Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
game.exe

Overview

General Information

Sample name:	game.exe
Analysis ID:	1524979
MD5:	7ff30d3ab976b5771ba56163f0919386
SHA1:	0acf7c157c7a0f0eae8d8b0ee11890a935a53724
SHA256:	511e21b8c183fee710862aa39fe11cd87d632377b123b0ecba4e979100237f42
Infos:

Detection

Score:	5
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates COM task schedule object (often to register a task for autostart)

Detected potential crypto function

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

Program does not show much activity (idle)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

×

Process Tree

System is w10x64

game.exe (PID: 7576 cmdline: "C:\Users\user\Desktop\game.exe" MD5: 7FF30D3AB976B5771BA56163F0919386)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: game.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: game.exe

Static PE information: certificate valid

Source: game.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: game.exe

Source: C:\Users\user\Desktop\game.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs			Jump to behavior

Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B5E4C0 FindFirstFileW,GetLastError,FindClose,		0_2_00B5E4C0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B90080 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,		0_2_00B90080
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A52380 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,PathIsUNCW,		0_2_00A52380
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B90480 FindFirstFileW,FindClose,		0_2_00B90480
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B6C6E0 FindFirstFileW,FindClose,FindClose,		0_2_00B6C6E0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B84B10 FindFirstFileW,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,		0_2_00B84B10
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B411C0 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,		0_2_00B411C0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BA37E0 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,		0_2_00BA37E0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B5DB60 _wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,		0_2_00B5DB60
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B5FD90 FindFirstFileW,FindClose,		0_2_00B5FD90

Source: C:\Users\user\Desktop\game.exe

Code function: 0_2_00B8EEF0 _wcsrchr,_wcsrchr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

Source: game.exe, 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmp, game.exe, 00000000.00000000.1667197531.0000000000CAB000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: FlashWindowExFlashWindowGetPackagePathhttp://www.example.comTESThttp://www.google.comhttp://www.yahoo.comtin9999.tmpattachment=.partGETcharsetDLD "filenameutf-8utf-16123POSTAdvancedInstallerLocal Network ServerISO-8859-1US-ASCIIHTTP/1.0Range: bytes=%u- equals www.yahoo.com (Yahoo)
Source: game.exe	String found in binary or memory: Logger::SetLogFile( %s ) while OLD path is:%sLOGGER->failed to create LOG at:LOGGER->Reusing LOG file at:%04d-%02d-%02d %02d-%02d-%02dworkstationOS Version: %u.%u.%u SP%u (%s) [%s]LOGGER->Creating LOG file at:serverCPU: UnkownCPUp?VFlashWindowExFlashWindowGetPackagePathhttp://www.example.comTESThttp://www.google.comhttp://www.yahoo.comtin9999.tmpattachment=.partGETcharsetDLD "filenameutf-8utf-16123POSTAdvancedInstallerLocal Network ServerISO-8859-1US-ASCIIHTTP/1.0Range: bytes=%u- equals www.yahoo.com (Yahoo)

Source: game.exe	String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: game.exe	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0
Source: game.exe	String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: game.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.crl0
Source: game.exe	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: game.exe	String found in binary or memory: http://ocsps.ssl.com0
Source: game.exe	String found in binary or memory: http://ocsps.ssl.com0?
Source: game.exe	String found in binary or memory: http://ocsps.ssl.com0Q
Source: game.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: game.exe	String found in binary or memory: https://www.ssl.com/repository0

Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B19F70 GetSystemDirectoryW,LoadLibraryExW,NtdllDefWindowProc_W,		0_2_00B19F70
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A50140 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,		0_2_00A50140
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00AAA220 ShowWindow,ShowWindow,GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,GetWindowRect,SendMessageW,		0_2_00AAA220
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A466D0 SysFreeString,SysAllocString,GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,SysFreeString,NtdllDefWindowProc_W,SysFreeString,		0_2_00A466D0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A48C90 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DestroyWindow,		0_2_00A48C90
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A46D30 NtdllDefWindowProc_W,		0_2_00A46D30
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A68F80 NtdllDefWindowProc_W,		0_2_00A68F80
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A493B0 NtdllDefWindowProc_W,		0_2_00A493B0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A5B400 NtdllDefWindowProc_W,		0_2_00A5B400
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BA5510 NtdllDefWindowProc_W,		0_2_00BA5510
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00AA96E0 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,		0_2_00AA96E0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A49990 NtdllDefWindowProc_W,		0_2_00A49990
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00AF9A20 NtdllDefWindowProc_W,		0_2_00AF9A20
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A55E10 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DeleteCriticalSection,		0_2_00A55E10
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A45FB0 GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,NtdllDefWindowProc_W,		0_2_00A45FB0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A4FFD0 NtdllDefWindowProc_W,		0_2_00A4FFD0

Source: C:\Users\user\Desktop\game.exe	Code function: 0_3_006AD402		0_3_006AD402
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B664D0		0_2_00B664D0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B785B0		0_2_00B785B0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B9DA70		0_2_00B9DA70
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BBA120		0_2_00BBA120
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BB22C0		0_2_00BB22C0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00AAA220		0_2_00AAA220
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A52380		0_2_00A52380
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B64350		0_2_00B64350
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BB8340		0_2_00BB8340
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00ADA4D0		0_2_00ADA4D0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00AEA400		0_2_00AEA400
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A50590		0_2_00A50590
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A6A5E0		0_2_00A6A5E0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A6C6F0		0_2_00A6C6F0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A5C7F0		0_2_00A5C7F0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00ACA730		0_2_00ACA730
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A4E8E0		0_2_00A4E8E0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B70800		0_2_00B70800
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00ABC860		0_2_00ABC860
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00C4080B		0_2_00C4080B
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BB6990		0_2_00BB6990
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A849E0		0_2_00A849E0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A62BF0		0_2_00A62BF0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A6EB30		0_2_00A6EB30
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00C2EB00		0_2_00C2EB00
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00AACB70		0_2_00AACB70
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BB6B40		0_2_00BB6B40
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00C36CBA		0_2_00C36CBA
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00ACEC30		0_2_00ACEC30
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00C08D30		0_2_00C08D30
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BB6E80		0_2_00BB6E80
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A33000		0_2_00A33000
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A7F130		0_2_00A7F130
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00C2712E		0_2_00C2712E
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BB9140		0_2_00BB9140
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BB7280		0_2_00BB7280
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A61380		0_2_00A61380
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BB9380		0_2_00BB9380
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00C274BC		0_2_00C274BC
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A6B6C0		0_2_00A6B6C0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BC57C0		0_2_00BC57C0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BB1800		0_2_00BB1800
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A79870		0_2_00A79870
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A5BAA0		0_2_00A5BAA0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BB3A80		0_2_00BB3A80
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A57CB0		0_2_00A57CB0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BB1C10		0_2_00BB1C10
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BB9C00		0_2_00BB9C00
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00AC1E80		0_2_00AC1E80
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00AE9FB0		0_2_00AE9FB0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A59FC0		0_2_00A59FC0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A5BFC0		0_2_00A5BFC0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B3BF60		0_2_00B3BF60

Source: C:\Users\user\Desktop\game.exe	Code function: String function: 00A3FC70 appears 113 times
Source: C:\Users\user\Desktop\game.exe	Code function: String function: 00A3A880 appears 58 times
Source: C:\Users\user\Desktop\game.exe	Code function: String function: 00A52380 appears 31 times
Source: C:\Users\user\Desktop\game.exe	Code function: String function: 00A38DB0 appears 110 times
Source: C:\Users\user\Desktop\game.exe	Code function: String function: 00A3A2F0 appears 51 times

Source: game.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: clean5.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\game.exe

Code function: 0_2_00B616C0 FormatMessageW,GetLastError,

Source: C:\Users\user\Desktop\game.exe

Code function: 0_2_00A7C860 GetDiskFreeSpaceExW,

Source: C:\Users\user\Desktop\game.exe

Code function: 0_2_00BA64B0 GetLastError,CoInitialize,CoCreateInstance,CoUninitialize,

Source: C:\Users\user\Desktop\game.exe

Code function: 0_2_00A3A1B0 LoadResource,LockResource,SizeofResource,

Source: game.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\game.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\game.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\game.exe

File read: C:\Users\user\Desktop\game.exe

Jump to behavior

Source: C:\Users\user\Desktop\game.exe	Section loaded: windowscodecs.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: msi.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: usp10.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: msls31.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: dwmapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: davhlpr.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: msimg32.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: dbghelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: cabinet.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: lpk.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: msihnd.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: secur32.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: wkscli.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: riched20.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: atlthunk.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: textshaping.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: tsappcmp.dll			Jump to behavior
Source: C:\Users\user\Desktop\game.exe	Section loaded: taskschd.dll			Jump to behavior

Source: C:\Users\user\Desktop\game.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: game.exe

Static PE information: certificate valid

Source: game.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: game.exe

Static file information: File size 3943344 > 1048576

Source: game.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x279c00

Source: game.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: game.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: game.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: game.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: game.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: game.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: game.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: game.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: game.exe

Source: game.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: game.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: game.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: game.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: game.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\game.exe

Code function: 0_2_00B73710 SHGetFolderPathW,GetSystemDirectoryW,GetWindowsDirectoryW,GetWindowsDirectoryW,GetModuleFileNameW,SHGetSpecialFolderLocation,LoadLibraryW,GetProcAddress,SHGetPathFromIDListW,SHGetMalloc,

Source: C:\Users\user\Desktop\game.exe	Code function: 0_3_006A5F52 pushad ; retf		0_3_006A603D
Source: C:\Users\user\Desktop\game.exe	Code function: 0_3_006AC352 push eax; ret		0_3_006AC355
Source: C:\Users\user\Desktop\game.exe	Code function: 0_3_0069C050 pushad ; retf 0069h		0_3_0069C9A9
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A4D390 push ecx; mov dword ptr [esp], ecx		0_2_00A4D391
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00C1F5E7 push ecx; ret		0_2_00C1F5FA

Source: C:\Users\user\Desktop\game.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B5E4C0 FindFirstFileW,GetLastError,FindClose,		0_2_00B5E4C0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B90080 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,		0_2_00B90080
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A52380 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,PathIsUNCW,		0_2_00A52380
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B90480 FindFirstFileW,FindClose,		0_2_00B90480
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B6C6E0 FindFirstFileW,FindClose,FindClose,		0_2_00B6C6E0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B84B10 FindFirstFileW,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,		0_2_00B84B10
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B411C0 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,		0_2_00B411C0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00BA37E0 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,		0_2_00BA37E0
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B5DB60 _wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,		0_2_00B5DB60
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00B5FD90 FindFirstFileW,FindClose,		0_2_00B5FD90

Source: C:\Users\user\Desktop\game.exe

Code function: 0_2_00B8EEF0 _wcsrchr,_wcsrchr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

Source: C:\Users\user\Desktop\game.exe

Code function: 0_2_00C1BCEB VirtualQuery,GetSystemInfo,

Source: C:\Users\user\Desktop\game.exe

Code function: 0_2_00C23B83 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\Desktop\game.exe

Code function: 0_2_00B92EA0 CreateFileW,GetLastError,OutputDebugStringW,OutputDebugStringW,SetFilePointer,FlushFileBuffers,WriteFile,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,OutputDebugStringW,WriteFile,WriteFile,FlushFileBuffers,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,

Source: C:\Users\user\Desktop\game.exe

Code function: 0_2_00B73710 SHGetFolderPathW,GetSystemDirectoryW,GetWindowsDirectoryW,GetWindowsDirectoryW,GetModuleFileNameW,SHGetSpecialFolderLocation,LoadLibraryW,GetProcAddress,SHGetPathFromIDListW,SHGetMalloc,

Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00C2A0EA mov ecx, dword ptr fs:[00000030h]		0_2_00C2A0EA
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00C1E569 mov esi, dword ptr fs:[00000030h]		0_2_00C1E569
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00C389FB mov eax, dword ptr fs:[00000030h]		0_2_00C389FB
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00C38A3F mov eax, dword ptr fs:[00000030h]		0_2_00C38A3F

Source: C:\Users\user\Desktop\game.exe

Code function: 0_2_00C1E5D5 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00A6E550 __set_se_translator,SetUnhandledExceptionFilter,		0_2_00A6E550
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00C1EFC8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00C1EFC8
Source: C:\Users\user\Desktop\game.exe	Code function: 0_2_00C23B83 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00C23B83

Source: C:\Users\user\Desktop\game.exe

Code function: 0_2_00B599A0 GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,GetLastError,CloseHandle,

Source: C:\Users\user\Desktop\game.exe	Code function: GetLocaleInfoW,		0_2_00C386F6
Source: C:\Users\user\Desktop\game.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,		0_2_00B88C30
Source: C:\Users\user\Desktop\game.exe	Code function: EnumSystemLocalesW,		0_2_00C3F8B8
Source: C:\Users\user\Desktop\game.exe	Code function: EnumSystemLocalesW,		0_2_00C3F99E
Source: C:\Users\user\Desktop\game.exe	Code function: EnumSystemLocalesW,		0_2_00C3F903
Source: C:\Users\user\Desktop\game.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,		0_2_00C3FDA5
Source: C:\Users\user\Desktop\game.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,		0_2_00C3FF7A

Source: C:\Users\user\Desktop\game.exe

Code function: 0_2_00B9F160 CreateNamedPipeW,CreateFileW,

Source: C:\Users\user\Desktop\game.exe

Code function: 0_2_00C1E230 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

Source: C:\Users\user\Desktop\game.exe

Code function: 0_2_00B9DA70 GetUserNameW,GetUserNameW,GetLastError,GetUserNameW,GetEnvironmentVariableW,GetEnvironmentVariableW,RegDeleteValueW,RegCloseKey,RegQueryInfoKeyW,RegCloseKey,RegCloseKey,RegDeleteKeyW,RegCloseKey,RegCloseKey,RegDeleteValueW,RegCloseKey,

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 Scheduled Task/Job	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	15 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q	game.exe	false		unknown
http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0	game.exe	false		unknown
http://ocsps.ssl.com0	game.exe	false		unknown
http://crls.ssl.com/ssl.com-rsa-RootCA.crl0	game.exe	false		unknown
http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0	game.exe	false		unknown
http://crls.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.crl0	game.exe	false		unknown
http://ocsps.ssl.com0Q	game.exe	false		unknown
https://www.ssl.com/repository0	game.exe	false		unknown
http://ocsps.ssl.com0?	game.exe	false		unknown
http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0	game.exe	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524979
Start date and time:	2024-10-03 14:49:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	game.exe
Detection:	CLEAN
Classification:	clean5.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 65% Number of executed functions: 53 Number of non-executed functions: 173
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: game.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.447087447835371
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	game.exe
File size:	3'943'344 bytes
MD5:	7ff30d3ab976b5771ba56163f0919386
SHA1:	0acf7c157c7a0f0eae8d8b0ee11890a935a53724
SHA256:	511e21b8c183fee710862aa39fe11cd87d632377b123b0ecba4e979100237f42
SHA512:	cd769f2eed61499c77b18365306c5f4c6ad7d6593f7710141c87f726fca4d379f71eb9cd5007c9579dbfebb69c4513dc5fe8a9ea3fa049b08dda2721a1306cdb
SSDEEP:	49152:yWbbWb9tjju4k9y6lHao8JhBJyRjYQcUBiUARPU8Gbr2Y5l50PDPAELcpB2MpF8Q:yr99u4kc8Hao8eRjYBU4UAir2Y5EPDm
TLSH:	56066B31764AC52FD9A201B0192C9A9F512CAF760BB254C7B3DC2E7E0BB55C21736E27
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........2#..\p..\p..\pq._q..\pq.Yq..\pq.Zq..\p..Xq..\p.._q..\p..Yq..\pq.Xq..\pq.]q..\pq.[q..\p..]pH.\p.[Uq..\p.[.p..\p...p..\p.[^q..\

File Icon


Icon Hash:	0e33713919a5130f

Static PE Info

General

Entrypoint:	0x5ef409
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64F9C46E [Thu Sep 7 12:39:10 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	608505ff1e7e27ff4a42ea9c4e9f4192

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=SSL.com Code Signing Intermediate CA RSA R1, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	01/06/2024 16:02:47 01/06/2025 16:02:47
Subject Chain	CN=Tulip Soft Limited, O=Tulip Soft Limited, L=Dagenham, S=London Borough of Barking and Dagenham, C=GB
Version:	3
Thumbprint MD5:	69985D67B105B53BE8B20BBA6F4E8048
Thumbprint SHA-1:	ED892EDC5950D96116F97900995B1CEE43A12598
Thumbprint SHA-256:	33E64EED43ECF01AA07F127277763C1EF6F68F72CB6140847D75CEC4F8FF2BF7
Serial:	43BD8D6AA3FECB65766396C09E9EEDEA

Entrypoint Preview

Instruction
call 00007F0C74E20D66h
jmp 00007F0C74E2059Fh
push ebp
mov ebp, esp
and dword ptr [0072C2CCh], 00000000h
sub esp, 24h
or dword ptr [00728020h], 01h
push 0000000Ah
call dword ptr [0067B25Ch]
test eax, eax
je 00007F0C74E208D2h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-20h]
mov dword ptr [ebp-0Ch], eax
xor edi, 756E6547h
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr [ebp-1Ch]
xor eax, 6C65746Eh
mov dword ptr [ebp-08h], eax
xor eax, eax
inc eax
push ebx
cpuid
mov esi, ebx
pop ebx
nop
lea ebx, dword ptr [ebp-24h]
mov dword ptr [ebx], eax
mov eax, dword ptr [ebp-04h]
or eax, dword ptr [ebp-08h]
or eax, edi
mov dword ptr [ebx+04h], esi
mov dword ptr [ebx+08h], ecx
mov dword ptr [ebx+0Ch], edx
jne 00007F0C74E20765h
mov eax, dword ptr [ebp-24h]
and eax, 0FFF3FF0h
cmp eax, 000106C0h
je 00007F0C74E20745h
cmp eax, 00020660h
je 00007F0C74E2073Eh
cmp eax, 00020670h
je 00007F0C74E20737h
cmp eax, 00030650h
je 00007F0C74E20730h
cmp eax, 00030660h
je 00007F0C74E20729h
cmp eax, 00030670h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x325ef4	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x336000	0x6d65c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3c0c28	0x1f88	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3a4000	0x29218	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2c84d0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2c8540	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x299d90	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x27b000	0x2fc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x32324c	0x280	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x279ac6	0x279c00	11aedc3b7d655a259d30cc5f5fc4cb28	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x27b000	0xac076	0xac200	1aad84f9ecc183c33dd368eec7c0e655	False	0.3258924518881627	DIY-Thermocam raw data (Lepton 3.x), scale -2630-8835, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 2048.000000, slope 974560704.000000	5.061847432030138	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x328000	0xd260	0x3c00	0bff262a25d32c3dde3349bee5da87c2	False	0.2669921875	data	4.791668844581246	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x336000	0x6d65c	0x6d800	5a0b1a4158dd8fad7bcf25888bcf031e	False	0.246597638413242	data	5.488066987169376	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3a4000	0x29218	0x29400	17574e23e92b0ab35c6f98688053b38f	False	0.4413293087121212	data	6.508215752056589	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x336910	0x13e	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 5 important colors	English	United States	0.25471698113207547
RT_BITMAP	0x336a50	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.03017241379310345
RT_BITMAP	0x337278	0x48a8	Device independent bitmap graphic, 290 x 16 x 32, image size 0	English	United States	0.11881720430107527
RT_BITMAP	0x33bb20	0xa6a	Device independent bitmap graphic, 320 x 16 x 4, image size 2562, resolution 2834 x 2834 px/m	English	United States	0.21680420105026257
RT_BITMAP	0x33c58c	0x152	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 10 important colors	English	United States	0.5295857988165681
RT_BITMAP	0x33c6e0	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.4875478927203065
RT_ICON	0x33cf08	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 0	English	United States	0.32899369766547326
RT_ICON	0x37ef30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08703319502074688
RT_ICON	0x3814d8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.16463414634146342
RT_ICON	0x382580	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.18565573770491803
RT_ICON	0x382f08	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3262411347517731
RT_DIALOG	0x383370	0xac	data	English	United States	0.7151162790697675
RT_DIALOG	0x38341c	0xcc	data	English	United States	0.6911764705882353
RT_DIALOG	0x3834e8	0x1b4	data	English	United States	0.5458715596330275
RT_DIALOG	0x38369c	0x136	data	English	United States	0.6064516129032258
RT_DIALOG	0x3837d4	0x4c	data	English	United States	0.8289473684210527
RT_STRING	0x383820	0x234	data	English	United States	0.4645390070921986
RT_STRING	0x383a54	0x182	data	English	United States	0.5103626943005182
RT_STRING	0x383bd8	0x50	data	English	United States	0.7375
RT_STRING	0x383c28	0x9a	data	English	United States	0.37662337662337664
RT_STRING	0x383cc4	0x2f6	data	English	United States	0.449868073878628
RT_STRING	0x383fbc	0x5c0	data	English	United States	0.3498641304347826
RT_STRING	0x38457c	0x434	data	English	United States	0.32899628252788105
RT_STRING	0x3849b0	0x100	data	English	United States	0.5703125
RT_STRING	0x384ab0	0x484	data	English	United States	0.39186851211072665
RT_STRING	0x384f34	0x1ea	data	English	United States	0.44081632653061226
RT_STRING	0x385120	0x18a	data	English	United States	0.5228426395939086
RT_STRING	0x3852ac	0x216	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.46254681647940077
RT_STRING	0x3854c4	0x624	data	English	United States	0.3575063613231552
RT_STRING	0x385ae8	0x660	data	English	United States	0.3474264705882353
RT_STRING	0x386148	0x2e2	data	English	United States	0.4037940379403794
RT_GROUP_ICON	0x38642c	0x14	data	English	United States	1.1
RT_GROUP_ICON	0x386440	0x4c	data	English	United States	0.8026315789473685
RT_VERSION	0x38648c	0x398	OpenPGP Public Key	English	United States	0.3858695652173913
RT_HTML	0x386824	0x3835	ASCII text, with very long lines (443), with CRLF line terminators	English	United States	0.08298005420807561
RT_HTML	0x38a05c	0x1316	ASCII text, with CRLF line terminators	English	United States	0.18399508800654932
RT_HTML	0x38b374	0x8c77	HTML document, ASCII text, with CRLF line terminators	English	United States	0.08081426068578103
RT_HTML	0x393fec	0x6acd	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10679931238798873
RT_HTML	0x39aabc	0x6a2	HTML document, ASCII text, with CRLF line terminators	English	United States	0.3486454652532391
RT_HTML	0x39b160	0x104a	HTML document, ASCII text, with CRLF line terminators	English	United States	0.2170263788968825
RT_HTML	0x39c1ac	0x15b1	HTML document, ASCII text, with CRLF line terminators	English	United States	0.17612101566720692
RT_HTML	0x39d760	0x205c	exported SGML document, ASCII text, with very long lines (659), with CRLF line terminators	English	United States	0.13604538870111058
RT_HTML	0x39f7bc	0x368d	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10834228428213391
RT_MANIFEST	0x3a2e4c	0x80f	XML 1.0 document, ASCII text, with CRLF, LF line terminators	English	United States	0.40814348036839554

Imports

DLL

Import

KERNEL32.dll

CreateFileW, CloseHandle, WriteFile, DeleteFileW, HeapDestroy, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, GetProcessHeap, SizeofResource, LockResource, LoadResource, FindResourceW, FindResourceExW, CreateEventExW, WaitForSingleObject, CreateProcessW, GetLastError, GetExitCodeProcess, SetEvent, RemoveDirectoryW, GetProcAddress, GetModuleHandleW, GetWindowsDirectoryW, CreateDirectoryW, GetTempPathW, GetTempFileNameW, MoveFileW, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, GetCurrentThreadId, RaiseException, SetLastError, GlobalUnlock, GlobalLock, GlobalAlloc, MulDiv, lstrcmpW, CreateEventW, FindClose, FindFirstFileW, GetFullPathNameW, InitializeCriticalSection, lstrcpynW, CreateThread, LoadLibraryExW, GetCurrentProcess, Sleep, WideCharToMultiByte, GetDiskFreeSpaceExW, DecodePointer, GetExitCodeThread, GetCurrentProcessId, FreeLibrary, GetSystemDirectoryW, lstrlenW, VerifyVersionInfoW, VerSetConditionMask, lstrcmpiW, LoadLibraryW, GetDriveTypeW, CompareStringW, FindNextFileW, GetLogicalDriveStringsW, GetFileSize, GetFileAttributesW, GetShortPathNameW, GetFinalPathNameByHandleW, SetFileAttributesW, GetFileTime, CopyFileW, ReadFile, SetFilePointer, SetFileTime, SystemTimeToFileTime, MultiByteToWideChar, GetSystemInfo, WaitForMultipleObjects, GetVersionExW, VirtualProtect, VirtualQuery, LoadLibraryExA, GetStringTypeW, LocalFree, LocalAlloc, SetUnhandledExceptionFilter, FileTimeToSystemTime, GetEnvironmentVariableW, GetSystemTime, GetDateFormatW, GetTimeFormatW, GetLocaleInfoW, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, FormatMessageW, GetEnvironmentStringsW, InitializeCriticalSectionEx, LoadLibraryA, GetModuleFileNameA, GetCurrentThread, GetConsoleOutputCP, FlushFileBuffers, Wow64DisableWow64FsRedirection, Wow64RevertWow64FsRedirection, IsWow64Process, SetConsoleTextAttribute, GetStdHandle, GetConsoleScreenBufferInfo, OutputDebugStringW, GetTickCount, GetCommandLineW, SetCurrentDirectoryW, SetEndOfFile, EnumResourceLanguagesW, GetSystemDefaultLangID, GetUserDefaultLangID, GetLocalTime, ResetEvent, GlobalFree, GetPrivateProfileStringW, GetPrivateProfileSectionNamesW, WritePrivateProfileStringW, CreateNamedPipeW, ConnectNamedPipe, TerminateThread, CompareFileTime, CopyFileExW, OpenEventW, PeekNamedPipe, WaitForSingleObjectEx, QueryPerformanceCounter, QueryPerformanceFrequency, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, EncodePointer, LCMapStringEx, CompareStringEx, GetCPInfo, GetSystemTimeAsFileTime, IsDebuggerPresent, InitializeSListHead, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, IsProcessorFeaturePresent, VirtualAlloc, VirtualFree, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoW, RtlUnwind, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, ExitProcess, GetFileType, LCMapStringW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetTimeZoneInformation, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, ReadConsoleW, WriteConsoleW, GetProcessAffinityMask, GetModuleHandleA, GlobalMemoryStatus, ReleaseSemaphore, CreateSemaphoreW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: game.exePID: 7576, Parent PID: 2580

General

Target ID:	0
Start time:	08:49:53
Start date:	03/10/2024
Path:	C:\Users\user\Desktop\game.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\game.exe"
Imagebase:	0xa30000
File size:	3'943'344 bytes
MD5 hash:	7FF30D3AB976B5771BA56163F0919386
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: game.exePID: 7576, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	43

Executed Functions

Function 00B73710 Relevance: 35.6, APIs: 10, Strings: 10, Instructions: 633libraryloaderCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?,SystemFolder,0000000C,?,?,?), ref: 00B73913
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00B73A0E
GetWindowsDirectoryW.KERNEL32(?,00000104,WindowsFolder,0000000D,?,?,?), ref: 00B73B06
GetWindowsDirectoryW.KERNEL32(?,00000104,WindowsVolume,0000000D,?,?,?), ref: 00B73BE5
GetModuleFileNameW.KERNEL32(00000000,?,00000104,WindowsVolume,0000000D,?,?,?), ref: 00B73D21
SHGetSpecialFolderLocation.SHELL32(00000000,?,WindowsVolume,0000000D,?,?,?), ref: 00B73E02
LoadLibraryW.KERNEL32(shfolder.dll,?,?,?), ref: 00B73E8C
GetProcAddress.KERNEL32(?,SHGetFolderPathW), ref: 00B73EBE
SHGetPathFromIDListW.SHELL32(?,?), ref: 00B73F73
SHGetMalloc.SHELL32(00000000), ref: 00B73F8C

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

Strings

ProgramFiles64Folder, xrefs: 00B7374E
TempFolder, xrefs: 00B73C12
WindowsFolder, xrefs: 00B73A93, 00B73AA8, 00B73AB2
WindowsVolume, xrefs: 00B73B74, 00B73B89, 00B73B93
SETUPEXEDIR, xrefs: 00B73CCE
SystemFolder, xrefs: 00B73883, 00B73898, 00B738A2
System32Folder, xrefs: 00B7399B, 00B739B0, 00B739BA
ProgramW6432, xrefs: 00B737A9
shfolder.dll, xrefs: 00B73E87
SHGetFolderPathW, xrefs: 00B73EB8

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Directory$FolderPathWindows$AddressAllocateFileFromHeapLibraryListLoadLocationMallocModuleNameProcSpecialSystem
String ID: ProgramFiles64Folder$ProgramW6432$SETUPEXEDIR$SHGetFolderPathW$System32Folder$SystemFolder$TempFolder$WindowsFolder$WindowsVolume$shfolder.dll
API String ID: 2148820474-2142986682
Opcode ID: 26fa077d620af648b1e25912862542300c211803482b8b6880509bb5815e5251
Instruction ID: 7ba72289e9d95790f7fa2e1cf2c49c5149b592d0ef227d879fb272ea9e2f0e41
Opcode Fuzzy Hash: 26fa077d620af648b1e25912862542300c211803482b8b6880509bb5815e5251
Instruction Fuzzy Hash: F7321870A002158BDB24DF24CC95BBAB3F5EF51710F1482ECE52A9B291EB319F85EB51

Function 00B785B0 Relevance: 31.1, APIs: 10, Strings: 7, Instructions: 1365synchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

GetTickCount.KERNEL32 ref: 00B78633
__Xtime_get_ticks.LIBCPMT ref: 00B7863B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B78685
GetCurrentProcess.KERNEL32(00000008,?,2BB8795F), ref: 00B78A6A
OpenProcessToken.ADVAPI32(00000000), ref: 00B78A71
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00B78AA0
CloseHandle.KERNEL32(00000000), ref: 00B78AB5

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000), ref: 00B79383
CreateThread.KERNEL32(00000000,00000000,00B79EB0,?,00000000,?), ref: 00B793BE
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,?), ref: 00B793F1

Part of subcall function 00B7C230: GetCurrentProcess.KERNEL32(?,2BB8795F,?), ref: 00B7C299
Part of subcall function 00B7C230: IsWow64Process.KERNEL32(00000000), ref: 00B7C2A0
Part of subcall function 00B7C230: _wcsrchr.LIBVCRUNTIME ref: 00B7C321

Strings

VersionString, xrefs: 00B78D34, 00B78D85
\/:*?"<>|, xrefs: 00B78831
/uninstall, xrefs: 00B78C63
true, xrefs: 00B78F9B, 00B78FC2, 00B78FC3
false, xrefs: 00B78FA0
\\?\, xrefs: 00B794C7
Maintenance mode:, xrefs: 00B78F8A

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Process$CreateCurrentHeapToken$AllocateCloseCountEventHandleInformationObjectOpenSingleThreadTickUnothrow_t@std@@@WaitWow64Xtime_get_ticks__ehfuncinfo$??2@_wcsrchr
String ID: /uninstall$Maintenance mode:$VersionString$\/:*?"<>|$\\?\$false$true
API String ID: 4099394082-1899154899
Opcode ID: be0e97783649d9c3f320409c25dd1eaecefd078a48ab3c72d8eb184b1c38fcbc
Instruction ID: 14fcaba7dbf26035e820515c0d05b051eabfc5f95597ea7cb8247b178abdc884
Opcode Fuzzy Hash: be0e97783649d9c3f320409c25dd1eaecefd078a48ab3c72d8eb184b1c38fcbc
Instruction Fuzzy Hash: 66B2D370900609DFDB10DFA8C849BAEBBF5FF45310F1482A9E429EB291DB74AE45CB50

Function 00B9DA70 Relevance: 26.8, APIs: 12, Strings: 3, Instructions: 536
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00B9DB05
GetLastError.KERNEL32 ref: 00B9DB0B
GetUserNameW.ADVAPI32(?,?), ref: 00B9DB53
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 00B9DB89
GetEnvironmentVariableW.KERNEL32(UserDomain,?,00000000,00000000,00000000), ref: 00B9DBD3
RegDeleteValueW.KERNEL32(?,?,00000000,80000001,00000001,00000000,2BB8795F), ref: 00B9DDD8
RegCloseKey.KERNEL32(?,?,00000000,80000001,00000001,00000000,2BB8795F), ref: 00B9DE08
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,2BB8795F,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00B9DF5F
RegDeleteKeyW.ADVAPI32(?,00000000), ref: 00B9DFF7
RegCloseKey.ADVAPI32(?,?,00000000,80000001,00000001,00000000), ref: 00B9E042
RegDeleteValueW.KERNEL32(?,?,?,80000001,00000001,00000000,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000031,?,00000000,80000001,00000001,00000000), ref: 00B9E13F
RegCloseKey.ADVAPI32(?,?,?,?,80000001,00000001,00000000,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000031,?,00000000,80000001,00000001,00000000), ref: 00B9E181

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00B9E05D
Software, xrefs: 00B9DE28
UserDomain, xrefs: 00B9DB84, 00B9DBCE

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CloseDelete$EnvironmentNameUserValueVariable$ErrorInfoLastQuery
String ID: Software$Software\Microsoft\Windows\CurrentVersion\RunOnce$UserDomain
API String ID: 3650088056-4079418357
Opcode ID: cbc5a69b5200c05869e6b5d7fd0712640e7683622a7e173d1342360b40b8923d
Instruction ID: 08d6274c39f5fa35aacfca01fe6ebbbccf1cf0de98e70a922f3f14dbb6f758bf
Opcode Fuzzy Hash: cbc5a69b5200c05869e6b5d7fd0712640e7683622a7e173d1342360b40b8923d
Instruction Fuzzy Hash: 95223A70D00249DFDF14DFA8C995BEEBBB4EF14704F2081A9E415B7291DB746A88CBA1

Function 00B599A0 Relevance: 16.6, APIs: 11, Instructions: 117
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00B599E8
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00B599F5
GetLastError.KERNEL32 ref: 00B599FF
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 00B59A29
GetLastError.KERNEL32 ref: 00B59A2F
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,?,?,?), ref: 00B59A55
AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000012,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00B59A88
EqualSid.ADVAPI32(00000000,?), ref: 00B59A97
FreeSid.ADVAPI32(?), ref: 00B59AA6
CloseHandle.KERNEL32(00000000), ref: 00B59AE0

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Token$ErrorInformationLastProcess$AllocateCloseCurrentEqualFreeHandleInitializeOpen
String ID:
API String ID: 695978879-0
Opcode ID: 94301c4a8eff6b94f75aee5e12a0947d8dbff995b9b44b1c11716d3ea4225746
Instruction ID: 25029794ba5d248aae39834fb8ee43c313a4a161fe06033fded7a7c98c7d6c30
Opcode Fuzzy Hash: 94301c4a8eff6b94f75aee5e12a0947d8dbff995b9b44b1c11716d3ea4225746
Instruction Fuzzy Hash: 5D4118B1900209EFEF10DFA4DC49BEEBBB8EF09315F104099E815B6290D7799948DB64

Function 00B664D0 Relevance: 7.8, APIs: 5, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(?,00000000,?,00000100), ref: 00B665CC
LoadStringW.USER32(?,00000000,?,00000001), ref: 00B666ED

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 1910dea92588814e73261d91d14bee97b8f9c43add61175c40b55add965fd74a
Instruction ID: c4b30f58907f5c7484238b4128e9b91a191d442080487323d29cbb02539c7935
Opcode Fuzzy Hash: 1910dea92588814e73261d91d14bee97b8f9c43add61175c40b55add965fd74a
Instruction Fuzzy Hash: F9C18E71D102499FDB04CFA8C9457EDFBF5FF48314F24822AE815AB291EB786A44CB90

Function 00B19F70 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00B19FB1

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

Part of subcall function 00A3A2F0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,80070057,8007000E,80004005,00A52BE4,00000000,?,?,?,*.*), ref: 00A3A313

LoadLibraryExW.KERNEL32(?,00000000,00000000,00C7F31D,000000FF), ref: 00B1A084

Strings

UxTheme.dll, xrefs: 00B19F8C, 00B1A05F, 00B1A060, 00B1A0F4

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: DirectoryFindHeapLibraryLoadProcessResourceSystem
String ID: UxTheme.dll
API String ID: 2891229163-352951104
Opcode ID: 264090f947552d5fd8e976b382badf916fc456b14ff751c8fe98c54f2d17f598
Instruction ID: 1bb99c42b7ce8a0ff0d846799661e6f71d1fdd3fdba7674147044dc358d9cbcd
Opcode Fuzzy Hash: 264090f947552d5fd8e976b382badf916fc456b14ff751c8fe98c54f2d17f598
Instruction Fuzzy Hash: 48A19AB0501745EFE714CF68C958B9ABBF0FF04318F20825DD8299B681D7BAA658CF91

Function 00C1E5D5 Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,00000000,00B8915E,?,?), ref: 00C1E5DA
HeapAlloc.KERNEL32(00000000,?,?), ref: 00C1E5E1
GetProcessHeap.KERNEL32(00000000,00000000,?,?), ref: 00C1E627
HeapFree.KERNEL32(00000000,?,?), ref: 00C1E62E

Part of subcall function 00C1E473: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00C1E61D,?,?,?), ref: 00C1E497
Part of subcall function 00C1E473: HeapAlloc.KERNEL32(00000000,?,00C1E61D,?,?,?), ref: 00C1E49E

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: a807eee5b511bf6bdc4c7ad990b7f1c234607fdf5abce40e07b50746832e2eac
Instruction ID: 2dc06b5f3bbe2c8231a1f4583825943004657f022c7f1eaf26a1b346b6faf582
Opcode Fuzzy Hash: a807eee5b511bf6bdc4c7ad990b7f1c234607fdf5abce40e07b50746832e2eac
Instruction Fuzzy Hash: 0FF0B4B2A04A1157CB352BB97C08BAF2995AFD77A57114029FA66C7151EF20CC81ABA0

Function 00B5E4C0 Relevance: 4.6, APIs: 3, Instructions: 93fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?), ref: 00B5E55D
FindClose.KERNEL32(00000000), ref: 00B5E5BC

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Find$AllocateCloseFileFirstHeap
String ID:
API String ID: 1673784098-0
Opcode ID: 88a7665110762f38446a2aa502219cd0c53c18f533185a01ab1d2597b39cd5b6
Instruction ID: 4e8c9110acf96f423037e65f2d8cf6871b992d19f9038ecec8ba5cd79e18c2f4
Opcode Fuzzy Hash: 88a7665110762f38446a2aa502219cd0c53c18f533185a01ab1d2597b39cd5b6
Instruction Fuzzy Hash: 8D31A3B1905614DBDB28DF14D948B5AB7F4EB04329F2041E9EC2997280F7709A48CB41

Function 00B9F160 Relevance: 3.1, APIs: 2, Instructions: 85filepipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNEL32(?,00000003,00000006,000000FF,00007F90,00007F90,00001388,00000000,?,2BB8795F,2BB8795F,?,?,?,00000000,00C92C65), ref: 00B9F1E7
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000,?,2BB8795F,2BB8795F,?,?,?,00000000,00C92C65,000000FF), ref: 00B9F20D

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Create$FileNamedPipe
String ID:
API String ID: 1328467360-0
Opcode ID: 8c92423c9c7e4ab478f8dfd6425860110dc3465a115e1434407fc313b5556424
Instruction ID: 21e2814f49e9babc22210577e7374fc0472073f096d9dd202ce39296f2cdeaca
Opcode Fuzzy Hash: 8c92423c9c7e4ab478f8dfd6425860110dc3465a115e1434407fc313b5556424
Instruction Fuzzy Hash: 8C31E631A84746BFE721CF14CC05BA9BBE4EB05730F20866AF965A76D0DB71A940CB44

Function 00A6E550 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__set_se_translator.LIBVCRUNTIME ref: 00A6E568
SetUnhandledExceptionFilter.KERNEL32(00B5D410), ref: 00A6E57E

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ExceptionFilterUnhandled__set_se_translator
String ID:
API String ID: 2480343447-0
Opcode ID: 28fbc936d4650986f815140d1a3b8f6c17ac955ae9b68d39f5fa976c066914db
Instruction ID: bb53f067f7ea0faee75165a04d1195e4a611c224ec2e18042199cf350746b24c
Opcode Fuzzy Hash: 28fbc936d4650986f815140d1a3b8f6c17ac955ae9b68d39f5fa976c066914db
Instruction Fuzzy Hash: F1E086667443906EC710A350AC09F5A7FA4AF96715F0544B6F600A3261C7B058499B71

Function 00B79EB0 Relevance: 25.3, APIs: 3, Strings: 11, Instructions: 774COMMON

Download Yara Rule

APIs

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00B79F84
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 00B79FB8

Part of subcall function 00A3A2F0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,80070057,8007000E,80004005,00A52BE4,00000000,?,?,?,*.*), ref: 00A3A313

Strings

Language selected programatically for UI:, xrefs: 00B7AD22
Language of a related product is:, xrefs: 00B7AC6C
%hu, xrefs: 00B7AA98
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 00B7AC04
Software\Caphyon\Advanced Installer\, xrefs: 00B7ABF0
A valid language was received from commnad line. This is:, xrefs: 00B7AA6A
AI_BOOTSTRAPPERLANGS, xrefs: 00B7B620, 00B7B632, 00B7B63C
Code returned to Windows by setup:, xrefs: 00B7A871
Advinst_Extract_, xrefs: 00B79F1B, 00B79F30, 00B79F3A
Language used for UI:, xrefs: 00B7AD9E
Languages of setup:, xrefs: 00B7B87B

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ByteCharMultiWide$FindHeapProcessResource
String ID: %hu$A valid language was received from commnad line. This is:$AI_BOOTSTRAPPERLANGS$Advinst_Extract_$Code returned to Windows by setup:$Language of a related product is:$Language selected programatically for UI:$Language used for UI:$Languages of setup:$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$Software\Caphyon\Advanced Installer\
API String ID: 2083075878-297406034
Opcode ID: 29b22974a675f648dc8481cff85e4a0cd4d87d22f608aa312eb84aa7c667ec34
Instruction ID: 63b4633f6acc14e147990f517c88206cddf4eb6128133fb5b92982fb4aa02bff
Opcode Fuzzy Hash: 29b22974a675f648dc8481cff85e4a0cd4d87d22f608aa312eb84aa7c667ec34
Instruction Fuzzy Hash: A152D2319016499FDB14DF68CD55BAEB7F4EF45310F1482A8E829EB2D2DB349E04CB92

Function 00B44200 Relevance: 24.8, APIs: 5, Strings: 9, Instructions: 327
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

MoveFileW.KERNEL32(?,?), ref: 00B4437A
GetModuleHandleW.KERNEL32(kernel32,?), ref: 00B443BC
GetProcAddress.KERNEL32(00000000,SetDllDirectory), ref: 00B4445C
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00B444B4

Part of subcall function 00B19F70: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00B19FB1

GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00B44404

Part of subcall function 00C1EE25: AcquireSRWLockExclusive.KERNEL32(00D5BFA8,?,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE2F
Part of subcall function 00C1EE25: ReleaseSRWLockExclusive.KERNEL32(00D5BFA8,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE62
Part of subcall function 00C1EE25: WakeAllConditionVariable.KERNEL32(00D5BFA4,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE6D

Strings

@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 00B44297
kernel32.dll, xrefs: 00B445BF
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 00B44277, 00B4427F
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 00B44290, 00B4429F
SetSearchPathMode, xrefs: 00B443FE
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 00B44272
SetDllDirectory, xrefs: 00B44456
SetDefaultDllDirectories, xrefs: 00B444AE
kernel32, xrefs: 00B443B7

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AddressProc$ExclusiveLock$AcquireConditionDirectoryFileHandleHeapModuleMoveProcessReleaseSystemVariableWake
String ID: @echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$SetDefaultDllDirectories$SetDllDirectory$SetSearchPathMode$kernel32$kernel32.dll
API String ID: 2125439804-3455668873
Opcode ID: 1a2cc0649a4f19967d78555a143f20c58481421f5fd701849bf5ebb6fe22b8aa
Instruction ID: 621cd10142090b63033ca396a14aba6c1965df23846785bd12bc2b3beeb6859e
Opcode Fuzzy Hash: 1a2cc0649a4f19967d78555a143f20c58481421f5fd701849bf5ebb6fe22b8aa
Instruction Fuzzy Hash: 0AE16CB0901A89DFDF20CF55C949BAEBBB4FF05318F108159E819AB391D7B49A08CF61

Function 00B79B70 Relevance: 22.0, APIs: 9, Strings: 3, Instructions: 1007threadCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00B79D40
SetLastError.KERNEL32(0000000E), ref: 00B79D5D
GetCurrentThreadId.KERNEL32 ref: 00B79D75
EnterCriticalSection.KERNEL32(00D629CC), ref: 00B79D92
LeaveCriticalSection.KERNEL32(00D629CC), ref: 00B79DB5
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00B79F84
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 00B79FB8

Part of subcall function 00B45F60: MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,00000000,00000000,?,?,00D5D6E0,00B93680,?), ref: 00B45F78
Part of subcall function 00B45F60: MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,?,-00000001), ref: 00B45FAA

SetEvent.KERNEL32(?,?,00000000,?,00000001), ref: 00B7A18D
SetEvent.KERNEL32(?,?,00000000,?), ref: 00B7A1FF

Part of subcall function 00B87620: DeleteFileW.KERNEL32(?,00000000,00000000,?,00000000,80004005,?,?,?,?,2BB8795F), ref: 00B8764B

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

Strings

FILES.7z, xrefs: 00B7A423
Code returned to Windows by setup:, xrefs: 00B7A871
Advinst_Extract_, xrefs: 00B79F1B, 00B79F30, 00B79F3A

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ByteCharMultiWide$CriticalEventSection$ActiveCurrentDeleteEnterErrorFileHeapLastLeaveProcessThreadWindow
String ID: Advinst_Extract_$Code returned to Windows by setup:$FILES.7z
API String ID: 1965834561-2771609608
Opcode ID: 312ef25e1710c8930d88d164b4938688955fc50b22942ce13943552d08d839df
Instruction ID: 5d55c73c77cec97b5db8252e7ac9734c5ab17d0c190226a039279ca595ce62ba
Opcode Fuzzy Hash: 312ef25e1710c8930d88d164b4938688955fc50b22942ce13943552d08d839df
Instruction Fuzzy Hash: 3492CD30900249DFDB10DBA8C849BEEBBF4EF55314F1482E9E419AB292DB749E45CF91

Function 00B890F0 Relevance: 18.2, APIs: 12, Instructions: 179
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 00B8912A
SetLastError.KERNEL32(0000000E,?,?), ref: 00B89167
GetCurrentThreadId.KERNEL32 ref: 00B891F2
SetWindowTextW.USER32(?,00000000), ref: 00B8927C
GetDlgItem.USER32(?,000003E9), ref: 00B89286
SetWindowTextW.USER32(00000000,?), ref: 00B89292
GetDlgItem.USER32(?,00000002), ref: 00B892FF
SetWindowTextW.USER32(00000000,?), ref: 00B89307

Part of subcall function 00B800D0: GetDlgItem.USER32(?,00000002), ref: 00B800F0
Part of subcall function 00B800D0: GetWindowRect.USER32(00000000,?), ref: 00B80106
Part of subcall function 00B800D0: ShowWindow.USER32(00000000,00000000,?,?,?,?,?,?,?,00B8914A,?,?), ref: 00B8011F
Part of subcall function 00B800D0: InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,?,?,?,00B8914A,?,?), ref: 00B8012A
Part of subcall function 00B800D0: GetDlgItem.USER32(00000000,000003E9), ref: 00B8013C
Part of subcall function 00B800D0: GetWindowRect.USER32(00000000,?), ref: 00B80152
Part of subcall function 00B800D0: SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000206,?,?,?,?,?,?,?,00B8914A), ref: 00B80195

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Window$Item$RectText$ActiveCurrentErrorInvalidateLastShowThread
String ID:
API String ID: 127311041-0
Opcode ID: ce9e95d46f76e24825fa921085cd5b8b2ed49dbc68ab57b7a04b92db0680ddd6
Instruction ID: 9924173d86dc9219dd7f37c76b5c08b8c194f3e5623f6915d16be2ff7383e5db
Opcode Fuzzy Hash: ce9e95d46f76e24825fa921085cd5b8b2ed49dbc68ab57b7a04b92db0680ddd6
Instruction Fuzzy Hash: 9C61CF71501705EFDB10EF68CD48B6ABBF4EF04320F148299F825AB2A1DB70A904CF61

Function 00A41830 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 265
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(Kernel32.dll,GetTempPath2W,?), ref: 00A41927
GetProcAddress.KERNEL32(00000000), ref: 00A4192E
CreateDirectoryW.KERNEL32(?,?,S-1-5-32-544,10000000,00000001,S-1-5-18,10000000,00000001), ref: 00A41A24

Part of subcall function 00C1EE76: AcquireSRWLockExclusive.KERNEL32(00D5BFA8,?,?,?,00A3ADE6,00D5CBBC,2BB8795F,?,?,00C4629D,000000FF,?,00B9F0FC,2BB8795F,?,?), ref: 00C1EE81
Part of subcall function 00C1EE76: ReleaseSRWLockExclusive.KERNEL32(00D5BFA8,?,00A3ADE6,00D5CBBC,2BB8795F,?,?,00C4629D,000000FF,?,00B9F0FC,2BB8795F,?,?), ref: 00C1EEBB

GetWindowsDirectoryW.KERNEL32(?,00000104,2BB8795F,?,?), ref: 00A41971
GetTempPathW.KERNEL32(00000104,?,2BB8795F,?,?), ref: 00A41A47

Part of subcall function 00C1EE25: AcquireSRWLockExclusive.KERNEL32(00D5BFA8,?,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE2F
Part of subcall function 00C1EE25: ReleaseSRWLockExclusive.KERNEL32(00D5BFA8,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE62
Part of subcall function 00C1EE25: WakeAllConditionVariable.KERNEL32(00D5BFA4,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE6D

Strings

Kernel32.dll, xrefs: 00A41922
GetTempPath2W, xrefs: 00A4191D
\SystemTemp\, xrefs: 00A41977
S-1-5-18, xrefs: 00A419C6
S-1-5-32-544, xrefs: 00A419D7

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ExclusiveLock$AcquireDirectoryRelease$AddressConditionCreateHandleModulePathProcTempVariableWakeWindows
String ID: GetTempPath2W$Kernel32.dll$S-1-5-18$S-1-5-32-544$\SystemTemp\
API String ID: 846588460-595641723
Opcode ID: e4df29b464790d498309c152f93ccc6fec488411910eb8abb51c69c1643de474
Instruction ID: 34db45ee3087984833ab44edc07a5361f9a39ded8d6676afd848bc7c6eb2d4e1
Opcode Fuzzy Hash: e4df29b464790d498309c152f93ccc6fec488411910eb8abb51c69c1643de474
Instruction Fuzzy Hash: 0AA1A7B1D013189FDB20DF94DD89BEDB7B4EB44310F1441A9E909A7291EB745E88CF61

Function 00C1E367 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DecodePointer.KERNEL32(?,?,?,00C1E6AD,00D5BF64,00000000,?,?,00B9F0A1,?), ref: 00C1E379
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,?,?,00C1E6AD,00D5BF64,00000000,?,?,00B9F0A1,?), ref: 00C1E38E
DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00B9F0A1,?), ref: 00C1E40A

Strings

atlthunk.dll, xrefs: 00C1E389
AtlThunk_AllocateData, xrefs: 00C1E39F
AtlThunk_FreeData, xrefs: 00C1E3E4
AtlThunk_InitData, xrefs: 00C1E3B6
AtlThunk_DataToCode, xrefs: 00C1E3CD

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: 519a925b96eee7b07340965d401b3f234781db1fe8da54ae0e21f98a2fa3fd35
Instruction ID: ad0efb108076caa6ae125cabe5108d1ace3c2aa89fe97e6b39daa3c87f35dff3
Opcode Fuzzy Hash: 519a925b96eee7b07340965d401b3f234781db1fe8da54ae0e21f98a2fa3fd35
Instruction Fuzzy Hash: A901C4716443006ACE01ABA0AD0AFDA3B549F03B19F144075FC15F72E3D7A2AE8DF6A5

Function 00B44830 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 244
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B44830: GetModuleFileNameW.KERNEL32(00000000,?,00000104,2BB8795F,00000000,?,00C86576,000000FF), ref: 00B44778

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

FreeLibrary.KERNEL32(?,2BB8795F,?,00000001,?), ref: 00B449B9
EnterCriticalSection.KERNEL32(00D5D67C,?,2BB8795F), ref: 00B449D7
DestroyWindow.USER32(00000000,?,2BB8795F), ref: 00B449F5
LeaveCriticalSection.KERNEL32(00D5D67C,?,2BB8795F), ref: 00B44A3E

Strings

.local, xrefs: 00B447E4
%s%lu, xrefs: 00B448AD

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CriticalSection$DestroyEnterFileFreeHeapLeaveLibraryModuleNameProcessWindow
String ID: %s%lu$.local
API String ID: 861831077-548699545
Opcode ID: b0ee415ec47463482d8886d2291842ca851e62b4b57f95ef2f73644caae35b42
Instruction ID: d3805c892e822d137b6f6b0c0df9ff49c5c3444533a4ca95664e0c48b4d80eb7
Opcode Fuzzy Hash: b0ee415ec47463482d8886d2291842ca851e62b4b57f95ef2f73644caae35b42
Instruction Fuzzy Hash: C891DA71A01714DFDB20DF68C844B6ABBF4FF00325F1446ADE856AB391DB74AA04DBA0

Function 00B5BC60 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 238
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,00000000,2BB8795F), ref: 00B5BEB6
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 00B5BEC6
RegCloseKey.ADVAPI32(00000000), ref: 00B5BF18

Strings

Advapi32.dll, xrefs: 00B5BEB1
RegOpenKeyTransactedW, xrefs: 00B5BEC0

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 4190037839-3913318428
Opcode ID: 06a283284a3b6711023628159e444aa31f1e15a2c2c434abebd328430ac170e4
Instruction ID: ff6701e3f1280840eaa98eefbd3e1078fed4a528dab1bad9839ef3e110e83300
Opcode Fuzzy Hash: 06a283284a3b6711023628159e444aa31f1e15a2c2c434abebd328430ac170e4
Instruction Fuzzy Hash: 5CA15BB1900308DFDB24CF68C945BAEBBF4FF48314F148599E855AB291DB74A948CF91

Function 00BA32F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(00C9816D,-00000400,?,00000002,00000400,2BB8795F,?,?,?), ref: 00BA3396
GetLastError.KERNEL32(?,?), ref: 00BA33A4
ReadFile.KERNEL32(00C9816D,00000000,00000400,?,00000000,?,?), ref: 00BA33BF

Strings

ADVINSTSFX, xrefs: 00BA33F3, 00BA34AE

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: File$ErrorLastPointerRead
String ID: ADVINSTSFX
API String ID: 64821003-4038163286
Opcode ID: 7020bbead59404c9d8d36281041d23fc64228c990ba3218bdbc3c52323bf9cd7
Instruction ID: 9f7b7b5ab33862ecae083179a879a11ec3685736f06e6f4a447584ec5c5228c2
Opcode Fuzzy Hash: 7020bbead59404c9d8d36281041d23fc64228c990ba3218bdbc3c52323bf9cd7
Instruction Fuzzy Hash: D961C071A082099BDB11CF68C881BBEBBF5FF4AB14F2442A5F501A7381DB349E45CB60

Function 00B47E60 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,2BB8795F,00000000,?,?,?,00000000,00C461A0,000000FF), ref: 00B47EA3
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 00B47ECC
RegCreateKeyExW.KERNEL32(?,00B5BF9F,00000000,00000000,00000000,00C461A0,00000000,00000000,00C461A0,2BB8795F,00000000,?,?,?,00000000,00C461A0), ref: 00B47F19
RegCloseKey.ADVAPI32(00000000,?,?,?,00000000,00C461A0,000000FF), ref: 00B47F2C

Strings

Advapi32.dll, xrefs: 00B47E9E
RegCreateKeyTransactedW, xrefs: 00B47EC6

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AddressCloseCreateHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1765684683-2994018265
Opcode ID: d6f55c12f23bf6d7834cf8d1aadd7ff3d9225c353b4d44f6c57e42108e153fca
Instruction ID: 3698745c6a8f5ad6e2c35eed5b5c069bafe9ea963aeee9fbdf3486e1f4cd3314
Opcode Fuzzy Hash: d6f55c12f23bf6d7834cf8d1aadd7ff3d9225c353b4d44f6c57e42108e153fca
Instruction Fuzzy Hash: 4731B472644345FFEB208F45DC45FABBBA8FB04760F10416AF915E7680DB71A904D6A4

Function 00B800D0 Relevance: 10.6, APIs: 7, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000002), ref: 00B800F0
GetWindowRect.USER32(00000000,?), ref: 00B80106
ShowWindow.USER32(00000000,00000000,?,?,?,?,?,?,?,00B8914A,?,?), ref: 00B8011F
InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,?,?,?,00B8914A,?,?), ref: 00B8012A
GetDlgItem.USER32(00000000,000003E9), ref: 00B8013C
GetWindowRect.USER32(00000000,?), ref: 00B80152
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000206,?,?,?,?,?,?,?,00B8914A), ref: 00B80195

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Window$Rect$Item$InvalidateShow
String ID:
API String ID: 2147159307-0
Opcode ID: 0bdb43b1247983423f06296ed54c6a115100593e27278bb98657e0dca865115b
Instruction ID: 0df29e7960bc762439b56e0c73cad51316b34c4f096b741f8da9f10876c818c1
Opcode Fuzzy Hash: 0bdb43b1247983423f06296ed54c6a115100593e27278bb98657e0dca865115b
Instruction Fuzzy Hash: 64216B71614304AFE300DF24DC49A6BBBE8EF8C711F108619F889DA291EB30E9418B62

Function 00B89330 Relevance: 9.1, APIs: 6, Instructions: 69
threadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,00BA5370,00CED3A8,00000000,?), ref: 00B893AD
GetLastError.KERNEL32 ref: 00B893BA
WaitForSingleObject.KERNEL32(00000000,FFFFFFFF), ref: 00B893E3
GetExitCodeThread.KERNEL32(00000000,?), ref: 00B893FD
TerminateThread.KERNEL32(00000000,00000000), ref: 00B89415
CloseHandle.KERNEL32(00000000), ref: 00B8941E

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Thread$CloseCodeCreateErrorExitHandleLastObjectSingleTerminateWait
String ID:
API String ID: 1566822279-0
Opcode ID: d11c5add4b274c71966c6eac616b13409a967b20691c1ef80eb9d834d93b2690
Instruction ID: 4cd316b04936a2908290bbaa58a643e0588de4da9f58b5336b8858c3f1caf222
Opcode Fuzzy Hash: d11c5add4b274c71966c6eac616b13409a967b20691c1ef80eb9d834d93b2690
Instruction Fuzzy Hash: F231BBB59006099BDF10DF94CD09BEEBBF8FB09715F104259E821B72E0D7799A04CBA4

Function 00B68BB0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.KERNELBASE(80004005,00C92C65,2BB8795F,?,?,00000000,?,?,00000000,00C92C65,000000FF,?,80004005,2BB8795F,?), ref: 00B68C15
GetFileVersionInfoW.KERNELBASE(80004005,?,00000000,000000FF,00000000,?,00000000,?,?,00000000,00C92C65,000000FF,?,80004005,2BB8795F,?), ref: 00B68C63

Strings

\StringFileInfo\%04x%04x\%s, xrefs: 00B68CCD
\VarFileInfo\Translation, xrefs: 00B68C97
ProductName, xrefs: 00B68CC3

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: FileInfoVersion$Size
String ID: ProductName$\StringFileInfo\%04x%04x\%s$\VarFileInfo\Translation
API String ID: 2104008232-2149928195
Opcode ID: cab5e3455085bdb005fd63ed84835605f5237ff0e2207de6c11d1c21967fd286
Instruction ID: c7c590c915058302f98e59b79ebd8dd23722c7edb82af461df4f6eea1714caa3
Opcode Fuzzy Hash: cab5e3455085bdb005fd63ed84835605f5237ff0e2207de6c11d1c21967fd286
Instruction Fuzzy Hash: 7161AE71901609DFDB14DFA8C989AAEB7F8FF15315F1442AEE811E7291EB349D04CBA0

Function 00B61850 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(ComCtl32.dll,2BB8795F,?,?,00000000), ref: 00B6188E
GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00B618B1
FreeLibrary.KERNEL32(00000000), ref: 00B6192F

Strings

ComCtl32.dll, xrefs: 00B61882
LoadIconMetric, xrefs: 00B618AB

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: ComCtl32.dll$LoadIconMetric
API String ID: 145871493-764666640
Opcode ID: 28ec1970e7cd4a2c211b6d56da0800bf9247e341a9ad4baa20a63113607da095
Instruction ID: ddbcbbc0e0e54414eb43b35ee8fa4f3aa3e140a44661e54cfca2f426bafd154d
Opcode Fuzzy Hash: 28ec1970e7cd4a2c211b6d56da0800bf9247e341a9ad4baa20a63113607da095
Instruction Fuzzy Hash: EC3195B1A00355ABDF108F99CC44BAFBFF8EB48314F04456AF915E7280D7794D008BA0

Function 00B5F310 Relevance: 7.6, APIs: 5, Instructions: 64windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjectsEx.USER32(00000001,00000000,000000FF,000005FF,00000004), ref: 00B5F331
PeekMessageW.USER32(?,00000000), ref: 00B5F377
TranslateMessage.USER32(00000000), ref: 00B5F382
DispatchMessageW.USER32(00000000), ref: 00B5F389
MsgWaitForMultipleObjectsEx.USER32(00000001,?,000000FF,000005FF,00000004), ref: 00B5F39B

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Message$MultipleObjectsWait$DispatchPeekTranslate
String ID:
API String ID: 4084795276-0
Opcode ID: adb1711c565837f0abce3681c10f8889ef8bd1a62420c8e5387b246e1a466ecb
Instruction ID: 9a405f93b339081fd1654800796fe2d3bb2111256599c83f2d407cfd078f859b
Opcode Fuzzy Hash: adb1711c565837f0abce3681c10f8889ef8bd1a62420c8e5387b246e1a466ecb
Instruction Fuzzy Hash: 291132316443066AE210CB519C81FBAB3DCEB89771F400266FE10E61C0D730E9888B35

Function 00B80C50 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 325COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,2BB8795F,?,00000010,?), ref: 00B80F2C

Part of subcall function 00B599A0: GetCurrentProcess.KERNEL32 ref: 00B599E8
Part of subcall function 00B599A0: OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00B599F5
Part of subcall function 00B599A0: GetLastError.KERNEL32 ref: 00B599FF
Part of subcall function 00B599A0: CloseHandle.KERNEL32(00000000), ref: 00B59AE0

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

Part of subcall function 00A3A2F0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,80070057,8007000E,80004005,00A52BE4,00000000,?,?,?,*.*), ref: 00A3A313

Strings

Extraction path set to:, xrefs: 00B80F7F
\\?\, xrefs: 00B80F39
[WindowsVolume], xrefs: 00B80CE0, 00B80CF2, 00B80CFC

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Process$CloseCurrentErrorFindHandleHeapLastOpenPathResourceToken
String ID: Extraction path set to:$[WindowsVolume]$\\?\
API String ID: 1971330335-3538578949
Opcode ID: 7146339ad78ca1c1597e62b2043749fa1fad7536916085cb1906342a5a15b289
Instruction ID: c3223f52023e97e09097b33e4e1d87239aef8431aac8aa885f73f9cd3554838f
Opcode Fuzzy Hash: 7146339ad78ca1c1597e62b2043749fa1fad7536916085cb1906342a5a15b289
Instruction Fuzzy Hash: 92C1C330901646DFDB11EFACC944BAEF7F5EF50311F1482A8E815AB2A2DB309D45CBA1

Function 00B782B0 Relevance: 6.1, APIs: 4, Instructions: 145fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,2BB8795F,?,00000010,?,00B7BD50,?), ref: 00B78316
SetFilePointer.KERNEL32(00000000,?,00000010,00000000), ref: 00B7835F
ReadFile.KERNEL32(00000000,2BB8795F,?,?,00000000,00000078,?), ref: 00B783A1
CloseHandle.KERNEL32(00000000), ref: 00B7841A

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: File$CloseCreateHandlePointerRead
String ID:
API String ID: 4133201480-0
Opcode ID: 59849597510b00e3b2ecf0e6305981f6e3311b1bf84a71bbe329cc7293e91829
Instruction ID: 25deaf6daa9a279d42d3206518e0a61697ab1916413b3fc8cfacf4c1da57b7be
Opcode Fuzzy Hash: 59849597510b00e3b2ecf0e6305981f6e3311b1bf84a71bbe329cc7293e91829
Instruction Fuzzy Hash: 6D519070940609EBDB11CB98CC88BAEFBF8FF45324F148299E425AB2D1DB749D05CB64

Function 00B78740 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00B785B0: GetTickCount.KERNEL32 ref: 00B78633
Part of subcall function 00B785B0: __Xtime_get_ticks.LIBCPMT ref: 00B7863B
Part of subcall function 00B785B0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B78685

Part of subcall function 00B9DA70: GetUserNameW.ADVAPI32(?,?), ref: 00B9DB05
Part of subcall function 00B9DA70: GetLastError.KERNEL32 ref: 00B9DB0B
Part of subcall function 00B9DA70: GetUserNameW.ADVAPI32(?,?), ref: 00B9DB53
Part of subcall function 00B9DA70: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 00B9DB89
Part of subcall function 00B9DA70: GetEnvironmentVariableW.KERNEL32(UserDomain,?,00000000,00000000,00000000), ref: 00B9DBD3

GetCurrentProcess.KERNEL32(00000008,?,2BB8795F), ref: 00B78A6A
OpenProcessToken.ADVAPI32(00000000), ref: 00B78A71

Strings

\/:*?"<>|, xrefs: 00B78831

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: EnvironmentNameProcessUserVariable$CountCurrentErrorLastOpenTickTokenUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: \/:*?"<>|
API String ID: 1564237509-3830478854
Opcode ID: 99f3ccc10266404172cd0798a315419a641f02e68269d9c032a75bad179847c3
Instruction ID: 4536b13d9b5f21ce5fcdc400ad3a93d16b32a52dd39a66315297625363c8dca1
Opcode Fuzzy Hash: 99f3ccc10266404172cd0798a315419a641f02e68269d9c032a75bad179847c3
Instruction Fuzzy Hash: 65B1D170D00308DFDB10DF68C9557AEBBB0EF05714F208269E869AB391DB746A49CBA1

Function 00C38B0C Relevance: 4.7, APIs: 3, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00C38CBB

Part of subcall function 00C36B67: RtlAllocateHeap.NTDLL(00000000,00000000,00C3490E,?,00C38AB8,?,00000000,?,00C28898,00000000,00C3490E,?,?,?,?,00C34708), ref: 00C36B99

__freea.LIBCMT ref: 00C38CD0
__freea.LIBCMT ref: 00C38CE0

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: __freea$AllocateHeap
String ID:
API String ID: 2243444508-0
Opcode ID: 4e36f39a33e7372a3403d4be0a6e42dc4965c38e4f6f90d647c326fcf80b8bfd
Instruction ID: 71b0def37470712c99ced21e919adbce9a18c2396100e5ad64cacca505228ebf
Opcode Fuzzy Hash: 4e36f39a33e7372a3403d4be0a6e42dc4965c38e4f6f90d647c326fcf80b8bfd
Instruction Fuzzy Hash: BD51D0B2621316AFEF25AF649C81EBB76A9EF04354F150128BD14D6250EF70CD58A7B0

Function 00B84230 Relevance: 4.7, APIs: 3, Instructions: 195fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,2BB8795F,?,?), ref: 00B84297
ReadFile.KERNEL32(?,00000000,00000018,?,00000000), ref: 00B843A2

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 46c6c5f71955a7c80b002d99e9b2fb249bfb98e579e0655aa3de1d9951062894
Instruction ID: d19133759102b731acc7b28ff202f0f60515d3bb2fc2f1d1251610c2a96eb96f
Opcode Fuzzy Hash: 46c6c5f71955a7c80b002d99e9b2fb249bfb98e579e0655aa3de1d9951062894
Instruction Fuzzy Hash: C0616DB1D006099FDB04DFA8D945B9EFBF4FB45720F14436AE825A7391EB74AA04CB90

Function 00B81040 Relevance: 4.7, APIs: 3, Instructions: 175fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,2BB8795F,?,00000000,?,80004005,?,00000000), ref: 00B810E0
GetLastError.KERNEL32 ref: 00B81110
GetLastError.KERNEL32(?), ref: 00B811A8

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ErrorLast$CreateFile
String ID:
API String ID: 1722934493-0
Opcode ID: ce312f58d9453a29939db2d054b2d498244dd45e97bfd7b2523707eed42d232c
Instruction ID: 42a94c58a5bdfcccc0fb10524229a5a660c8ba27cc01aea2f3d7c501c5e45bea
Opcode Fuzzy Hash: ce312f58d9453a29939db2d054b2d498244dd45e97bfd7b2523707eed42d232c
Instruction Fuzzy Hash: 7451B371A00B059FDB10EF68D845B9AF7F5FF45320F148B99E526A72E1EB30A905CB90

Function 00C2A076 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00C2A070,?,00C23B82,?,?,2BB8795F,00C23B82,?), ref: 00C2A087
TerminateProcess.KERNEL32(00000000,?,00C2A070,?,00C23B82,?,?,2BB8795F,00C23B82,?), ref: 00C2A08E
ExitProcess.KERNEL32 ref: 00C2A0A0

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 00539e8a14504a1510d408db529ebee4cdaf3593d44eed8ba9cdde42b24881da
Instruction ID: 8d0cf41dad83f485d40ab78aabc3b5a3c525c15c7e6c78b0a3d0ec9e9a96b51a
Opcode Fuzzy Hash: 00539e8a14504a1510d408db529ebee4cdaf3593d44eed8ba9cdde42b24881da
Instruction Fuzzy Hash: 8AD06C31000219ABDB116FA1ED09B9E3F2AAF86359B008011B91A4A472CB369D96AA85

Function 00C3D5A0 Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C3D0D0: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00C3D0FB

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00C3D3E7,?,00000000,?,?,?), ref: 00C3D601
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00C3D3E7,?,00000000,?,?,?), ref: 00C3D643

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: b270fdabb366fcdf55a49ff45dff75fc8e7c3c68b7d2261cc040e9f5dbb873b3
Instruction ID: d2d361a61962d6a6fbc5e379765232e1f78612dc78bc425c3049c812521b938c
Opcode Fuzzy Hash: b270fdabb366fcdf55a49ff45dff75fc8e7c3c68b7d2261cc040e9f5dbb873b3
Instruction Fuzzy Hash: 3E5137709203454EDB20CF35E8426AEFBF5EF42304F14456ED0ABCB252D7759A46DB90

Function 00B925C0 Relevance: 3.2, APIs: 2, Instructions: 174registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,?,00000000,000000C8,00000000,000000C8,000000C8), ref: 00B9262E
RegQueryValueExW.ADVAPI32(?,?,00000000,00000002,00000000,00000002,00000002,000000C8), ref: 00B92670

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 57a766666facd41c1ac1fa7b089563f0ca65581c0925644148c7bf83db0b011e
Instruction ID: 600cd5dc28b800c07e606702ce3b3fb90aaa80d46afcc87450acea4860ec2b35
Opcode Fuzzy Hash: 57a766666facd41c1ac1fa7b089563f0ca65581c0925644148c7bf83db0b011e
Instruction Fuzzy Hash: 5E51AE71D00219ABDF21EBA4CD45BAFB7B8EF15310F100569E811F7291DB35AE04DBA2

