d03f9dc83bc00fd4a369f0b69788e8
Opcode Fuzzy Hash: c35ce5efa97e0a0e0df2248c8794b2b73e85b398d5e0b997cf299361cd7868be
Instruction Fuzzy Hash: 7531FE74A40209CFCB04EFA4D984AEE7BB5FF48314F208565D505A7368EB389945CF91

Function 00BF4B70 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b9b7a3c81a37beab08d8535074ea01d48402c4d31c06808326093bea913bed
Instruction ID: 003bb7d44757015b3169304dead0d89014d3238a38c51fa67966ebb16e01b890
Opcode Fuzzy Hash: 17b9b7a3c81a37beab08d8535074ea01d48402c4d31c06808326093bea913bed
Instruction Fuzzy Hash: D121B5312046065FC719EB39EC80E6E7BAAFF81310F148A79D0098B669DF74E949C796

Function 00BF4B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5dd09599cf15c85d788858a7cf8d534b3a3616fb18964691ac1c70efa51f5af
Instruction ID: 5bf5c1268dcd8322dc784fa985cef1f4907567421e79d1a293d4267ac68aefc0
Opcode Fuzzy Hash: a5dd09599cf15c85d788858a7cf8d534b3a3616fb18964691ac1c70efa51f5af
Instruction Fuzzy Hash: 4A216F312406065FC708EB69E980A5EB7AAFFC0310B148A39D4098B669DF74ED49CB96

Function 00BF6888 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f066891154ebd176174703c9c84e54942c8dd52323e48fa4ca07b66297d056
Instruction ID: b259e3de3c9ba1a4ef9e5e58caeffd50023886af9871c16dd4e20f111ed8d236
Opcode Fuzzy Hash: 89f066891154ebd176174703c9c84e54942c8dd52323e48fa4ca07b66297d056
Instruction Fuzzy Hash: 7021B471900209CFDB00DBA4C9497FEBBF1EF49305F10C0AAD905A7252DBB54E0ADB62

Function 00BF66F9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2483b59a3590a634708180fbeca55115d67b661e8eda664afe26b76d1441367
Instruction ID: d0546df9443f2645d75771a89e36b1c7b9b31252e47dab93728040356d3eeb30
Opcode Fuzzy Hash: b2483b59a3590a634708180fbeca55115d67b661e8eda664afe26b76d1441367
Instruction Fuzzy Hash: 030175323046509FC705677DAC549AE7FE6EFC922130845BBE50ACB766DE64CC0D8B91

Function 00BF2A80 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dd99fbe6f2dc2e6ccb958db1f2198de0b454880f7811bb05bf8ae6249b2aa59
Instruction ID: 2719e00d2e83d99fd0a99eeaaaa488fa40c471331e649653f321993d11e56402
Opcode Fuzzy Hash: 3dd99fbe6f2dc2e6ccb958db1f2198de0b454880f7811bb05bf8ae6249b2aa59
Instruction Fuzzy Hash: 88019E716007008FC712AF3DC4049AB7BE5EF42714B1589AAD289CF765DB71EC088BC2

Function 00BF41D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae6db2ad4fb05226047933f61889bdfefb724d378da5fb33397b85a73bd78eb3
Instruction ID: c53c9100460c962b2d050b7894ab51175886421805e4a100d75f92b0e23ce876
Opcode Fuzzy Hash: ae6db2ad4fb05226047933f61889bdfefb724d378da5fb33397b85a73bd78eb3
Instruction Fuzzy Hash: 14F024B26042012FD7086769AC90ABE3A9AEFC6320F15456AE108D73A6CF209D018367

Function 00BF6388 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd96d9aecd8203968e3d601991b5a6709c338be24467a7c805c48e42edaab9b7
Instruction ID: 61574954e1212fc61197774382c419fc366e5c35d2a6c4fb59163954f99827af
Opcode Fuzzy Hash: fd96d9aecd8203968e3d601991b5a6709c338be24467a7c805c48e42edaab9b7
Instruction Fuzzy Hash: 8EF0C270D09288AFCF01EFB8985159DBFB1DF46300F2086EED44AE7656D6704E09DB12

Function 00BF6398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca985b0c125aa61ab0c6e54318e739f7fded7b3f4bb51d6beb4780e08e039eb6
Instruction ID: 209c63d599d3551c94054b733de2293d7a3833b29e9ce2a4a1e3bc172d9988eb
Opcode Fuzzy Hash: ca985b0c125aa61ab0c6e54318e739f7fded7b3f4bb51d6beb4780e08e039eb6
Instruction Fuzzy Hash: 5DF08270E00208EFCB04EFB8D9416AD7BF5EF44300F6085A9A509E7344DA305F04DB52

Function 00BF2DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08c3833c99a61118169567dd4aebb8035ae47f4316498e2ffc6ffe347deb882a
Instruction ID: f1c8ffd14101ad817a4fe24cc6bbaf26d0151660066ba6d4207c0d2dcdc6d886
Opcode Fuzzy Hash: 08c3833c99a61118169567dd4aebb8035ae47f4316498e2ffc6ffe347deb882a
Instruction Fuzzy Hash: FCE0C971E101188F8B84EFBD95056EE7BF5EB49310B2141BAD619E7311EA709E058B92

Function 00BF66C8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438d86e422895a3020272a8f3d4be807246769bb43e0b4b00b77ce7d449d7e04
Instruction ID: c0586341a090713b6c431c27a25c987c5430f265f63b50dfabb6b98b3093a449
Opcode Fuzzy Hash: 438d86e422895a3020272a8f3d4be807246769bb43e0b4b00b77ce7d449d7e04
Instruction Fuzzy Hash: 20D05E2131A2A00F9706223C282C1EE2FA589CA61132905BFF248DB796C8548C079397

Function 00BF6469 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f9aa9df637992e7c8df4d1a77f092a86b86b6408b14230d150f15f0cb7d508
Instruction ID: bbacf336ef604df4cd4d5305ecffc7007636c85b53262e8f7496eec813ba5660
Opcode Fuzzy Hash: b4f9aa9df637992e7c8df4d1a77f092a86b86b6408b14230d150f15f0cb7d508
Instruction Fuzzy Hash: 83D02B743493404FD3089728C480C103BA9EF48300B2001FAE108C7376C824EC06C705

Function 00BF6478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3762344288.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bf0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 819ff05d26780adcb9f56ac7a847ed6627dd0d97bbad3648cd70f35792654627
Instruction ID: 8487d7d8813a323a560cf43f5456da549b8d26c7f8069b245d6aebe19c953468
Opcode Fuzzy Hash: 819ff05d26780adcb9f56ac7a847ed6627dd0d97bbad3648cd70f35792654627
Instruction Fuzzy Hash: 34C012757802044F8708DB5CD080C1573EAEB8C71072040B5E609C7339CD20EC41C618

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\huge[1].dat

C:\Users\user\AppData\Local\Temp\23E4.exe

C:\Users\user\AppData\Local\Temp\5371.exe

C:\Users\user\AppData\Local\Temp\nsk4E9F.tmp

C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\INetC.dll

C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\blowfish.dll

C:\Users\user\AppData\Local\Temp\nsp4EBF.tmp\nsProcess.dll

C:\Users\user\AppData\Local\Temp\nsr4CB.tmp\liteFirewall.dll

C:\Users\user\AppData\Local\Temp\nst9548.tmp

C:\Users\user\AppData\Local\Temp\setup.exe

Windows Analysis Report
file.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre