Edit tour

Windows Analysis Report
Launcher.exe

Overview

General Information

Sample name:	Launcher.exe
Analysis ID:	1634508
MD5:	9ac3cffff2b2704d80330f3fe6986ddd
SHA1:	625e7e0f87a05a2dfc25459af0448fd5530527b8
SHA256:	7f9684d810854a7212ea9aa9842a3a9ac7bbb35cefe250257bc1747f5d830ed9
Tags:	exeLummaStealeruser-TornadoAV_dev
Infos:

Detection

Score:	64
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Sample uses string decryption to hide its real strings

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Launcher.exe (PID: 7448 cmdline: "C:\Users\user\Desktop\Launcher.exe" MD5: 9AC3CFFFF2B2704D80330F3FE6986DDD)

conhost.exe (PID: 7456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Launcher.exe (PID: 7500 cmdline: "C:\Users\user\Desktop\Launcher.exe" MD5: 9AC3CFFFF2B2704D80330F3FE6986DDD)

cleanup

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T00:44:00.263218+0100	2028371	3	Unknown Traffic	192.168.2.11	49705	92.122.104.90	443	TCP
2025-03-11T00:44:03.327176+0100	2028371	3	Unknown Traffic	192.168.2.11	49706	92.122.104.90	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Launcher.exe	Virustotal: Detection: 50%			Perma Link
Source: Launcher.exe	ReversingLabs: Detection: 58%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.1% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1062089204.0000000002A58000.00000004.00000020.00020000.00000000.sdmp	String decryptor: defaulemot.run/jUSiaz
Source: 00000000.00000002.1062089204.0000000002A58000.00000004.00000020.00020000.00000000.sdmp	String decryptor: begindecafer.world/QwdZdf
Source: 00000000.00000002.1062089204.0000000002A58000.00000004.00000020.00020000.00000000.sdmp	String decryptor: garagedrootz.top/oPsoJAN
Source: 00000000.00000002.1062089204.0000000002A58000.00000004.00000020.00020000.00000000.sdmp	String decryptor: modelshiverd.icu/bJhnsj
Source: 00000000.00000002.1062089204.0000000002A58000.00000004.00000020.00020000.00000000.sdmp	String decryptor: arisechairedd.shop/JnsHY
Source: 00000000.00000002.1062089204.0000000002A58000.00000004.00000020.00020000.00000000.sdmp	String decryptor: catterjur.run/boSnzhu
Source: 00000000.00000002.1062089204.0000000002A58000.00000004.00000020.00020000.00000000.sdmp	String decryptor: orangemyther.live/IozZ
Source: 00000000.00000002.1062089204.0000000002A58000.00000004.00000020.00020000.00000000.sdmp	String decryptor: fostinjec.today/LksNAz

Source: Launcher.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 92.122.104.90:443 -> 192.168.2.11:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.122.104.90:443 -> 192.168.2.11:49706 version: TLS 1.2

Source: Launcher.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008AAA8E FindFirstFileExW,	0_2_008AAA8E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008AAB3F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_008AAB3F
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008AAA8E FindFirstFileExW,	2_2_008AAA8E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008AAB3F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_008AAB3F

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+4C6E5BC6h]	2_2_0044D020
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], edx	2_2_0040E830
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov dword ptr [esi], ebx	2_2_0040E830
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then push eax	2_2_0044953F
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+1C010B3Ah]	2_2_0040D7C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+2E5A4C14h]	2_2_0040D7C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 18A944CDh	2_2_0041F075
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+08h]	2_2_0043314C
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-4A38BC72h]	2_2_0041D97C
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	2_2_0041D97C
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movsx edx, byte ptr [ebx+ecx]	2_2_0044A915
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp al, 5Ch	2_2_00402130
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [edi], bl	2_2_0040C180
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 1ED597A4h	2_2_00447980
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+4C6E5BC6h]	2_2_0044D180
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	2_2_0044B9A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-4A38BC72h]	2_2_0041BBE6
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	2_2_0041BBE6
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ebp+02h]	2_2_00429A40
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+070A39CCh]	2_2_00430A40
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 7A542AABh	2_2_0044C200
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then push esi	2_2_00411A0D
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	2_2_0040A230
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	2_2_0040A230
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+08h]	2_2_0040E2D4
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-691C0498h]	2_2_00438AFB
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+16h]	2_2_00438AFB
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	2_2_004102FE
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-444B2606h]	2_2_0044BAA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+7B8E0828h]	2_2_0041CB46
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+edi+00000090h]	2_2_00402B50
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then jmp dword ptr [00453BFCh]	2_2_00432356
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+31C48B22h]	2_2_00443B00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ebx, byte ptr [ebp+eax+070A3970h]	2_2_0042FB30
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edx, esi	2_2_0041BBC8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edi, byte ptr [ecx]	2_2_0041BBC8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov dword ptr [esp+04h], eax	2_2_0041BBC8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+ecx+04h]	2_2_004203D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then lea edi, dword ptr [eax+070A39A0h]	2_2_00412BD7
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+16h]	2_2_00438BE8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_00440C40
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edi+04h]	2_2_0044B450
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00438C36
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	2_2_0041ACC0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-3E88CADCh]	2_2_0041C4EF
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-757569DEh]	2_2_004304B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+070A39A0h]	2_2_004304B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx eax, di	2_2_004304B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	2_2_00429560
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	2_2_00429560
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [esp+ebx+08h], cl	2_2_0040E518
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx esi, byte ptr [ebx+eax]	2_2_00410D1C
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+4C6E5BC2h]	2_2_0044C530
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then push esi	2_2_0041DDC0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-72h]	2_2_004235C9
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+070A39ACh]	2_2_00420D80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-377C9EDAh]	2_2_00420D80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 6D58C181h	2_2_00420D80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-1028CA64h]	2_2_00411D9B
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-72h]	2_2_004235AE
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0043360F
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-186CCFC6h]	2_2_004476C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edx, dword ptr [ecx+esi+3Ch]	2_2_004476C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx+70h]	2_2_0041CECB
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edi, dword ptr [ecx+esi*4-000009BCh]	2_2_0040D6F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-5E1C168Ch]	2_2_0041E744
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov dword ptr [ebp-18h], esi	2_2_0044975C
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 743EDB10h	2_2_0044BF20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+000000C8h]	2_2_00412FC3
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_004347F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov dword ptr [esp+14h], esi	2_2_00447F80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax]	2_2_00447F80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax]	2_2_00447F80

Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com

Source: Joe Sandbox View

IP Address: 92.122.104.90 92.122.104.90

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49705 -> 92.122.104.90:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49706 -> 92.122.104.90:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com

Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C0464fd338918e8dd935a9241acdeda5f; path=/; secure; HttpOnly; SameSite=Nonesessionid=7bb56d3a4c9b09db86ee4bb1; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26508Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 10 Mar 2025 23:44:04 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-ControlI equals www.youtube.com (Youtube)
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: defaulemot.run
Source: global traffic	DNS traffic detected: DNS query: begindecafer.world
Source: global traffic	DNS traffic detected: DNS query: garagedrootz.top
Source: global traffic	DNS traffic detected: DNS query: modelshiverd.icu
Source: global traffic	DNS traffic detected: DNS query: arisechairedd.shop
Source: global traffic	DNS traffic detected: DNS query: catterjur.run
Source: global traffic	DNS traffic detected: DNS query: orangemyther.live
Source: global traffic	DNS traffic detected: DNS query: fostinjec.today
Source: global traffic	DNS traffic detected: DNS query: sterpickced.digital
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: Launcher.exe, 00000002.00000002.1123568295.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: Launcher.exe, 00000002.00000002.1123568295.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: Launcher.exe, 00000002.00000002.1123568295.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=3Cj4p8f8gr
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=N4H9vOOxi8kG&l=english&am
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=e
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=EZbG2DEumYDH&l=engli
Source: Launcher.exe, 00000002.00000002.1123568295.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=1Vea
Source: Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=D1VziU1eIKI3&l=englis
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&a
Source: Launcher.exe, 00000002.00000002.1123568295.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=np
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcD
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=G3UTKgHH4xLD&l=engl
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=nc69vwog8R9p&l=
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=sd6kCnGQW5Ji&
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=n4_f9JKDa7wP&
Source: Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/respo
Source: Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=oQ1d_VAfa_o
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: Launcher.exe, 00000002.00000002.1123568295.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=b
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: Launcher.exe, 00000002.00000002.1123568295.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199822375128
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199822VB
Source: Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: Launcher.exe, 00000002.00000002.1123568295.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128NiTE
Source: Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamloopback.host
Source: Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCou
Source: Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: Launcher.exe, 00000002.00000002.1123568295.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/priv
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: Launcher.exe, 00000002.00000002.1123568295.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown	HTTPS traffic detected: 92.122.104.90:443 -> 192.168.2.11:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.122.104.90:443 -> 192.168.2.11:49706 version: TLS 1.2

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 2_2_0043EDB0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

2_2_0043EDB0

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 2_2_0043EDB0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

2_2_0043EDB0

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 2_2_0043F1A7 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_0043F1A7

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00853A10	0_2_00853A10
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0087CBB0	0_2_0087CBB0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0087D470	0_2_0087D470
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0086A890	0_2_0086A890
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0087F890	0_2_0087F890
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0085C0A0	0_2_0085C0A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008578A0	0_2_008578A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008598A0	0_2_008598A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0086F0A0	0_2_0086F0A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008570B0	0_2_008570B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008800B0	0_2_008800B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008910B0	0_2_008910B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0087A0C0	0_2_0087A0C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008950C0	0_2_008950C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008658D0	0_2_008658D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0087C8D0	0_2_0087C8D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00851000	0_2_00851000
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0088A000	0_2_0088A000
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0086F820	0_2_0086F820
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0085A830	0_2_0085A830
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00867840	0_2_00867840
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0085B850	0_2_0085B850
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0088E860	0_2_0088E860
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0089D07A	0_2_0089D07A
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00871070	0_2_00871070
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00870980	0_2_00870980
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00876180	0_2_00876180
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00855990	0_2_00855990
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008661A0	0_2_008661A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008799A0	0_2_008799A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0085E9B0	0_2_0085E9B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0087D1D0	0_2_0087D1D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008849E0	0_2_008849E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00863100	0_2_00863100
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00887930	0_2_00887930
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00874150	0_2_00874150
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0087C150	0_2_0087C150
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0085A160	0_2_0085A160
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00857A80	0_2_00857A80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0085F280	0_2_0085F280
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00868A80	0_2_00868A80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0085D2A0	0_2_0085D2A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00864AB0	0_2_00864AB0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00895AC0	0_2_00895AC0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00865AE0	0_2_00865AE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008612E0	0_2_008612E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0087F2E0	0_2_0087F2E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00865210	0_2_00865210
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00864210	0_2_00864210
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0087E220	0_2_0087E220
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0085B240	0_2_0085B240
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00873260	0_2_00873260
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00859270	0_2_00859270
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00883380	0_2_00883380
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0086F3C0	0_2_0086F3C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008713E0	0_2_008713E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008923E0	0_2_008923E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0086B3F0	0_2_0086B3F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00886300	0_2_00886300
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00895310	0_2_00895310
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00856320	0_2_00856320
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00856B20	0_2_00856B20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00858320	0_2_00858320
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0086E320	0_2_0086E320
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00868340	0_2_00868340
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00888B40	0_2_00888B40
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008B0342	0_2_008B0342
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00858B50	0_2_00858B50
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0088FB50	0_2_0088FB50
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00889350	0_2_00889350
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00875B60	0_2_00875B60
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00863490	0_2_00863490
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0088A490	0_2_0088A490
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00863CA0	0_2_00863CA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008684A0	0_2_008684A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008AE4C8	0_2_008AE4C8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0085FCC0	0_2_0085FCC0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00874CC0	0_2_00874CC0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0088D4D0	0_2_0088D4D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00870CE0	0_2_00870CE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00871CE0	0_2_00871CE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00888CE0	0_2_00888CE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0088BCF0	0_2_0088BCF0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00887C10	0_2_00887C10
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00872C60	0_2_00872C60
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00885470	0_2_00885470
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00853580	0_2_00853580
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00869580	0_2_00869580
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0086BD80	0_2_0086BD80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00894580	0_2_00894580
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0088EDA0	0_2_0088EDA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008595B0	0_2_008595B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0087A5C0	0_2_0087A5C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008895C0	0_2_008895C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00889DC0	0_2_00889DC0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008655D0	0_2_008655D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00883DD0	0_2_00883DD0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00873DE0	0_2_00873DE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008905F0	0_2_008905F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0087E510	0_2_0087E510
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0086A520	0_2_0086A520
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0085B540	0_2_0085B540
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0088F550	0_2_0088F550
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0085CD70	0_2_0085CD70
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00872690	0_2_00872690
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0087EE90	0_2_0087EE90
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00895690	0_2_00895690
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00865EA0	0_2_00865EA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008986BA	0_2_008986BA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0088D6E0	0_2_0088D6E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008626F0	0_2_008626F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00856600	0_2_00856600
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00895E00	0_2_00895E00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00858610	0_2_00858610
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00868620	0_2_00868620
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0088FE20	0_2_0088FE20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0088AE30	0_2_0088AE30
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0085DF80	0_2_0085DF80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0085C780	0_2_0085C780
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0086CF90	0_2_0086CF90
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0085F7E0	0_2_0085F7E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008A2FE0	0_2_008A2FE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00874FF0	0_2_00874FF0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00855700	0_2_00855700
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00881F00	0_2_00881F00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00888F10	0_2_00888F10
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00868F20	0_2_00868F20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00857F30	0_2_00857F30
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00873740	0_2_00873740
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0088A760	0_2_0088A760
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00855F70	0_2_00855F70
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0088B770	0_2_0088B770
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0040E830	2_2_0040E830
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0040B990	2_2_0040B990
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00401040	2_2_00401040
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0041F075	2_2_0041F075
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0043C830	2_2_0043C830
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0044B0C0	2_2_0044B0C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004138F0	2_2_004138F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0044B170	2_2_0044B170
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00444900	2_2_00444900
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0044A915	2_2_0044A915
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0040F1EE	2_2_0040F1EE
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0043E9F0	2_2_0043E9F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00430A40	2_2_00430A40
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00430A60	2_2_00430A60
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00408A70	2_2_00408A70
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00437A7D	2_2_00437A7D
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00415A00	2_2_00415A00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00423A00	2_2_00423A00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0044B200	2_2_0044B200
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0044C200	2_2_0044C200
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0040A230	2_2_0040A230
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0043D2E5	2_2_0043D2E5
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00438AFB	2_2_00438AFB
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0040DAA2	2_2_0040DAA2
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0044BAA0	2_2_0044BAA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004132B6	2_2_004132B6
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00402B50	2_2_00402B50
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0040CB50	2_2_0040CB50
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00443B00	2_2_00443B00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0042DB20	2_2_0042DB20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0042FB30	2_2_0042FB30
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0041BBC8	2_2_0041BBC8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0044A3CE	2_2_0044A3CE
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004203D0	2_2_004203D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00438BE8	2_2_00438BE8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004533EA	2_2_004533EA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00447B80	2_2_00447B80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00445380	2_2_00445380
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0040FBA0	2_2_0040FBA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00417440	2_2_00417440
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00424440	2_2_00424440
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0044B450	2_2_0044B450
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00409460	2_2_00409460
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0040C460	2_2_0040C460
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0040BC70	2_2_0040BC70
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00444C00	2_2_00444C00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0043B42B	2_2_0043B42B
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004414D4	2_2_004414D4
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00442CE0	2_2_00442CE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00437CE6	2_2_00437CE6
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0043A4EC	2_2_0043A4EC
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00412CFA	2_2_00412CFA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004304B0	2_2_004304B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00412559	2_2_00412559
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00403560	2_2_00403560
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00429560	2_2_00429560
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00437D76	2_2_00437D76
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0041C578	2_2_0041C578
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0044C530	2_2_0044C530
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004285C0	2_2_004285C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004435D0	2_2_004435D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0044B5D0	2_2_0044B5D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0043ADE3	2_2_0043ADE3
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0042DDE4	2_2_0042DDE4
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0041AD80	2_2_0041AD80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00420D80	2_2_00420D80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00407D90	2_2_00407D90
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0042BE67	2_2_0042BE67
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00432E6D	2_2_00432E6D
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0044AE70	2_2_0044AE70
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00416611	2_2_00416611
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00423E10	2_2_00423E10
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0042F620	2_2_0042F620
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004476C0	2_2_004476C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0041CECB	2_2_0041CECB
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00408EE0	2_2_00408EE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004276E0	2_2_004276E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004326E0	2_2_004326E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004246F0	2_2_004246F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00431EA1	2_2_00431EA1
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00416F43	2_2_00416F43
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00442F40	2_2_00442F40
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00443740	2_2_00443740
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0044AF60	2_2_0044AF60
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00403F00	2_2_00403F00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0043CF19	2_2_0043CF19
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00428F20	2_2_00428F20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0044BF20	2_2_0044BF20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00412FC3	2_2_00412FC3
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0042CFE3	2_2_0042CFE3
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004047E2	2_2_004047E2
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00406FE6	2_2_00406FE6
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004207EA	2_2_004207EA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0042D780	2_2_0042D780
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00445780	2_2_00445780
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00447F80	2_2_00447F80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0043BF98	2_2_0043BF98
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004267A6	2_2_004267A6
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0042C7B1	2_2_0042C7B1
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0086A890	2_2_0086A890
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0087F890	2_2_0087F890
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008578A0	2_2_008578A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0085C0A0	2_2_0085C0A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008598A0	2_2_008598A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0086F0A0	2_2_0086F0A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008570B0	2_2_008570B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008800B0	2_2_008800B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008910B0	2_2_008910B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0087A0C0	2_2_0087A0C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008950C0	2_2_008950C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008658D0	2_2_008658D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0087C8D0	2_2_0087C8D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00851000	2_2_00851000
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0088A000	2_2_0088A000
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0086F820	2_2_0086F820
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0085A830	2_2_0085A830
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00867840	2_2_00867840
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0085B850	2_2_0085B850
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0088E860	2_2_0088E860
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0089D07A	2_2_0089D07A
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00871070	2_2_00871070
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00870980	2_2_00870980
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00876180	2_2_00876180
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00855990	2_2_00855990
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008661A0	2_2_008661A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008799A0	2_2_008799A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0085E9B0	2_2_0085E9B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0087D1D0	2_2_0087D1D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008849E0	2_2_008849E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00863100	2_2_00863100
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00887930	2_2_00887930
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00874150	2_2_00874150
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0087C150	2_2_0087C150
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0085A160	2_2_0085A160
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00857A80	2_2_00857A80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0085F280	2_2_0085F280
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00868A80	2_2_00868A80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0085D2A0	2_2_0085D2A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00864AB0	2_2_00864AB0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00895AC0	2_2_00895AC0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00865AE0	2_2_00865AE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008612E0	2_2_008612E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0087F2E0	2_2_0087F2E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00853A10	2_2_00853A10
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00865210	2_2_00865210
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00864210	2_2_00864210
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0087E220	2_2_0087E220
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0085B240	2_2_0085B240
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00873260	2_2_00873260
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00859270	2_2_00859270
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00883380	2_2_00883380
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0087CBB0	2_2_0087CBB0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0086F3C0	2_2_0086F3C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008713E0	2_2_008713E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008923E0	2_2_008923E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0086B3F0	2_2_0086B3F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00886300	2_2_00886300
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00895310	2_2_00895310
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00856320	2_2_00856320
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00856B20	2_2_00856B20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00858320	2_2_00858320
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0086E320	2_2_0086E320
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00868340	2_2_00868340
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00888B40	2_2_00888B40
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008B0342	2_2_008B0342
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00858B50	2_2_00858B50
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0088FB50	2_2_0088FB50
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00889350	2_2_00889350
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00875B60	2_2_00875B60
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00863490	2_2_00863490
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0088A490	2_2_0088A490
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00863CA0	2_2_00863CA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008684A0	2_2_008684A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008AE4C8	2_2_008AE4C8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0085FCC0	2_2_0085FCC0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00874CC0	2_2_00874CC0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0088D4D0	2_2_0088D4D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00870CE0	2_2_00870CE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00871CE0	2_2_00871CE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00888CE0	2_2_00888CE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0088BCF0	2_2_0088BCF0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00887C10	2_2_00887C10
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00872C60	2_2_00872C60
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0087D470	2_2_0087D470
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00885470	2_2_00885470
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00853580	2_2_00853580
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0086BD80	2_2_0086BD80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00869580	2_2_00869580
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00894580	2_2_00894580
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0088EDA0	2_2_0088EDA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008595B0	2_2_008595B0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0087A5C0	2_2_0087A5C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00889DC0	2_2_00889DC0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008895C0	2_2_008895C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008655D0	2_2_008655D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00883DD0	2_2_00883DD0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00873DE0	2_2_00873DE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008905F0	2_2_008905F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0087E510	2_2_0087E510
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0086A520	2_2_0086A520
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0085B540	2_2_0085B540
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0088F550	2_2_0088F550
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0085CD70	2_2_0085CD70
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00872690	2_2_00872690
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0087EE90	2_2_0087EE90
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00895690	2_2_00895690
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00865EA0	2_2_00865EA0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008986BA	2_2_008986BA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0088D6E0	2_2_0088D6E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008626F0	2_2_008626F0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00856600	2_2_00856600
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00895E00	2_2_00895E00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00858610	2_2_00858610
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00868620	2_2_00868620
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0088FE20	2_2_0088FE20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0088AE30	2_2_0088AE30
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0085DF80	2_2_0085DF80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0085C780	2_2_0085C780
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0086CF90	2_2_0086CF90
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0085F7E0	2_2_0085F7E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008A2FE0	2_2_008A2FE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00874FF0	2_2_00874FF0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00855700	2_2_00855700
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00881F00	2_2_00881F00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00888F10	2_2_00888F10
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00868F20	2_2_00868F20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00857F30	2_2_00857F30
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00873740	2_2_00873740
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0088A760	2_2_0088A760
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00855F70	2_2_00855F70
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0088B770	2_2_0088B770

Source: C:\Users\user\Desktop\Launcher.exe	Code function: String function: 0040B220 appears 47 times
Source: C:\Users\user\Desktop\Launcher.exe	Code function: String function: 008A0E2C appears 46 times
Source: C:\Users\user\Desktop\Launcher.exe	Code function: String function: 00898BC0 appears 101 times
Source: C:\Users\user\Desktop\Launcher.exe	Code function: String function: 0041AD70 appears 96 times
Source: C:\Users\user\Desktop\Launcher.exe	Code function: String function: 008A5BD4 appears 34 times

Source: Launcher.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Launcher.exe	Static PE information: Section: .bss ZLIB complexity 1.0003245881088825
Source: Launcher.exe	Static PE information: Section: .bss ZLIB complexity 1.0003245881088825

Source: classification engine

Classification label: mal64.evad.winEXE@4/0@11/1

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 2_2_0043D2E5 CoCreateInstance,

2_2_0043D2E5

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7456:120:WilError_03

Source: Launcher.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Launcher.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Launcher.exe	Virustotal: Detection: 50%
Source: Launcher.exe	ReversingLabs: Detection: 58%

Source: C:\Users\user\Desktop\Launcher.exe

File read: C:\Users\user\Desktop\Launcher.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"
Source: C:\Users\user\Desktop\Launcher.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Launcher.exe	Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"
Source: C:\Users\user\Desktop\Launcher.exe	Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: dpapi.dll	Jump to behavior

Source: Launcher.exe

Static file information: File size 1207808 > 1048576

Source: Launcher.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0088CA05 pushfd ; ret	0_2_0088CA09
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0088CC5D push 89D0F735h; ret	0_2_0088CC65
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00898D7A push ecx; ret	0_2_00898D8D
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0045494F push edi; ret	2_2_00454955
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00455924 push ebx; iretd	2_2_00455939
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004549B4 push edx; ret	2_2_004549DD
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004549B1 push ebx; ret	2_2_004549B2
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00454A45 push ebx; ret	2_2_00454A4E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00454A2C push ebx; ret	2_2_00454A2E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00454A30 push edx; ret	2_2_004549DD
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004542E9 push esp; ret	2_2_004542EA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004542AD push ebx; ret	2_2_004542AE
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004542BC push edx; ret	2_2_004542BD
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_004542BF push ebx; ret	2_2_004542C2
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00451CAC push cs; retf	2_2_00451CD7
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00455586 push esp; ret	2_2_00455591
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00453E68 push sp; ret	2_2_0045426A
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0088CA05 pushfd ; ret	2_2_0088CA09
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_0088CC5D push 89D0F735h; ret	2_2_0088CC65
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00898D7A push ecx; ret	2_2_00898D8D

Source: Launcher.exe

Static PE information: section name: .text entropy: 7.087634248192435

Source: C:\Users\user\Desktop\Launcher.exe

API coverage: 3.5 %

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008AAA8E FindFirstFileExW,	0_2_008AAA8E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008AAB3F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_008AAB3F
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008AAA8E FindFirstFileExW,	2_2_008AAA8E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008AAB3F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_008AAB3F

Source: Launcher.exe, 00000002.00000002.1123568295.0000000000F83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0R
Source: Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWd

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 2_2_004494F0 LdrInitializeThunk,

2_2_004494F0

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_00898A4E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00898A4E

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_008C11B4 mov edi, dword ptr fs:[00000030h]

0_2_008C11B4

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_008A64CC GetProcessHeap,

0_2_008A64CC

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00898A4E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00898A4E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00898A42 SetUnhandledExceptionFilter,	0_2_00898A42
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_008A0B7E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_008A0B7E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00898692 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00898692
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00898A4E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00898A4E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00898A42 SetUnhandledExceptionFilter,	2_2_00898A42
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_008A0B7E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_008A0B7E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 2_2_00898692 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00898692

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_008C11B4 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_008C11B4

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Launcher.exe

Memory written: C:\Users\user\Desktop\Launcher.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	0_2_008A58BC
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_008AA0E4
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	0_2_008AA049
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	0_2_008AA396
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	0_2_008AA337
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	0_2_008AA4B6
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	0_2_008AA46B
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	0_2_008A5DB7
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_008A9DF8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_008AA55D
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	0_2_008AA663
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	2_2_008A58BC
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_008AA0E4
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	2_2_008AA049
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	2_2_008AA396
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	2_2_008AA337
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	2_2_008AA4B6
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	2_2_008AA46B
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	2_2_008A5DB7
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_008A9DF8
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_008AA55D
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	2_2_008AA663

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_00899487 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00899487

Source: C:\Users\user\Desktop\Launcher.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	211 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	2 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Launcher.exe	50%	Virustotal		Browse
Launcher.exe	58%	ReversingLabs	Win32.Trojan.LummaC

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	92.122.104.90	true	false	high
modelshiverd.icu	unknown	unknown	false	high
garagedrootz.top	unknown	unknown	false	high
fostinjec.today	unknown	unknown	false	high
catterjur.run	unknown	unknown	false	high
defaulemot.run	unknown	unknown	false	high
sterpickced.digital	unknown	unknown	false	high
arisechairedd.shop	unknown	unknown	false	high
orangemyther.live	unknown	unknown	false	high
begindecafer.world	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199822375128	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://steamcommunity.com/my/wishlist/	Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://player.vimeo.com	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=nc69vwog8R9p&l=	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=np	Launcher.exe, 00000002.00000002.1123568295.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamloopback.host	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/?subsection=broadcasts	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://help.steampowered.com/en/	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/shared/images/respo	Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp	false	high
https://steamcommunity.com/market/	Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://store.steampowered.com/news/	Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=oQ1d_VAfa_o	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://steamcommunity.com/?subsection=b	Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=N4H9vOOxi8kG&l=english&am	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://store.steampowered.com/subscriber_agreement/	Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.gstatic.cn/recaptcha/	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
http://store.steampowered.com/subscriber_agreement/	Launcher.exe, 00000002.00000002.1123568295.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	false	high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	Launcher.exe, 00000002.00000002.1123568295.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	false	high
https://recaptcha.net/recaptcha/;	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.valvesoftware.com/legal.htm	Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&a	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://steamcommunity.com/discussions/	Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.youtube.com	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199822375128	Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://store.steampowered.com/stats/	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://medal.tv	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://broadcast.st.dl.eccdnx.com	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/steam_refunds/	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=G3UTKgHH4xLD&l=engl	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://steamcommunity.com/profiles/76561199822375128NiTE	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	Launcher.exe, 00000002.00000002.1123568295.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=e	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=3Cj4p8f8gr	Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	false	high
https://s.ytimg.com;	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/workshop/	Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://login.steampowered.com/	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcD	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://store.steampowered.com/legal/	Launcher.exe, 00000002.00000002.1123568295.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	false	high
https://steam.tv/	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=sd6kCnGQW5Ji&	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://store.steampowered.com/privacy_agreement/	Launcher.exe, 00000002.00000002.1123568295.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	false	high
https://store.steampowered.com/points/shop/	Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://recaptcha.net	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/	Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://store.steampowered.com/priv	Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp	false	high
https://steamcommunity.com	Launcher.exe, 00000002.00000002.1123568295.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	false	high
https://sketchfab.com	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lv.queniujq.cn	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.youtube.com/	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
http://127.0.0.1:27060	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=D1VziU1eIKI3&l=englis	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://store.steampowered.com/privacy_agreement/	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=EZbG2DEumYDH&l=engli	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=n4_f9JKDa7wP&	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=1Vea	Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	Launcher.exe, 00000002.00000002.1123568295.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/recaptcha/	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://checkout.steampowered.com/	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://help.steampowered.com/	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.steampowered.com/	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	false	high
http://store.steampowered.com/account/cookiepreferences/	Launcher.exe, 00000002.00000002.1123568295.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.0000000003486000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	Launcher.exe, 00000002.00000002.1124012630.0000000003482000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123133566.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://store.steampowered.com/mobile	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://steamcommunity.com/	Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp, Launcher.exe, 00000002.00000002.1123568295.0000000000FB1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCou	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/;	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199822VB	Launcher.exe, 00000002.00000002.1123726466.000000000104B000.00000004.00000020.00020000.00000000.sdmp, Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/about/	Launcher.exe, 00000002.00000003.1123053745.000000000348A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.cloudflare.steamstatic.com/	Launcher.exe, 00000002.00000003.1123084013.000000000104B000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
92.122.104.90	steamcommunity.com	European Union		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1634508
Start date and time:	2025-03-11 00:43:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Launcher.exe
Detection:	MAL
Classification:	mal64.evad.winEXE@4/0@11/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 87% Number of executed functions: 21 Number of non-executed functions: 152
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
92.122.104.90	wanscam software ocx setup download.exe	Get hash	malicious	Unknown	Browse
	9XBNCpoOBa.exe	Get hash	malicious	LummaC Stealer	Browse
	https://staemcomumnity.com/gift/id=95124	Get hash	malicious	Unknown	Browse
	https://steam-shortlink.cfd/s/KQRA	Get hash	malicious	Unknown	Browse
	https://steamcommunity-cash.com/gift-card/6386958612	Get hash	malicious	Unknown	Browse
	https://staemcomunnittly.com/gift/activation=Dor5Fhnm6w	Get hash	malicious	HTMLPhisher	Browse
	https://steamcommunttiy.com/activation=Tvc2Fh12mw1	Get hash	malicious	Unknown	Browse
	https://sltreanmcommnunlty.com/nurka/kisloy/efotr	Get hash	malicious	Unknown	Browse
	http://steamcommunity-cash.com/gift/id=572931441	Get hash	malicious	Unknown	Browse
	ForcesLangi.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	download.php.exe.bin.exe	Get hash	malicious	Amadey, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.73.234.102
	FORTNITE_MOD_MENU.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	Arly.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	FORTNITE_MOD_MENU.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	RexLabs 1.59.5.exe	Get hash	malicious	Discord Token Stealer, PRYSMAX STEALER	Browse	104.73.234.102