Function 00B92430 Relevance: 3.1, APIs: 2, Instructions: 145registryCOMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00B924A1
RegOpenKeyExW.KERNEL32(00000001,?,00000000,00000001,?,?,?,?,?,00000001,\Software), ref: 00B92510

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Open_wcsrchr
String ID:
API String ID: 1765551594-0
Opcode ID: ee41c36784a47165017cba043ab5f7087381bb030353e50970f090eb13e00ee5
Instruction ID: 1aa2e4baba35fa6d566df935300091d3eae3be8204311703f6dbe33b8b3870e7
Opcode Fuzzy Hash: ee41c36784a47165017cba043ab5f7087381bb030353e50970f090eb13e00ee5
Instruction Fuzzy Hash: EF518071E00615AFDB00CBA8CC95BAEBBF9FB44325F1042A9E925A73D1D7749904CB91

Function 00B7FE60 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00B7F7C6), ref: 00B7FE60
DestroyWindow.USER32(00000000,00000000), ref: 00B7FF17

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: DestroyErrorLastWindow
String ID:
API String ID: 1182162058-0
Opcode ID: e2c0886f43b0288997902284ec784d56f52369b20332687d1387024b6f419838
Instruction ID: 94a061c7a572b9a9931e489327e0048d04e8d9aa5e3e8ea5af6abf05a013ba4b
Opcode Fuzzy Hash: e2c0886f43b0288997902284ec784d56f52369b20332687d1387024b6f419838
Instruction Fuzzy Hash: FB21D57261020A9BDB20AF08EC017BA77D4EB55321F004266FC18CB691CB75EC65DBF5

Function 00B62240 Relevance: 3.0, APIs: 2, Instructions: 41windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B61850: LoadLibraryW.KERNEL32(ComCtl32.dll,2BB8795F,?,?,00000000), ref: 00B6188E
Part of subcall function 00B61850: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00B618B1
Part of subcall function 00B61850: FreeLibrary.KERNEL32(00000000), ref: 00B6192F

SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00B62284
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00B6228F

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: LibraryMessageSend$AddressFreeLoadProc
String ID:
API String ID: 3032493519-0
Opcode ID: 461c96e1bb94cbeb0b15b145ccd2ddd67bfa55c29ff8737d84a4f1c03f654040
Instruction ID: cab5a8844b35f7eef09afbd677541ba8f85ed79b3caeb65f7f481929a6ca5bec
Opcode Fuzzy Hash: 461c96e1bb94cbeb0b15b145ccd2ddd67bfa55c29ff8737d84a4f1c03f654040
Instruction Fuzzy Hash: C6F0303178131837F66021595C47F67B68DD781BA9F14427AFA98AF2C2ECC67C0002E8

Function 00C38878 Relevance: 3.0, APIs: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringEx.KERNEL32(?,00C38BFA,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00C388AC
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00C38BFA,?,?,00000000,?,00000000), ref: 00C388CA

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 3852cac5eae3aa48339a7bbf811013565d26d2af906fec31a4e2f506f8e91a4c
Instruction ID: 2c8079aa46ee154ecb7f4c9cc18ab43c5a6ece46b092ef54aeda9209e13380eb
Opcode Fuzzy Hash: 3852cac5eae3aa48339a7bbf811013565d26d2af906fec31a4e2f506f8e91a4c
Instruction Fuzzy Hash: E7F0763201121ABBCF126F91DC05EDE3F26EF887A0F058121FE1866061CB32D935AB91

Function 00B80060 Relevance: 3.0, APIs: 2, Instructions: 30threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B80069
DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C8F950,000000FF), ref: 00B80078

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CurrentDestroyThreadWindow
String ID:
API String ID: 2223599578-0
Opcode ID: e156b155e3efb9370a6778135d59bd763dfc44e0b655f33a7a488d869b73c938
Instruction ID: 3276b60cff72151620d81cc670a9767fad9d03ea57885be02265bf125944937b
Opcode Fuzzy Hash: e156b155e3efb9370a6778135d59bd763dfc44e0b655f33a7a488d869b73c938
Instruction Fuzzy Hash: 70F0A7710127409BD370BB29EE48B47BBD5AF54B61F10095DE486DAAA0C7B0F844CB24

Function 00C36B2D Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00C3E6A1,?,00000000,?,?,00C3E942,?,00000007,?,?,00C3ED94,?,?), ref: 00C36B43
GetLastError.KERNEL32(?,?,00C3E6A1,?,00000000,?,?,00C3E942,?,00000007,?,?,00C3ED94,?,?), ref: 00C36B4E

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: d07d629ec714a52fc23ef74b01224ea6a80b3b41ff1c5773106cf88e45426963
Instruction ID: 4d176fbeeb5109962ba5661a2b169aa225a8378f10181caf4e400dca36354b6b
Opcode Fuzzy Hash: d07d629ec714a52fc23ef74b01224ea6a80b3b41ff1c5773106cf88e45426963
Instruction Fuzzy Hash: FEE08672500314ABCB112BB4BC0DB9A7B989B01355F014010F51CD6161DB388A919B94

Function 00B45F60 Relevance: 2.6, APIs: 2, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,00000000,00000000,?,?,00D5D6E0,00B93680,?), ref: 00B45F78
MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,?,-00000001), ref: 00B45FAA

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 7e23174175d15c3a061c1c1bc58dc5a222e905940c5d4aa5ff50c31e4a977efd
Instruction ID: f1350074be18a9149875a38fbf27b7bfb96c05d3444f382bf282d619c6117a0e
Opcode Fuzzy Hash: 7e23174175d15c3a061c1c1bc58dc5a222e905940c5d4aa5ff50c31e4a977efd
Instruction Fuzzy Hash: 43014532301A22AFD6209B49DC89F1EF799EF90321F204129F315EB2D1CB206D1197A1

Function 00C368D7 Relevance: 2.6, APIs: 2, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00C23EA4,00C38AD6,?,00C28898,00000000,00C3490E,?,?,?,?,00C34708,?,?,00000004), ref: 00C368DB
SetLastError.KERNEL32(00000000), ref: 00C3697D

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: f7a629349c26f0a0d62bf983430507dafd283424b4d832eccec7e827051406c0
Instruction ID: 2704836e6f57cab6809bf2494c7c1b47365741b40c39b5a90f7443b245c1bbfc
Opcode Fuzzy Hash: f7a629349c26f0a0d62bf983430507dafd283424b4d832eccec7e827051406c0
Instruction Fuzzy Hash: 801104712247047ED7103FB5ACC6F2B3A68AB027A9F104530FB25E61E2DE618C09B270

Function 00C3D1A4 Relevance: 1.6, APIs: 1, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(E8458D00,?,00C3D3F3,00C3D3E7,00000000), ref: 00C3D1D6

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: f63076482fadf56fc365696a242ad1363fd03ce235abc4efa2710eeef55e008d
Instruction ID: 1fb4f5049df0bb7f373e701216b4d59ae18a2e017b162136354449dddbf9f7df
Opcode Fuzzy Hash: f63076482fadf56fc365696a242ad1363fd03ce235abc4efa2710eeef55e008d
Instruction Fuzzy Hash: BA514CB19142589ADB218E28EC80BEA7BBCEB55704F2405EDE5ABD7142C331DE46DF20

Function 00B88AC0 Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

EnumResourceLanguagesW.KERNEL32(?,00000010,00000001,00B88C00,?), ref: 00B88B0B

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: EnumLanguagesResource
String ID:
API String ID: 4141015960-0
Opcode ID: d50cfd65cbe71e2bb4c550da15e73623f5d060ed61e7f82a791bd227ed9ffac5
Instruction ID: e091b15f8dc1ad2cd638e5b7b86e66dbb4d3f2c55c0c91d9d9f5bc2ec5a96af9
Opcode Fuzzy Hash: d50cfd65cbe71e2bb4c550da15e73623f5d060ed61e7f82a791bd227ed9ffac5
Instruction Fuzzy Hash: 7341A0B190020A9FDB10EF98C951BDFFBF4FF44324F14066AE815A7691DB76A944CBA0

Function 00C380CF Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,00C36924,00000001,00000364,?,00000002,000000FF,?,00C28898,00000000,00C3490E,?), ref: 00C38110

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 29753e9506db8c9c956de62122878d4a9976dad066a61b299279c0595b981e97
Instruction ID: 2488418820349f52ff5175d2964351face80c7738388b73a2f9d29189a4c2333
Opcode Fuzzy Hash: 29753e9506db8c9c956de62122878d4a9976dad066a61b299279c0595b981e97
Instruction Fuzzy Hash: CAF0E23262072467DB216A229C06B5F3B49AF42770F198412BC24E7191CE31EE0E92E0

Function 00A3AA00 Relevance: 1.5, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C2068A: RaiseException.KERNEL32(E06D7363,00000001,00000003,2BB8795F,?,?,00B9F158,80004005,2BB8795F,?,?), ref: 00C206EA

RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AllocateExceptionHeapRaise
String ID:
API String ID: 3789339297-0
Opcode ID: 56b946831043f50530e05f9eb47408c62faeba7c376fb3e91211985f46b6d8e9
Instruction ID: 37fc5a807594c3a4cccafce59d3c0e107440955924552af8efa1da87baae8172
Opcode Fuzzy Hash: 56b946831043f50530e05f9eb47408c62faeba7c376fb3e91211985f46b6d8e9
Instruction Fuzzy Hash: 40F02772A44708BFC700CF04DC02F6ABBA8FB08B10F00462AFC1593690DB32A804CA50

Function 00C36B67 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00C3490E,?,00C38AB8,?,00000000,?,00C28898,00000000,00C3490E,?,?,?,?,00C34708), ref: 00C36B99

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5c7417bebf4f01a27d941006e008478e09e3d9fac8895b3b7bf3171911e69316
Instruction ID: 7aca936f0f761df927d8a166a4c64241ed36f23a31073c0ffb7d9a61bdd9ec10
Opcode Fuzzy Hash: 5c7417bebf4f01a27d941006e008478e09e3d9fac8895b3b7bf3171911e69316
Instruction Fuzzy Hash: E7E0E5321303207BEA213626DC04B5BB6989F023A4F118110AC25E30D0DB25DE00A9A0

Function 00C34876 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00C3487D

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 4896d363d7196ea0d55f39db7a4a6bd1c37307202416999644e2ff5a49ca2a76
Instruction ID: b4d1bb6542d6b12ea88a862201def172f272cd69b8677bc5ead0c98e66dad774
Opcode Fuzzy Hash: 4896d363d7196ea0d55f39db7a4a6bd1c37307202416999644e2ff5a49ca2a76
Instruction Fuzzy Hash: F7E075B2C4120EAADF00EFE4C442AEEBBB8AB04300F504126A605E6141EA7497859BA1

Function 00C1B3D2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00C1B3A1

Part of subcall function 00C1BEA5: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00C1BEB0
Part of subcall function 00C1BEA5: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00C1BF18
Part of subcall function 00C1BEA5: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00C1BF29

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: e86ce5c99732973a0beb019ce57af1c8c334c13e0bc27fb910d9698dabfa3fb4
Instruction ID: 610cb603472948335b73f66d752e5182ed8fea2d30d0423fec3447f1f439b685
Opcode Fuzzy Hash: e86ce5c99732973a0beb019ce57af1c8c334c13e0bc27fb910d9698dabfa3fb4
Instruction Fuzzy Hash: A6B012C125A001BD760451151D02CBB015CC4D3BA2330411BFC04C5240DB804C8E3431

Function 00C1B3FA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00C1B3A1

Part of subcall function 00C1BEA5: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00C1BEB0
Part of subcall function 00C1BEA5: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00C1BF18
Part of subcall function 00C1BEA5: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00C1BF29

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 422d144e869eefa658975c196b355be52ebf97eef219d23be8ed7429e04c2128
Instruction ID: 5ac89998a3976bf7d8e076fbbb42c000467bf7ddfded856ad18727a52cd6fade
Opcode Fuzzy Hash: 422d144e869eefa658975c196b355be52ebf97eef219d23be8ed7429e04c2128
Instruction Fuzzy Hash: 88B012D1258001BD760452151D02CB701DCC4D3B22B30411BFD04C4240DB804C8E3431

Function 00C1B3AA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00C1B3A1

Part of subcall function 00C1BEA5: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00C1BEB0
Part of subcall function 00C1BEA5: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00C1BF18
Part of subcall function 00C1BEA5: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00C1BF29

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 47b3b1e58bf870ee82bbdfd83190b549019156e0c27af3fbb7c5c9340eed41f4
Instruction ID: e3776820c7d6170ab3c6939bba04ed563297da042526b73c74bf1d6864203fb6
Opcode Fuzzy Hash: 47b3b1e58bf870ee82bbdfd83190b549019156e0c27af3fbb7c5c9340eed41f4
Instruction Fuzzy Hash: 8DB012D1258401BD760451151D03DB7015CC4D3B22330411BFC04C4240EF804D8E3431

Function 00C1B45E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00C1B3A1

Part of subcall function 00C1BEA5: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00C1BEB0
Part of subcall function 00C1BEA5: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00C1BF18
Part of subcall function 00C1BEA5: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00C1BF29

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 6306a5e26fda61180d42b8916e372a767d6a34df0dbc3a4cbe26b8b78d0e070e
Instruction ID: 8fd0b054a3ac93deacb1e246d5d6187c61007a82c5e84f7aae4dcd867aa4547b
Opcode Fuzzy Hash: 6306a5e26fda61180d42b8916e372a767d6a34df0dbc3a4cbe26b8b78d0e070e
Instruction Fuzzy Hash: 77B012D1259501BD760451151C02DB7015CC4C3B22330421BFC04C4240DB804DCD3431

Function 00B9F260 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,2BB8795F,?,?,00000000,00C97393,000000FF), ref: 00B9F299

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9ce16791955a6a46856b8ad2076eca00c3a70f40f615088ba475eb447c1ad83c
Instruction ID: 5ddb17495924d4706e9f6fe511a4c1b356f8bcc6f80e9645504d57daccc6f905
Opcode Fuzzy Hash: 9ce16791955a6a46856b8ad2076eca00c3a70f40f615088ba475eb447c1ad83c
Instruction Fuzzy Hash: 9F112EB1904A45DFD710CF68C944B5ABBF9FB05730F108769E825D76D0D775AD048B80

Non-executed Functions

Function 00A33000 Relevance: 170.7, Strings: 134, Instructions: 3218COMMON

Download Yara Rule

Strings

AI_UninstallTasks, xrefs: 00A36F5D
Patch, xrefs: 00A35C9B
StopServices, xrefs: 00A33C6B, 00A33DB1
CreateFolder, xrefs: 00A35783, 00A358C9
AI_PreRequisite, xrefs: 00A36AFA, 00A36B80, 00A36C06, 00A36C8C
SelfRegModules, xrefs: 00A365C5
PatchSize, xrefs: 00A35D15
PublishComponents, xrefs: 00A3685A
6000, xrefs: 00A361B1
MsiUnpublishAssemblies, xrefs: 00A338A5
File, xrefs: 00A33423, 00A35503, 00A35B55
AI_XmlUninstall, xrefs: 00A3724B, 00A372D1
Environment, xrefs: 00A35277, 00A362D0
UnregisterProgIdInfo, xrefs: 00A34BB3
AI_ChainProductsPseudo, xrefs: 00A37357
MoveFiles, xrefs: 00A359A9
RemoveFiles, xrefs: 00A3549D, 00A355E3
AI_XmlInstall, xrefs: 00A36CEC, 00A36D69
UnregisterComPlus, xrefs: 00A33EF7
RemoveEnvironmentStrings, xrefs: 00A35211
100000, xrefs: 00A36A6A
AI_GxInstall, xrefs: 00A36DE6
Shortcut, xrefs: 00A3513B, 00A35F44
DuplicateFile, xrefs: 00A353BD, 00A35DE1
UnpublishComponents, xrefs: 00A339E6
UnregisterClassInfo, xrefs: 00A34927
WriteIniValues, xrefs: 00A36224
ODBCTranslator, xrefs: 00A3432F, 00A36459
Component_, xrefs: 00A33A78, 00A33D04, 00A33E4A, 00A33F90, 00A34241, 00A34362, 00A344A8, 00A3473E, 00A3487A, 00A34ED8, 00A3501E, 00A35164, 00A352DE, 00A353F0, 00A35536, 00A357DB, 00A358FC, 00A35A42, 00A35B88, 00A35E14, 00A35F57, 00A361D7, 00A3625D, 00A362E3, 00A363E6, 00A3646C, 00A364F2, 00A36578, 00A3667B, 00A36701, 00A36782, 00A3680D, 00A36893
1800, xrefs: 00A36CFF, 00A3725E
AI_DownloadPrereq, xrefs: 00A36AD4
WriteRegistryValues, xrefs: 00A3619E
BindImage, xrefs: 00A35EA1, 00A35EC7
AI_InstallPostPrerequisite, xrefs: 00A36C66
Component, xrefs: 00A332E9, 00A3355D, 00A336A8, 00A337D1
AI_InstallPrerequisite, xrefs: 00A36BE0
MsiPublishAssemblies, xrefs: 00A368DB
UnregisterExtensionInfo, xrefs: 00A34A88
AI_UninstallAccounts, xrefs: 00A36E63
AI_UserGroups, xrefs: 00A36F06, 00A370FA
CreateShortcuts, xrefs: 00A35F1E
Feature, xrefs: 00A33B8B, 00A36983
UnpublishFeatures, xrefs: 00A33B25
RemoveRegistry, xrefs: 00A34847
TypeLib, xrefs: 00A36565
AI_ExtractPrereq, xrefs: 00A36B5A
5000, xrefs: 00A35EB4
InstallValidate, xrefs: 00A33631
RemoveShortcuts, xrefs: 00A350CB
AI_ProcessAccounts, xrefs: 00A37151
AI_DefaultActionCost, xrefs: 00A37451
AI_ScheduledTasks, xrefs: 00A371F4
3000, xrefs: 00A3379E, 00A33A12, 00A33B58, 00A33F2A, 00A346CE, 00A34814, 00A3495A, 00A34AA0, 00A34BE6, 00A34D2C, 00A35244, 00A35FB7, 00A3612E, 00A36552, 00A36655
AI_XmlAttribute, xrefs: 00A36D8F, 00A372F7
10000, xrefs: 00A3686D, 00A37464
FileCost, xrefs: 00A333BD
200000, xrefs: 00A369ED
PatchFiles, xrefs: 00A35C35
1500, xrefs: 00A34E72, 00A34FB8, 00A36D7C, 00A372E4
AppSearch, xrefs: 00A33149, 00A331CA
1500000, xrefs: 00A366DB
RegisterProgIdInfo, xrefs: 00A3609E
Registry, xrefs: 00A34701, 00A361C4
AI_AppSearchEx, xrefs: 00A37057, 00A3707D
MsiConfigureServices, xrefs: 00A3674E, 00A36774
SelfReg, xrefs: 00A340A3, 00A365EB
IniFile, xrefs: 00A34FEB, 00A36245
RegisterClassInfo, xrefs: 00A35FA4
ProgId, xrefs: 00A34C34, 00A360C4
12000, xrefs: 00A341B6, 00A342FC, 00A34442, 00A3538A, 00A354D0, 00A35631, 00A35750, 00A35896, 00A35F31, 00A363C0, 00A36446, 00A364CC
Extension, xrefs: 00A34AD3, 00A36047
PublishComponent, xrefs: 00A33A45, 00A36880
MoveFile, xrefs: 00A35A0F
30000, xrefs: 00A338D8, 00A36237, 00A368F3
ODBCDataSource, xrefs: 00A341E9, 00A363D3
MIME, xrefs: 00A34D5F, 00A36141
AI_ProcessTasks, xrefs: 00A371CE
100, xrefs: 00A35C68, 00A360B1, 00A36FED
AppId, xrefs: 00A3498D, 00A35FCA
8000, xrefs: 00A3408B, 00A34588, 00A36343, 00A365D8
Feature_, xrefs: 00A3390B, 00A34B06, 00A36058, 00A36917, 00A36B0D, 00A36B93, 00A36C19, 00A36CB3
UnregisterMIMEInfo, xrefs: 00A34CF9
RegisterComPlus, xrefs: 00A36642
AI_ProcessGroups, xrefs: 00A370D4
MsiAssembly, xrefs: 00A36906
~, xrefs: 00A36C4A
FileSize, xrefs: 00A35BCF
RemoveFolders, xrefs: 00A3571D
InstallFinalize, xrefs: 00A36A57
Options, xrefs: 00A36C40, 00A36CC6
RemoveDuplicateFiles, xrefs: 00A35357
InstallFiles, xrefs: 00A35AEF
CostInitialize, xrefs: 00A33283
SelfUnregModules, xrefs: 00A3403D
PublishFeatures, xrefs: 00A3695D
500, xrefs: 00A37065
RemoveODBC, xrefs: 00A34183, 00A342C9, 00A3440F
InstallServices, xrefs: 00A366C8
AI_UninstallGroups, xrefs: 00A36EE0
AI_CountRowAction, xrefs: 00A373D4
15000, xrefs: 00A33C9E, 00A33DE4, 00A359DC, 00A35DAE, 00A36034, 00A36761, 00A36970
CreateFolders, xrefs: 00A35863
UnregisterFonts, xrefs: 00A34555
RemoveFile, xrefs: 00A35649
DuplicateFiles, xrefs: 00A35D7B
3000000, xrefs: 00A362BD
RegisterFonts, xrefs: 00A36330
ServiceInstall, xrefs: 00A366EE
Location, xrefs: 00A36B34, 00A36BBA
AI_GxUninstall, xrefs: 00A36FDA
CostFinalize, xrefs: 00A33508
2000, xrefs: 00A3317C, 00A36DF9, 00A36E76, 00A36EF3, 00A36F70, 00A370E7, 00A37164, 00A371E1
20000, xrefs: 00A367E7
WriteEnvironmentStrings, xrefs: 00A362AA
RegisterMIMEInfo, xrefs: 00A3611B
InstallInitialize, xrefs: 00A369DA
Complus, xrefs: 00A33F5D, 00A36668
ProcessComponents, xrefs: 00A3376B
RemoveRegistryValues, xrefs: 00A3469B, 00A347E1
RegisterTypeLibraries, xrefs: 00A3653F
InstallODBC, xrefs: 00A363AD, 00A36433, 00A364B9
AI_Game, xrefs: 00A36E0C, 00A37000
800, xrefs: 00A33664
AI_XmlElement, xrefs: 00A36D12, 00A37271
RemoveIniFile, xrefs: 00A34EA5
ServiceControl, xrefs: 00A33CD1, 00A33E17, 00A367FA
120000, xrefs: 00A350FE
Font, xrefs: 00A345BB, 00A36356
AI_UserAccounts, xrefs: 00A36E89, 00A37177
StartServices, xrefs: 00A367D4
ODBCDriver, xrefs: 00A34475, 00A364DF
RemoveIniValues, xrefs: 00A34E3F, 00A34F85
RemoveExistingProducts, xrefs: 00A33024
RegisterExtensionInfo, xrefs: 00A36021

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID: 100$10000$100000$12000$120000$1500$15000$1500000$1800$2000$20000$200000$3000$30000$3000000$500$5000$6000$800$8000$AI_AppSearchEx$AI_ChainProductsPseudo$AI_CountRowAction$AI_DefaultActionCost$AI_DownloadPrereq$AI_ExtractPrereq$AI_Game$AI_GxInstall$AI_GxUninstall$AI_InstallPostPrerequisite$AI_InstallPrerequisite$AI_PreRequisite$AI_ProcessAccounts$AI_ProcessGroups$AI_ProcessTasks$AI_ScheduledTasks$AI_UninstallAccounts$AI_UninstallGroups$AI_UninstallTasks$AI_UserAccounts$AI_UserGroups$AI_XmlAttribute$AI_XmlElement$AI_XmlInstall$AI_XmlUninstall$AppId$AppSearch$BindImage$Complus$Component$Component_$CostFinalize$CostInitialize$CreateFolder$CreateFolders$CreateShortcuts$DuplicateFile$DuplicateFiles$Environment$Extension$Feature$Feature_$File$FileCost$FileSize$Font$IniFile$InstallFiles$InstallFinalize$InstallInitialize$InstallODBC$InstallServices$InstallValidate$Location$MIME$MoveFile$MoveFiles$MsiAssembly$MsiConfigureServices$MsiPublishAssemblies$MsiUnpublishAssemblies$ODBCDataSource$ODBCDriver$ODBCTranslator$Options$Patch$PatchFiles$PatchSize$ProcessComponents$ProgId$PublishComponent$PublishComponents$PublishFeatures$RegisterClassInfo$RegisterComPlus$RegisterExtensionInfo$RegisterFonts$RegisterMIMEInfo$RegisterProgIdInfo$RegisterTypeLibraries$Registry$RemoveDuplicateFiles$RemoveEnvironmentStrings$RemoveExistingProducts$RemoveFile$RemoveFiles$RemoveFolders$RemoveIniFile$RemoveIniValues$RemoveODBC$RemoveRegistry$RemoveRegistryValues$RemoveShortcuts$SelfReg$SelfRegModules$SelfUnregModules$ServiceControl$ServiceInstall$Shortcut$StartServices$StopServices$TypeLib$UnpublishComponents$UnpublishFeatures$UnregisterClassInfo$UnregisterComPlus$UnregisterExtensionInfo$UnregisterFonts$UnregisterMIMEInfo$UnregisterProgIdInfo$WriteEnvironmentStrings$WriteIniValues$WriteRegistryValues$~
API String ID: 0-2910470256
Opcode ID: 6a0a529b7ffda5368ddd4f9707f951c6bd281e4127cef546e0a63d495bfc3f49
Instruction ID: b50983cf2ca6d926b30c6c31335d3d8a6bde82f585213044200607f37ac5cecd
Opcode Fuzzy Hash: 6a0a529b7ffda5368ddd4f9707f951c6bd281e4127cef546e0a63d495bfc3f49
Instruction Fuzzy Hash: 0B730860A48384A6EB55EB709E157AE7B219B62707F20436CFA416F3D1DFF4078487B2

Function 00B92EA0 Relevance: 44.3, APIs: 16, Strings: 9, Instructions: 517fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00D5D704,C0000000,00000003,00000000,00000004,00000080,00000000,2BB8795F,00D5D6E0,00D5D6F8,?), ref: 00B92F20
GetLastError.KERNEL32 ref: 00B92F3D
OutputDebugStringW.KERNEL32(00000000,00000020), ref: 00B92FB6
OutputDebugStringW.KERNEL32(00000000,?,0000001C), ref: 00B930BA
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,0000001C), ref: 00B9312B
WriteFile.KERNEL32(00000000,00D5CBD8,00000000,00000000,00000000,?,0000001C), ref: 00B9315B
WriteFile.KERNEL32(00000000,000000B7,?,00000000,00000000,00CD28AC,00000002), ref: 00B93206
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 00B9320F
FlushFileBuffers.KERNEL32(00000000,?,0000001C), ref: 00B93160

Part of subcall function 00A3A2F0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,80070057,8007000E,80004005,00A52BE4,00000000,?,?,?,*.*), ref: 00A3A313

OutputDebugStringW.KERNEL32(00000000,?,0000001D), ref: 00B93303
WriteFile.KERNEL32(00000000,00000000,00000002,?,00000000,?,0000001D), ref: 00B93389
FlushFileBuffers.KERNEL32(00000000,?,0000001D), ref: 00B93394
WriteFile.KERNEL32(00000000,000000FF,?,00000000,00000000,00CD28AC,00000002,?,?,CPU: ,00000005), ref: 00B93408
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 00B93411
WriteFile.KERNEL32(00000000,000000B7,?,00000000,00000000,00CD28AC,00000002), ref: 00B93496
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 00B9349F

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

Strings

server, xrefs: 00B931B2, 00B931BA
LOGGER->Creating LOG file at:, xrefs: 00B932AB, 00B932BD, 00B932C7
CPU: , xrefs: 00B93257, 00B9326D, 00B9339D
OS Version: %u.%u.%u SP%u (%s) [%s], xrefs: 00B931D6
workstation, xrefs: 00B931AD
LOGGER->failed to create LOG at:, xrefs: 00B92F71, 00B92F83, 00B92F8D
x64, xrefs: 00B931A0, 00B931AC
x86, xrefs: 00B93197
LOGGER->Reusing LOG file at:, xrefs: 00B93062, 00B93074, 00B9307E

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: File$BuffersFlushWrite$DebugOutputString$CreateErrorFindHeapLastPointerProcessResource
String ID: CPU: $LOGGER->Creating LOG file at:$LOGGER->Reusing LOG file at:$LOGGER->failed to create LOG at:$OS Version: %u.%u.%u SP%u (%s) [%s]$server$workstation$x64$x86
API String ID: 611875259-1312762833
Opcode ID: cd1c3bdc0a3e044d0921c3047e0bd8855ef59b429f4b6638949b05fe05173ec7
Instruction ID: 062a11054fcd79081c3c14392259be7473b07a73fea4487c1aa9c951507a88a6
Opcode Fuzzy Hash: cd1c3bdc0a3e044d0921c3047e0bd8855ef59b429f4b6638949b05fe05173ec7
Instruction Fuzzy Hash: E1128E70A012099FDB10DF68CD49BAEBBF4FF05314F1482A8E815AB2A2DB74DE45CB50

Function 00A6EB30 Relevance: 37.8, APIs: 13, Strings: 8, Instructions: 1086stringthreadsleepCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,msix,00000004,?,?,?,?,?, ?(-|/)+q,00CD451E), ref: 00A6EF21
lstrcmpiW.KERNEL32(?,?,msixbundle,0000000A,msix,00000004,?,?,?,?,?, ?(-|/)+q,00CD451E), ref: 00A6F0B1
GetCurrentThreadId.KERNEL32 ref: 00A6F2A1
Sleep.KERNEL32(000007D0,?,?,?,?,?,?,?,?,?,?, ?(-|/)+q,00CD451E), ref: 00A6F641
std::_Throw_Cpp_error.LIBCPMT ref: 00A6F6C4
std::_Throw_Cpp_error.LIBCPMT ref: 00A6F6CB
std::_Throw_Cpp_error.LIBCPMT ref: 00A6F6D2
std::_Throw_Cpp_error.LIBCPMT ref: 00A6F6E8
GetCurrentThreadId.KERNEL32 ref: 00A6F8DE

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

std::_Throw_Cpp_error.LIBCPMT ref: 00A6F9EF
std::_Throw_Cpp_error.LIBCPMT ref: 00A6F9F6
std::_Throw_Cpp_error.LIBCPMT ref: 00A6F9FD
std::_Throw_Cpp_error.LIBCPMT ref: 00A6FA04

Part of subcall function 00A52380: FindClose.KERNEL32(00000000), ref: 00A524BF
Part of subcall function 00A52380: PathIsUNCW.SHLWAPI(?,*.*,00000000), ref: 00A52577

Part of subcall function 00B616C0: FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,2BB8795F,?,00000000), ref: 00B6170B
Part of subcall function 00B616C0: GetLastError.KERNEL32(?,00000000), ref: 00B61715

Strings

appx, xrefs: 00A6F0CC
?(-|/)+q, xrefs: 00A6EC86
Launch failed. Error:, xrefs: 00A6F4DC
msix, xrefs: 00A6EDE1
msixbundle, xrefs: 00A6EF40
Return code of launched file:, xrefs: 00A6F5B6
Launching file:, xrefs: 00A6EBCA
(, xrefs: 00A6F608

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThreadlstrcmpi$CloseErrorFindFormatHeapLastMessagePathProcessSleep
String ID: ?(-|/)+q$($Launch failed. Error:$Launching file:$Return code of launched file:$appx$msix$msixbundle
API String ID: 3415484555-3482523422
Opcode ID: a24e88e6895575b2581a864188ad88720acfaa68f7d2957e2f0344c13c4e80db
Instruction ID: 38629a0eb73adc84a62b4c3ad0da7d2f6b79390187e03fe30311d4bf1b8390ce
Opcode Fuzzy Hash: a24e88e6895575b2581a864188ad88720acfaa68f7d2957e2f0344c13c4e80db
Instruction Fuzzy Hash: 5CA2AD71D00258DFDB24DF68C845BADB7B1BF45314F1482A9E419AB292EB70AE84CB91

Function 00AAA220 Relevance: 24.6, APIs: 16, Instructions: 591nativewindowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000,2BB8795F,?,?), ref: 00AAA274
ShowWindow.USER32(?,00000005,?,?), ref: 00AAA2A1
GetWindowLongW.USER32(FFFFFFFB,000000F0), ref: 00AAA2D0
SetWindowLongW.USER32(FFFFFFFB,000000F0,00000000), ref: 00AAA2EE
NtdllDefWindowProc_W.NTDLL(FFFFFFFB,0000000C,?,?,?,?), ref: 00AAA301
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00AAA319
GetWindowLongW.USER32(FFFFFFFB,000000F0), ref: 00AAA345
SetWindowLongW.USER32(FFFFFFFB,000000F0,00000000), ref: 00AAA363
NtdllDefWindowProc_W.NTDLL(FFFFFFFB,00000080,?,?,?,?), ref: 00AAA379
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00AAA391
GetWindowLongW.USER32(0000000100000003,000000F0), ref: 00AAA445
SetWindowLongW.USER32(0000000100000003,000000F0,00000000), ref: 00AAA463
NtdllDefWindowProc_W.NTDLL(0000000100000003,00000086,?,00000000,?,?), ref: 00AAA475
SetWindowLongW.USER32(0000000100000003,000000F0,00000000), ref: 00AAA487
GetWindowRect.USER32(?,?), ref: 00AAA528
SendMessageW.USER32(00000000,00000112,0000F060,00000000), ref: 00AAA724

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Window$Long$NtdllProc_$Show$MessageRectSend
String ID:
API String ID: 4041393160-0
Opcode ID: 28f6f6e7f2a4feca0b354135980777421ae476ec5bc9ea49eb7690bc7eba98be
Instruction ID: 47016b1480c9f568445a558092ecc5b745d729e38a552b83e2dc864575ac023e
Opcode Fuzzy Hash: 28f6f6e7f2a4feca0b354135980777421ae476ec5bc9ea49eb7690bc7eba98be
Instruction Fuzzy Hash: 68323774900319EFDB21CF64C988BAEBBF1FF59320F248159E915AB2E0C771A840DB91

Function 00A52380 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 664fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000), ref: 00A524BF
PathIsUNCW.SHLWAPI(?,*.*,00000000), ref: 00A52577
FindFirstFileW.KERNEL32(?,?,*.*,00000000), ref: 00A526CC
GetFullPathNameW.KERNEL32(?,00000000,00000000,00000000), ref: 00A526E6
GetFullPathNameW.KERNEL32(?,00000000,?,00000000), ref: 00A52719
FindClose.KERNEL32(00000000,?,?), ref: 00A5277D
SetLastError.KERNEL32(0000007B,?,?), ref: 00A52787
_wcsrchr.LIBVCRUNTIME ref: 00A527DD
_wcsrchr.LIBVCRUNTIME ref: 00A527FD
PathIsUNCW.SHLWAPI(*.*,?,2BB8795F), ref: 00A52995

Strings

*.*, xrefs: 00A524EA, 00A52547, 00A52548, 00A528C4, 00A52994
\\?\UNC\, xrefs: 00A52597, 00A5264E, 00A529B7, 00A52A70
\\?\, xrefs: 00A52661, 00A526B6, 00A52A86, 00A52ADE

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Path$Find$CloseFullName_wcsrchr$ErrorFileFirstLast
String ID: *.*$\\?\$\\?\UNC\
API String ID: 1241272779-1700010636
Opcode ID: 605409dd788af7b4b552cbe4f70cc3ab6e7946c772f887f5f8cd21b5ff044e83
Instruction ID: a00bc72912e0f4def7d767e524d799a70f191e36b094c0acf6a672d01c55db9d
Opcode Fuzzy Hash: 605409dd788af7b4b552cbe4f70cc3ab6e7946c772f887f5f8cd21b5ff044e83
Instruction Fuzzy Hash: EC320270600601DFDB14DF68C989B6EF7B5FF66316F104228E8159B2A1EB71AD08CB90

