Windows Analysis Report
PiratedLauncher.exe

Overview

General Information

Sample name: PiratedLauncher.exe
Analysis ID: 1655143
MD5: 9cf70e7720867826dbcfb024bb1beb90
SHA1: dc2936155faa218a03ef98bcdcaa15b1cf7e45da
SHA256: af21c3e996213f7b1b9b58363723990f423cfa846d824625ddf4977dd550e579
Infos:

Detection

Score: 60
Range: 0 - 100
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
.NET source code contains potential unpacker
Joe Sandbox ML detected suspicious sample
Yara detected Costura Assembly Loader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
May sleep (evasive loops) to hinder dynamic analysis
Program does not show much activity (idle)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: PiratedLauncher.exe Virustotal: Detection: 46% Perma Link
Source: PiratedLauncher.exe ReversingLabs: Detection: 41%
Joe Sandbox ML detected suspicious sample
Source: Submited Sample Neural Call Log Analysis: 90.6%
Uses 32bit PE files
Source: PiratedLauncher.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: PiratedLauncher.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: costura.costura.pdb.compressed source: PiratedLauncher.exe
Source: Binary string: C:\Users\danie\Desktop\Documentos\PiratedLauncher\PiratedLauncher\obj\Debug\PiratedLauncher.pdb source: PiratedLauncher.exe
Source: Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed;microsoft.bcl.asyncinterfacesicostura.microsoft.bcl.asyncinterfaces.dll.compressed source: PiratedLauncher.exe
Source: Binary string: costura.costura.pdb.compressed|||Costura.pdb|806F4C19B2D7FD9E3B836269EC07647019A29E95|7960 source: PiratedLauncher.exe
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://james.newtonking.com/projects/json
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0O
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: PiratedLauncher.exe, 00000000.00000002.1106187579.0000000006912000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: PiratedLauncher.exe String found in binary or memory: https://piratedheat.top/api/checkKey.php?api_key=
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://piratedheat.top/api/json
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://piratedheat.top/api/launcherVersion
Source: PiratedLauncher.exe String found in binary or memory: https://piratedheat.top/api/launcherVersionAhttps://piratedheat.top/api/json
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.newtonsoft.com/json
Source: PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Sample file is different than original file name gathered from version info
Source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs PiratedLauncher.exe
Source: PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs PiratedLauncher.exe
Source: PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs PiratedLauncher.exe
Source: PiratedLauncher.exe, 00000000.00000002.1103685563.0000000000963000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs PiratedLauncher.exe
Source: PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs PiratedLauncher.exe
Source: PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs PiratedLauncher.exe
Uses 32bit PE files
Source: PiratedLauncher.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: PiratedLauncher.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal60.evad.winEXE@2/0@0/0
Source: C:\Users\user\Desktop\PiratedLauncher.exe Mutant created: NULL
Source: PiratedLauncher.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: PiratedLauncher.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\PiratedLauncher.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: PiratedLauncher.exe Virustotal: Detection: 46%
Source: PiratedLauncher.exe ReversingLabs: Detection: 41%
Source: PiratedLauncher.exe String found in binary or memory: Exiting.Whttps://piratedheat.top/api/launcherVersionAhttps://piratedheat.top/api/json
Source: unknown Process created: C:\Users\user\Desktop\PiratedLauncher.exe "C:\Users\user\Desktop\PiratedLauncher.exe"
Source: unknown Process created: C:\Users\user\Desktop\PiratedLauncher.exe "C:\Users\user\Desktop\PiratedLauncher.exe"
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\PiratedLauncher.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: PiratedLauncher.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: PiratedLauncher.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: PiratedLauncher.exe Static file information: File size 1699840 > 1048576
Source: PiratedLauncher.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x176000
Source: PiratedLauncher.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: PiratedLauncher.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: PiratedLauncher.exe, 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003AF9000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000000.00000002.1104800164.0000000003879000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1195281641.0000000002D23000.00000004.00000800.00020000.00000000.sdmp, PiratedLauncher.exe, 00000002.00000002.1194342520.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: costura.costura.pdb.compressed source: PiratedLauncher.exe
Source: Binary string: C:\Users\danie\Desktop\Documentos\PiratedLauncher\PiratedLauncher\obj\Debug\PiratedLauncher.pdb source: PiratedLauncher.exe
Source: Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed;microsoft.bcl.asyncinterfacesicostura.microsoft.bcl.asyncinterfaces.dll.compressed source: PiratedLauncher.exe
Source: Binary string: costura.costura.pdb.compressed|||Costura.pdb|806F4C19B2D7FD9E3B836269EC07647019A29E95|7960 source: PiratedLauncher.exe

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: PiratedLauncher.exe, AssemblyLoader.cs .Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
Yara detected Costura Assembly Loader
Source: Yara match File source: PiratedLauncher.exe, type: SAMPLE
Source: Yara match File source: 00000002.00000002.1195281641.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.1056274522.0000000000202000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1104672970.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PiratedLauncher.exe PID: 6964, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PiratedLauncher.exe PID: 6184, type: MEMORYSTR
Binary contains a suspicious time stamp
Source: PiratedLauncher.exe Static PE information: 0xF4F1661D [Tue Mar 23 04:57:01 2100 UTC]
Source: PiratedLauncher.exe Static PE information: section name: .text entropy: 7.791525435429848
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\PiratedLauncher.exe Memory allocated: 2630000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Memory allocated: 2870000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Memory allocated: 2630000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Memory allocated: 2B40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Memory allocated: 2CF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Memory allocated: 4CF0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\PiratedLauncher.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\PiratedLauncher.exe TID: 6988 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe TID: 6224 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\PiratedLauncher.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\PiratedLauncher.exe Memory allocated: page read and write | page guard Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Users\user\Desktop\PiratedLauncher.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\userbrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\userbrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\userbrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\userbriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\userFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\userFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\userFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\userST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\userSTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\userSTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\userSTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Users\user\Desktop\PiratedLauncher.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PiratedLauncher.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1655143 Sample: PiratedLauncher.exe Startdate: 03/04/2025 Architecture: WINDOWS Score: 60 9 Multi AV Scanner detection for submitted file 2->9 11 .NET source code contains potential unpacker 2->11 13 Joe Sandbox ML detected suspicious sample 2->13 15 Yara detected Costura Assembly Loader 2->15 5 PiratedLauncher.exe 2 2->5         started        7 PiratedLauncher.exe 2 2->7         started        process3
⊘No contacted IP infos