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	GTA_installer.exe	Get hash	malicious	Unknown	Browse	184.30.131.245
	GTA_installer.exe	Get hash	malicious	Unknown	Browse	2.23.77.188
	Nouvelle_commande9353834.xls	Get hash	malicious	Unknown	Browse	23.60.203.209
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	Nouvelle_commande9353834.xls	Get hash	malicious	Unknown	Browse	23.199.214.10
	840.xls	Get hash	malicious	Unknown	Browse	23.199.214.10
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	Fd-Employee-Handbook(1).pdf	Get hash	malicious	Unknown	Browse	23.197.208.205
	download.php.exe.bin.exe	Get hash	malicious	Amadey, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.73.234.102
	FORTNITE_MOD_MENU.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	CryptocommSetup.msi	Get hash	malicious	BumbleBee	Browse	92.122.104.90
	COTA#U00c7#U00c3O.xls	Get hash	malicious	Unknown	Browse	92.122.104.90
	Order_Mar25.xls	Get hash	malicious	Unknown	Browse	92.122.104.90
	file.exe	Get hash	malicious	LummaC Stealer	Browse	92.122.104.90
	COTA#U00c7#U00c3O.xls	Get hash	malicious	Unknown	Browse	92.122.104.90
	Order_Mar25.xls	Get hash	malicious	Unknown	Browse	92.122.104.90
	POETDB24-2577.xla.xlsx	Get hash	malicious	Unknown	Browse	92.122.104.90
	POETDB24-25771.xla.xlsx	Get hash	malicious	Unknown	Browse	92.122.104.90
	file.exe	Get hash	malicious	LummaC Stealer	Browse	92.122.104.90
	file.exe	Get hash	malicious	LummaC Stealer	Browse	92.122.104.90

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.732880160833874
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Launcher.exe
File size:	1'207'808 bytes
MD5:	9ac3cffff2b2704d80330f3fe6986ddd
SHA1:	625e7e0f87a05a2dfc25459af0448fd5530527b8
SHA256:	7f9684d810854a7212ea9aa9842a3a9ac7bbb35cefe250257bc1747f5d830ed9
SHA512:	fbfb1534fd4b3247c8516a39076bf590ab6ffc66b445ff4e1b9abf04067b5111484304a8d7e984cf73f2f6039133cb4e458edc401ca0ecf4f78f1e133246e5af
SSDEEP:	24576:6j/mpbrBKmSRYVOkIWNmdLCNRYVOkIWNmdLC:sEbrBhSublNmdLCNublNmdLC
TLSH:	6245021161E1D073F659A1B539B9E7B814ABEAB2C73C4FCB42E4E3389514AD0072F52E
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g.................J..........2.............@.......................................@.....................................(..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x449432
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67CD8EEB [Sun Mar 9 12:51:55 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	5939c2f1c22856cd3b44078e652cb2e3