Function 00A466D0 Relevance: 22.9, APIs: 15, Instructions: 389memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00A46B60: EnterCriticalSection.KERNEL32(00D629CC,2BB8795F,00000000,?,?,?,?,?,?,00A4638E,00C4930D,000000FF), ref: 00A46B9D
Part of subcall function 00A46B60: LoadCursorW.USER32(00000000,00007F00), ref: 00A46C18
Part of subcall function 00A46B60: LoadCursorW.USER32(00000000,00007F00), ref: 00A46CBE

SysFreeString.OLEAUT32(00000000), ref: 00A46773
SysAllocString.OLEAUT32(00000000), ref: 00A467A4
GetWindowLongW.USER32(?,000000EC), ref: 00A4687B
GetWindowLongW.USER32(?,000000EC), ref: 00A4688B
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00A46896
NtdllDefWindowProc_W.NTDLL(?,?,00000001,?), ref: 00A468A4
GetWindowLongW.USER32(?,000000EB), ref: 00A468B2
SetWindowTextW.USER32(?,00CCF96C), ref: 00A46951
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00A46986
GlobalLock.KERNEL32(00000000), ref: 00A46994
GlobalUnlock.KERNEL32(?), ref: 00A469E8
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00A46A73
SysFreeString.OLEAUT32(00000000), ref: 00A46A8C
NtdllDefWindowProc_W.NTDLL(?,?,?,00000000), ref: 00A46AD3
SysFreeString.OLEAUT32(00000000), ref: 00A46AF2

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Window$Long$String$FreeGlobal$AllocCursorLoadNtdllProc_$CriticalEnterLockSectionTextUnlock
String ID:
API String ID: 4180125975-0
Opcode ID: 065581fcfeea02c5c54ecb3e791946bef9b3aaca4bf9224a1698adc0c7caa3c7
Instruction ID: 2be3802e46215f8f2cc271981669109eb574bcd10d0d7ddcd4550b52a70280b9
Opcode Fuzzy Hash: 065581fcfeea02c5c54ecb3e791946bef9b3aaca4bf9224a1698adc0c7caa3c7
Instruction Fuzzy Hash: FFD1C075900309EFDB10DFA4CD48BAFBBB8EF86714F144169E811E7291DB759A04CBA2

Function 00A50590 Relevance: 21.6, APIs: 14, Instructions: 611COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00A50643
ShowWindow.USER32(00000000,?), ref: 00A50662
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00A50670
GetWindowRect.USER32(00000000,?), ref: 00A50687
ShowWindow.USER32(00000000,?), ref: 00A506A8
SetWindowLongW.USER32(?,000000EB,?), ref: 00A506BF

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

ShowWindow.USER32(?,?), ref: 00A507FD
GetWindowLongW.USER32(?,000000EB), ref: 00A5082C
ShowWindow.USER32(?,?), ref: 00A50849
GetWindowRect.USER32(?,?), ref: 00A5086E

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Window$LongShow$Rect$AllocateHeap
String ID:
API String ID: 283321994-0
Opcode ID: 80c3a78c9b094b086b27f1d31cb455091fbd62968836629021e3a70c835b88e3
Instruction ID: 1d5d34050c6eb93db3f19d719ccd9e9add4cf95f221f8a99ddb0caaa9308b3b7
Opcode Fuzzy Hash: 80c3a78c9b094b086b27f1d31cb455091fbd62968836629021e3a70c835b88e3
Instruction Fuzzy Hash: 82422571A043089FCB24CFA8D984AAEBBF5FF89311F14465EE855EB260D730A949CF51

Function 00B70800 Relevance: 21.0, APIs: 2, Strings: 9, Instructions: 1718fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

Part of subcall function 00A3A2F0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,80070057,8007000E,80004005,00A52BE4,00000000,?,?,?,*.*), ref: 00A3A313

CopyFileW.KERNEL32(?,?,00000000,00000000,00000000), ref: 00B70E35
CopyFileW.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,?), ref: 00B713E6

Part of subcall function 00B45F60: MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,00000000,00000000,?,?,00D5D6E0,00B93680,?), ref: 00B45F78
Part of subcall function 00B45F60: MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,?,-00000001), ref: 00B45FAA

Strings

instname-target.msi, xrefs: 00B70DAA, 00B7135B
instname-template.msi, xrefs: 00B70CB6, 00B71260
InstanceId, xrefs: 00B71691, 00B716A3, 00B716AB
{%0.8X-%0.4X-%0.4X-%0.2X%0.2X-%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X}, xrefs: 00B71183
ProductCode, xrefs: 00B7161D, 00B7162F, 00B71639
instname-custom.mst, xrefs: 00B70DE8, 00B71399
\\?\, xrefs: 00B70D18, 00B712C2
ProductName, xrefs: 00B70F04, 00B70F16, 00B70F20, 00B7152F, 00B71541, 00B7154B
AI_PRODUCTNAME_ARP, xrefs: 00B70F8C, 00B70F9E, 00B70FA8, 00B715A6, 00B715B8, 00B715C2

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ByteCharCopyFileHeapMultiWide$AllocateFindProcessResource
String ID: AI_PRODUCTNAME_ARP$InstanceId$ProductCode$ProductName$\\?\$instname-custom.mst$instname-target.msi$instname-template.msi${%0.8X-%0.4X-%0.4X-%0.2X%0.2X-%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X}
API String ID: 2938402143-731456645
Opcode ID: 5f393da0c53cc3d17c9a49fb3d435b8613bff01084d045e595230ea0c0851d4a
Instruction ID: ec38ea095b8e59d34d4bec16cd6084496e4a47af05335e5f6e8d66a1dee9466f
Opcode Fuzzy Hash: 5f393da0c53cc3d17c9a49fb3d435b8613bff01084d045e595230ea0c0851d4a
Instruction Fuzzy Hash: B4E2AF71900649DBDB00DFACC945BAEBBF4EF45314F1481A9E419EB292EB34DE04CBA1

Function 00B6C6E0 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

FindFirstFileW.KERNEL32(?,?,?,00000001), ref: 00B6CA82
FindClose.KERNEL32(00000000), ref: 00B6CAB0
FindClose.KERNEL32(00000000), ref: 00B6CB39

Strings

No acceptable version found., xrefs: 00B6D04C
No acceptable version found. Operating System not supported., xrefs: 00B6D03E
No acceptable version found. It must be downloaded., xrefs: 00B6D030
No acceptable version found. It is already downloaded and it will be installed., xrefs: 00B6D045
Not selected for install., xrefs: 00B6D053
No acceptable version found. It must be installed from package., xrefs: 00B6D029
An acceptable version was found., xrefs: 00B6D022
No acceptable version found. It must be downloaded manually from a site., xrefs: 00B6D037

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Find$Close$FileFirstHeapProcess
String ID: An acceptable version was found.$No acceptable version found.$No acceptable version found. It is already downloaded and it will be installed.$No acceptable version found. It must be downloaded manually from a site.$No acceptable version found. It must be downloaded.$No acceptable version found. It must be installed from package.$No acceptable version found. Operating System not supported.$Not selected for install.
API String ID: 4254541338-749633484
Opcode ID: d5d7744b9fd4a2a011ec9ce586fb88ac035469bea8b7b3c41efa8c1d35505a00
Instruction ID: f42b9b0114f8f024c3111e03d7cd5ddd2486d31998272b3f10d69e1fe0506bda
Opcode Fuzzy Hash: d5d7744b9fd4a2a011ec9ce586fb88ac035469bea8b7b3c41efa8c1d35505a00
Instruction Fuzzy Hash: E5F18B7190060ACFDB10DF28C9497AEFBF5EF45310F1486D9D899AB392DB389A44CB91

Function 00A6C6F0 Relevance: 15.7, Strings: 12, Instructions: 718COMMON

Download Yara Rule

Strings

= ", xrefs: 00A6CDEA
EndDialog, xrefs: 00A6CAD7
' AND `Control_`=', xrefs: 00A6C935
', ', xrefs: 00A6CB66, 00A6CBE6, 00A6CC6C, 00A6CCF5
Dialog, xrefs: 00A6C783, 00A6C7AB
Control_Default, xrefs: 00A6C75B
AND , xrefs: 00A6CD9D
ControlEvent, xrefs: 00A6C9CB
INSERT INTO `ControlEvent` (`Dialog_`, `Control_`,`Event`,`Argument`, `Condition`, `Ordering`) VALUES (', xrefs: 00A6CB17
"', ', xrefs: 00A6CE42
') TEMPORARY, xrefs: 00A6CF76
`Dialog_`=', xrefs: 00A6C901

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID: = "$ AND $"', '$' AND `Control_`='$') TEMPORARY$', '$ControlEvent$Control_Default$Dialog$EndDialog$INSERT INTO `ControlEvent` (`Dialog_`, `Control_`,`Event`,`Argument`, `Condition`, `Ordering`) VALUES ('$`Dialog_`='
API String ID: 0-200699992
Opcode ID: a4e38bc7a4dfdfaf889ad5208e2c6e22354a5cbd2bcbdff2f824a70a774085d8
Instruction ID: a048fb0ddc124775a5491145be2581080e06f96b670dac4b4a3de4f79df6f295
Opcode Fuzzy Hash: a4e38bc7a4dfdfaf889ad5208e2c6e22354a5cbd2bcbdff2f824a70a774085d8
Instruction Fuzzy Hash: B462AD70E00258DFDB14DF68CD84BEEBBB1BF59314F108299E409A7291DB74AA89CF51

Function 00B84B10 Relevance: 15.7, APIs: 10, Instructions: 657COMMON

Download Yara Rule

APIs

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

CloseHandle.KERNEL32(?,2BB8795F,00000000), ref: 00B86631

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CloseHandleHeapProcess
String ID:
API String ID: 3728050799-0
Opcode ID: 858c80a7d106379eaec3a01b218d137f2d5152adbb0164903420c6703d8939ea
Instruction ID: 9a43cbf987bf3259f5f1b0bddbde3f70f4af93c24be5ba7d73fce1e781733e37
Opcode Fuzzy Hash: 858c80a7d106379eaec3a01b218d137f2d5152adbb0164903420c6703d8939ea
Instruction Fuzzy Hash: E162B9B0900659CFDB20DF28CD4479EBBF0AF46314F1482D9D548AB2A2DB749E85CF95

Function 00A6B6C0 Relevance: 14.9, APIs: 1, Strings: 7, Instructions: 856windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00A6B70F

Strings

AiTabPage, xrefs: 00A6B90E, 00A6BA57
' AND `Control_`=', xrefs: 00A6B89B
Dialog, xrefs: 00A6BE6C, 00A6BE94, 00A6C01A, 00A6C03A, 00A6C062
ControlEvent, xrefs: 00A6B97A
Title, xrefs: 00A6BE3E
SpawnDialog, xrefs: 00A6BDAD
`Dialog_`=', xrefs: 00A6B85C

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: MessageSend
String ID: ' AND `Control_`='$AiTabPage$ControlEvent$Dialog$SpawnDialog$Title$`Dialog_`='
API String ID: 3850602802-1412757306
Opcode ID: f17b52f4e9f58abf560bba645d46181c89e9a2bc58ab9416929e655977c01911
Instruction ID: 251856f83a394c9608ad15befeedc76813ec3376f6a7367feae8b1af9f81f3aa
Opcode Fuzzy Hash: f17b52f4e9f58abf560bba645d46181c89e9a2bc58ab9416929e655977c01911
Instruction Fuzzy Hash: C272AE71D10258CFDB14DF68C894BEEB7B1FF59304F148299E445AB391DB74AA84CBA0

Function 00A5C7F0 Relevance: 13.3, Strings: 10, Instructions: 767COMMON

Download Yara Rule

Strings

AI_DynInstances, xrefs: 00A5CB7C
ProductVersion, xrefs: 00A5C9D8
Manufacturer, xrefs: 00A5C94B
OldProductCode, xrefs: 00A5CAF2
AI_MajorUpgrades, xrefs: 00A5CC5B
ProductCode, xrefs: 00A5C83C
InstanceId, xrefs: 00A5CA65
, xrefs: 00A5D0A5
UpgradeCode, xrefs: 00A5C8BE
AI_GenNewCompGuids, xrefs: 00A5CD3E

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID: $AI_DynInstances$AI_GenNewCompGuids$AI_MajorUpgrades$InstanceId$Manufacturer$OldProductCode$ProductCode$ProductVersion$UpgradeCode
API String ID: 0-614494711
Opcode ID: 9ef50375ce38334fbc44bb37fec1e4df6948366a2c19c28b8b2d9aee15fbfa4b
Instruction ID: 747921e74666079644c686fa0dcc564910548c0adaff7b59638250d83d96e145
Opcode Fuzzy Hash: 9ef50375ce38334fbc44bb37fec1e4df6948366a2c19c28b8b2d9aee15fbfa4b
Instruction Fuzzy Hash: 6662F031D00258CFCB18CB64CD94BEEBBB1BF55315F148299E846B7291DB746E88CBA1

Function 00A61380 Relevance: 12.9, APIs: 5, Strings: 2, Instructions: 685windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00A61461

Part of subcall function 00C1EE76: AcquireSRWLockExclusive.KERNEL32(00D5BFA8,?,?,?,00A3ADE6,00D5CBBC,2BB8795F,?,?,00C4629D,000000FF,?,00B9F0FC,2BB8795F,?,?), ref: 00C1EE81
Part of subcall function 00C1EE76: ReleaseSRWLockExclusive.KERNEL32(00D5BFA8,?,00A3ADE6,00D5CBBC,2BB8795F,?,?,00C4629D,000000FF,?,00B9F0FC,2BB8795F,?,?), ref: 00C1EEBB

Part of subcall function 00C1EE25: AcquireSRWLockExclusive.KERNEL32(00D5BFA8,?,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE2F
Part of subcall function 00C1EE25: ReleaseSRWLockExclusive.KERNEL32(00D5BFA8,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE62
Part of subcall function 00C1EE25: WakeAllConditionVariable.KERNEL32(00D5BFA4,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE6D

SendMessageW.USER32(?,0000104D,00000000,?), ref: 00A61982
SendMessageW.USER32(?,0000102B,?,0000000F), ref: 00A61A30
SendMessageW.USER32(?,00001003,00000001,?), ref: 00A61AD1

Part of subcall function 00B52560: __cftof.LIBCMT ref: 00B525B0

SendMessageW.USER32(?,0000101E,00000000,0000FFFE), ref: 00A61D08

Strings

Icon, xrefs: 00A617D6
AiFeatIco, xrefs: 00A6171B

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: MessageSend$ExclusiveLock$AcquireRelease$ConditionVariableWake__cftof
String ID: AiFeatIco$Icon
API String ID: 1739475930-1280411655
Opcode ID: 856f08ff7de26004b67934b0eb4608a2ca36ac1f80bdaa896872dea2b4b0364d
Instruction ID: 7b6f14f50c5c7acb0475a9e6566799aa78020d8790d3d7d1bfbc3e5f33d8ab81
Opcode Fuzzy Hash: 856f08ff7de26004b67934b0eb4608a2ca36ac1f80bdaa896872dea2b4b0364d
Instruction Fuzzy Hash: 7D626971900658DFDB24CF68CD88BEEBBB1BB49304F144199E45AAB391DB746E84CF90

Function 00B64350 Relevance: 12.8, APIs: 6, Strings: 1, Instructions: 580COMMON

Download Yara Rule

APIs

Part of subcall function 00C1EE76: AcquireSRWLockExclusive.KERNEL32(00D5BFA8,?,?,?,00A3ADE6,00D5CBBC,2BB8795F,?,?,00C4629D,000000FF,?,00B9F0FC,2BB8795F,?,?), ref: 00C1EE81
Part of subcall function 00C1EE76: ReleaseSRWLockExclusive.KERNEL32(00D5BFA8,?,00A3ADE6,00D5CBBC,2BB8795F,?,?,00C4629D,000000FF,?,00B9F0FC,2BB8795F,?,?), ref: 00C1EEBB

GetStdHandle.KERNEL32(000000F5,?,2BB8795F,?,?), ref: 00B6472A
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?), ref: 00B64731
GetStdHandle.KERNEL32(000000F5,0000000C,?,?), ref: 00B64745
SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 00B6474C
GetStdHandle.KERNEL32(000000F5,000000FF,?,00000000,?,00000000,00CD28AC,00000002,?,?), ref: 00B647DB
SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 00B647E2

Strings

Error, xrefs: 00B64A0C

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ConsoleHandle$AttributeExclusiveLockText$AcquireBufferInfoReleaseScreen
String ID: Error
API String ID: 3518662907-2619118453
Opcode ID: 12ac7fdb75d7c5df327a7ba5c10c95a06f781d393cbda6c3001fad6e8d378025
Instruction ID: ac82b6ecf4ee060019ba67d5503d2239915a7f39b975e2c979e75dabb8bcd34e
Opcode Fuzzy Hash: 12ac7fdb75d7c5df327a7ba5c10c95a06f781d393cbda6c3001fad6e8d378025
Instruction Fuzzy Hash: C9425970D0075ACBDB24CF68CD45BADBBB0FF55314F1042A9E419A7291EB786A84DFA0

Function 00B8EEF0 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 411COMMON

Download Yara Rule

APIs

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

_wcsrchr.LIBVCRUNTIME ref: 00B8F07D
_wcsrchr.LIBVCRUNTIME ref: 00B8F0A5
GetLogicalDriveStringsW.KERNEL32(00000064,?), ref: 00B8F0FE
GetDriveTypeW.KERNEL32(?), ref: 00B8F11A
Wow64DisableWow64FsRedirection.KERNEL32(00000000,00000000), ref: 00B8F1A1
Wow64RevertWow64FsRedirection.KERNEL32(00000000,00000000), ref: 00B8F401

Strings

]%!, xrefs: 00B8F099

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Wow64$DriveRedirection_wcsrchr$DisableHeapLogicalProcessRevertStringsType
String ID: ]%!
API String ID: 1737443197-1069524040
Opcode ID: 6fa6f8d098b97ec4bd5e1c9d07001980f9560db22b20d2474f911ed3038ead82
Instruction ID: 45189be226d44071a0b24439caf924e233ea4c437481d62fd9984939eef60957
Opcode Fuzzy Hash: 6fa6f8d098b97ec4bd5e1c9d07001980f9560db22b20d2474f911ed3038ead82
Instruction Fuzzy Hash: 69F1927190055ACFDB24EF68C848BADB7F4EF55310F1481E9E459A72A2DB709E84CF90

Function 00ACA730 Relevance: 10.7, Strings: 8, Instructions: 672COMMON

Download Yara Rule

Strings

VersionNT64, xrefs: 00ACA84E
ServicePackLevelMinor, xrefs: 00ACA8B4
MsiNTProductType, xrefs: 00ACA91A
WindowsBuild, xrefs: 00ACA8E7
ServicePackLevel, xrefs: 00ACA881
AiVerMin, xrefs: 00ACA9C2
AiVerMax, xrefs: 00ACA9D7
VersionNT, xrefs: 00ACA81B

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionVariableWake
String ID: AiVerMax$AiVerMin$MsiNTProductType$ServicePackLevel$ServicePackLevelMinor$VersionNT$VersionNT64$WindowsBuild
API String ID: 4258034872-3011993468
Opcode ID: 313f49b8cc36b78a0d6eb1ec68021c9dbe367ae0cdee39ea8d76f9e9d617a85a
Instruction ID: 0167ee688c94d3bdbb0beeb5479a5d843e29d6e4ed94b9c4a8760aefd2cd76df
Opcode Fuzzy Hash: 313f49b8cc36b78a0d6eb1ec68021c9dbe367ae0cdee39ea8d76f9e9d617a85a
Instruction Fuzzy Hash: B0528C70A00258DFDB14DF68C994FADB7B1BF55304F15829DE40AAB391DB70AE84CBA1

Function 00C4080B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00C409EF

Strings

1#SNAN, xrefs: 00C40917
1#INF, xrefs: 00C40941
1#QNAN, xrefs: 00C4091E
1#IND, xrefs: 00C40910

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 02d45b9efcf4cceb6864c0395dc181c1ec6ff01f0763061b09b8deac51941ae2
Instruction ID: d5ad8e7543c7e0e6f0a7433df8937767c826179086a596c578b645a063904294
Opcode Fuzzy Hash: 02d45b9efcf4cceb6864c0395dc181c1ec6ff01f0763061b09b8deac51941ae2
Instruction Fuzzy Hash: 57D23871E082288FDB65CE28DD40BEAB7B5FB44305F1841EAD85DE7240E778AE858F41

Function 00A849E0 Relevance: 9.9, Strings: 7, Instructions: 1105COMMON

Download Yara Rule

Strings

AiTabPage, xrefs: 00A84ECC, 00A85018
Binary.xaml, xrefs: 00A8548D
' AND `Control_`=', xrefs: 00A84E53
ControlEvent, xrefs: 00A84F38
.xaml, xrefs: 00A8539C, 00A8540F, 00A854F6
D, xrefs: 00A859E7
`Dialog_`=', xrefs: 00A84E14

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID: ' AND `Control_`='$.xaml$AiTabPage$Binary.xaml$ControlEvent$D$`Dialog_`='
API String ID: 0-3446021766
Opcode ID: 5f3c8de74152b817f7177d14097fd25a9883b8d532c6d6fc6ab7fc5178c860a8
Instruction ID: 701bcc9536d32ef4dc8050d6e67bc69ddca8dfd201068e1e32a34a8dbb682670
Opcode Fuzzy Hash: 5f3c8de74152b817f7177d14097fd25a9883b8d532c6d6fc6ab7fc5178c860a8
Instruction Fuzzy Hash: 51B29B70D00258DFDB24DB68C984BEEBBB5BF55300F1081D9E449A7292DB74AE88CF91

Function 00BA64B0 Relevance: 9.5, APIs: 4, Strings: 1, Instructions: 743comCOMMON

Download Yara Rule

APIs

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

GetLastError.KERNEL32 ref: 00BA65DD
CoInitialize.OLE32(00000000), ref: 00BA6B91
CoCreateInstance.COMBASE(00CED46C,00000000,00000001,00CED47C,00000000), ref: 00BA6BC1
CoUninitialize.COMBASE ref: 00BA6D78

Strings

{374DE290-123F-4565-9164-39C4925E467B}, xrefs: 00BA6C0D

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CreateErrorHeapInitializeInstanceLastProcessUninitialize
String ID: {374DE290-123F-4565-9164-39C4925E467B}
API String ID: 3594623390-4280329633
Opcode ID: a2e35acdd82dd88f23e6b5f6b2eb130bd053e67b9ef1740871fa15cff12a0035
Instruction ID: ff6f379e2b5804f684c7f5ea8cfbbcae1d4d7e69c82b387309004cfb09c0ac61
Opcode Fuzzy Hash: a2e35acdd82dd88f23e6b5f6b2eb130bd053e67b9ef1740871fa15cff12a0035
Instruction Fuzzy Hash: AF52C4B0A04705DBDB11DF68C849BAEB7F4EF56310F188199E801EB291EB75DD05CBA1

Function 00BA37E0 Relevance: 9.2, APIs: 6, Instructions: 190fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,-00000010,?,2BB8795F,?,00000000,00000000), ref: 00BA38B1
FindNextFileW.KERNEL32(?,00000000), ref: 00BA38CC

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: FileFind$FirstNext
String ID:
API String ID: 1690352074-0
Opcode ID: 90c627d180ca4aa677840ffd97c61ce8c0d2a8c793b613554c6b839666bd7d16
Instruction ID: cf5d468b9115a9509b12d0bc3d3d16a63f535ec19d50f8c96d0de8eec065a0e5
Opcode Fuzzy Hash: 90c627d180ca4aa677840ffd97c61ce8c0d2a8c793b613554c6b839666bd7d16
Instruction Fuzzy Hash: F1715C71900689DFDF10DFA8C948BDEBBF4FF19324F148169E815AB291DB349A04CB51

Function 00C1E569 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,00C1E485,00000000,?,00C1E61D,?,?,?), ref: 00C1E56B
GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000,?,00C1E61D,?,?,?), ref: 00C1E592
HeapAlloc.KERNEL32(00000000,?,00C1E61D,?,?,?), ref: 00C1E599
InitializeSListHead.KERNEL32(00000000,?,00C1E61D,?,?,?), ref: 00C1E5A6
GetProcessHeap.KERNEL32(00000000,00000000,?,00C1E61D,?,?,?), ref: 00C1E5BB
HeapFree.KERNEL32(00000000,?,00C1E61D,?,?,?), ref: 00C1E5C2

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: 5138155f82097367a4367c48654e1629bd2b8586de999e35d9e93585d6b8e06f
Instruction ID: a49a4021d9bb2ffce48f1fcd42533d12f5453f3785ad07a245bfa4eb667b70f1
Opcode Fuzzy Hash: 5138155f82097367a4367c48654e1629bd2b8586de999e35d9e93585d6b8e06f
Instruction Fuzzy Hash: 51F0A4716016019BD7109F29AC08B1B77A9BF9A71AF00002AEE56C3250EB30CC408A60

Function 00B5DB60 Relevance: 7.7, APIs: 5, Instructions: 240fileCOMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00B5DBB8

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

FindFirstFileW.KERNEL32(?,00000000,?,?,00B712AD), ref: 00B5DCB8
FindFirstFileW.KERNEL32(?,00000000,0000002A,?,00000000,?,?,00B712AD), ref: 00B5DD55
FindClose.KERNEL32(00000000,?,00000000,?,?,00B712AD), ref: 00B5DD7B
FindClose.KERNEL32(00000000,?,00000000,?,?,00B712AD), ref: 00B5DDC5

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Find$CloseFileFirst$HeapProcess_wcsrchr
String ID:
API String ID: 968983534-0
Opcode ID: 9a2f4f04524ebcfdd1aef3060c4b93c96ab18051b6aaa7fc898e58f3435a1fcc
Instruction ID: 09986df320fa30365b25739ca4e9c50d61f8b44b0d7f4033b4d0696ea19cbc50
Opcode Fuzzy Hash: 9a2f4f04524ebcfdd1aef3060c4b93c96ab18051b6aaa7fc898e58f3435a1fcc
Instruction Fuzzy Hash: 8771E171A002459BDB20DF68CC44BAEB7F4FF4532AF1083A9E815972C0D7B49A48CB90

Function 00ABC860 Relevance: 6.7, APIs: 2, Strings: 2, Instructions: 683memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,00000000,00CCF96C,00000000), ref: 00ABCF10
HeapFree.KERNEL32(00000000,?,00000000,00CCF96C,00000000), ref: 00ABCF16

Strings

TextControlForeground, xrefs: 00ABCDC1
TextControlForegroundFocused, xrefs: 00ABCD5C

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: TextControlForeground$TextControlForegroundFocused
API String ID: 3859560861-993231238
Opcode ID: 96fb94bc77c1138cd474fe8035158d4e350484cb6778929655ef64d18f1e7d19
Instruction ID: df798de002541daafb67e303735338e22bc68a523ee80693c426d12e3f911ab7
Opcode Fuzzy Hash: 96fb94bc77c1138cd474fe8035158d4e350484cb6778929655ef64d18f1e7d19
Instruction Fuzzy Hash: AB52CD70D00248DFCB14DFA8C945BEEBBB4FF44324F20426DE515AB2A2DB74AA45CB91

Function 00C36CBA Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00C36D47

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 574ee3e7ae2eaa060d8c240e0e3effab78a123393c400bbf031c84402723425f
Instruction ID: 8aebc513a61952906fe4b05dd8196701bad00ce187f2c82ed3ab1449940c010a
Opcode Fuzzy Hash: 574ee3e7ae2eaa060d8c240e0e3effab78a123393c400bbf031c84402723425f
Instruction Fuzzy Hash: B4B16972A14255AFDB15CF68C881BFEBBA5EF59310F14C16AE814AB342D234DE05CBA0

Function 00B90080 Relevance: 6.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff6a4623c2b19e6940c81724913b12c32a59399eec6a6be32555447a9ca174a3
Instruction ID: 08d0f40b605d66d8039acc0a52339a3964d35bb274305348dfb98ed87cb91911
Opcode Fuzzy Hash: ff6a4623c2b19e6940c81724913b12c32a59399eec6a6be32555447a9ca174a3
Instruction Fuzzy Hash: 77819B71911218DFDB50DF28CC89B99BBF4EF45314F1482E9E858AB292DB309E84CF91

Function 00A57CB0 Relevance: 5.7, Strings: 4, Instructions: 696COMMON

Download Yara Rule

Strings

AI_NO_BORDER_NORMAL, xrefs: 00A57D9D
AI_CONTROL_VISUAL_STYLE_EX, xrefs: 00A58165
AI_NO_BORDER_HOVER, xrefs: 00A57E4A
AI_CONTROL_VISUAL_STYLE, xrefs: 00A57D0A

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID: AI_CONTROL_VISUAL_STYLE$AI_CONTROL_VISUAL_STYLE_EX$AI_NO_BORDER_HOVER$AI_NO_BORDER_NORMAL
API String ID: 0-932585912
Opcode ID: 8b44b271bcb5eba36228a389ce1f11fb86a7534756dd1099af8b7c9c9c83b3d9
Instruction ID: 28dc28eb5caf575f1d8f26d46f75b7fc7b8c7e27a2bb1899e3bb0cd555654f59
Opcode Fuzzy Hash: 8b44b271bcb5eba36228a389ce1f11fb86a7534756dd1099af8b7c9c9c83b3d9
Instruction Fuzzy Hash: 1042F571D002288FDB18DF68CC447ADB7B1FF95301F148259E895BB391DB78AA49CBA1

Function 00A4E8E0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 425registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000033,?,?,00000002,00CCF96C,00000000,?,80000001,00000001,00000000,AppEvents\Schemes\Apps\Explorer\Navigating\.Current,00000033,2BB8795F), ref: 00A4EA74
RegCloseKey.ADVAPI32(?,00000033,?,?,00CCF96C,00000000,?,80000001,00000000,00000000,AppEvents\Schemes\Apps\Explorer\Navigating\.Current,00000033,2BB8795F,?,?), ref: 00A4EC9D

Strings

AppEvents\Schemes\Apps\Explorer\Navigating\.Current, xrefs: 00A4E938, 00A4EB19

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Close
String ID: AppEvents\Schemes\Apps\Explorer\Navigating\.Current
API String ID: 3535843008-2431777889
Opcode ID: 740705382c9eee5865610e0b28ef3e83f4e1cffe2de31e11cb7f849a2cfbb618
Instruction ID: dbd5f16581a6b47cda4196d003b4c474a508b23b8afa5659ad5d3f3fbcc11812
Opcode Fuzzy Hash: 740705382c9eee5865610e0b28ef3e83f4e1cffe2de31e11cb7f849a2cfbb618
Instruction Fuzzy Hash: 2BF1CE71D102489FDB14DF68CD85BEEBBB5FF88310F208259E855B7281DB74AA84CB91

Function 00BB6B40 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

/Kim, xrefs: 00BB6BE6

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID: /Kim
API String ID: 0-585551710
Opcode ID: 884db506bfeaa2d6a0d15d3727ced6282ffdbd57d2223ae0e919d8d6ed13b581
Instruction ID: 5b16333f6bcaa78eaa4a671c482e23ba84d37cfb9dbbde6d95ddea9f452a4e85
Opcode Fuzzy Hash: 884db506bfeaa2d6a0d15d3727ced6282ffdbd57d2223ae0e919d8d6ed13b581
Instruction Fuzzy Hash: 1A81F372B087484FCB18CE2D88817AABBE2EBD8350F594A6DF489C7351D6B4DD05C792

Function 00BB6E80 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 246COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 00BB708D
__aulldvrm.LIBCMT ref: 00BB70C5

Strings

/Kim, xrefs: 00BB6EE6

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: __aulldvrm
String ID: /Kim
API String ID: 1302938615-585551710
Opcode ID: ac2c661a9f34f89f6a13e63258d665641b0842ed8778d74f9f61d66a0ebdbb8c
Instruction ID: 47d92442a93c354de89585325423ce89e5a5557c2b57223fbccde37147d4edb0
Opcode Fuzzy Hash: ac2c661a9f34f89f6a13e63258d665641b0842ed8778d74f9f61d66a0ebdbb8c
Instruction Fuzzy Hash: 51812672B087484FC708CE2D88806BABBD6EBD8350F59866EF448C7352D6B0DD09C792

Function 00A7C860 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,00000000), ref: 00A7C98E

Strings

PrimaryVolumePath, xrefs: 00A7C8C1
OutOfDiskSpace, xrefs: 00A7C9F8, 00A7CA6E

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: DiskFreeSpace
String ID: OutOfDiskSpace$PrimaryVolumePath
API String ID: 1705453755-3793120454
Opcode ID: f16a0ab073aea282d667916b034ec5d9103ab6d957e00cf3a6ef23295da0b843
Instruction ID: 0488f8f88ce5d3dd936bb20d1d48de12b375d7adbd9d8481319e343f9a36e7f3
Opcode Fuzzy Hash: f16a0ab073aea282d667916b034ec5d9103ab6d957e00cf3a6ef23295da0b843
Instruction Fuzzy Hash: D3719C31910258EFCB15DF68CD81BEDB7B5BF19310F148299F649A7282DB346E88CB91

Function 00B90480 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 173fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?), ref: 00B9053C
FindClose.KERNEL32(00000000), ref: 00B90687

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

Strings

%d.%d.%d.%d, xrefs: 00B90619

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Find$AllocateCloseFileFirstHeap
String ID: %d.%d.%d.%d
API String ID: 1673784098-3491811756
Opcode ID: a61114b611bcec949bb871744db636151e34d4fbd4e0faef2ed4196edaab99af
Instruction ID: e34455d01be9bbd2f64c85d68bb4f3a680eb89c131d1ee1ef8742223e8b4a00c
Opcode Fuzzy Hash: a61114b611bcec949bb871744db636151e34d4fbd4e0faef2ed4196edaab99af
Instruction Fuzzy Hash: A7616A71905219DFDF20EF28C949B9DBBB4EF45314F1082E9E819AB291DB759E84CF80

Function 00A6A5E0 Relevance: 5.4, Strings: 4, Instructions: 356COMMON

Download Yara Rule

Strings

Hide, xrefs: 00A6A6A2, 00A6A6C3
= ", xrefs: 00A6A8FA
Show, xrefs: 00A6A8D0
<> ", xrefs: 00A6A6F7

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID: <> "$ = "$Hide$Show
API String ID: 0-289022205
Opcode ID: 8e027d6d8f9fc904850d79d4ee387fb82d4ef15711bcb06882332972b5d34942
Instruction ID: fef2856558947f54cbdcadb890025d5016f43e06b941e2db9758bef75b66ccda
Opcode Fuzzy Hash: 8e027d6d8f9fc904850d79d4ee387fb82d4ef15711bcb06882332972b5d34942
Instruction Fuzzy Hash: 97F17C70D00259CFDB14DF64C955BAEB7B1BF65304F1082DAE00A7B292DB746A84CFA1

Function 00B88C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

GetLocaleInfoW.KERNEL32(?,00000002,00CCF96C,00000000), ref: 00B88CA1
GetLocaleInfoW.KERNEL32(?,00000002,00B88815,-00000001,00000078,-00000001), ref: 00B88CDD

Strings

%d-%s, xrefs: 00B88CE7

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: InfoLocale$HeapProcess
String ID: %d-%s
API String ID: 3246605784-1781338863
Opcode ID: 329d35fae1752b0d1cc4dea5ee41534ebbbe1e3a320948d47db11d345837c486
Instruction ID: d692d7560ee7ba3214138a9b68ab16afce269a387840b33b4338990521b2cea2
Opcode Fuzzy Hash: 329d35fae1752b0d1cc4dea5ee41534ebbbe1e3a320948d47db11d345837c486
Instruction Fuzzy Hash: EE317C71900209ABDB00DF98CD4ABAEFBB8FF04725F10416DF515AB2D1DB759904CB90

Function 00A5BAA0 Relevance: 5.3, Strings: 4, Instructions: 346COMMON

Download Yara Rule

Strings

OldProductCode, xrefs: 00A5BDE1
ProductCode, xrefs: 00A5BD4E
MultipleInstances, xrefs: 00A5BAE2
MultipleInstancesProps, xrefs: 00A5BBE0

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID: MultipleInstances$MultipleInstancesProps$OldProductCode$ProductCode
API String ID: 0-469785651
Opcode ID: 93e9e4fca5edb94b0af3bd7bc61b39e34dc30f255ceacedf8b1c193d3574d3a1
Instruction ID: fcad8656a733851536fdb6db8707d507f781c42e2d8606d654ea8db5ac15ed60
Opcode Fuzzy Hash: 93e9e4fca5edb94b0af3bd7bc61b39e34dc30f255ceacedf8b1c193d3574d3a1
Instruction Fuzzy Hash: 57C1E176A10205CFCB18CF28C991ABAB7B2FF45307B15816DDD026B255EB30AD49CBA0

Function 00BB7280 Relevance: 5.3, Strings: 4, Instructions: 254COMMON

Download Yara Rule

Strings

inf, xrefs: 00BB72EC
nan, xrefs: 00BB7321, 00BB7344
nan(ind), xrefs: 00BB730B
nan(snan), xrefs: 00BB732D

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID: inf$nan$nan(ind)$nan(snan)
API String ID: 0-3276396208
Opcode ID: 7ec5a36ede4de6b80da23daffd63a8b4763d7611c9854a7785b1948e928002e4
Instruction ID: 79fa5674dded60140f6d63494e644c87f345a50914df15ec1091dfbe6d3169be
Opcode Fuzzy Hash: 7ec5a36ede4de6b80da23daffd63a8b4763d7611c9854a7785b1948e928002e4
Instruction Fuzzy Hash: 8B713731B086418BD714DE2D98812BAB7D1EFD9310F588ABEE885D7340DAB4DD0A9792

Function 00B411C0 Relevance: 4.7, APIs: 3, Instructions: 167fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,2BB8795F,00000000,?), ref: 00B41279
FindNextFileW.KERNEL32(000000FF,00000010), ref: 00B4137F
FindClose.KERNEL32(000000FF), ref: 00B413D6

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 8628956f1a84a33ec60b374549f50732d8b5580d47bee48efd5cf1274d1871e8
Instruction ID: 91f5285d2a9d17425346b2317369dfef41ea76f6aafb462e372fbab7e57c6c32
Opcode Fuzzy Hash: 8628956f1a84a33ec60b374549f50732d8b5580d47bee48efd5cf1274d1871e8
Instruction Fuzzy Hash: 8261A770E00259DFCF24DFA8C888BEEBBB8EB05310F1486A9E455A7281DB705E84DF51

Function 00C23B83 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00C23C7B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00C23C85
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00C23C92

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e94fa3e203d13638769c41c721eea3b39ac60f58761821b05e59f02ded811efa
Instruction ID: 706809d77951544bd5e5cdbdb5e7785cee8b5294d6bd786edaafc23cc3b75b32
Opcode Fuzzy Hash: e94fa3e203d13638769c41c721eea3b39ac60f58761821b05e59f02ded811efa
Instruction Fuzzy Hash: 5531B575901228ABCB21DF28DD897CDBBB4BF08310F5042EAE41CA7251EB749F859F45

Function 00A3A1B0 Relevance: 4.6, APIs: 3, Instructions: 65COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,2BB8795F,00000001,00000000,?,00000000,00C45AD0,000000FF,?,00A3A15C,2BB8795F,?,?,*.*,?), ref: 00A3A1DB
LockResource.KERNEL32(00000000,?,00A3A15C,2BB8795F,?,?,*.*,?,00000000,00C461A0,000000FF,?,00A3A300,?,?,*.*), ref: 00A3A1E6
SizeofResource.KERNEL32(00000000,00000000,?,00A3A15C,2BB8795F,?,?,*.*,?,00000000,00C461A0,000000FF,?,00A3A300,?,?), ref: 00A3A1F4

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: e6e04964b229d1072c740cdb41d0d623af8e8b492e70f3bdf14ec56311b0921a
Instruction ID: e96dcb25ac0abde1456b12638ec0283be3f5811a3980c499c794c92291ce5dc7
Opcode Fuzzy Hash: e6e04964b229d1072c740cdb41d0d623af8e8b492e70f3bdf14ec56311b0921a
Instruction Fuzzy Hash: 7411EB72A00A249BCB34DF59DC45B7BF7E8EB9A721F01452AFC5AD3250E6369C008690

Function 00A48C90 Relevance: 4.5, APIs: 3, Instructions: 28COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(0000001B,000000FC), ref: 00A48CA9
SetWindowLongW.USER32(0000001B,000000FC,?), ref: 00A48CB7
DestroyWindow.USER32(0000001B,?,?,?,?,?,?,?,?,80004003,?,00000000,?,?,00CD1CCC), ref: 00A48CE3

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Window$Long$Destroy
String ID:
API String ID: 3055081903-0
Opcode ID: 5a4f6911907c2a6b3df06293b89262cc75db4234d229abd396fe2c54f2e48779
Instruction ID: f4a04063ce0b1d3bf9a0ede73e2e7254915660ddba7ab537cdd0e2903414891e
Opcode Fuzzy Hash: 5a4f6911907c2a6b3df06293b89262cc75db4234d229abd396fe2c54f2e48779
Instruction Fuzzy Hash: 66F03034006B11DBDB615F28FD45B967BE0BF05732B00871DE8AAC66E0CB35A844DB10

Function 00ADA4D0 Relevance: 4.2, Strings: 3, Instructions: 404COMMON

Download Yara Rule

Strings

+, xrefs: 00ADA9F8
AI_TREE_ITEMS_IMAGES, xrefs: 00ADA513
AiRefreshCost, xrefs: 00ADA9C2

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID: +$AI_TREE_ITEMS_IMAGES$AiRefreshCost
API String ID: 0-77810284
Opcode ID: 26d8b48ceacb7220b8a3e0d3120f5723069ef5352e73ea1abbacd7083942d250
Instruction ID: b6fe95c134a4c5b608faca9ac7cbbb1c8460f00d701a56cc856d038ba435995b
Opcode Fuzzy Hash: 26d8b48ceacb7220b8a3e0d3120f5723069ef5352e73ea1abbacd7083942d250
Instruction Fuzzy Hash: 0E028C70D00348DFDB15CFA8C949BDEBBB0AF15304F24819EE445AB392DB755A48DBA2

Function 00BC57C0 Relevance: 4.1, Strings: 3, Instructions: 314COMMON

Download Yara Rule

Strings

) AND ( , xrefs: 00BC59A3
Show, xrefs: 00BC594A
gfff, xrefs: 00BC5902

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID: ) AND ( $Show$gfff
API String ID: 0-344708357
Opcode ID: 683a8ac3cbf9ecddcf0ba9a702287f74a0aceb4e6bea801df7036d185b838215
Instruction ID: 2eceefc80822b8722209f59e3bbd009412d51cacca7e1c5ca59fbbe62c07cba1
Opcode Fuzzy Hash: 683a8ac3cbf9ecddcf0ba9a702287f74a0aceb4e6bea801df7036d185b838215
Instruction Fuzzy Hash: 74D17871900658CFDB24DF68C945BAEBBF1EF45314F1482DDE44AAB281DB70AE84CB91

Function 00AEA400 Relevance: 3.5, Strings: 2, Instructions: 997COMMON

Download Yara Rule

Strings

ElevetionShield, xrefs: 00AEAB7C
V, xrefs: 00AEB252

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID: ElevetionShield$V
API String ID: 0-1713583497
Opcode ID: 6421e042a7a75a5581ff748a68ac33cd6b02da310fcfc92b4c1cb13be978b19b
Instruction ID: 955577e966296f1bc114a7042f9bf49e72ff9d489863342c97381a5bd325faa9
Opcode Fuzzy Hash: 6421e042a7a75a5581ff748a68ac33cd6b02da310fcfc92b4c1cb13be978b19b
Instruction Fuzzy Hash: 0FA28B70D01298DEDF20DFA8C985BDEBBB0BF15304F248199E449A7291DB746A88CF61

Function 00C2EB00 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423aa1991e8c071495ca86e1b201fe26525c53e52d190e3902999f40fa1ebccc
Instruction ID: d531098343182f3959f7b57f12800cd0a72c377163843038acf3b612acf1d55e
Opcode Fuzzy Hash: 423aa1991e8c071495ca86e1b201fe26525c53e52d190e3902999f40fa1ebccc
Instruction Fuzzy Hash: 80F13071E002299FDF14CFA9D980AADB7B1FF48314F158269E825BB790D7309E45CB94

Function 00A62BF0 Relevance: 3.3, APIs: 2, Instructions: 258windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000102B,00000000,00000001), ref: 00A62D1B
SendMessageW.USER32(?,0000102B,?,-00000002), ref: 00A62F05

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: cf9d38beb7e2d2db1f441f5f60742031fe8e73806bcd2d8d4ad304d5ab7445c9
Instruction ID: 572d39dfa6cfc9c2b4240d5ea4ab7bb6c5d6769c05b837160c04ed4184fcb6d2
Opcode Fuzzy Hash: cf9d38beb7e2d2db1f441f5f60742031fe8e73806bcd2d8d4ad304d5ab7445c9
Instruction Fuzzy Hash: 05B1D271A00646AFCB18CF24C995BE9FBF5FF19300F18826AE459DB291D735E950CB90

Function 00B616C0 Relevance: 3.1, APIs: 2, Instructions: 134windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,2BB8795F,?,00000000), ref: 00B6170B
GetLastError.KERNEL32(?,00000000), ref: 00B61715

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AllocateErrorFormatHeapLastMessage
String ID:
API String ID: 4114510652-0
Opcode ID: 413656ee0495b9c95377400867f20db1ea36d787867d74f0140fab91bdc85de5
Instruction ID: b757dab324a2b3d7eab59cfa2b972e51da476ad128fea6230d3d3b0e96c0d5e8
Opcode Fuzzy Hash: 413656ee0495b9c95377400867f20db1ea36d787867d74f0140fab91bdc85de5
Instruction Fuzzy Hash: 8241D2B2A002159FDB14CF99D9067BEF7F8EF44714F1806AAE805EB380DBB95D008791

Function 00A50140 Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000004,000000FC), ref: 00A501A7
SetWindowLongW.USER32(00000004,000000FC,?), ref: 00A501B9

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: b998ff95f2de4d7fd05f6531a0c20f1dd05fcbe376f00b1b80a2f36cd3a17587
Instruction ID: 11c526a7b042ed5be0511e4e3bc42c35b4eeab26be8d5b41f563a0ca1629dd73
Opcode Fuzzy Hash: b998ff95f2de4d7fd05f6531a0c20f1dd05fcbe376f00b1b80a2f36cd3a17587
Instruction Fuzzy Hash: FD415AB0A01B46EFDB10CF64D908B5ABBA4BF14325F104259E824DBA90D776A928DB90

Function 00AA96E0 Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000FC), ref: 00AA974F
SetWindowLongW.USER32(00000000,000000FC,?), ref: 00AA975D

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: e717a3f4d874a8469a94a1eef834015b2e3b7cf2423160c97bc552083d0570d9
Instruction ID: d3368877ce8aa3e9860e7b964fb73361f0cea84b891de05246d3e3c7e0d50c0a
Opcode Fuzzy Hash: e717a3f4d874a8469a94a1eef834015b2e3b7cf2423160c97bc552083d0570d9
Instruction Fuzzy Hash: 5D315971900609EFCB10DF69C984B9AFBB4FF05320F148269E825EB7D0D771A954CBA0

Function 00C1E230 Relevance: 3.0, APIs: 2, Instructions: 15timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00C1DFF3,?,?,?,?,00B78640), ref: 00C1E249
GetSystemTimeAsFileTime.KERNEL32(?,00000000,?,00C1DFF3,?,?,?,?,00B78640), ref: 00C1E24D

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 162c2c25bba815a504eff27197bdee8d428349912b11cdad6151bbe0ee435273
Instruction ID: 454bedb8f781c815534d23139a6df0c0c75d72a8436e66bc1e326e3b9e809ff6
Opcode Fuzzy Hash: 162c2c25bba815a504eff27197bdee8d428349912b11cdad6151bbe0ee435273
Instruction Fuzzy Hash: 76D02232901238DB8A012B91FC047DCBB2CDE8BB217040013EC06C3220CB311C00AFE1

Function 00A79870 Relevance: 2.0, Strings: 1, Instructions: 764COMMON

Download Yara Rule

Strings

2, xrefs: 00A79C30

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: e6d37be5ca15f58824cdae2cc024159def93f4d826d525e321ff6bac9d99a7fa
Instruction ID: c2815091679fe4153d41dab7ed1dbaeae3f52ff412d62ab29f9d929cc9ffe432
Opcode Fuzzy Hash: e6d37be5ca15f58824cdae2cc024159def93f4d826d525e321ff6bac9d99a7fa
Instruction Fuzzy Hash: 7852A0B1A083569BCB04DF69D99196FB7E5BF84304F00893EF49AD7241EB34D928C792

Function 00BBA120 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

gfff, xrefs: 00BBA7D4

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: ea2b43c00c9b19c57762a5f41b424a3901e2a93ea3d96498973638769c5a1c79
Instruction ID: 0fec1060d1f6e96e05cd62a7283093da405b3b30c7846eb9e6a3d925fa5ee051
Opcode Fuzzy Hash: ea2b43c00c9b19c57762a5f41b424a3901e2a93ea3d96498973638769c5a1c79
Instruction Fuzzy Hash: 87122635B043418BD7689E2CD9C53BDB6E6EB94300F14487EE996CB3A1E6BACD448707

Function 00AACB70 Relevance: 1.8, Strings: 1, Instructions: 523COMMON

Download Yara Rule

Strings

unordered_map/set too long, xrefs: 00AACD55, 00AACF3F

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ExceptionRaise__floor_pentium4
String ID: unordered_map/set too long
API String ID: 996205981-306623848
Opcode ID: bd2ebba29bf7a6575b37855029f6be9a188cf4260edbd09d7034ad4b6d21f374
Instruction ID: 0f2b55f4bc410bb6069ad0b7ad13eac4325e18d3d2d2e3df466fa1e7114db6a2
Opcode Fuzzy Hash: bd2ebba29bf7a6575b37855029f6be9a188cf4260edbd09d7034ad4b6d21f374
Instruction Fuzzy Hash: 6412F5B1A002099FCB15DF69C881AADFBF5FF49310F14826AE816EB391D735E941CB90

Function 00C3F903 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C36786: GetLastError.KERNEL32(?,?,00C2849E,?,?,00000000,?,00000003,00C23B82,?,00C23AF1,?,?,00C23D00), ref: 00C3678A
Part of subcall function 00C36786: SetLastError.KERNEL32(00000000,?,00C23D00,?,?,?,?,?,00000000,?,?,?,00C34650,00D527B8,0000000C,00C3490E), ref: 00C3682C

EnumSystemLocalesW.KERNEL32(00C3FA29,00000001,00000000,?,-00000050,?,00C4005A,00000000,?,?,?,00000055,?), ref: 00C3F975

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 85470f883d0411466018f88d904e2f95534584a77b5f1c1f74a126a9358ad9c3
Instruction ID: 6dcee9a7a606915ff4a72f4c782d1c971360ddfdbcae1f6e9bf72188bdf3f76b
Opcode Fuzzy Hash: 85470f883d0411466018f88d904e2f95534584a77b5f1c1f74a126a9358ad9c3
Instruction Fuzzy Hash: A8113636610704AFDB189F79D89177AB791FF80328F14483DE54687600D3716903CB40

Function 00C3F99E Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C36786: GetLastError.KERNEL32(?,?,00C2849E,?,?,00000000,?,00000003,00C23B82,?,00C23AF1,?,?,00C23D00), ref: 00C3678A
Part of subcall function 00C36786: SetLastError.KERNEL32(00000000,?,00C23D00,?,?,?,?,?,00000000,?,?,?,00C34650,00D527B8,0000000C,00C3490E), ref: 00C3682C

EnumSystemLocalesW.KERNEL32(00C3FC7C,00000001,0000000C,?,-00000050,?,00C4001E,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00C3F9E8

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e0e5f3179f586abc49e20950175209faaa6d46ccfee48e301ad0c4b01b595d50
Instruction ID: 1d53127aea1cff2550d978e098e2407886fbf330ddbca736a00b94b750cb0206
Opcode Fuzzy Hash: e0e5f3179f586abc49e20950175209faaa6d46ccfee48e301ad0c4b01b595d50
Instruction Fuzzy Hash: 6EF022366103086FDB245F389881B6A7B91EF81368F15493DF9018B690C6719C42C650

Function 00C3F8B8 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C36786: GetLastError.KERNEL32(?,?,00C2849E,?,?,00000000,?,00000003,00C23B82,?,00C23AF1,?,?,00C23D00), ref: 00C3678A
Part of subcall function 00C36786: SetLastError.KERNEL32(00000000,?,00C23D00,?,?,?,?,?,00000000,?,?,?,00C34650,00D527B8,0000000C,00C3490E), ref: 00C3682C

EnumSystemLocalesW.KERNEL32(00C3F811,00000001,0000000C,?,?,00C4007C,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00C3F8EF

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: cd97790442d85cf5244fd2486dde1a3743839335a9546cb5add4ecca845c256f
Instruction ID: 7394d950951d8100915dfbf51745750e50ce93a749c043a3ba43ceb5e16129cf
Opcode Fuzzy Hash: cd97790442d85cf5244fd2486dde1a3743839335a9546cb5add4ecca845c256f
Instruction Fuzzy Hash: 1AF0553AB003086BCB08AF39D80576ABF94EFC2724F06406DEA058B290C2319D43C790

Function 00A5B400 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,?,00000000,00000000,00A60717,?,?,?), ref: 00A5B450

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 711a4541e16f757f54e4146b307357e25365b300fd87b49f0e67b299c20de850
Instruction ID: 9a7fa9a16906209d9706ba1d524b00c5d96d24ee61f577087fd19083730b0acb
Opcode Fuzzy Hash: 711a4541e16f757f54e4146b307357e25365b300fd87b49f0e67b299c20de850
Instruction Fuzzy Hash: A1F05E34024245EFE7258F54C858A79B7B6FB44317F4445E6E884C5562D3358D59DE30

Function 00C386F6 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00C35ED0,?,20001004,00000000,00000002,?,?,00C354D2), ref: 00C3872A

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4e4de0e757eab534b8197835306d86a4e274b55abb489b67bb26233c9343464c
Instruction ID: 0c7c2a32bac44364a277385f761935152075c1de95e7c6819b3287397eba08d9
Opcode Fuzzy Hash: 4e4de0e757eab534b8197835306d86a4e274b55abb489b67bb26233c9343464c
Instruction Fuzzy Hash: 44E04F31511628FBCF122F61DC08B9E7F16EF45760F104011FD1566162CF729D25AAD5

Function 00BB9140 Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

0e+00, xrefs: 00BB917D

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID: 0e+00
API String ID: 0-2793203700
Opcode ID: 891f300ee4578775ff5a195a601a65ca0d0038f0b5df74d7a2a3bb316f28f745
Instruction ID: b9223dfe41923568589b3a3f7d45d1b7e4d1835cb56f7a2ae6e44e8e83f75f0d
Opcode Fuzzy Hash: 891f300ee4578775ff5a195a601a65ca0d0038f0b5df74d7a2a3bb316f28f745
Instruction Fuzzy Hash: FF61D232F083098BC7089E2D9C913AAF7E1EBC9350F48467DF949CB391E6B5D9488781

Function 00A7F130 Relevance: .8, Instructions: 763COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ade833c4cac4ee5ba55a59260bc7c061021ca901487469528522075e01916de
Instruction ID: 41bb9a5f3b67519dc4674a389eba5a87d6f80298ebaacb597a417f3f842a1482
Opcode Fuzzy Hash: 7ade833c4cac4ee5ba55a59260bc7c061021ca901487469528522075e01916de
Instruction Fuzzy Hash: CF725970D00269CFDB24DF68CD45BEDBBB4AF14304F1081E9E858A7292EB749A85DF90

Function 00BB22C0 Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72db8719782bc2cc37eda25ac61ad2ff5f58557fd9f548eca9a0b3d487e96489
Instruction ID: 5d3920460c0e59b1032e8936f69240ba864ff98bc65e5c068584d6378b28a052
Opcode Fuzzy Hash: 72db8719782bc2cc37eda25ac61ad2ff5f58557fd9f548eca9a0b3d487e96489
Instruction Fuzzy Hash: 1702B132B083564FC718CE2DC8916AAF7D6EBD8350F484A6DE885C7391DA74DD49CB82

Function 00BB9380 Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea46f1a9dc83f3b045535a86bf9e991aa4413d7dcb551506b6eb226ac1528f6a
Instruction ID: e2cc0824d7b59395ac918f6a4bb46d086a9d35f6f983fdde8dd23bce9936c85f
Opcode Fuzzy Hash: ea46f1a9dc83f3b045535a86bf9e991aa4413d7dcb551506b6eb226ac1528f6a
Instruction Fuzzy Hash: A4D1E075A083518FC7148F28C8806AABBE1EBD9340F584A7EFA99C7351E7B1D905C782

Function 00C274BC Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d835544d8bbef956da019e9a9dbc615793c6606258e93a25dfabbfbdc2c94e08
Instruction ID: bf22012ef5e82fc2c59ecbb3109a28f79327aa2d67c239b8fa4cdcfe91b543b3
Opcode Fuzzy Hash: d835544d8bbef956da019e9a9dbc615793c6606258e93a25dfabbfbdc2c94e08
Instruction Fuzzy Hash: 6AE1CF70A087258FCB24CF68E4C4A6EB7F1FF45310B244B5DE4669BA91D730AE41CB51

Function 00ACEC30 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 156db8f513f2d5f8d000a2910508acc26875950f66462aef7599a54e7cbdca93
Instruction ID: 9a8e5b35360276fe24ab1257faf3ea14921cf5d9aca1f2f343152144f6dc5d37
Opcode Fuzzy Hash: 156db8f513f2d5f8d000a2910508acc26875950f66462aef7599a54e7cbdca93
Instruction Fuzzy Hash: C2E169B1900209AFCB14CF68C591BADFBF5FF08350F15826AE819AB391D775AA40CB90

Function 00C2712E Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b53aa0918ac14a443af001173dbb8725401621a8ff4b2b64c770ed282ad99d
Instruction ID: 145f6c5e4a63046c1f276e5db7202968802a79077a2edb00e7ca4f0802a9edb3
Opcode Fuzzy Hash: 85b53aa0918ac14a443af001173dbb8725401621a8ff4b2b64c770ed282ad99d
Instruction Fuzzy Hash: 45C1F230608666CFCB28CF68E4D46BEBBB1BF05310F24471DE86697AA1C730AE45DB51

Function 00BB1800 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54edb6517d666f24f99120c0a34d56e2e5e786cbcf89b9f0deb22c785def0d89
Instruction ID: 43114aa6958d1770133cd7d9005c809d3f95f9400f282a9a53b90958ef10ad41
Opcode Fuzzy Hash: 54edb6517d666f24f99120c0a34d56e2e5e786cbcf89b9f0deb22c785def0d89
Instruction Fuzzy Hash: 4C91A272B043154FD708CE2DCD9136AF6E6ABC8314F19853EF99AC73A1E679D8418A81

Function 00BB8340 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 721425040fc8ad6a5c666584ca5512f036834d75ae285096be3a2e9b4d92c346
Instruction ID: 18ac7df2e12655e71fc87efac3233d512df49c00c5ad9c5020b8c31f2c32a4d6
Opcode Fuzzy Hash: 721425040fc8ad6a5c666584ca5512f036834d75ae285096be3a2e9b4d92c346
Instruction Fuzzy Hash: 0671F372B183068FC304CE2DD84126BBBD6EBD8360F184A6DE495D7380DA74D909C782

Function 00BA5510 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CreateHeapInstanceProcess
String ID:
API String ID: 776714826-0
Opcode ID: e70ea4b4bdc9ef896914aa1aefb4eb8bf6f745cf4ccb7e271fec918f53c1d133
Instruction ID: e78937e63dcef7b347d9ab4048bcd0b667cb9d8d7e88619c51d629858d78cd4e
Opcode Fuzzy Hash: e70ea4b4bdc9ef896914aa1aefb4eb8bf6f745cf4ccb7e271fec918f53c1d133
Instruction Fuzzy Hash: 4B6127B0500B44DFEB20CF24C54838ABBE0FF15318F14899DD59A9B792D7B9A609DF91

Function 00A46D30 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cdafc43a34f6bba948d3df0dd6b405e0a536168ca6d4991192787c06e5a474e
Instruction ID: 3e6e7c2cd571a304d84d9cd382356b930320eeae93af4a131ee59455555a0457
Opcode Fuzzy Hash: 4cdafc43a34f6bba948d3df0dd6b405e0a536168ca6d4991192787c06e5a474e
Instruction Fuzzy Hash: 6971F7B1801B48CFE761CF78C94578ABBF0BB05324F148A5ED4A99B3D1D3B96648CB91

Function 00BB6990 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 414d79b5f1c1cff376574cec94b6b6bc1fa8ee77bef934ef1840f8c7efccb908
Instruction ID: 4b0108116fa80a7359b73108ad4903b00db2496df1a513e6bc2c4201a453136e
Opcode Fuzzy Hash: 414d79b5f1c1cff376574cec94b6b6bc1fa8ee77bef934ef1840f8c7efccb908
Instruction Fuzzy Hash: DC418F213092414BDF0C8E1958912FABBD0EBA5210B5885EFF4C7DB302E6E99C0E9792

Function 00BB3A80 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea1200c054fea38aee7ac9da3a1ac60d0f04c8ed2d49ca0de94e64abd5b9fc9
Instruction ID: c0959f969f64cf2a7d8e6b04312d2623e37abaaad6ebce261ba5358abcc8b87a
Opcode Fuzzy Hash: 9ea1200c054fea38aee7ac9da3a1ac60d0f04c8ed2d49ca0de94e64abd5b9fc9
Instruction Fuzzy Hash: C33185353096414BDB2CCE1D54A16FABBD1EFD9710B5405EFE4C2CB306E6A19A0AD3D1

Function 00C08D30 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6afe253b12aaa36d717f23001545720c63f362d899c67ef4601615383a87c1ca
Instruction ID: b6a414a97689e09828fc7d1720219637508182113ae8007bf090aa1ea01340b5
Opcode Fuzzy Hash: 6afe253b12aaa36d717f23001545720c63f362d899c67ef4601615383a87c1ca
Instruction Fuzzy Hash: 9C21B436760A464B9B4CCB2DEC7667532D1E789301788D27DEA5BCB3D1D7388526C350

Function 00AF9A20 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b64694bd0bd86c9862a2dea96c8742bde909f85350a1bf6dc3dc7d4522650f2
Instruction ID: f1b2d4efdafbeadd46167e9ceaca00555425c2673d8f08e17136ea06d9388f9c
Opcode Fuzzy Hash: 5b64694bd0bd86c9862a2dea96c8742bde909f85350a1bf6dc3dc7d4522650f2
Instruction Fuzzy Hash: 124105B0901745EED704CF69C10878AFBF0BF19318F20825ED4589B781D3BAA658CBD5

Function 00A493B0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac147965d66c62bac3ed93aa4071217dce98f22ca9bb5c542212825fd03847d3
Instruction ID: e6b1a3cd6cd0912796238f52681e4332f0eaea4e1a5614bf67b2bde486d118e7
Opcode Fuzzy Hash: ac147965d66c62bac3ed93aa4071217dce98f22ca9bb5c542212825fd03847d3
Instruction Fuzzy Hash: 612149B0804748DFD711CF58C94478ABBF4FB19324F11869ED855AB791D3B5AA48CB90

Function 00A49990 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5101c79d3743cbd67b8cd067ad56e5887bbcb1f186c2a39a1c7576eb54154aec
Instruction ID: 9b221a5f3b96f84f1046ebedf87dc096a3d8dbb6f317c571e007e168aa1a9f44
Opcode Fuzzy Hash: 5101c79d3743cbd67b8cd067ad56e5887bbcb1f186c2a39a1c7576eb54154aec
Instruction Fuzzy Hash: 25215BB0804748DFD710CF58C90478ABBF4FB09324F11869ED8559B791D3B5AA48CB90

Function 00A68F80 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 568934e9cd4b8a789b0dda2af28bdcfee0ea9a560d3a656c98d54472299bcb85
Instruction ID: 3f377e06cce73c0653e18ec16353542de01e1278170c8deb2f75fe1c11a09937
Opcode Fuzzy Hash: 568934e9cd4b8a789b0dda2af28bdcfee0ea9a560d3a656c98d54472299bcb85
Instruction Fuzzy Hash: 5A11EDB5905348DFDB40CF58C544749BBF4FB08328F2082AEE8189B381D3769A06CF80

Function 00C389FB Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7256d12ef092ee44ad0c7fe8bab721573f741716e9995ed85113c18b9f43381b
Instruction ID: 47bdde214123cc9734df30b94e0ccb549da7877a8b284b9f1c11bcbbe698a02f
Opcode Fuzzy Hash: 7256d12ef092ee44ad0c7fe8bab721573f741716e9995ed85113c18b9f43381b
Instruction Fuzzy Hash: 95F03032661324DFCB26C748C405A5973E8EB49B59F115096F611D7250CBB0DE44D7D0

Function 00C38A3F Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a31a1b2c87d20f6f1ccd6e3f5e56cdbfee1b29986efbea090f4dac1cf3a30c
Instruction ID: 460753f371a83088e2df055b2f25f02d1bccfcd3f468b739903825441daca6b1
Opcode Fuzzy Hash: 52a31a1b2c87d20f6f1ccd6e3f5e56cdbfee1b29986efbea090f4dac1cf3a30c
Instruction Fuzzy Hash: 5EE08C32921228EBCB14DB98C90498AF3ECEB44B00F154896F501D3204C670DF05E7D0

Function 00C2A0EA Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3d887da81fdedc6452c1d6739ee335ce7b001dbe01c7d1735001e7da883b1b
Instruction ID: ca319bbba09d17283884057d0e3d673d69000ea16b4e7a93c024371302ff5b5a
Opcode Fuzzy Hash: ac3d887da81fdedc6452c1d6739ee335ce7b001dbe01c7d1735001e7da883b1b
Instruction Fuzzy Hash: 2BC08C34011A50CBCE298912A6713A93354E3A17D2FA0048EC9120BA42DE1E9D86F602

Function 00B63B80 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 220registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\ProductOptions,00000000,00020119,00000000), ref: 00B63BF0
RegQueryValueExW.ADVAPI32(00000000,ProductType,00000000,00000000,?), ref: 00B63C2B
RegQueryValueExW.ADVAPI32(00000000,ProductSuite,00000000,00000000,?,?), ref: 00B63CA6
RegCloseKey.ADVAPI32(00000000), ref: 00B63E7E

Strings

BackOffice, xrefs: 00B63D12
CommunicationServer, xrefs: 00B63D2B
Terminal Server, xrefs: 00B63D44
DataCenter, xrefs: 00B63D8F
SYSTEM\CurrentControlSet\Control\ProductOptions, xrefs: 00B63BE6
ServerNT, xrefs: 00B63C54
Personal, xrefs: 00B63DA9
Security Appliance, xrefs: 00B63DEE
Storage Server, xrefs: 00B63E05
Blade, xrefs: 00B63DC0
ProductSuite, xrefs: 00B63C9B
Enterprise, xrefs: 00B63CF9
Compute Server, xrefs: 00B63E1C
ProductType, xrefs: 00B63C20
Small Business, xrefs: 00B63CE0
Small Business(Restricted), xrefs: 00B63D5D
EmbeddedNT, xrefs: 00B63D76
WinNT, xrefs: 00B63C31
Embedded(Restricted), xrefs: 00B63DD7

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: BackOffice$Blade$CommunicationServer$Compute Server$DataCenter$Embedded(Restricted)$EmbeddedNT$Enterprise$Personal$ProductSuite$ProductType$SYSTEM\CurrentControlSet\Control\ProductOptions$Security Appliance$ServerNT$Small Business$Small Business(Restricted)$Storage Server$Terminal Server$WinNT
API String ID: 1586453840-3149529848
Opcode ID: 374c226cda459a892094ba7275f18576b2870add462406b424cb9b0d3d4f186f
Instruction ID: 45dc496ac1eb68b3556321118838ab57090f5a7ee26fbd584af04dda648ed612
Opcode Fuzzy Hash: 374c226cda459a892094ba7275f18576b2870add462406b424cb9b0d3d4f186f
Instruction Fuzzy Hash: 2A71C8707003488ADF209B35CD817AA76E9EB51B14F5040F9ED0AE7691FB3DCE498B60

Function 00B63800 Relevance: 35.2, APIs: 11, Strings: 9, Instructions: 223registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 00B6386E
RegQueryValueExW.ADVAPI32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 00B638B5
RegQueryValueExW.ADVAPI32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 00B638D4
RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 00B63903
RegQueryValueExW.ADVAPI32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 00B63978
RegQueryValueExW.ADVAPI32(00000000,ReleaseId,00000000,00000000,?,?), ref: 00B639EB
RegQueryValueExW.ADVAPI32(00000000,CSDVersion,00000000,00000000,?,?), ref: 00B63A3D
GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00B63AD3
GetProcAddress.KERNEL32(00000000), ref: 00B63ADA
GetCurrentProcess.KERNEL32(?), ref: 00B63B11
RegCloseKey.ADVAPI32(00000000), ref: 00B63B52

Strings

CSDVersion, xrefs: 00B63A32
IsWow64Process, xrefs: 00B63AC9
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00B63864
ReleaseId, xrefs: 00B639E0
CurrentMajorVersionNumber, xrefs: 00B638AA
CurrentVersion, xrefs: 00B638F8
CurrentMinorVersionNumber, xrefs: 00B638C9
CurrentBuildNumber, xrefs: 00B6396D
kernel32, xrefs: 00B63ACE

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: QueryValue$AddressCloseCurrentHandleModuleOpenProcProcess
String ID: CSDVersion$CurrentBuildNumber$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$IsWow64Process$ReleaseId$Software\Microsoft\Windows NT\CurrentVersion$kernel32
API String ID: 3667490055-3583743485
Opcode ID: 9e690d37cdad2f4e1296fd9769aaf49a3a5debce1e33f1b7449a11e2b3eb334a
Instruction ID: 869b48dc23429ee46b2f5e00a74162b6139d989eec83c783e9fe63e4a61c36a0
Opcode Fuzzy Hash: 9e690d37cdad2f4e1296fd9769aaf49a3a5debce1e33f1b7449a11e2b3eb334a
Instruction Fuzzy Hash: 6F916FB19017589EDB20CF10CC45BA9B7F5EB45B11F0002E6E909A7290EB769B94CF60

Function 00B998F0 Relevance: 30.1, APIs: 9, Strings: 8, Instructions: 321COMMON

Download Yara Rule

Strings

txt, xrefs: 00B999C3
ps1, xrefs: 00B99996, 00B999A8, 00B999B2
Unable to retrieve exit code from process., xrefs: 00B99C6F
Unable to get a temp file for script output, temp path: , xrefs: 00B999FD
Unable to retrieve PowerShell output from file: , xrefs: 00B99C4C
powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new, xrefs: 00B99A4D
Unable to create process: , xrefs: 00B99AF2
Unable to find file , xrefs: 00B99923

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID: Unable to create process: $Unable to find file $Unable to get a temp file for script output, temp path: $Unable to retrieve PowerShell output from file: $Unable to retrieve exit code from process.$powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new$ps1$txt
API String ID: 0-4129021124
Opcode ID: 61bde506dd982df484f0b8a66da7961c134383821611fd935a9118f69d9ce4d3
Instruction ID: 46d9e4f22e7ac30a42182f547f839e8e9740710d317f297766a4d5626a419513
Opcode Fuzzy Hash: 61bde506dd982df484f0b8a66da7961c134383821611fd935a9118f69d9ce4d3
Instruction Fuzzy Hash: C5C1BC70D01649ABDF10DBA8CD45BAEBBF8FF19310F1082A9F515AB291DB749A01CB91