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
call 00007F6AC4AF9CDAh
jmp 00007F6AC4AF9B49h
mov ecx, dword ptr [00471840h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F6AC4AF9CD6h
test esi, ecx
jne 00007F6AC4AF9CF8h
call 00007F6AC4AF9D01h
mov ecx, eax
cmp ecx, edi
jne 00007F6AC4AF9CD9h
mov ecx, BB40E64Fh
jmp 00007F6AC4AF9CE0h
test esi, ecx
jne 00007F6AC4AF9CDCh
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [00471840h], ecx
not ecx
pop edi
mov dword ptr [00471880h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [0046E820h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [0046E7E0h]
xor dword ptr [ebp-04h], eax
call dword ptr [0046E7DCh]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [0046E868h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00473490h
call dword ptr [0046E840h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F6AC4B00825h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6e608	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x73e00	0x4540
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x75000	0x3420	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x6aaf8	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x66f68	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6e77c	0x14c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x64880	0x64a00	264a6b80f403ec03290314404d7341fc	False	0.5429129464285715	data	7.087634248192435	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x66000	0xa02c	0xa200	d5633a5e63f5f0dd82bb024c4deee238	False	0.4222849151234568	data	4.899659326945419	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x71000	0x2c5c	0x1600	300f1aae4a09a01ee6617efed7a71430	False	0.4069602272727273	data	4.7426899195730305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x74000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x75000	0x3420	0x3600	31cbd51510cb3b55c9256c403b8d92c6	False	0.7714120370370371	data	6.609028400943488	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x79000	0x57400	0x57400	1e796581343dc9f51b97c34524b1077f	False	1.0003245881088825	data	7.999461935882898	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xd1000	0x57400	0x57400	1e796581343dc9f51b97c34524b1077f	False	1.0003245881088825	data	7.999461935882898	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeConsole, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEndOfFile, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-11T00:44:00.263218+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49705	92.122.104.90	443	TCP
2025-03-11T00:44:03.327176+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49706	92.122.104.90	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2025 00:43:58.541404009 CET	49705	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:43:58.541440010 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:43:58.541507006 CET	49705	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:43:58.544919014 CET	49705	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:43:58.544931889 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:00.263127089 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:00.263217926 CET	49705	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:00.267316103 CET	49705	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:00.267348051 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:00.267627954 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:00.330925941 CET	49705	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:00.812978029 CET	49705	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:00.860331059 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:01.486164093 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:01.486198902 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:01.486207962 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:01.486232996 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:01.486248970 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:01.486300945 CET	49705	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:01.486334085 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:01.486352921 CET	49705	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:01.486383915 CET	49705	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:01.555202007 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:01.555262089 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:01.555322886 CET	49705	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:01.555347919 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:01.555388927 CET	49705	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:01.558552027 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:01.558628082 CET	49705	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:01.558635950 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:01.558650970 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:01.558698893 CET	49705	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:01.560014009 CET	49705	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:01.560031891 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:01.560048103 CET	49705	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:01.560054064 CET	443	49705	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:01.571492910 CET	49706	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:01.571546078 CET	443	49706	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:01.571625948 CET	49706	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:01.571985960 CET	49706	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:01.571997881 CET	443	49706	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:03.327042103 CET	443	49706	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:03.327176094 CET	49706	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:03.543212891 CET	49706	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:03.543256044 CET	443	49706	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:03.544248104 CET	443	49706	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:03.569179058 CET	49706	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:03.612360001 CET	443	49706	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:04.267246008 CET	443	49706	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:04.267317057 CET	443	49706	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:04.267363071 CET	443	49706	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:04.267374039 CET	49706	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:04.267415047 CET	443	49706	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:04.267456055 CET	49706	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:04.267476082 CET	49706	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:04.336234093 CET	443	49706	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:04.336313009 CET	443	49706	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:04.336400032 CET	443	49706	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:04.336446047 CET	49706	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:04.336477995 CET	443	49706	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:04.336509943 CET	49706	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:04.336558104 CET	443	49706	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:04.336611986 CET	49706	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:04.337317944 CET	49706	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:04.337374926 CET	443	49706	92.122.104.90	192.168.2.11
Mar 11, 2025 00:44:04.337408066 CET	49706	443	192.168.2.11	92.122.104.90
Mar 11, 2025 00:44:04.337424994 CET	443	49706	92.122.104.90	192.168.2.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2025 00:43:58.227096081 CET	54283	53	192.168.2.11	1.1.1.1
Mar 11, 2025 00:43:58.235668898 CET	53	54283	1.1.1.1	192.168.2.11
Mar 11, 2025 00:43:58.243499041 CET	51264	53	192.168.2.11	1.1.1.1
Mar 11, 2025 00:43:58.252319098 CET	53	51264	1.1.1.1	192.168.2.11
Mar 11, 2025 00:43:58.253714085 CET	54634	53	192.168.2.11	1.1.1.1
Mar 11, 2025 00:43:58.464006901 CET	53	54634	1.1.1.1	192.168.2.11
Mar 11, 2025 00:43:58.465560913 CET	55216	53	192.168.2.11	1.1.1.1
Mar 11, 2025 00:43:58.475100040 CET	53	55216	1.1.1.1	192.168.2.11
Mar 11, 2025 00:43:58.476730108 CET	60183	53	192.168.2.11	1.1.1.1
Mar 11, 2025 00:43:58.486358881 CET	53	60183	1.1.1.1	192.168.2.11
Mar 11, 2025 00:43:58.487737894 CET	49599	53	192.168.2.11	1.1.1.1
Mar 11, 2025 00:43:58.496929884 CET	53	49599	1.1.1.1	192.168.2.11
Mar 11, 2025 00:43:58.498250961 CET	54133	53	192.168.2.11	1.1.1.1
Mar 11, 2025 00:43:58.506427050 CET	53	54133	1.1.1.1	192.168.2.11
Mar 11, 2025 00:43:58.507740974 CET	54996	53	192.168.2.11	1.1.1.1
Mar 11, 2025 00:43:58.516660929 CET	53	54996	1.1.1.1	192.168.2.11
Mar 11, 2025 00:43:58.517977953 CET	57586	53	192.168.2.11	1.1.1.1
Mar 11, 2025 00:43:58.526671886 CET	53	57586	1.1.1.1	192.168.2.11
Mar 11, 2025 00:43:58.528183937 CET	49821	53	192.168.2.11	1.1.1.1
Mar 11, 2025 00:43:58.535352945 CET	53	49821	1.1.1.1	192.168.2.11
Mar 11, 2025 00:44:01.561702967 CET	56534	53	192.168.2.11	1.1.1.1
Mar 11, 2025 00:44:01.569587946 CET	53	56534	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 11, 2025 00:43:58.227096081 CET	192.168.2.11	1.1.1.1	0x85ec	Standard query (0)	defaulemot.run	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.243499041 CET	192.168.2.11	1.1.1.1	0xf3aa	Standard query (0)	begindecafer.world	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.253714085 CET	192.168.2.11	1.1.1.1	0x867	Standard query (0)	garagedrootz.top	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.465560913 CET	192.168.2.11	1.1.1.1	0x77a2	Standard query (0)	modelshiverd.icu	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.476730108 CET	192.168.2.11	1.1.1.1	0x7d78	Standard query (0)	arisechairedd.shop	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.487737894 CET	192.168.2.11	1.1.1.1	0x5e52	Standard query (0)	catterjur.run	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.498250961 CET	192.168.2.11	1.1.1.1	0xe071	Standard query (0)	orangemyther.live	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.507740974 CET	192.168.2.11	1.1.1.1	0xda17	Standard query (0)	fostinjec.today	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.517977953 CET	192.168.2.11	1.1.1.1	0x117a	Standard query (0)	sterpickced.digital	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.528183937 CET	192.168.2.11	1.1.1.1	0x13ab	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:44:01.561702967 CET	192.168.2.11	1.1.1.1	0xd916	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 11, 2025 00:43:58.235668898 CET	1.1.1.1	192.168.2.11	0x85ec	Name error (3)	defaulemot.run	none	none	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.252319098 CET	1.1.1.1	192.168.2.11	0xf3aa	Name error (3)	begindecafer.world	none	none	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.464006901 CET	1.1.1.1	192.168.2.11	0x867	Name error (3)	garagedrootz.top	none	none	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.475100040 CET	1.1.1.1	192.168.2.11	0x77a2	Name error (3)	modelshiverd.icu	none	none	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.486358881 CET	1.1.1.1	192.168.2.11	0x7d78	Name error (3)	arisechairedd.shop	none	none	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.496929884 CET	1.1.1.1	192.168.2.11	0x5e52	Name error (3)	catterjur.run	none	none	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.506427050 CET	1.1.1.1	192.168.2.11	0xe071	Name error (3)	orangemyther.live	none	none	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.516660929 CET	1.1.1.1	192.168.2.11	0xda17	Name error (3)	fostinjec.today	none	none	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.526671886 CET	1.1.1.1	192.168.2.11	0x117a	Name error (3)	sterpickced.digital	none	none	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:43:58.535352945 CET	1.1.1.1	192.168.2.11	0x13ab	No error (0)	steamcommunity.com		92.122.104.90	A (IP address)	IN (0x0001)	false
Mar 11, 2025 00:44:01.569587946 CET	1.1.1.1	192.168.2.11	0xd916	No error (0)	steamcommunity.com		92.122.104.90	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49705	92.122.104.90	443	7500	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 23:44:00 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-10 23:44:01 UTC	1974	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 10 Mar 2025 23:44:01 GMT Content-Length: 26508 Connection: close Set-Cookie: sessionid=b424721a430f14cdecb34c22; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C0464fd338918e8dd935a9241acdeda5f; path=/; secure; HttpOnly; SameSite=None
2025-03-10 23:44:01 UTC	14410	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-10 23:44:01 UTC	10166	IN	Data Raw: 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: k" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2025-03-10 23:44:01 UTC	1932	IN	Data Raw: 73 65 63 74 69 6f 6e 54 65 78 74 22 3e 0a 09 09 09 09 41 6e 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 3a 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 2f 70 3e 0a 09 09 09 3c 68 33 3e 46 61 69 6c 65 64 20 6c 6f 61 64 69 6e 67 20 70 72 6f 66 69 6c 65 20 64 61 74 61 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2e 3c 2f 68 33 3e 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 72 65 74 75 72 6e 4c 69 6e 6b 22 3e 48 65 72 65 27 73 20 61 20 6c 69 6e 6b 20 74 6f 20 74 68 65 20 53 74 65 61 6d 20 43 6f 6d 6d 75 6e 69 74 79 20 3c 61 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 53 74 61 6e 64 61 72 64 22 20 68 72 65 66 3d 22 Data Ascii: sectionText">An error was encountered while processing your request:<br><br></p><h3>Failed loading profile data, please try again later.</h3><br><br><p class="returnLink">Here's a link to the Steam Community <a class="linkStandard" href="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49706	92.122.104.90	443	7500	C:\Users\user\Desktop\Launcher.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 23:44:03 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-10 23:44:04 UTC	1974	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 10 Mar 2025 23:44:04 GMT Content-Length: 26508 Connection: close Set-Cookie: sessionid=7bb56d3a4c9b09db86ee4bb1; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C0464fd338918e8dd935a9241acdeda5f; path=/; secure; HttpOnly; SameSite=None
2025-03-10 23:44:04 UTC	14410	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-10 23:44:04 UTC	10166	IN	Data Raw: 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: k" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2025-03-10 23:44:04 UTC	1932	IN	Data Raw: 73 65 63 74 69 6f 6e 54 65 78 74 22 3e 0a 09 09 09 09 41 6e 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 3a 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 2f 70 3e 0a 09 09 09 3c 68 33 3e 46 61 69 6c 65 64 20 6c 6f 61 64 69 6e 67 20 70 72 6f 66 69 6c 65 20 64 61 74 61 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2e 3c 2f 68 33 3e 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 72 65 74 75 72 6e 4c 69 6e 6b 22 3e 48 65 72 65 27 73 20 61 20 6c 69 6e 6b 20 74 6f 20 74 68 65 20 53 74 65 61 6d 20 43 6f 6d 6d 75 6e 69 74 79 20 3c 61 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 53 74 61 6e 64 61 72 64 22 20 68 72 65 66 3d 22 Data Ascii: sectionText">An error was encountered while processing your request:<br><br></p><h3>Failed loading profile data, please try again later.</h3><br><br><p class="returnLink">Here's a link to the Steam Community <a class="linkStandard" href="

Target ID:	0
Start time:	19:43:56
Start date:	10/03/2025
Path:	C:\Users\user\Desktop\Launcher.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Launcher.exe"
Imagebase:	0x850000
File size:	1'207'808 bytes
MD5 hash:	9AC3CFFFF2B2704D80330F3FE6986DDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:43:56
Start date:	10/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff650920000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:43:57
Start date:	10/03/2025
Path:	C:\Users\user\Desktop\Launcher.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Launcher.exe"
Imagebase:	0x850000
File size:	1'207'808 bytes
MD5 hash:	9AC3CFFFF2B2704D80330F3FE6986DDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Launcher.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
Launcher.exe