Function 00A48CF0 Relevance: 25.0, APIs: 13, Strings: 1, Instructions: 462stringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32(?,#32770), ref: 00A48DF7

Strings

#32770, xrefs: 00A48DEE

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: lstrcmp
String ID: #32770
API String ID: 1534048567-463685578
Opcode ID: bf1ba7835bb9fcb15fc267a51b6580754002118485bdf04367b6a97d97e1831e
Instruction ID: e5b66707dae6a2e6714f1523cf29cdd6398c834dae9f6ae63755e8f1161d75d1
Opcode Fuzzy Hash: bf1ba7835bb9fcb15fc267a51b6580754002118485bdf04367b6a97d97e1831e
Instruction Fuzzy Hash: B4027E74A00309EFDB14CFA8D948BAEBBF5FF89714F144559F805AB290DB79A944CB20

Function 00A3EEB0 Relevance: 25.0, APIs: 8, Strings: 6, Instructions: 455libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,2BB8795F,000000B4,?), ref: 00A3EF30
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00A3EF36
LoadLibraryW.KERNEL32(combase.dll,CoIncrementMTAUsage,?,?,?,?,?,?,?,?,?,?,?,?,2BB8795F,00C47765), ref: 00A3EF6C
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00A3EF72

Strings

combase.dll, xrefs: 00A3EF2B, 00A3EF67
CoIncrementMTAUsage, xrefs: 00A3EF62
RoGetActivationFactory, xrefs: 00A3EF26
Windows.Foundation.Uri, xrefs: 00A3F35A
.dll, xrefs: 00A3F084
DllGetActivationFactory, xrefs: 00A3F0E0

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$Windows.Foundation.Uri$combase.dll
API String ID: 2574300362-3956872289
Opcode ID: 5745c8f5e9e15bb111750f20ab762c3cafc1d5c63b1b6258dae84d6ea5bfd5ec
Instruction ID: c2f9bd45e6302e08277e57371aea90d4f7fe0cb554e51d05af565fdf828f7c64
Opcode Fuzzy Hash: 5745c8f5e9e15bb111750f20ab762c3cafc1d5c63b1b6258dae84d6ea5bfd5ec
Instruction Fuzzy Hash: 2F027B71D10209EFDB14DFA8D945BAEBBB4FF08714F204229F915A7390EB74AA44CB90

Function 00B6A450 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(00000007,000001F6), ref: 00B6A49E
GetDlgItem.USER32(00000007,000001F8), ref: 00B6A4AB
GetDlgItem.USER32(00000007,000001F7), ref: 00B6A4ED
SetWindowTextW.USER32(00000000,?), ref: 00B6A4FC
ShowWindow.USER32(?,00000005), ref: 00B6A562
GetDlgItem.USER32(00000007,000001F7), ref: 00B6A584
SetWindowTextW.USER32(00000000,?), ref: 00B6A593
ShowWindow.USER32(?,00000000), ref: 00B6A5F8
ShowWindow.USER32(?,00000000), ref: 00B6A5FF
SetWindowPos.USER32(00000007,00000000,00000000,00000000,?,?,00000616), ref: 00B6A648
GetDlgItem.USER32(?,00000000), ref: 00B6A67A
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000014,?,00000000,?,?,00000616), ref: 00B6A6D1

Strings

Details >>, xrefs: 00B6A56B
Details <<, xrefs: 00B6A4D4

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Window$Item$Show$Text
String ID: Details <<$Details >>
API String ID: 2476474966-3763984547
Opcode ID: 1bff7e32babab027c3d12649d5047997eb9dce8578a3a9abb993fdce1810b332
Instruction ID: 7379adbd7f37a3e9cfb79d3512d9be405efe141b1b7ad4e64d2600096012095c
Opcode Fuzzy Hash: 1bff7e32babab027c3d12649d5047997eb9dce8578a3a9abb993fdce1810b332
Instruction Fuzzy Hash: DB91AC71D00209ABDF049F68DD85BAEBBB5FF58310F148259F801B7690DB34A990DFA1

Function 00B7C230 Relevance: 21.4, APIs: 4, Strings: 8, Instructions: 439COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,2BB8795F,?), ref: 00B7C299
IsWow64Process.KERNEL32(00000000), ref: 00B7C2A0

Part of subcall function 00B5DE10: _wcsrchr.LIBVCRUNTIME ref: 00B5DE49

_wcsrchr.LIBVCRUNTIME ref: 00B7C321
_wcsrchr.LIBVCRUNTIME ref: 00B7C3B7

Strings

/p //, xrefs: 00B7C461
"%s" , xrefs: 00B7C55D
TRANSFORMS=":%d", xrefs: 00B7C410
EXE_CMD_LINE="%s ", xrefs: 00B7C642
.x64, xrefs: 00B7C302
/fvomus //, xrefs: 00B7C46A, 00B7C4BF, 00B7C4C0
/i //, xrefs: 00B7C46F
%s AI_SETUPEXEPATH="%s" SETUPEXEDIR="%s", xrefs: 00B7C5EF

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: _wcsrchr$Process$CurrentWow64
String ID: "%s" $ /fvomus //$ /i //$ /p //$ EXE_CMD_LINE="%s "$ TRANSFORMS=":%d"$%s AI_SETUPEXEPATH="%s" SETUPEXEDIR="%s"$.x64
API String ID: 657290924-2074823060
Opcode ID: fa83cce3af9bc2860f92b7f244cfb8fcb3c6644b6148b85a475340496a1f75ab
Instruction ID: 60b7187addb5ac97f5ea0ef384706c656c15ec481f39734ed4fb8287e9223eae
Opcode Fuzzy Hash: fa83cce3af9bc2860f92b7f244cfb8fcb3c6644b6148b85a475340496a1f75ab
Instruction Fuzzy Hash: 6BF1C131A006459FDB04DF68C955BAEBBF4FF05311F1482ADE829AB292DB74ED04CB91

Function 00A6E610 Relevance: 21.4, APIs: 4, Strings: 8, Instructions: 358libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,00000043), ref: 00A6E738
GetProcAddress.KERNEL32(00000000,InitializeEmbeddedUI), ref: 00A6E751
GetProcAddress.KERNEL32(00000043,ShutdownEmbeddedUI), ref: 00A6E75D
GetProcAddress.KERNEL32(00000043,EmbeddedUIHandler), ref: 00A6E76A

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

Strings

SELECT `Data` FROM `Binary` WHERE `Name` = 'InstallerAnalytics.dll', xrefs: 00A6E699
build , xrefs: 00A6E85F
21.0.1, xrefs: 00A6E84A
ShutdownEmbeddedUI, xrefs: 00A6E753
EmbeddedUIHandler, xrefs: 00A6E75F
INAN, xrefs: 00A6E645
2178626c, xrefs: 00A6E86E
InitializeEmbeddedUI, xrefs: 00A6E74B

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AddressProc$Heap$AllocateLibraryLoadProcess
String ID: build $21.0.1$2178626c$EmbeddedUIHandler$INAN$InitializeEmbeddedUI$SELECT `Data` FROM `Binary` WHERE `Name` = 'InstallerAnalytics.dll'$ShutdownEmbeddedUI
API String ID: 230625546-3827178392
Opcode ID: 7194cf477b22b51cf111f14487d30303cd7da8c5904611c69dc75bb3df2d46b5
Instruction ID: b51359c17311003868a2c3348caff831c94935af18aaf71e61f323d21b5279ba
Opcode Fuzzy Hash: 7194cf477b22b51cf111f14487d30303cd7da8c5904611c69dc75bb3df2d46b5
Instruction Fuzzy Hash: E0D1A075E002099FDB04DFA8CD45BEEBBB4FF18310F144669E915AB391EB74AA44CB90

Function 00A3F7C0 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 270libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,2BB8795F,00000000,?,?,?,?,?,?,?,?,?,?,?,2BB8795F), ref: 00A3F83B
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00A3F841
LoadLibraryW.KERNEL32(?,.dll,-00000001,00000000,00CCF96C,00000000,00000000,00000000), ref: 00A3F9DB

Strings

combase.dll, xrefs: 00A3F836, 00A3F8D5
CoIncrementMTAUsage, xrefs: 00A3F8D0
RoGetActivationFactory, xrefs: 00A3F831
.dll, xrefs: 00A3F9C2
DllGetActivationFactory, xrefs: 00A3FA1E

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: LibraryLoad$AddressProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll
API String ID: 1469910268-2454113998
Opcode ID: 4e3d4afcfa27c546e9eddaaa9f3b4beb775c65c320ea30c05a3918597b84e40f
Instruction ID: f0693d6c438a8de22ee26d02dab32bdcc6070f0403f5a68ed841ccd5aea83b54
Opcode Fuzzy Hash: 4e3d4afcfa27c546e9eddaaa9f3b4beb775c65c320ea30c05a3918597b84e40f
Instruction Fuzzy Hash: 26B15B71D10209EFDB14DFA8D895BAEFBB5FF58310F248529F815A72A0DB709944CB90

Function 00B602B0 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 443registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\JavaSoft\Java Development Kit\,00000000,?,?,2BB8795F,?,?), ref: 00B60313
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?), ref: 00B60497
RegQueryValueExW.ADVAPI32(?,JavaHome,00000000,00000000,00000000,?,?,?,?), ref: 00B604F3
RegQueryValueExW.ADVAPI32(?,JavaHome,00000000,00000000,00000000,?), ref: 00B60543
RegCloseKey.ADVAPI32(?), ref: 00B60583
RegCloseKey.ADVAPI32(?,?), ref: 00B6088B

Part of subcall function 00A3A2F0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,80070057,8007000E,80004005,00A52BE4,00000000,?,?,?,*.*), ref: 00A3A313

RegCloseKey.ADVAPI32(?,?,?,?), ref: 00B608C8
RegCloseKey.ADVAPI32(?), ref: 00B60953

Strings

Software\JavaSoft\Java Development Kit\, xrefs: 00B60305, 00B6030D
Software\JavaSoft\Java Runtime Environment\, xrefs: 00B602F6
JavaHome, xrefs: 00B604ED, 00B60538

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Close$OpenQueryValue$FindResource
String ID: JavaHome$Software\JavaSoft\Java Development Kit\$Software\JavaSoft\Java Runtime Environment\
API String ID: 2031014976-1079072530
Opcode ID: 42767f1c004f480bd36d4623f329588262a9a4a4dbbee61563b64eb1ce639dd1
Instruction ID: f02a12112656b745990aaa34df3c52a09157b63b8299669a38eba13a9133944b
Opcode Fuzzy Hash: 42767f1c004f480bd36d4623f329588262a9a4a4dbbee61563b64eb1ce639dd1
Instruction Fuzzy Hash: 7B0284719112699FDF20EB29CD48B9EB7F5EF54304F1042D9E809A7291DB78AE84CF50

Function 00B6CC20 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 410libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00B897D0: GetSystemDefaultLangID.KERNEL32(2BB8795F,0000004C,?,00000048,?), ref: 00B89806

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2,?,?,?,?,00000000), ref: 00B6CD83
GetProcAddress.KERNEL32(00000000), ref: 00B6CD8A
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000000), ref: 00B6CDC0

Strings

Undefined, xrefs: 00B6D05A
No acceptable version found., xrefs: 00B6D073, 00B6D074
Searching for:, xrefs: 00B6CE79
Search result:, xrefs: 00B6CFF9
Wrong OS or Os language for:, xrefs: 00B6D0EB
kernel32, xrefs: 00B6CD7E
IsWow64Process2, xrefs: 00B6CD79

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AddressCurrentDefaultHandleLangModuleProcProcessSystem
String ID: IsWow64Process2$No acceptable version found.$Search result:$Searching for:$Undefined$Wrong OS or Os language for:$kernel32
API String ID: 323535258-4160927586
Opcode ID: e4cbd588acfc6e0431654df701c4057585f6361db3f1a5243a12fbf600a101fb
Instruction ID: e572ad3344a8b0c9a1629d1febfcbbea2c93ea7cb426dc8e972eb2cf4b50b029
Opcode Fuzzy Hash: e4cbd588acfc6e0431654df701c4057585f6361db3f1a5243a12fbf600a101fb
Instruction Fuzzy Hash: 6AF1D570E00604DFCB20DFA8C984BAEBBF1FF45314F1482A9E455AB291DB79AD46CB50

Function 00A68440 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 229windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00A685CB
SendMessageW.USER32(00000000,00000439,00000000,0000002C), ref: 00A685DF
SendMessageW.USER32(00000000,00000421,00000003,?), ref: 00A685F4
SendMessageW.USER32(00000000,00000418,00000000,0000012C), ref: 00A68609
SendMessageW.USER32(?,000000D6,-00000001,00000000), ref: 00A68620

Part of subcall function 00A48400: SetWindowLongW.USER32(?,000000FC,00000000), ref: 00A48436

GetWindowRect.USER32(?,?), ref: 00A68652
SendMessageW.USER32(00000000,00000412,00000000), ref: 00A686B4
SendMessageW.USER32(00000000,00000411,00000001,0000002C), ref: 00A686C4

Strings

tooltips_class32, xrefs: 00A684C2
,, xrefs: 00A6857A

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: MessageSend$Window$LongRect
String ID: ,$tooltips_class32
API String ID: 3777635722-3856767331
Opcode ID: 83ca72faa38c9d85cc96922929ad97d91124acd2df76fd2aa56f7a8ff4c02a2c
Instruction ID: 1a61ed24cf3b2b9dccc638091130d7547cb312eea26715bc2f801e1e5e614f69
Opcode Fuzzy Hash: 83ca72faa38c9d85cc96922929ad97d91124acd2df76fd2aa56f7a8ff4c02a2c
Instruction Fuzzy Hash: 63914271A00318AFDB14CFA4CD95BAEBBF9FF08301F14452AF956EA290DB74A904CB50

Function 00B6A140 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 132windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B61850: LoadLibraryW.KERNEL32(ComCtl32.dll,2BB8795F,?,?,00000000), ref: 00B6188E
Part of subcall function 00B61850: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00B618B1
Part of subcall function 00B61850: FreeLibrary.KERNEL32(00000000), ref: 00B6192F

GetDlgItem.USER32(?,000001F4), ref: 00B6A181
SendMessageW.USER32(00000000,00000170,00000000,00000000), ref: 00B6A192
MulDiv.KERNEL32(00000009,00000000), ref: 00B6A1AA
GetDlgItem.USER32(?,000001F6), ref: 00B6A1E4
SendMessageW.USER32(00000000,00000030,?,00000000), ref: 00B6A204
GetDlgItem.USER32(?,000001F8), ref: 00B6A20E
GetWindowRect.USER32(?,?), ref: 00B6A21F
GetWindowRect.USER32(?,?), ref: 00B6A232
GetWindowRect.USER32(00000000,?), ref: 00B6A242

Strings

Courier New, xrefs: 00B6A1B0

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ItemRectWindow$LibraryMessageSend$AddressFreeLoadProc
String ID: Courier New
API String ID: 2386506630-2572734833
Opcode ID: 66ea72d523916720d943cbaf15e49318721c80a7662efdb7fd135cf48dab55bb
Instruction ID: 9932a42f720300e421b2dc69c7c5b961f2a7d91f673448eeb75c7811e9d5e251
Opcode Fuzzy Hash: 66ea72d523916720d943cbaf15e49318721c80a7662efdb7fd135cf48dab55bb
Instruction Fuzzy Hash: 53419271B803087FEB149F25CC42FAE76E9EF49B05F010529FB09BA2C1DAB5AC408B55

Function 00B92BA0 Relevance: 16.7, APIs: 11, Instructions: 192fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00D5D6E0,2BB8795F,?,00000010), ref: 00B92BDC

Part of subcall function 00A3A2F0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,80070057,8007000E,80004005,00A52BE4,00000000,?,?,?,*.*), ref: 00A3A313

EnterCriticalSection.KERNEL32(00000010,2BB8795F,?,00000010), ref: 00B92BE9
WriteFile.KERNEL32(00000000,?,?,000000FF,00000000), ref: 00B92C1B
FlushFileBuffers.KERNEL32(00000000,?,?,000000FF,00000000), ref: 00B92C24
WriteFile.KERNEL32(00000000,00B88897,D6E0B9EC,00C94BED,00000000,00CCF93C,00000001,?,?,000000FF,00000000), ref: 00B92CA6
FlushFileBuffers.KERNEL32(00000000,?,?,000000FF,00000000), ref: 00B92CAF
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 00B92CE5
FlushFileBuffers.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 00B92CEE
WriteFile.KERNEL32(00000000,?,?,?,00000000,00CD28AC,00000002,?,?,?,00000000,?,?,000000FF,00000000), ref: 00B92D4F
FlushFileBuffers.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 00B92D58
LeaveCriticalSection.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 00B92D88

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: File$BuffersFlushWrite$CriticalSection$AllocateEnterFindHeapInitializeLeaveResource
String ID:
API String ID: 201293332-0
Opcode ID: f6da5ca04781aa28e67a737a4f9ef0edc4f020f922d67859e567cfe42a89bcea
Instruction ID: 8524c21d5a8a589e0542a7622a6541e66dbbbdd5d14a6bd4f7f2044f7e7d1057
Opcode Fuzzy Hash: f6da5ca04781aa28e67a737a4f9ef0edc4f020f922d67859e567cfe42a89bcea
Instruction Fuzzy Hash: FB619B71901644EFEB00DF68CD49BAEBBB4FF15314F1481A8F855A72A2DB70AD14DBA0

Function 00B940F0 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 302libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00B19F70: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00B19FB1

GetLastError.KERNEL32(2BB8795F,?,?,?,00C94FFD,000000FF,?,00B76122,?), ref: 00B9415D
GetProcAddress.KERNEL32(00000000,GetPackagePath), ref: 00B942ED
GetProcAddress.KERNEL32(00000000,GetPackagePath), ref: 00B94346
FreeLibrary.KERNEL32(00000000,?,?,?,?,00C94FFD,000000FF,?,00B76122,?), ref: 00B94434

Strings

Kernel32.dll, xrefs: 00B94131
GetPackagePath, xrefs: 00B942E7, 00B94340
x64, xrefs: 00B941D6
x86, xrefs: 00B941A5
neutral, xrefs: 00B941F2

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AddressProc$DirectoryErrorFreeLastLibrarySystem
String ID: GetPackagePath$Kernel32.dll$neutral$x64$x86
API String ID: 2155880084-4043905686
Opcode ID: 1a23e003fe1654a2bb0824330d0794e1b610bb57c5063d633f0d1cf8320a6991
Instruction ID: e275d6c6e01a531c50ed70539ffcbfa87a7a0493e5e6b77ac1bab7edf65ce194
Opcode Fuzzy Hash: 1a23e003fe1654a2bb0824330d0794e1b610bb57c5063d633f0d1cf8320a6991
Instruction Fuzzy Hash: E6C16870A002199FCF04CFA8C984B9EBBF1FF59314F1481A9E815AB391EB719946CB91

Function 00A46B60 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00D629CC,2BB8795F,00000000,?,?,?,?,?,?,00A4638E,00C4930D,000000FF), ref: 00A46B9D
LoadCursorW.USER32(00000000,00007F00), ref: 00A46C18
LoadCursorW.USER32(00000000,00007F00), ref: 00A46CBE
LeaveCriticalSection.KERNEL32(00D629CC), ref: 00A46D13

Strings

0, xrefs: 00A46CA3
AtlAxWin140, xrefs: 00A46BCF, 00A46C33
WM_ATLGETHOST, xrefs: 00A46BA9
WM_ATLGETCONTROL, xrefs: 00A46BB4
AtlAxWinLic140, xrefs: 00A46C7F, 00A46CD5

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CriticalCursorLoadSection$EnterLeave
String ID: 0$AtlAxWin140$AtlAxWinLic140$WM_ATLGETCONTROL$WM_ATLGETHOST
API String ID: 3727441302-283551416
Opcode ID: 0f6c4f9b5f2f7828d2f64369eec28c8be2b2604b336a9cf6ffe1e3c3937e5ab2
Instruction ID: e6264e18def9d6b7364788546e3a44139fdeda9662559c10064d9abe945d555d
Opcode Fuzzy Hash: 0f6c4f9b5f2f7828d2f64369eec28c8be2b2604b336a9cf6ffe1e3c3937e5ab2
Instruction Fuzzy Hash: 625101B5D50719ABCB00DFA4D944BEEBFB8FB48715F14412BE804A7390D7B55A048FA1

Function 00B697F0 Relevance: 15.2, APIs: 10, Instructions: 151windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00B6982F
GetWindowLongW.USER32(?,000000F0), ref: 00B69840
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B69852
GetWindowLongW.USER32(?,000000EC), ref: 00B69865
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B69874
SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 00B69888
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00B69897
GetWindowRect.USER32(?,?), ref: 00B698D6
GetDlgItem.USER32(?,?), ref: 00B69912
GetWindowRect.USER32(?,?), ref: 00B69938

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Window$Long$MessageRectSend$Item
String ID:
API String ID: 661679956-0
Opcode ID: 1b8d36a4c49c1aa56e477db96a04f4e20eb813fa8fe7b1581136f744e046fb1c
Instruction ID: 9b00786d1f92de8ba34cc6b5963af84d3ff8119e62aecfd6feb5f8cd979fbd66
Opcode Fuzzy Hash: 1b8d36a4c49c1aa56e477db96a04f4e20eb813fa8fe7b1581136f744e046fb1c
Instruction Fuzzy Hash: 76418E715043069FD720DF69DC84B2BB7E8FF99721F104A1EF995D7291DB30A8848B62

Function 00C295C7 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 487COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00C2999F

Strings

f, xrefs: 00C296D9
p, xrefs: 00C29726
p, xrefs: 00C296C4
f, xrefs: 00C296BD
:, xrefs: 00C29692
p, xrefs: 00C296E0
f, xrefs: 00C2971F

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: __aulldiv
String ID: :$f$f$f$p$p$p
API String ID: 3732870572-1434680307
Opcode ID: b04f93f3d4d5a82928cfb366f134e6fb183da4aa5a393462a07fece3aed1a8e0
Instruction ID: cbb5d61c8a6bb2a7b10a6a91ead0cfbdebc7e9e8c7c294a476e090d9de330896
Opcode Fuzzy Hash: b04f93f3d4d5a82928cfb366f134e6fb183da4aa5a393462a07fece3aed1a8e0
Instruction Fuzzy Hash: 09029D79A00128DBDF34DF69F4446EDB7B2FB41B14FA44119E4297BA84D7308E8ACB64

Function 00A44E90 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 265memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00A44ED5
SysAllocString.OLEAUT32(?), ref: 00A44EE9
VariantInit.OLEAUT32(?), ref: 00A44F24
VariantClear.OLEAUT32(?), ref: 00A44F7C
VariantClear.OLEAUT32(?), ref: 00A44F86
VariantClear.OLEAUT32(?), ref: 00A44F90
VariantClear.OLEAUT32(?), ref: 00A44F9D

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

Strings

<body><h3 style="color:green;">Error loading resource:</h3><p style="white-space:nowrap">"%s"</p></body>, xrefs: 00A4501B

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Variant$Clear$AllocAllocateHeapInitString
String ID: <body><h3 style="color:green;">Error loading resource:</h3><p style="white-space:nowrap">"%s"</p></body>
API String ID: 1547307772-1571955069
Opcode ID: 4c6fa0dc40b40d2b2f92acf7102888572d18e8f846950a0febba131fc6e330b2
Instruction ID: 2e46db092f9a1205547f25d3848b90c2f9332a878d197706dbf0bf61d5ffdf4c
Opcode Fuzzy Hash: 4c6fa0dc40b40d2b2f92acf7102888572d18e8f846950a0febba131fc6e330b2
Instruction Fuzzy Hash: 9D917D75D00648DFCB00DFA8C944BEEBBB8FF89324F148259E415E7291DB74AA44CBA0

Function 00B996E0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 180fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

Part of subcall function 00A3A2F0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,80070057,8007000E,80004005,00A52BE4,00000000,?,?,?,*.*), ref: 00A3A313

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,ps1,ps1,00000003,?,00B76948), ref: 00B997D1
WriteFile.KERNEL32(00000000,0000FEFF,00000002,?,00000000), ref: 00B99815
WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 00B99832
CloseHandle.KERNEL32(00000000), ref: 00B9984C
CloseHandle.KERNEL32(00000000,?,?,00000000,00000000), ref: 00B9988B

Strings

Unable to get temp file , xrefs: 00B997B2
Unable to save script file , xrefs: 00B9985B
ps1, xrefs: 00B99749, 00B9975B, 00B99765, 00B99776

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: File$CloseHandleWrite$CreateFindHeapProcessResource
String ID: Unable to get temp file $Unable to save script file $ps1
API String ID: 3201387394-4253966538
Opcode ID: d460b640066cc428ad136933c3277febfac7bd3d56d8dedeb0442d67e97fed9b
Instruction ID: 3a8b59de3a939649d5faf7e125f0f64de9c302bd1d3e65ed620f46e031d2e6f2
Opcode Fuzzy Hash: d460b640066cc428ad136933c3277febfac7bd3d56d8dedeb0442d67e97fed9b
Instruction Fuzzy Hash: 0951B370A01249AFDF10DFA8CD45BAEBBB8EF05314F1441ACE511AB2C2D7749D05CBA1

Function 00A3D430 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 157processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 00A3D538
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 00A3D542
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 00A3D551
GetExitCodeProcess.KERNEL32(?,?), ref: 00A3D56E
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 00A3D578
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 00A3D585
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000044,?), ref: 00A3D58F

Strings

"%s" %s, xrefs: 00A3D4C0

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ErrorLastProcess$CloseCodeCreateExitHandleHeapObjectSingleWait
String ID: "%s" %s
API String ID: 3234789809-1070868581
Opcode ID: be145b7c0461f224a7c77e768961c77f339176601029ad83783331073b897168
Instruction ID: 649f532b2d882aa05d0a8015cdfd35ccc634bd587409dd96e8c1d0d01947d7c2
Opcode Fuzzy Hash: be145b7c0461f224a7c77e768961c77f339176601029ad83783331073b897168
Instruction Fuzzy Hash: B351C471A00205DFDB20CF65EC04BAEBBB9FF85729F244629F425A7290D774AD45CBA0

Function 00B88910 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 148libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDefaultLangID.KERNEL32 ref: 00B8894C
GetUserDefaultLangID.KERNEL32 ref: 00B88959
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00B8896B
GetProcAddress.KERNEL32(00000000,GetSystemDefaultUILanguage), ref: 00B8897F
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 00B88994

Strings

GetUserDefaultUILanguage, xrefs: 00B8898E
kernel32.dll, xrefs: 00B88962
GetSystemDefaultUILanguage, xrefs: 00B88979

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AddressDefaultLangProc$LibraryLoadSystemUser
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll
API String ID: 667524283-3528650308
Opcode ID: 709fd8972adbc6de1ca2abd16e027fb5d793d09ddfa3f79292aa160b807db0a0
Instruction ID: 78ce54fa58fe582e31e92857261a574dc84597b526343e6ce9cd73ea0910fda2
Opcode Fuzzy Hash: 709fd8972adbc6de1ca2abd16e027fb5d793d09ddfa3f79292aa160b807db0a0
Instruction Fuzzy Hash: FF419E706043419FCB54EF28E85067EB7E1EF99354F95186EE889D32A0EB30D944CB52

Function 00C22670 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00C226A7
___except_validate_context_record.LIBVCRUNTIME ref: 00C226AF
_ValidateLocalCookies.LIBCMT ref: 00C22738
__IsNonwritableInCurrentImage.LIBCMT ref: 00C22763
_ValidateLocalCookies.LIBCMT ref: 00C227B8
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00C227CE
___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00C227E3

Strings

csm, xrefs: 00C2274D

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record___vcrt_initialize_locks___vcrt_uninitialize_locks
String ID: csm
API String ID: 1385549066-1018135373
Opcode ID: eafe6e11fed13ae304361b09e6a9a704c2b4cb35a3dc7569fc80f0a5e9e1d992
Instruction ID: 94b9a0e08e407b296d1867ed7c088cbf7e1178334e6b594fb8c3fd60c8a83cb5
Opcode Fuzzy Hash: eafe6e11fed13ae304361b09e6a9a704c2b4cb35a3dc7569fc80f0a5e9e1d992
Instruction Fuzzy Hash: 1D412234A00228ABCF00EF68E884A9EBBB0EF45714F108095FC246B792C7759B49DB91

Function 00A790B0 Relevance: 13.9, APIs: 9, Instructions: 433memorysynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

CreateThread.KERNEL32(00000000,00000000,00A791F0,00CD4900,00000000,2BB8795F), ref: 00A7915F
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00A79178
CloseHandle.KERNEL32(00000000), ref: 00A7918E
CoInitializeEx.COMBASE(00000000,00000000), ref: 00A79249
GetProcessHeap.KERNEL32(?,00000000), ref: 00A7934B
HeapFree.KERNEL32(00000000,?,00000000), ref: 00A79351
GetProcessHeap.KERNEL32(?,00000000), ref: 00A793CA
HeapFree.KERNEL32(00000000,?,00000000), ref: 00A793D0
CoUninitialize.COMBASE ref: 00A79527

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Heap$Process$Free$CloseCreateHandleInitializeObjectSingleThreadUninitializeWait
String ID:
API String ID: 661592132-0
Opcode ID: 3b09cbe403de0ff9fc496e2de6f1c46ee369c57f280b1ccf95368c47a659bd49
Instruction ID: 26952d5e3bebada8caa5f0b88e0b89c9fa250f6fed6caf8fe8d574cdeb1b30b5
Opcode Fuzzy Hash: 3b09cbe403de0ff9fc496e2de6f1c46ee369c57f280b1ccf95368c47a659bd49
Instruction Fuzzy Hash: A6026D70D00219DFDB14CFA8C945BEEBBB8FF45304F20816EE419AB291DB749A49DB90

Function 00B68590 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 290fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,2BB8795F,00000000,00000000,?), ref: 00B685EB
GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?,?,00000000,00000000), ref: 00B6877D
Wow64DisableWow64FsRedirection.KERNEL32(00000000,?,?,00000000,00000000), ref: 00B68817
CopyFileW.KERNEL32(?,?,00000000,?,?,00000000,00000000), ref: 00B68839
Wow64RevertWow64FsRedirection.KERNEL32(00000000,?,?,00000000), ref: 00B68865
DeleteFileW.KERNEL32(?,2BB8795F,00000000,00000000,00C45D70,000000FF,?,80070057,80004005,?), ref: 00B6891D

Strings

shim_clone, xrefs: 00B68777

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Wow64$File$Redirection$CopyDeleteDisableFolderNamePathRevertTemp
String ID: shim_clone
API String ID: 3507832535-3944563459
Opcode ID: 3e9e2d3fcb589d11fb30df7762520768ae10f797b5d0a8555a483ed36e51b7e7
Instruction ID: 77eed742b5edb766aa1aa9a18368b45d2573b462caa42fa6f6e1605a7b643a53
Opcode Fuzzy Hash: 3e9e2d3fcb589d11fb30df7762520768ae10f797b5d0a8555a483ed36e51b7e7
Instruction Fuzzy Hash: AAA1F370A002589FDB24DB24CC45BBAB7F5EF45310F5442EDE90AA7292EF38AE44CB55

Function 00A32830 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00D5D69C,00000000,2BB8795F,00000000,00C86663,000000FF,?,2BB8795F), ref: 00A329A3
GetLastError.KERNEL32(?,2BB8795F), ref: 00A329AD

Strings

VolumeCostSize, xrefs: 00A32867
VolumeCostAvailable, xrefs: 00A32870
VolumeCostRequired, xrefs: 00A32879
VolumeCostDifference, xrefs: 00A32883
VolumeCostVolume, xrefs: 00A3285D, 00A32915

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpin
String ID: VolumeCostAvailable$VolumeCostDifference$VolumeCostRequired$VolumeCostSize$VolumeCostVolume
API String ID: 439134102-34576578
Opcode ID: ca5f97e5fdc012ec189bc38950b0f9562f68cb56a6a56f33e7fc64e712b0b888
Instruction ID: d87b28a6cb5ed5c1656e65d326c8f10680836435cf55039ecf30211a6929716f
Opcode Fuzzy Hash: ca5f97e5fdc012ec189bc38950b0f9562f68cb56a6a56f33e7fc64e712b0b888
Instruction Fuzzy Hash: CE51D0B19003099BDB20DF94DC057AEBBF4FB08715F100229E818E7390E775AA089BA1

Function 00BA6DA0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

SHGetSpecialFolderLocation.SHELL32(00000000,00000023,?,?,?,?,00D5D6E0), ref: 00BA6DB0
LoadLibraryW.KERNEL32(Shell32.dll,?,?,00D5D6E0), ref: 00BA6DC3
GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 00BA6DD3
SHGetPathFromIDListW.SHELL32(?,00000000), ref: 00BA6E5C
SHGetMalloc.SHELL32(?), ref: 00BA6E9E

Strings

Shell32.dll, xrefs: 00BA6DBE
SHGetSpecialFolderPathW, xrefs: 00BA6DCD

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AddressFolderFromLibraryListLoadLocationMallocPathProcSpecial
String ID: SHGetSpecialFolderPathW$Shell32.dll
API String ID: 2352187698-2988203397
Opcode ID: 9db115675bb813250c3d8a6eed72fd90e7af992eb0d8b5f8e908207adc3ca61a
Instruction ID: a2ba8211c0da0e3b90915ce242c4eccf2f122717cd1a24715d2d05795b5d23cc
Opcode Fuzzy Hash: 9db115675bb813250c3d8a6eed72fd90e7af992eb0d8b5f8e908207adc3ca61a
Instruction Fuzzy Hash: A231F4B66007019BDB249F34DC05BABBBF5EF95711F08C86CE885C7290FB7198858B91

Function 00B9EC10 Relevance: 12.3, APIs: 8, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1d80c8b6b592142cb24d243ef4fc139ccdd5a7e2c875ab9f637de3969719f74
Instruction ID: 1d158219c48305bfbaee5e7182c1bdec9a3cf46f09c333f43d6d7d0c168bbfd5
Opcode Fuzzy Hash: d1d80c8b6b592142cb24d243ef4fc139ccdd5a7e2c875ab9f637de3969719f74
Instruction Fuzzy Hash: C9A1D171600704ABDF10EF64DC89BAABBE4EF58721F1041BAF915EB291DB75D800CBA1

Function 00A41070 Relevance: 12.2, APIs: 8, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00A41164
SysFreeString.OLEAUT32(00000000), ref: 00A411D9
GetProcessHeap.KERNEL32(-000000F3,?,?), ref: 00A41249
HeapFree.KERNEL32(00000000,-000000F3,?,?), ref: 00A4124F
GetProcessHeap.KERNEL32(-000000F3,00000000,00000000,00000000,00000000,00000000,2BB8795F,?,00000001,?), ref: 00A4127C
HeapFree.KERNEL32(00000000,-000000F3,00000000,00000000,00000000,00000000,00000000,2BB8795F,?,00000001,?), ref: 00A41282
SysFreeString.OLEAUT32(00000000), ref: 00A4129A
SysFreeString.OLEAUT32(?), ref: 00A4133B

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Free$HeapString$Process
String ID:
API String ID: 1565486995-0
Opcode ID: 709e1618aed29a8407f09f20fa0c3c7e15f8b5812bd9dc64e555598aec2d508f
Instruction ID: c875c358471f6a8ceab52853c7ee6143174431199e4c66c3a66d272a35e13516
Opcode Fuzzy Hash: 709e1618aed29a8407f09f20fa0c3c7e15f8b5812bd9dc64e555598aec2d508f
Instruction Fuzzy Hash: 02A16974D00219DFDB10DFA8C945BEEBBB8EF45310F244669E410A72C1DBB8AE44DBA1

Function 00AAEF90 Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000F0), ref: 00AAEFD7
GetWindow.USER32(00000000,00000004), ref: 00AAEFFA
GetWindowRect.USER32(00000000,?), ref: 00AAF00B
GetWindowLongW.USER32(00000000,000000F0), ref: 00AAF01E
MonitorFromWindow.USER32(00000000,00000002), ref: 00AAF036
GetMonitorInfoW.USER32(00000000,?), ref: 00AAF04C
GetWindowRect.USER32(00000000,?), ref: 00AAF072
SetWindowPos.USER32(?,00000000,?,?,000000FF,000000FF,00000015), ref: 00AAF12F

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Window$LongMonitorRect$FromInfo
String ID:
API String ID: 2882702216-0
Opcode ID: 9c5dae79ed0e66fb562699d58993746f691ce588838998c8dba7c804e0fb4fe0
Instruction ID: bc9aa0e08846fc13d136f4e4b4a742912a27ed7b9f12d31fa2b4627c69b86c7c
Opcode Fuzzy Hash: 9c5dae79ed0e66fb562699d58993746f691ce588838998c8dba7c804e0fb4fe0
Instruction Fuzzy Hash: 59516272D002199FDB24CFA8CD49A9EBBB5FF49721F244229E815F7295EB30AD04CB50

Function 00A511C0 Relevance: 12.1, APIs: 8, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A511EA
GetWindow.USER32(?,00000005), ref: 00A511F7
GetWindow.USER32(00000000,00000002), ref: 00A51332

Part of subcall function 00A51040: GetWindowRect.USER32(?,?), ref: 00A5106C
Part of subcall function 00A51040: GetWindowRect.USER32(?,?), ref: 00A5107C

GetWindowRect.USER32(?,?), ref: 00A5128B
GetWindowRect.USER32(00000000,?), ref: 00A5129B
GetWindowRect.USER32(00000000,?), ref: 00A512B5

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Window$Rect
String ID:
API String ID: 3200805268-0
Opcode ID: 9d2c778b53dbed5e3a7f43dc63d8405142271f1cbef27ace053b7ed6e3e5254e
Instruction ID: 9315ebcf7985d70c927996c0b9b2c9f385960e02e43e13965f68e138d9e5dcf4
Opcode Fuzzy Hash: 9d2c778b53dbed5e3a7f43dc63d8405142271f1cbef27ace053b7ed6e3e5254e
Instruction Fuzzy Hash: E6419A305047019BC321DB29C990ABBF7FABF96705F504A2DF89597961EB30E988CB52

Function 00C1E473 Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00C1E61D,?,?,?), ref: 00C1E497
HeapAlloc.KERNEL32(00000000,?,00C1E61D,?,?,?), ref: 00C1E49E

Part of subcall function 00C1E569: IsProcessorFeaturePresent.KERNEL32(0000000C,00C1E485,00000000,?,00C1E61D,?,?,?), ref: 00C1E56B

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,00C1E61D,?,?,?), ref: 00C1E4AE
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00C1E61D,?,?,?), ref: 00C1E4D5
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,00C1E61D,?,?,?), ref: 00C1E4E9
InterlockedPopEntrySList.KERNEL32(00000000,?,00C1E61D,?,?,?), ref: 00C1E4FC
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00C1E61D,?,?,?), ref: 00C1E50F

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
String ID:
API String ID: 2460949444-0
Opcode ID: d13bbb1ec162878d3dd71e5d9048b1993b9cc6411ea1cbb7582fdd1dad1cbf98
Instruction ID: 0edf28e76c2945d6eb373e06f17156fdf70fda2be8de544ce19b24793ccd7de1
Opcode Fuzzy Hash: d13bbb1ec162878d3dd71e5d9048b1993b9cc6411ea1cbb7582fdd1dad1cbf98
Instruction Fuzzy Hash: B9110471600325ABD33117A4AD48FEF3359EF4B799F104521FE11E7251EB24CD4466B0

Function 00B94470 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 324synchronizationfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

DeleteFileW.KERNEL32(?,?,?,?,00000000,?,?,?,?), ref: 00B94782

Part of subcall function 00A3A2F0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,80070057,8007000E,80004005,00A52BE4,00000000,?,?,?,*.*), ref: 00A3A313

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

ResetEvent.KERNEL32(00000000,2BB8795F,?,?,00000000,00C9510D,000000FF,?,80004005), ref: 00B9481F
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00C9510D,000000FF,?,80004005), ref: 00B9483F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000000,00C9510D,000000FF,?,80004005), ref: 00B9484A

Strings

TEST, xrefs: 00B945CD
tin9999.tmp, xrefs: 00B945D4

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: HeapObjectSingleWait$AllocateDeleteEventFileFindProcessResetResource
String ID: TEST$tin9999.tmp
API String ID: 1604106433-3424081289
Opcode ID: f4826c6d79e6abfac9c6f754dfc29ab8f1d8663e7ab918c66c0cdcda6441b959
Instruction ID: 066696493b23700577aeedba0576505db3f2429f75765d3d05bd12969fdabedd
Opcode Fuzzy Hash: f4826c6d79e6abfac9c6f754dfc29ab8f1d8663e7ab918c66c0cdcda6441b959
Instruction Fuzzy Hash: 71C1CF71900249DFDF20DF68CD55BEEB7E8FF05320F1082A9E81A9B291DB749A05CB91

Function 00B87370 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 231fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00B8753E
SetFilePointer.KERNEL32(?,7FFFFFFF,00000000,00000000,?), ref: 00B8759D
SetEndOfFile.KERNEL32(?), ref: 00B875A6
CloseHandle.KERNEL32(?), ref: 00B875BF

Strings

%sholder%d.aiph, xrefs: 00B8751A
Not enough disk space to extract file:, xrefs: 00B8743A

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: File$CloseCreateHandlePointer
String ID: %sholder%d.aiph$Not enough disk space to extract file:
API String ID: 22866420-929304071
Opcode ID: a89e4c21cacace82af71817f2feb6dc4194f693eac6762a942951688b311009e
Instruction ID: f5884b00d65c898c9fec2f72c772ee8014a5776345336e3ab1591b282a5c1be2
Opcode Fuzzy Hash: a89e4c21cacace82af71817f2feb6dc4194f693eac6762a942951688b311009e
Instruction Fuzzy Hash: 7B819F75A402099FDB10EF68CC45B9EBBE4FF54324F284699ED25A73A1DB31E904CB90

Function 00A48460 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 194comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00CD1C8C,00000000,00000001,00CD2314,?), ref: 00A48530

Strings

{, xrefs: 00A48590
:, xrefs: 00A4851A

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CreateInstance
String ID: :${
API String ID: 542301482-3766677574
Opcode ID: ef02f9c23fe7aa10206a7925fc9efcf518ed5eb14bbba0212bd2055a302e4f5e
Instruction ID: bfdf0b77c0212b72bc06ee317e82a6887ede18eb5f05519f2822c25652fc75fc
Opcode Fuzzy Hash: ef02f9c23fe7aa10206a7925fc9efcf518ed5eb14bbba0212bd2055a302e4f5e
Instruction Fuzzy Hash: BC61B278A003159BDF249F58E844BBDB7F5AF89B10F24406AE901EB390EB79DD40CB61

Function 00B5E0F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 169fileCOMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32(?,00000000,?,\\?\,00000004,?,?,?,00C86F0D,000000FF,?,00B5E406,?), ref: 00B5E193

Part of subcall function 00A3A2F0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,80070057,8007000E,80004005,00A52BE4,00000000,?,?,?,*.*), ref: 00A3A313

RemoveDirectoryW.KERNEL32(?,2BB8795F,?,?,?,?,00C86F0D,000000FF,?,00B5E406,?,00000000), ref: 00B5E1C2
GetLastError.KERNEL32(?,2BB8795F,?,?,?,?,00C86F0D,000000FF,?,00B5E406,?,00000000), ref: 00B5E1D2
DeleteFileW.KERNEL32(?,00000000,?,\\?\,00000004,?,?,?,00000000,00C86F0D,000000FF,?,80004005,2BB8795F,?), ref: 00B5E2A3
GetLastError.KERNEL32(?,?,?,00000000,00C86F0D,000000FF,?,80004005,2BB8795F,?,?,?,?,00C86F0D,000000FF), ref: 00B5E2E2

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

Strings

\\?\, xrefs: 00B5E154, 00B5E166, 00B5E170, 00B5E264, 00B5E276, 00B5E280

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: DirectoryErrorLastRemove$DeleteFileFindHeapProcessResource
String ID: \\?\
API String ID: 728736790-4282027825
Opcode ID: 4039a948b5717de1bb2824c6b33788e68c416b891d6109a57409a47670a1f09c
Instruction ID: 8756dd26d7096df74acae1139d0d16cf439e13757b0b8bda9c48dfd914670727
Opcode Fuzzy Hash: 4039a948b5717de1bb2824c6b33788e68c416b891d6109a57409a47670a1f09c
Instruction Fuzzy Hash: 4851CD719006149FEB14DFA8C949BAEB7E8FF05322F1046A9FD65E7290DB35DE088B50

Function 00A4E200 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 150fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000,?,2BB87961), ref: 00A4E343
CloseHandle.KERNEL32(00000000), ref: 00A4E3A0

Part of subcall function 00C1EE76: AcquireSRWLockExclusive.KERNEL32(00D5BFA8,?,?,?,00A3ADE6,00D5CBBC,2BB8795F,?,?,00C4629D,000000FF,?,00B9F0FC,2BB8795F,?,?), ref: 00C1EE81
Part of subcall function 00C1EE76: ReleaseSRWLockExclusive.KERNEL32(00D5BFA8,?,00A3ADE6,00D5CBBC,2BB8795F,?,?,00C4629D,000000FF,?,00B9F0FC,2BB8795F,?,?), ref: 00C1EEBB

WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 00A4E407
CloseHandle.KERNEL32(00000000,753CE610), ref: 00A4E42D

Part of subcall function 00C1EE25: AcquireSRWLockExclusive.KERNEL32(00D5BFA8,?,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE2F
Part of subcall function 00C1EE25: ReleaseSRWLockExclusive.KERNEL32(00D5BFA8,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE62
Part of subcall function 00C1EE25: WakeAllConditionVariable.KERNEL32(00D5BFA4,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE6D

Strings

html, xrefs: 00A4E2FC
aix, xrefs: 00A4E301

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ExclusiveLock$AcquireCloseFileHandleRelease$ConditionCreateVariableWakeWrite
String ID: aix$html
API String ID: 3683816281-2369804267
Opcode ID: 639efe0a2a98022d36806588dfa0e32a5b9061ad187255ac9681af179e5d8beb
Instruction ID: f1e0114cb7514e26fd73157390ede1534bd4719c3da48079bee38608f72ee4e1
Opcode Fuzzy Hash: 639efe0a2a98022d36806588dfa0e32a5b9061ad187255ac9681af179e5d8beb
Instruction Fuzzy Hash: B2618BB0900748DFDB20CF98D949BAEBBB4BB45308F104259E411AB391DBF56A49DFA1

Function 00A67040 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 124windowstringCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000043A,00000000,00000074), ref: 00A670B5
lstrcpynW.KERNEL32(?,?,00000020), ref: 00A6712B
MulDiv.KERNEL32(?,00000048,00000000), ref: 00A67168
SendMessageW.USER32(?,00000444,00000000,00000074), ref: 00A6719A

Strings

?, xrefs: 00A6716E
t, xrefs: 00A67176

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: MessageSend$lstrcpyn
String ID: ?$t
API String ID: 3928028829-1995845436
Opcode ID: b2718c57190a6cce6b8f966d8a8822d9ae011fe494222b3cb251114ba02ad604
Instruction ID: 2b3a9fddbaeb5d2b96977c070b8066e3cd7a0ae82f7a72640ca0511967149085
Opcode Fuzzy Hash: b2718c57190a6cce6b8f966d8a8822d9ae011fe494222b3cb251114ba02ad604
Instruction Fuzzy Hash: 88516EB1508340AFE721DF60DC49B9BBBE8FB49705F00491EF699D6292D774E508CB62

Function 00B5FA40 Relevance: 10.6, APIs: 7, Instructions: 108processsynchronizationCOMMON

Download Yara Rule

APIs

Wow64DisableWow64FsRedirection.KERNEL32(00000000,2BB8795F,00000010), ref: 00B5FA87
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,2BB8795F,00C8AA8D), ref: 00B5FAFF
GetLastError.KERNEL32 ref: 00B5FB10
WaitForSingleObject.KERNEL32(00C8AA8D,000000FF), ref: 00B5FB2C
GetExitCodeProcess.KERNEL32(00C8AA8D,00000000), ref: 00B5FB3D
CloseHandle.KERNEL32(00C8AA8D), ref: 00B5FB47
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 00B5FB62

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Wow64$ProcessRedirection$CloseCodeCreateDisableErrorExitHandleLastObjectRevertSingleWait
String ID:
API String ID: 1153077990-0
Opcode ID: 56eff42aa08b07137b988de172d29483572410cf45fd6fb86cce7288d8b22934
Instruction ID: 2e40ceadf0d84ed988ea7e8bc3dc967b6950fc63872217b1b44fb2041471fa71
Opcode Fuzzy Hash: 56eff42aa08b07137b988de172d29483572410cf45fd6fb86cce7288d8b22934
Instruction Fuzzy Hash: 16415E71E04389ABDB10CFA4CD08BAEFBF9EF4A315F1446A9E825A7190D7749E44CB50

Function 00B689C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shlwapi.dll,?,?,?,?,00B74041,?,2BB8795F,?,?), ref: 00B689DB
GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 00B689F1
FreeLibrary.KERNEL32(00000000), ref: 00B68A2A
FreeLibrary.KERNEL32(00000000,?,?,?,?,00B74041,?,2BB8795F,?,?), ref: 00B68A46

Strings

DllGetVersion, xrefs: 00B689EB
Shlwapi.dll, xrefs: 00B689DA

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: DllGetVersion$Shlwapi.dll
API String ID: 1386263645-2240825258
Opcode ID: 06b9ee3317e17e9d5d69095ace3799e642fdc0216fae1c3d884e6ba8578704a3
Instruction ID: e3406aa867547b29bc88c0707a2767f3fe7dd551e3f95c4aef76e6aba90095a4
Opcode Fuzzy Hash: 06b9ee3317e17e9d5d69095ace3799e642fdc0216fae1c3d884e6ba8578704a3
Instruction Fuzzy Hash: 9821A4766043015BC700EF69E84166FB7E4FFDA711F80066EF89AD3241EB35984497A2

Function 00C38302 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00C3840F,00C3490E,0000000C,?,00000000,00000000,?,00C38679,00000021,FlsSetValue,00CCCE8C,00CCCE94,?), ref: 00C383C3

Strings

api-ms-, xrefs: 00C38359
ext-ms-, xrefs: 00C3836D

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4307c547bfaaf12bb75cb40d357066b6188ef560e43f5c575f0dbbaf16152601
Instruction ID: 0a6288c47dfe0b7ba3b8cb4bade6816f0cfce7c78c0154d551cf0a91e2d73fa4
Opcode Fuzzy Hash: 4307c547bfaaf12bb75cb40d357066b6188ef560e43f5c575f0dbbaf16152601
Instruction Fuzzy Hash: C621D571A11314ABC7619B21DC45B5F3768EB41B60F151114FD26E73E1DB74EE08CAE1

Function 00B5EA40 Relevance: 9.2, APIs: 6, Instructions: 233COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,2BB8795F,00000000,?,00000000,?,?,?,00C8A895,000000FF,?,00B874D1,?,?,?,?), ref: 00B5EA8B
CreateDirectoryW.KERNEL32(00C8A895,00000000,?,00000000,00CE0AD8,00000001), ref: 00B5EB4A
GetLastError.KERNEL32 ref: 00B5EB58

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath
String ID:
API String ID: 953296794-0
Opcode ID: 37c67c8ec1345a5a46f037a0fc3625bd45c583ed383325462a0b7475a6a84b89
Instruction ID: 90df515834e2c9c6dd49f2e59fce4e164f2c2dcf5530799c32f74446b8a4007c
Opcode Fuzzy Hash: 37c67c8ec1345a5a46f037a0fc3625bd45c583ed383325462a0b7475a6a84b89
Instruction Fuzzy Hash: C481B4719006099FDB14DFA8C885B9DBBF4FF15325F1446A9E825A72D0DB71DA08CB50

Function 00B69990 Relevance: 9.2, APIs: 6, Instructions: 156windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 00B699C2
GetWindowLongW.USER32(?,000000F0), ref: 00B699C8
GetDlgItem.USER32(?,?), ref: 00B69A3A
GetWindowRect.USER32(00000000,?), ref: 00B69A52
SetWindowPos.USER32(00000014,00000000,?,00000002,00000002,?,00000014,?,00000002,00000002,?,?,?,000000F0,?,00000000), ref: 00B69ADF
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 00B69B13

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Window$MessageSend$ItemLongRect
String ID:
API String ID: 3432912040-0
Opcode ID: e98840eafa220a150728a908fd3a4091a261d9cb86c77fa8ae64e732e8251298
Instruction ID: 32a89a5406bea79f87146b8d6e6976e9801cd47191c552e71e6f5235c150ee94
Opcode Fuzzy Hash: e98840eafa220a150728a908fd3a4091a261d9cb86c77fa8ae64e732e8251298
Instruction Fuzzy Hash: C1517730204301DFD724CF28D989B2ABBE5FF88715F144A5DF9899B2A5DB31E844CB52

Function 00A712B0 Relevance: 9.2, APIs: 6, Instructions: 153COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A712FA
std::_Lockit::_Lockit.LIBCPMT ref: 00A7131C
std::_Lockit::~_Lockit.LIBCPMT ref: 00A71344
__Getctype.LIBCPMT ref: 00A71425
std::_Facet_Register.LIBCPMT ref: 00A71487
std::_Lockit::~_Lockit.LIBCPMT ref: 00A714B1

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 095a2700ec7b6234456c55f600373742f4c6fc0b5ae6c55891211642ce4de959
Instruction ID: e6a9a2da4ea381e5e91bb4bd5b3d41c9d364107d3c2a8ef57308b5d6eeb7b2af
Opcode Fuzzy Hash: 095a2700ec7b6234456c55f600373742f4c6fc0b5ae6c55891211642ce4de959
Instruction Fuzzy Hash: 7B619EB0C00749CFDB11CF68C981BAEB7F4BB15314F14C259E849AB391EB74AA84CB91

Function 00A710B0 Relevance: 9.1, APIs: 6, Instructions: 140COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A710ED
std::_Lockit::_Lockit.LIBCPMT ref: 00A7110F
std::_Lockit::~_Lockit.LIBCPMT ref: 00A71137
__Getcoll.LIBCPMT ref: 00A71201
std::_Facet_Register.LIBCPMT ref: 00A71246
std::_Lockit::~_Lockit.LIBCPMT ref: 00A7127E

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID:
API String ID: 1184649410-0
Opcode ID: 738a8d57adbc5d9b83baac74a3768e6d42e4897b9eb5069df984839701ffce8a
Instruction ID: b1a627d54384418e206e5526f3ef5aae892e316ac464e3c64d30cddb052ba606
Opcode Fuzzy Hash: 738a8d57adbc5d9b83baac74a3768e6d42e4897b9eb5069df984839701ffce8a
Instruction Fuzzy Hash: 16518BB1D01249EFDB01DF98D984BADBBF0FF41310F208159E809AB381DB746A45DB91

Function 00B69B50 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 327COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000080,00000001,Close,50000001,?,00000128,?,00000032,0000000E,00000082,000001F5,?,50000000,?,00000026), ref: 00B69E3B

Strings

Close, xrefs: 00B69D54
Send Error Report, xrefs: 00B69D9D
Details >>, xrefs: 00B69DC1
Copy, xrefs: 00B69E22

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: HandleModule
String ID: Close$Copy$Details >>$Send Error Report
API String ID: 4139908857-113472931
Opcode ID: 82f7ba4ebf0840e8a14b5b4c4437866a104103e78b68afa3ca764e77a7064d5b
Instruction ID: ffd41c1543a58f37682ce328d1f244d1aaeeb416ff8d340ed9b5a1062a6eac56
Opcode Fuzzy Hash: 82f7ba4ebf0840e8a14b5b4c4437866a104103e78b68afa3ca764e77a7064d5b
Instruction Fuzzy Hash: D6C1AD70A40245AFEB24CF64CC55BAEB7B9FF04710F144269F915BB2D0EBB5A905CB90

Function 00C20573 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00C2056A,00C20536,?,?,00A6E56D,00B5CDF0,?,00000008), ref: 00C20581
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00C2058F
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00C205A8
SetLastError.KERNEL32(00000000,00C2056A,00C20536,?,?,00A6E56D,00B5CDF0,?,00000008), ref: 00C205FA

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 84249c3b0007833ceae1d238e0840022de78ab1bfc84becc0256fd92802fdf72
Instruction ID: dc4ac340e184bd9b21c2ebd6a3bff0f79ce32324598461d6fb98f4209ed09775
Opcode Fuzzy Hash: 84249c3b0007833ceae1d238e0840022de78ab1bfc84becc0256fd92802fdf72
Instruction Fuzzy Hash: 2C01F7722497316EEB6427B8BC8965B2788EB02775730033BF830A19F3EF194D047568

Function 00BA4030 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 244fileCOMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00BA4064

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

DeleteFileW.KERNEL32(?), ref: 00BA410A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00BA423F

Part of subcall function 00B60990: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,2BB8795F,00000001,75A8EB20,00000000), ref: 00B609DF
Part of subcall function 00B60990: ReadFile.KERNEL32(00000000,?,000003FF,?,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000,2BB8795F,00000001,75A8EB20,00000000), ref: 00B60A15

Part of subcall function 00B61B90: LoadStringW.USER32(000000A1,?,00000514,2BB8795F), ref: 00B61AF6

_wcsrchr.LIBVCRUNTIME ref: 00BA4179

Strings

--verbose --log-file="%s" --remove-pack-file "%s" "%s", xrefs: 00BA40BE

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: File$Delete_wcsrchr$CreateHeapLoadProcessReadString
String ID: --verbose --log-file="%s" --remove-pack-file "%s" "%s"
API String ID: 2917987377-3685554107
Opcode ID: 0f609af02ec15e3f8140dde5ec3ae41bf9642dc526f7776165a9da8ea69c8b9e
Instruction ID: 6001fd65e821426c71c4adcd9d2db09f20976661039b006f0795996c4e965300
Opcode Fuzzy Hash: 0f609af02ec15e3f8140dde5ec3ae41bf9642dc526f7776165a9da8ea69c8b9e
Instruction Fuzzy Hash: 6D91D131A006099FDB00DFA8C845B9EFBF4EF56324F1482A9E815EB292DB75DD04CB91

Function 00B5FB90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166synchronizationCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00B5FD19

Part of subcall function 00B5DAC0: _wcsrchr.LIBVCRUNTIME ref: 00B5DAF9

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00B5FD35
GetExitCodeProcess.KERNEL32(00000000,00C8AB17), ref: 00B5FD46
CloseHandle.KERNEL32(00000000), ref: 00B5FD54

Strings

open, xrefs: 00B5FC10

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CloseCodeErrorExitHandleLastObjectProcessSingleWait_wcsrchr
String ID: open
API String ID: 1209170042-2758837156
Opcode ID: 50741f83da423dc9f729bcf5ba19c75c07bd3f17f05b430ca951a1024e0086ab
Instruction ID: 40f5c0badb55d827dcd9be37ab99eb85e6168ebf7bcd6ba898aca979369e999d
Opcode Fuzzy Hash: 50741f83da423dc9f729bcf5ba19c75c07bd3f17f05b430ca951a1024e0086ab
Instruction Fuzzy Hash: 8E615A71A0064A9BDB10CF69C8447AEFBF4FF45325F1482A9E825A73D1DB749944CF90

Function 00A4A1A0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156threadCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000E,2BB8795F), ref: 00A4A1DF
GetCurrentThreadId.KERNEL32 ref: 00A4A223
EnterCriticalSection.KERNEL32(00D629CC), ref: 00A4A243
LeaveCriticalSection.KERNEL32(00D629CC), ref: 00A4A267

Part of subcall function 00C1E5D5: GetProcessHeap.KERNEL32(00000008,00000008,00000000,00B8915E,?,?), ref: 00C1E5DA
Part of subcall function 00C1E5D5: HeapAlloc.KERNEL32(00000000,?,?), ref: 00C1E5E1

Strings

AXWIN UI Window, xrefs: 00A4A348

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CriticalHeapSection$AllocCurrentEnterErrorLastLeaveProcessThread
String ID: AXWIN UI Window
API String ID: 2176831970-1592869507
Opcode ID: aa41db49f2442f3c53a1653a1a0681258b29514a437ead1fc36421b171deed16
Instruction ID: 79716dbcf823789750108706c0ead040d563132195378de16be201ffa952c249
Opcode Fuzzy Hash: aa41db49f2442f3c53a1653a1a0681258b29514a437ead1fc36421b171deed16
Instruction Fuzzy Hash: FC51E176640305AFDB20CF68DC05BABBBE8FB94721F00411AF904E7390D7B1A804DB61

Function 00B3BA00 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 74libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(SetWindowTheme), ref: 00B3BACD
SendMessageW.USER32(000000EF,00001036,00010000,00010000), ref: 00B3BB0F

Part of subcall function 00C1EE76: AcquireSRWLockExclusive.KERNEL32(00D5BFA8,?,?,?,00A3ADE6,00D5CBBC,2BB8795F,?,?,00C4629D,000000FF,?,00B9F0FC,2BB8795F,?,?), ref: 00C1EE81
Part of subcall function 00C1EE76: ReleaseSRWLockExclusive.KERNEL32(00D5BFA8,?,00A3ADE6,00D5CBBC,2BB8795F,?,?,00C4629D,000000FF,?,00B9F0FC,2BB8795F,?,?), ref: 00C1EEBB

Part of subcall function 00B19F70: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00B19FB1

Part of subcall function 00C1EE25: AcquireSRWLockExclusive.KERNEL32(00D5BFA8,?,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE2F
Part of subcall function 00C1EE25: ReleaseSRWLockExclusive.KERNEL32(00D5BFA8,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE62
Part of subcall function 00C1EE25: WakeAllConditionVariable.KERNEL32(00D5BFA4,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE6D

Strings

explorer, xrefs: 00B3BAF7
UxTheme.dll, xrefs: 00B3BA61
SetWindowTheme, xrefs: 00B3BAC2

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$AddressConditionDirectoryMessageProcSendSystemVariableWake
String ID: SetWindowTheme$UxTheme.dll$explorer
API String ID: 1065053019-3123591815
Opcode ID: c12e5474ddb0d127c8e75ac8477ac79d5c01afcacffcdcac37fd502d7f55d20b
Instruction ID: c2f264daf2021db4572de56a46df5a2a6bc102d9d7473b8d7a3d2435b1aea7ee
Opcode Fuzzy Hash: c12e5474ddb0d127c8e75ac8477ac79d5c01afcacffcdcac37fd502d7f55d20b
Instruction Fuzzy Hash: 28218071A40B05ABC720DF59DC42FAD77A4EB01760F210625E921E77D0DBB06988DBB1

Function 00A70610 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00A70657
OpenProcessToken.ADVAPI32(00000000,00000028,00000000), ref: 00A70664
GetLastError.KERNEL32 ref: 00A706A2
CloseHandle.KERNEL32(00000000), ref: 00A706D9

Strings

SeShutdownPrivilege, xrefs: 00A70672

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Process$CloseCurrentErrorHandleLastOpenToken
String ID: SeShutdownPrivilege
API String ID: 2767541406-3733053543
Opcode ID: bb577d30b42063a6e5dbac28e344cc2c6f53e545b0c24249ea5f248dd2660ab9
Instruction ID: 08b419b1c1b0a50be9c7ca35429fd88808445341f5c2ffe3b6d98ffde9062930
Opcode Fuzzy Hash: bb577d30b42063a6e5dbac28e344cc2c6f53e545b0c24249ea5f248dd2660ab9
Instruction Fuzzy Hash: 672128B1A40308AFEB10DFA0DD59FEEBBB8FB09715F104119E915F6290DBB5A904CB24

Function 00C2A10C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,2BB8795F,?,?,00000000,00CA92A9,000000FF,?,00C2A09C,?,?,00C2A070,?), ref: 00C2A141
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00C2A153
FreeLibrary.KERNEL32(00000000,?,00000000,00CA92A9,000000FF,?,00C2A09C,?,?,00C2A070,?), ref: 00C2A175

Strings

mscoree.dll, xrefs: 00C2A13A
CorExitProcess, xrefs: 00C2A14B

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 75428d3dd90e8991a0db19ca4a360745d8c38940eba6f6e7562680ddb8224611
Instruction ID: b7ce40106a18059d29c98f52b76640d2be559b183e84deb8534f214cb156cf6c
Opcode Fuzzy Hash: 75428d3dd90e8991a0db19ca4a360745d8c38940eba6f6e7562680ddb8224611
Instruction Fuzzy Hash: 0F01A771940629EFCB018B94DC09FAFBBB8FB05B25F004626F822E26D0DB759D00CA50

Function 00A52E30 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 338memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,00000000,?,?,2BB8795F), ref: 00A52EEC
HeapFree.KERNEL32(00000000,?,00000000,?,?,2BB8795F), ref: 00A52EF2
GetProcessHeap.KERNEL32(?,00000000), ref: 00A53077
HeapFree.KERNEL32(00000000,?,00000000), ref: 00A5307D

Strings

#, xrefs: 00A531B5

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: #
API String ID: 3859560861-1885708031
Opcode ID: 4c3badf2b16a4565ca0ed53645d56a8d9e10b46dfab5b8d71e5503bfab31ca67
Instruction ID: 9bebed824946b2fc536cb283d1db0bee3c6ab27412c1b14ba398f56ce759b0b6
Opcode Fuzzy Hash: 4c3badf2b16a4565ca0ed53645d56a8d9e10b46dfab5b8d71e5503bfab31ca67
Instruction Fuzzy Hash: ADD17872D00219DBDF04CFA8D9457EEFBB0FF94315F244269E815A7290DBB55A08DBA0

Function 00A791F0 Relevance: 7.8, APIs: 5, Instructions: 270memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000000), ref: 00A79249
GetProcessHeap.KERNEL32(?,00000000), ref: 00A7934B
HeapFree.KERNEL32(00000000,?,00000000), ref: 00A79351
GetProcessHeap.KERNEL32(?,00000000), ref: 00A793CA
HeapFree.KERNEL32(00000000,?,00000000), ref: 00A793D0
CoUninitialize.COMBASE ref: 00A79527

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Heap$FreeProcess$InitializeUninitialize
String ID:
API String ID: 4239879612-0
Opcode ID: 83f9cf155db4c65f40298f4d65fd7088ed0d6ca4d9b0d8febd5f9affb233dab4
Instruction ID: 1624fe171c99fd87241184ecefe76ad03927efdeb5f80b86dd521f655240c7ec
Opcode Fuzzy Hash: 83f9cf155db4c65f40298f4d65fd7088ed0d6ca4d9b0d8febd5f9affb233dab4
Instruction Fuzzy Hash: E4B14A70D00218DFDB10CFA8CD45BEEBBB8BF45304F20819EE419AB291DB749A49CB60

Function 00B97740 Relevance: 7.7, APIs: 5, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 14b4005b5ddb8bded35d84b953f5dfce540fe3a3628f21cc92715aea24a0c356
Instruction ID: 0343d0ab5ffc44a854d1ea571439b2682c0514973c395ea7ef77acb5363b9a01
Opcode Fuzzy Hash: 14b4005b5ddb8bded35d84b953f5dfce540fe3a3628f21cc92715aea24a0c356
Instruction Fuzzy Hash: CA812871904349DFDF11CFA8C98479EBBF5FF49324F2482A9E914AB291DB749940CBA0

Function 00A69BB0 Relevance: 7.7, APIs: 5, Instructions: 178windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000318,00000000,00000004), ref: 00A69C17
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00A69C3F
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A69C57
SendMessageW.USER32(?,0000130A,00000000,?), ref: 00A69C88
SendMessageW.USER32(00000000,00000136,?,?), ref: 00A69D75

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 90edf934cb2df564101ea4c50fc2319f64c98361af27fbb53af5c4d4b74aefd1
Instruction ID: f22b998953648566c53eb26612e95a976d9f98653932393a5b48a5ef9e6d2dd7
Opcode Fuzzy Hash: 90edf934cb2df564101ea4c50fc2319f64c98361af27fbb53af5c4d4b74aefd1
Instruction Fuzzy Hash: 7361E572900718AFDB219FE4DC49BAEBBB9FF48725F14011AFA15EB291C7706911CB60

Function 00BA4520 Relevance: 7.7, APIs: 5, Instructions: 160threadsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,2BB8795F,?,00000000,74DF34C0,?,?,?,00000000,00C984FD,000000FF,?,00B86290), ref: 00BA4560
CreateThread.KERNEL32(00000000,00000000,00BA48D0,?,00000000,00000000), ref: 00BA4596
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00BA46A6
GetExitCodeThread.KERNEL32(00000000,00000000), ref: 00BA46B1
CloseHandle.KERNEL32(00000000), ref: 00BA46D1

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CreateThread$AllocateCloseCodeEventExitHandleHeapObjectSingleWait
String ID:
API String ID: 978852114-0
Opcode ID: 05f4f3ae39cc3065b73739676e05099fa3b4988828567869f1a4cd7a5b3bab4e
Instruction ID: 4a6907940e187c9a113121c7cfd2d1b6e270ab3795b0410cf1a5cf541755dc80
Opcode Fuzzy Hash: 05f4f3ae39cc3065b73739676e05099fa3b4988828567869f1a4cd7a5b3bab4e
Instruction Fuzzy Hash: A7516A74A04309DFCB10CF68D984BAEBBF4FF5A314F2586A9E816A7751D770A804CB50

Function 00B96E00 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00B96E61

Strings

FTP Server, xrefs: 00B97838, 00B9784A, 00B97854
HTTP/1.0, xrefs: 00B97C48
Local Network Server, xrefs: 00B975E8, 00B975FA, 00B97604
GET, xrefs: 00B96FE9

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ErrorLast
String ID: FTP Server$GET$HTTP/1.0$Local Network Server
API String ID: 1452528299-797884378
Opcode ID: 30b32fd799a30903ee4740ec327ac0a90648edd44ce0e15151016fe3aa7214ae
Instruction ID: c1fb51a9b9b2fb802493982400c8733287a18dd15550681eabc755affd6c0fda
Opcode Fuzzy Hash: 30b32fd799a30903ee4740ec327ac0a90648edd44ce0e15151016fe3aa7214ae
Instruction Fuzzy Hash: D141C2719006199BDB10EFA8DC49BAEBBF8EF05720F104179F911EB291DB749A049BA1

Function 00B57890 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B578BD
std::_Lockit::_Lockit.LIBCPMT ref: 00B578E0
std::_Lockit::~_Lockit.LIBCPMT ref: 00B57908
std::_Facet_Register.LIBCPMT ref: 00B5797D
std::_Lockit::~_Lockit.LIBCPMT ref: 00B579A7

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 91dacff4fc5b8c94c22c7111530e2f4a5500383ff62c9624bdf013da748ee78b
Instruction ID: e54cb0af33a9e0fb9b550fcd71b2ad6260e634b432bd53308910a75ca95a4acd
Opcode Fuzzy Hash: 91dacff4fc5b8c94c22c7111530e2f4a5500383ff62c9624bdf013da748ee78b
Instruction Fuzzy Hash: 4641F071944215EFDB11CF58E884BAEBBB4EF40320F2442D9E854A7391CB30AE44CBE0

Function 00B5A300 Relevance: 7.6, APIs: 6, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,?,?), ref: 00B5A319
LocalFree.KERNEL32(?,?,?), ref: 00B5A329
GetLastError.KERNEL32 ref: 00B5A367
LocalAlloc.KERNEL32(00000040,00000014), ref: 00B5A3A8
GetLastError.KERNEL32 ref: 00B5A3C2
LocalFree.KERNEL32(?), ref: 00B5A3D3

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Local$Free$ErrorLast$AllocAllocateHeap
String ID:
API String ID: 1027944315-0
Opcode ID: 730607b10184d803692072f720bcddd70d3f7e6e5a83468b88c583f8b3957558
Instruction ID: 2c3c269d4384a08e4c27d9d33b890a15ba698b91410965589f0c7d6b17816022
Opcode Fuzzy Hash: 730607b10184d803692072f720bcddd70d3f7e6e5a83468b88c583f8b3957558
Instruction Fuzzy Hash: 253158702007059FE720DF65DC44B5BB7E8FF4471AF004AAEE986E2650E774E90D8BA2

Function 00A40B90 Relevance: 7.6, APIs: 5, Instructions: 60memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A40BDA
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00A40BE0
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 00A40C03
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,00C47B46,000000FF), ref: 00A40C2B
HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,00C47B46,000000FF), ref: 00A40C31

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Heap$FreeProcess$FormatMessage
String ID:
API String ID: 1606019998-0
Opcode ID: 72917c435d33618653f27923b5189804e0e153c4e089624b20fb666d349c8d6b
Instruction ID: 56d499b460486e2a50fbf9176e61091a63c82b6c61d97e8b26f2a55c305671dc
Opcode Fuzzy Hash: 72917c435d33618653f27923b5189804e0e153c4e089624b20fb666d349c8d6b
Instruction Fuzzy Hash: 1B1146B5A44319ABEB00DF94CC46FAFB7BCFB04B14F100515F514A72C1DBB559049B91

Function 00A5AB80 Relevance: 7.6, APIs: 5, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00A5AB8B
SendMessageW.USER32(?,?,?,0000102B), ref: 00A5ABE8
SendMessageW.USER32(?,?,?,0000102B), ref: 00A5AC37
SendMessageW.USER32(?,00001043,00000000,00000000), ref: 00A5AC48
SendMessageW.USER32(?,00001013,00000000,00000000), ref: 00A5AC55

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 5ce3be1858214bdfc6b8339c91160bafcb6f90f5c4582aad4e18171667191936
Instruction ID: f96e0026fbcc057a34a174c72fb83b75d115b9ea2d5fa190c296df6f3a144ffc
Opcode Fuzzy Hash: 5ce3be1858214bdfc6b8339c91160bafcb6f90f5c4582aad4e18171667191936
Instruction Fuzzy Hash: D6216D31918346AAE320DF00CD40B1ABBF1BFEE758F202B0EF5D0211A4E7F191848E86

Function 00A61150 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 211windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

Part of subcall function 00B3B5D0: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,?,000000EF,?,00A5A158,00000000,80004005), ref: 00B3B638
Part of subcall function 00B3B5D0: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00B3B668

SendMessageW.USER32(?,00001036,00000004,00000004), ref: 00A612ED
SendMessageW.USER32(?,00001036,00000400,00000400), ref: 00A61304
SendMessageW.USER32(?,00001061,00000000,?), ref: 00A61360

Strings

QuickSelectionList, xrefs: 00A61229, 00A6123B, 00A61245

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: MessageSend$AllocateHeapWindow
String ID: QuickSelectionList
API String ID: 3168177373-3633591268
Opcode ID: 16f9eb2072874748610be89bdacce4daf829441ee1f369c1c936903bcbcbe637
Instruction ID: 1c8ab91e0e60fb4078c6fb0207e137f68e32c222879cbd8208e03e10f993c54b
Opcode Fuzzy Hash: 16f9eb2072874748610be89bdacce4daf829441ee1f369c1c936903bcbcbe637
Instruction Fuzzy Hash: 3471AB71A00604AFDB14DF68C885BAAFBF4FF89324F14466DE566A7390DB74A904CB60

Function 00A699A0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00A69AB2
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00A69ABA

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

Part of subcall function 00A6B6C0: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00A6B70F

Strings

SysTabControl32, xrefs: 00A69A95
TabHost, xrefs: 00A69A29, 00A69A3B, 00A69A45

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: MessageSend$AllocateHeap
String ID: SysTabControl32$TabHost
API String ID: 4003639188-2872506973
Opcode ID: d5487cc60a0657594606dbbde19f6c0685f53012320514b28e81fa7b58be508d
Instruction ID: 58e72e0a19459460069e41b42dee43c34bce0dee524cd1ad44bb3afeca6d680f
Opcode Fuzzy Hash: d5487cc60a0657594606dbbde19f6c0685f53012320514b28e81fa7b58be508d
Instruction Fuzzy Hash: 51518D75A00605AFDB10DF68C844BAEBBF8FF49710F14426AF915AB390DB35AD00CBA5

Function 00BA3600 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 167synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,2BB8795F), ref: 00BA3634

Part of subcall function 00B45F60: MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,00000000,00000000,?,?,00D5D6E0,00B93680,?), ref: 00B45F78
Part of subcall function 00B45F60: MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,?,-00000001), ref: 00B45FAA

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

Strings

*.*, xrefs: 00BA36AA, 00BA36BC, 00BA36C4
.pack, xrefs: 00BA3971
.jar, xrefs: 00BA3ABC

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapObjectSingleWait
String ID: *.*$.jar$.pack
API String ID: 2019434529-3892993289
Opcode ID: e4a23ce660e3231b998ab2d26fb2e28f1721522cc32f568a4d9ac57ff7f525df
Instruction ID: 55c44e460b5c9ce51c526be1a814da5541ba2e6c0699ba4ea9603206b1b47b4f
Opcode Fuzzy Hash: e4a23ce660e3231b998ab2d26fb2e28f1721522cc32f568a4d9ac57ff7f525df
Instruction Fuzzy Hash: 01514FB0A0465A9BDB10DFA9C948BAEF7F4FF05714F1442A9F425A7291DB34DE04CB90

Function 00B914A0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00B9157A

Strings

\, xrefs: 00B914FC
\, xrefs: 00B9151E
\, xrefs: 00B914F4

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: DiskFreeSpace
String ID: \$\$\
API String ID: 1705453755-3791832595
Opcode ID: 4e9553028b3cfac980e165f26abba6d46044c5007635dede303be73bc27b4b8e
Instruction ID: 19267ca744f35260618536f4e7abe98297beb6a77d3dba5f4de1097ff56590e6
Opcode Fuzzy Hash: 4e9553028b3cfac980e165f26abba6d46044c5007635dede303be73bc27b4b8e
Instruction Fuzzy Hash: 6941A761D1425287CF30DF2884416ABB7F4FFE5354F178EBEE89A97140E7309984A386

Function 00B5E200 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,00000000,?,\\?\,00000004,?,?,?,00000000,00C86F0D,000000FF,?,80004005,2BB8795F,?), ref: 00B5E2A3

Part of subcall function 00A3A2F0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,80070057,8007000E,80004005,00A52BE4,00000000,?,?,?,*.*), ref: 00A3A313

DeleteFileW.KERNEL32(?,2BB8795F,?,74DF3340,?,00000000,00C86F0D,000000FF,?,00B5E046), ref: 00B5E2D2
GetLastError.KERNEL32(?,?,?,00000000,00C86F0D,000000FF,?,80004005,2BB8795F,?,?,?,?,00C86F0D,000000FF), ref: 00B5E2E2

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

Strings

\\?\, xrefs: 00B5E154, 00B5E166, 00B5E170, 00B5E264, 00B5E276, 00B5E280

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: DeleteFile$ErrorFindHeapLastProcessResource
String ID: \\?\
API String ID: 2079828947-4282027825
Opcode ID: 395f4144901ab60b1ebb6f22e5af93a26d4cc9099dea59e86d76516dff7429ce
Instruction ID: 69a4b2df67a375d25d6922b7599f92071e0d1457ea8ebb28b4713d1ba54738bf
Opcode Fuzzy Hash: 395f4144901ab60b1ebb6f22e5af93a26d4cc9099dea59e86d76516dff7429ce
Instruction Fuzzy Hash: E6218071900614DFDB14DFA8C948BAEB7E8FF05322F144699EC61D72A4DB36D9088B50

Function 00A40F60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoOriginateLanguageException), ref: 00A40FA2
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00A40FA8

Strings

combase.dll, xrefs: 00A40F9D
RoOriginateLanguageException, xrefs: 00A40F98

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoOriginateLanguageException$combase.dll
API String ID: 2574300362-3996158991
Opcode ID: e33c940acae6c124be4e089923e74c7f71da7b8969f1cdb8d870b3039d56ff8e
Instruction ID: 311cc3768f9b14bbb7f6fddd17283e7503fa7ae2acb4fe82a45c59f7231d0b34
Opcode Fuzzy Hash: e33c940acae6c124be4e089923e74c7f71da7b8969f1cdb8d870b3039d56ff8e
Instruction Fuzzy Hash: EF318D7090434ADFDB20DFA8C942BEEBBF4FB44314F100629E824A72D0DBB55A84DB91

Function 00B96C70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,00B94C2A,?,2BB8795F,?,?,?,?,00C95275,000000FF), ref: 00B96C7D
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00B94C2A,?,2BB8795F,?,?,?,?,00C95275,000000FF,?), ref: 00B96C9E
GetLastError.KERNEL32(?,2BB8795F,?,?,?,?,00C95275,000000FF,?,00B9452D,?,?,00000000,?,?), ref: 00B96CFE

Strings

AdvancedInstaller, xrefs: 00B96CE6

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CreateEvent$ErrorLast
String ID: AdvancedInstaller
API String ID: 1131763895-1372594473
Opcode ID: 3a3f72f5f2910a1ec6eccaa66bc09d9c9dc83db7f77c1a3dfa18c4c3d1934f6f
Instruction ID: 4dba3cd0cf6af7b897ad2d032de68a10484aff035d9bea159bf1a07214afae1e
Opcode Fuzzy Hash: 3a3f72f5f2910a1ec6eccaa66bc09d9c9dc83db7f77c1a3dfa18c4c3d1934f6f
Instruction Fuzzy Hash: A3115B71740702BBD720CB21CD89F1ABBE4FF84715F204429F5159B690D771B851CBA0

Function 00B67090 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00C1EE76: AcquireSRWLockExclusive.KERNEL32(00D5BFA8,?,?,?,00A3ADE6,00D5CBBC,2BB8795F,?,?,00C4629D,000000FF,?,00B9F0FC,2BB8795F,?,?), ref: 00C1EE81
Part of subcall function 00C1EE76: ReleaseSRWLockExclusive.KERNEL32(00D5BFA8,?,00A3ADE6,00D5CBBC,2BB8795F,?,?,00C4629D,000000FF,?,00B9F0FC,2BB8795F,?,?), ref: 00C1EEBB

LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr), ref: 00B670EE
GetProcAddress.KERNEL32(00000000), ref: 00B670F5

Part of subcall function 00C1EE25: AcquireSRWLockExclusive.KERNEL32(00D5BFA8,?,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE2F
Part of subcall function 00C1EE25: ReleaseSRWLockExclusive.KERNEL32(00D5BFA8,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE62
Part of subcall function 00C1EE25: WakeAllConditionVariable.KERNEL32(00D5BFA4,?,00A3AE57,00D5CBBC,00CA94C0), ref: 00C1EE6D

Strings

SymFromAddr, xrefs: 00B670E4
Dbghelp.dll, xrefs: 00B670E9

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$AddressConditionLibraryLoadProcVariableWake
String ID: Dbghelp.dll$SymFromAddr
API String ID: 1702099962-642441706
Opcode ID: 65a988e96222eae8a1f749b9b423c8c900b38f2d110112e7842668bb127c29c2
Instruction ID: 8618f042b91b03c6e9ae8e958938881a9788ca204286c02bc22dd40b18db0e2c
Opcode Fuzzy Hash: 65a988e96222eae8a1f749b9b423c8c900b38f2d110112e7842668bb127c29c2
Instruction Fuzzy Hash: 6C014CB1A44744EFC710DF58DD46B49B7A4E70BB24F100669EC15D77D0DF786A089B21

Function 00C2369C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,00C2364D,00000000,00000001,00D5C33C,?,?,?,00C237F0,00000004,InitializeCriticalSectionEx,00CC9F70,InitializeCriticalSectionEx), ref: 00C236A9
GetLastError.KERNEL32(?,00C2364D,00000000,00000001,00D5C33C,?,?,?,00C237F0,00000004,InitializeCriticalSectionEx,00CC9F70,InitializeCriticalSectionEx,00000000,?,00C2399D), ref: 00C236B3
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,00C227D3), ref: 00C236DB

Strings

api-ms-, xrefs: 00C236C0

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6639c2381a84db907ab3810d4fcb8575ae42786582d7e09ae9ec01954cac8d51
Instruction ID: 8e85d3159fc3eeb79203a68ec1077888902805f466ac763426332ded07808c6f
Opcode Fuzzy Hash: 6639c2381a84db907ab3810d4fcb8575ae42786582d7e09ae9ec01954cac8d51
Instruction Fuzzy Hash: BDE01270644244B7DB101B51FC06F1E3A58AB01B44F140024FA1DE55E1D766EA549684

Function 00A464E0 Relevance: 6.3, APIs: 4, Instructions: 269memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 00A465AA
SysFreeString.OLEAUT32(00000000), ref: 00A465F6
SysFreeString.OLEAUT32(00000000), ref: 00A46618
SysFreeString.OLEAUT32(00000000), ref: 00A46773

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: e5f0477008fbf71b0db5508d25896446c822a10ec2adc6cfdc02c140e7f5ec09
Instruction ID: bef51ae4ea97972575ccbed5be4e0d3c42fcb6365b8522457cb73dd852ff5a52
Opcode Fuzzy Hash: e5f0477008fbf71b0db5508d25896446c822a10ec2adc6cfdc02c140e7f5ec09
Instruction Fuzzy Hash: 4BA18075A0020A9FDB14DFA8CD44FAEB7B8EF85714F104519E915E7380EB74AA05CB62

Function 00A63770 Relevance: 6.3, APIs: 4, Instructions: 256windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000001,0000110A,00000004,?), ref: 00A63863
SendMessageW.USER32(00000001,0000110A,00000001,00000000), ref: 00A63897
SendMessageW.USER32(?,0000110A,00000004,?), ref: 00A63A10
SendMessageW.USER32(?,0000110A,00000001,00000000), ref: 00A63A36

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1f10e9158be60dc789d5f2f568e61c42d36ef52db51535a13feab6149cb893fa
Instruction ID: 1e942553d41d7700245d1c09024eb1e876b6c8cbe29f29de745405c92d963c8f
Opcode Fuzzy Hash: 1f10e9158be60dc789d5f2f568e61c42d36ef52db51535a13feab6149cb893fa
Instruction Fuzzy Hash: 72A14D72A00208DFCF15CF68D895BEEB7B5BF48310F144569E856AB291DB70EA46CF50

Function 00A4EF50 Relevance: 6.2, APIs: 4, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00A4F088
SysAllocString.OLEAUT32(00000000), ref: 00A4F09B
VariantClear.OLEAUT32(00000000), ref: 00A4F0BD
VariantClear.OLEAUT32(?), ref: 00A4F0EE

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ClearVariant$AllocString
String ID:
API String ID: 2502263055-0
Opcode ID: ee9a0903318548aba5b4c0153aa087a937c9d1b4402d0d655592b3fb1511b770
Instruction ID: 82bb2c6b9ea760f162fb65ad27003d0f3bfbf893f01a648ab6f2747297a71663
Opcode Fuzzy Hash: ee9a0903318548aba5b4c0153aa087a937c9d1b4402d0d655592b3fb1511b770
Instruction Fuzzy Hash: 7B5182B5A002589FDB20CF68CD40B9AB7B4FF88714F1085A9E919EB241E775E984CF94

Function 00B75920 Relevance: 6.2, APIs: 4, Instructions: 164COMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNEL32(2BB8795F,00000000,00000000), ref: 00B75980
GetShortPathNameW.KERNEL32(?,80004005,?), ref: 00B759EE
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,00000000,00000000,?), ref: 00B75A3E
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,-00000001,00000000,00000000), ref: 00B75A74

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ByteCharMultiNamePathShortWide
String ID:
API String ID: 3379522384-0
Opcode ID: 66f50fb263d825d5d420ba01df81bfabdd70f4f38405eec06da1a79d8ccdb152
Instruction ID: f2582fb7b7eb99edbfbed106de61466fb2e0d6c1f1dfec2d2e30597b0bc0e63f
Opcode Fuzzy Hash: 66f50fb263d825d5d420ba01df81bfabdd70f4f38405eec06da1a79d8ccdb152
Instruction Fuzzy Hash: 79517C71600A06AFD724DF58CC89F6EF7F5EF85720F20866DE5299B291DBB1A8008B50

Function 00B3B7C0 Relevance: 6.2, APIs: 4, Instructions: 159windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001036,00010000,00000000), ref: 00B3B82B
GetWindowRect.USER32(00000000), ref: 00B3B884

Part of subcall function 00AF05E0: GetWindowRect.USER32(?,?), ref: 00AF0672
Part of subcall function 00AF05E0: GetWindowRect.USER32(?,?), ref: 00AF068A

SendMessageW.USER32(?,00001026,00000000,000000FF), ref: 00B3B991
SendMessageW.USER32(?,0000108A,00000000,00000011), ref: 00B3B9A4

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: MessageRectSendWindow
String ID:
API String ID: 2814762282-0
Opcode ID: 95ebb91bb38563ba86b3dc0a078743a19388c2dfeafab21dc070e7770c999539
Instruction ID: 5ff594f98d9b47c6e5a0aa6b119c3683623ff5e8dc0a3035a2fb6e8d229c0f1c
Opcode Fuzzy Hash: 95ebb91bb38563ba86b3dc0a078743a19388c2dfeafab21dc070e7770c999539
Instruction Fuzzy Hash: B7512671D00718ABDB10DFA9CD45BAEFBF8FF59710F10421AE915A7291DB706981CB60

Function 00B908C0 Relevance: 6.2, APIs: 4, Instructions: 157registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,2BB8795F), ref: 00B90936
_wcsrchr.LIBVCRUNTIME ref: 00B90960
RegQueryValueExW.ADVAPI32(00000000,00CE7EB0,00000000,00000000,00000000,00000000,00CE7EB0,00000001,?,00000000,00000000), ref: 00B909E3
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00B90A2F

Part of subcall function 00B907E0: RegOpenKeyExW.ADVAPI32(00000000,2BB8795F,00000000,00020019,00000002,2BB8795F,00000001,00000010,00000002,00B8FB0C,2BB8795F,00000000,00000000), ref: 00B9087C

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Close$OpenQueryValue_wcsrchr
String ID:
API String ID: 213811329-0
Opcode ID: c3039fed50ce1d123c9b60c8eb0f58d7f499ae912648791bd96c46c978d8c55c
Instruction ID: f89a63329ac356b7036661b67c12b83c6be2afd09f4effa07a3ae6f8e8443691
Opcode Fuzzy Hash: c3039fed50ce1d123c9b60c8eb0f58d7f499ae912648791bd96c46c978d8c55c
Instruction Fuzzy Hash: E351CD719053499FEB10DF68C944BAEBBB5EB40320F1482AAEC24A73D1D775AA04CB90

Function 00AF05E0 Relevance: 6.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00AF0672
GetWindowRect.USER32(?,?), ref: 00AF068A
GetWindowRect.USER32(?,?), ref: 00AF06F6
GetWindowLongW.USER32(?,000000EC), ref: 00AF071A

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Window$Rect$Long
String ID:
API String ID: 3486571012-0
Opcode ID: c4fe3445b553ee36e4dc850981329d39f81b05729f3d23e8a371a690ee7c093a
Instruction ID: 179bb5aa04acabb78779c960e5ee89e683cdf231526b7c09d53ab2ef62530c11
Opcode Fuzzy Hash: c4fe3445b553ee36e4dc850981329d39f81b05729f3d23e8a371a690ee7c093a
Instruction Fuzzy Hash: 0A41BB32A083099FC740CF65D980E6BB7E8FF99715F04462EF989E7251E770E9508B62

Function 00AEBAC0 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,00000017,2BB8795F,?,00D5D514,?,?,?,?,00000000,Function_0024632D,000000FF,?,?,00D5D514), ref: 00AEBB09
LoadResource.KERNEL32(00000000,00000000,?,00D5D514,?,?,?,?,00000000,Function_0024632D,000000FF,?,?,00D5D514,?), ref: 00AEBB18
LockResource.KERNEL32(00000000,?,00D5D514,?,?,?,?,00000000,Function_0024632D,000000FF,?,?,00D5D514,?), ref: 00AEBB23
SizeofResource.KERNEL32(00000000,?,?,00D5D514,?,?,?,?,00000000,Function_0024632D,000000FF,?,?,00D5D514,?), ref: 00AEBB34

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 59ec9b8359774534899f282e890c79e07b3f7d41cd31604c7d81319fa2cc643a
Instruction ID: f7ed5a1eac80fc515906cae3d143dea0fd4dc92ac07ebba275067a5763694560
Opcode Fuzzy Hash: 59ec9b8359774534899f282e890c79e07b3f7d41cd31604c7d81319fa2cc643a
Instruction Fuzzy Hash: 4A31D1B1D157459BD7209F75DD45B6FBBB8EF44720F004229E865E3281EB309A04C6A1

Function 00B987E0 Relevance: 6.1, APIs: 4, Instructions: 62synchronizationCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,?,?,00B97BA2,?,?,?,?,?,00000003,00000000,2BB8795F,00000000), ref: 00B987F2
GetLastError.KERNEL32(?,?,?,00B97BA2,?,?,?,?,?,00000003,00000000,2BB8795F,00000000), ref: 00B9881F
WaitForSingleObject.KERNEL32(?,0000000A,?,?,?,00B97BA2,?,?,?,?,?,00000003,00000000,2BB8795F,00000000), ref: 00B98855
SetEvent.KERNEL32(?,?,?,?,00B97BA2,?,?,?,?,?,00000003,00000000,2BB8795F,00000000), ref: 00B98878

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Event$ErrorLastObjectResetSingleWait
String ID:
API String ID: 708712559-0
Opcode ID: 5ed42c79ff00ba0c01b4389a9a8767cd82da59c91bba0637a276a64b51d64244
Instruction ID: 73d30d68cdd03196d8d7b6bf0d457529f4b256721198045ab296e7d2eaae568b
Opcode Fuzzy Hash: 5ed42c79ff00ba0c01b4389a9a8767cd82da59c91bba0637a276a64b51d64244
Instruction Fuzzy Hash: 69114C316047408EEB719B25E988B5B7BE1FB62724F4448BEE08687972CB60EC85C760

Function 00C1C723 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00C1C72A
std::_Lockit::_Lockit.LIBCPMT ref: 00C1C735
std::_Lockit::~_Lockit.LIBCPMT ref: 00C1C7A3

Part of subcall function 00C1C885: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00C1C89D

std::locale::_Setgloballocale.LIBCPMT ref: 00C1C750

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: 5e6d2700ce4420bd4d1a78458b415b9ac7358c6773d66ae8893da14958e6e7fa
Instruction ID: 119f63288bb3e066dd85b0f1a8141b237427252225ab73223103715a17efc916
Opcode Fuzzy Hash: 5e6d2700ce4420bd4d1a78458b415b9ac7358c6773d66ae8893da14958e6e7fa
Instruction Fuzzy Hash: 7101BC75A412119BDB06EB30D885ABD7B62FFC6710B18404AF811973C2CF74AE82EBD0

Function 00A66C30 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 321windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00A66DF1
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00A66DF9

Part of subcall function 00A3AA00: RtlAllocateHeap.NTDLL(?,00000000,?,2BB8795F,00000000,00C45D20,000000FF,?,?,00D52BCC,?,00B9F158,80004005,2BB8795F,?,?), ref: 00A3AA4A

Strings

RichEdit20W, xrefs: 00A66DD4

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: MessageSend$AllocateHeap
String ID: RichEdit20W
API String ID: 4003639188-4173859555
Opcode ID: c5b425306f5d68d3a76972b0e7eeab58b920556c13267bd3580f9f6d9d4267e7
Instruction ID: 9370e85ce7104457703c607bc7114f180d8883dbaab80ec5b9013b70b77779e4
Opcode Fuzzy Hash: c5b425306f5d68d3a76972b0e7eeab58b920556c13267bd3580f9f6d9d4267e7
Instruction Fuzzy Hash: C6B15771A01619AFDB14CFA8C984BEEBBF5FF48310F144169E945AB291DB71AD00CBA0

Function 00B938A0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 239COMMON

Download Yara Rule

Strings

Everyone, xrefs: 00B939AB
ADVINST_LOGS, xrefs: 00B9397B

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: AddressAllocateFolderHeapLibraryLoadLocationProcSpecial
String ID: ADVINST_LOGS$Everyone
API String ID: 1617241543-3921853867
Opcode ID: 863b4e5b1b83e754b18775859bc64754b58f6585b7d49c6655558efc66cc53cc
Instruction ID: 5e3ed164903b0e472266463538d626931be0e1187781f3b0bd67174673b03ac5
Opcode Fuzzy Hash: 863b4e5b1b83e754b18775859bc64754b58f6585b7d49c6655558efc66cc53cc
Instruction Fuzzy Hash: FB91CF71901209DFDF00DFA8C949BAEFBF4EF15714F2442A8E856AB291DB355E04CBA1

Function 00B57A30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00B57C62

Strings

false, xrefs: 00B57B7F
true, xrefs: 00B57B95

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: 1ee39130d6d311517cdb942d3f890653dbd4ca6b736a7068f59347aba73a4ccc
Instruction ID: 64802c22141a7b3f0ce8ca303e2e735673abffe56f5ce28d7cdf709c2bcef4b6
Opcode Fuzzy Hash: 1ee39130d6d311517cdb942d3f890653dbd4ca6b736a7068f59347aba73a4ccc
Instruction Fuzzy Hash: 7871A1B1D04748DBDB10DF94C941BDEBBF8FF05710F14826AE815AB281EB75AA48CB91

Function 00B927D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

CloseHandle.KERNEL32(?,2BB8795F,000000C9,00000000), ref: 00B92953
DeleteCriticalSection.KERNEL32(?,2BB8795F,000000C9,00000000), ref: 00B929E1

Strings

<< Advanced Installer (x86) Log >>, xrefs: 00B928BF

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CloseCriticalDeleteHandleHeapProcessSection
String ID: << Advanced Installer (x86) Log >>
API String ID: 1977327082-396061572
Opcode ID: 45e4d4d8b07252dd46fecdee56dc0f123e8bc0c89a71e5d60454cc034ed851f7
Instruction ID: 149bbb41780ad33c78552c916326e71cd99970cdf18a17f9a7089dec5bb01d79
Opcode Fuzzy Hash: 45e4d4d8b07252dd46fecdee56dc0f123e8bc0c89a71e5d60454cc034ed851f7
Instruction Fuzzy Hash: B261CB70A01785EFDB10DF68C948B4ABBF0FF49315F1482A9E845DB791DB749A08CBA1

Function 00B4F4E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 160COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,2BB8795F), ref: 00B4F581

Strings

\\?\UNC\, xrefs: 00B4F5A8, 00B4F609
\\?\, xrefs: 00B4F67E, 00B4F6A9

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Path
String ID: \\?\$\\?\UNC\
API String ID: 2875597873-3019864461
Opcode ID: ddf32f23b3bb69b6a72ef7d50e5cb8ae638453c4b9dc6876d03d1366df1cbb17
Instruction ID: 1af7278e7caf23c1394c62c74ee48ca6fcbcd698842b36c0d2047ad03524da1a
Opcode Fuzzy Hash: ddf32f23b3bb69b6a72ef7d50e5cb8ae638453c4b9dc6876d03d1366df1cbb17
Instruction Fuzzy Hash: AB51DFB0D002059BDB14DF68D985BBEB7F5FF54304F10866DE841A7290EB70AA48CBE0

Function 00B98900 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 147synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00A3AD40: GetProcessHeap.KERNEL32 ref: 00A3AD95

GetLastError.KERNEL32(?,00000000,FTP Server,0000000A), ref: 00B98984
WaitForSingleObject.KERNEL32(?,0000000A,?,00000000,FTP Server,0000000A), ref: 00B989BD

Strings

REST %u, xrefs: 00B98951

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: ErrorHeapLastObjectProcessSingleWait
String ID: REST %u
API String ID: 1530046183-3183379045
Opcode ID: b464b8c283683387028ffe2f95ac5b500e9533247c04f86aae9bd31ade7281e2
Instruction ID: d28be8ba380f402d71fef0ec083dceeb8878c97fea56b7f19490f6d4a433b7b2
Opcode Fuzzy Hash: b464b8c283683387028ffe2f95ac5b500e9533247c04f86aae9bd31ade7281e2
Instruction Fuzzy Hash: EC51CE31600604DFDB20DF68CC85B6AB7E5FF42324F1486BAE4669B6A1DB74EC45CB41

Function 00B93B90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,2BB8795F,?,?,00D5D6E0), ref: 00B93BCF
CreateDirectoryW.KERNEL32(?,00000000,?,00D5D6E0), ref: 00B93C30

Strings

ADVINST_LOGS, xrefs: 00B93C08

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: CreateDirectoryPathTemp
String ID: ADVINST_LOGS
API String ID: 2885754953-2492584244
Opcode ID: 0b4270f8f1b24ab9f9e9152e8677a0140b61d9abc13fdd74b43926fedd325640
Instruction ID: 468c1a034c5342d270a57fcd0265bf910a9a9567214221ae2e3766fa91c165a1
Opcode Fuzzy Hash: 0b4270f8f1b24ab9f9e9152e8677a0140b61d9abc13fdd74b43926fedd325640
Instruction Fuzzy Hash: 3551B175900619CACF209F28C8487BAB7F4FF15B14F2446BED859A7291EB355EC1CB90

Function 00B68AA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B68590: SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,2BB8795F,00000000,00000000,?), ref: 00B685EB

GetLastError.KERNEL32(?,?), ref: 00B68B5E
DeleteFileW.KERNEL32(?), ref: 00B68B71

Strings

Shlwapi.dll, xrefs: 00B68AA0, 00B68AD8

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: DeleteErrorFileFolderLastPath
String ID: Shlwapi.dll
API String ID: 3097891619-1687636465
Opcode ID: 2a43f8c3da332f311b5dd82d7c350aaffba17e0d3320901885799d121231a072
Instruction ID: c8bb7ddf36d97c0b4011c5f95e88e59e7818dc015ac4533b7511fae23438bc4f
Opcode Fuzzy Hash: 2a43f8c3da332f311b5dd82d7c350aaffba17e0d3320901885799d121231a072
Instruction Fuzzy Hash: B13132B19003099FDB15DFA5C844BEEBBF8EF49711F18466AE905A3280DB359A44CBA1

Function 00A78B90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A78BBB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00A78C1E

Strings

bad locale name, xrefs: 00A78C41

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 0e868621669c51b64596b7cb7134571b3a8e1101266ac4d7490918da167aaf3f
Instruction ID: e478b9e7cf278e006118f8921d5314f9db43c6f8eebcc082cb66ed47cbf2a049
Opcode Fuzzy Hash: 0e868621669c51b64596b7cb7134571b3a8e1101266ac4d7490918da167aaf3f
Instruction Fuzzy Hash: 0C212170A05780DFD720CF68C84478BBFE4AF05700F14869EE489C7B81D7B9AA08D7A1

Function 00B3B4E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B3BA00: GetProcAddress.KERNEL32(SetWindowTheme), ref: 00B3BACD
Part of subcall function 00B3BA00: SendMessageW.USER32(000000EF,00001036,00010000,00010000), ref: 00B3BB0F

SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00B3B550
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00B3B558

Part of subcall function 00A48400: SetWindowLongW.USER32(?,000000FC,00000000), ref: 00A48436

Strings

SysListView32, xrefs: 00B3B529

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: MessageSend$AddressLongProcWindow
String ID: SysListView32
API String ID: 3249030398-78025650
Opcode ID: 1c27fb06fe1aa944173e7fd6b9d703d22aee3dea2497d5769ec35421b392d9f4
Instruction ID: 1ea80a921e38748cdab8bcaf8f56b98a96bf56ad257fc198f2f99ec54ae74db8
Opcode Fuzzy Hash: 1c27fb06fe1aa944173e7fd6b9d703d22aee3dea2497d5769ec35421b392d9f4
Instruction Fuzzy Hash: F3117931300354BBD6209B258C05F6BFBA9FFC9761F154219FA05AB2A0CBB1A900DAA1

Function 00A887F0 Relevance: 5.2, APIs: 4, Instructions: 240memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00000000), ref: 00A889FC
HeapFree.KERNEL32(00000000,?,?,?,00000000), ref: 00A88A02
GetProcessHeap.KERNEL32(?,?), ref: 00A88A5C
HeapFree.KERNEL32(00000000,?,?), ref: 00A88A62

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: d2bbc698187438d71999d55131b8b93e7a51669d5fe66fea7fb4f93a1527dad2
Instruction ID: f76306ed9ad21e1be3de75246f50440bdccc16b6206820834e37b6b2ac4578ed
Opcode Fuzzy Hash: d2bbc698187438d71999d55131b8b93e7a51669d5fe66fea7fb4f93a1527dad2
Instruction Fuzzy Hash: 50A1A971D00258DBCB18EFA8C944BEEFBB4BF01324F55425AE811672D1DF78AA45CBA1

Function 00A87490 Relevance: 5.2, APIs: 4, Instructions: 176memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00000000,?,?), ref: 00A875DC
HeapFree.KERNEL32(00000000,?,?,?,00000000,?,?), ref: 00A875E2
GetProcessHeap.KERNEL32(?,?,?,?), ref: 00A8763C
HeapFree.KERNEL32(00000000,?,?,?,?), ref: 00A87642

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 7ff38d6c64e8bb9eb10a8aa7837f238964c3afd56f7c0ca79ca0a72eb6b6c966
Instruction ID: ec2bbd380f0411ae41b723fd79ebfaa02a1a689a87e573396aeeae5a5e88fc3b
Opcode Fuzzy Hash: 7ff38d6c64e8bb9eb10a8aa7837f238964c3afd56f7c0ca79ca0a72eb6b6c966
Instruction Fuzzy Hash: 0361DC70D09218DFCB19EFA8C944BEEFBB4BF10314F244269E41167291EB30AA45DB90

Function 00A3EA60 Relevance: 5.1, APIs: 4, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,2BB8795F,?,?,?,00C4760D,000000FF), ref: 00A3EAA7
HeapFree.KERNEL32(00000000,?,?,2BB8795F,?,?,?,00C4760D,000000FF), ref: 00A3EAAD

Part of subcall function 00A40A20: GetProcessHeap.KERNEL32(00000000,-0000001B,00000001,?,?,00A40B4B,00000000,?,00000001,?), ref: 00A40A43
Part of subcall function 00A40A20: HeapAlloc.KERNEL32(00000000,00000000,-0000001B,00000001,?,?,00A40B4B,00000000,?,00000001,?), ref: 00A40A49

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,2BB8795F), ref: 00A3EB36
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,?,0000FDE9,00000000,?,?,00000000,00000000,2BB8795F), ref: 00A3EB88

Memory Dump Source

Source File: 00000000.00000002.1671872319.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1671845353.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088072.0000000000CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672151552.0000000000D58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672172176.0000000000D5A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672201184.0000000000D5B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672235514.0000000000D66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_game.jbxd

Similarity

API ID: Heap$ByteCharMultiProcessWide$AllocFree
String ID:
API String ID: 1621643742-0
Opcode ID: 06bded41b9d2d18f7790d86f4d1a6bef9143927d8b1beaefb25e12a4d2f81ecb
Instruction ID: 890accd727e9f9018c07c5c704999fd782d2551a633c437d555a65a618951d2f
Opcode Fuzzy Hash: 06bded41b9d2d18f7790d86f4d1a6bef9143927d8b1beaefb25e12a4d2f81ecb
Instruction Fuzzy Hash: 66418EB1A04209AFDB15DFA9D801BAEBBF8FB45720F10476EE524A73C0D7B55A049B90