0d6a7513f8f64bdcf2c2026dfe922f06fe5e2159e2e4fc7c4fca702ece8da38c

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LeviLauncher.exe
Size 32.8MB
Sample260731-mcaeaael2w
SHA256 0d6a7513f8f64bdcf2c2026dfe922f06fe5e2159e2e4fc7c4fca702ece8da38c
MD5 7ebdd24530fe82a963a56e2a20fdf1f5
SHA1 6b0780b716d830c12a6bd01df2b486e5eb6279cc
SHA512 a9bbc8c3bef87745b1907a07a928911d43ef6afd735b6315bc9ac99beb2eab423ddd57f57083cdebeb0db093d4c1d6726d4591b0eabb055f0ce16e46db725602
SSDEEP 393216:4IJl2WR8CHuGgJHeFA4+K+G+6HI0Z0V4+K/WRqPUMrUWK:4IJl2WRhWFev+GLpN/WRUa9
TLSH
T11677BF43F56144F4C5AAD634C5A79213BB313C589F3153DB2AA0A6382FBB7D0AE7A314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Loads dropped DLL 4 IoCs

pid	Process
4192	LeviLauncher.exe
4192	LeviLauncher.exe
4192	LeviLauncher.exe
4192	LeviLauncher.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LeviLauncher.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2792	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2792	powershell.exe
2792	powershell.exe
2792	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3628	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 3628	4192	LeviLauncher.exe	89
PID 3628 wrote to memory of 3336	3628	msedgewebview2.exe	90
PID 3628 wrote to memory of 4596	3628	msedgewebview2.exe	91
PID 3628 wrote to memory of 4596	3628	msedgewebview2.exe	91
PID 3628 wrote to memory of 4596	3628	msedgewebview2.exe	91
PID 3628 wrote to memory of 4596	3628	msedgewebview2.exe	91
PID 3628 wrote to memory of 3360	3628	msedgewebview2.exe	92
PID 3628 wrote to memory of 5536	3628	msedgewebview2.exe	93
PID 3628 wrote to memory of 5536	3628	msedgewebview2.exe	93
PID 3628 wrote to memory of 5536	3628	msedgewebview2.exe	93
PID 3628 wrote to memory of 4904	3628	msedgewebview2.exe	94
PID 3628 wrote to memory of 4904	3628	msedgewebview2.exe	94
PID 3628 wrote to memory of 4904	3628	msedgewebview2.exe	94
PID 3628 wrote to memory of 4904	3628	msedgewebview2.exe	94
PID 3628 wrote to memory of 4904	3628	msedgewebview2.exe	94
PID 4192 wrote to memory of 2792	4192	LeviLauncher.exe	95

C:\Users\Admin\AppData\Local\Temp\LeviLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\LeviLauncher.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=LeviLauncher.exe --webview-exe-version=0.3.13 --user-data-dir="C:\Users\Admin\AppData\Roaming\LeviLauncher.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4192.4156.1611792808898444950 /pfhostedapp:a7c8585caa31e376b69e23dd4df7138da8bce0f1
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\LeviLauncher.exe\EBWebView /prefetch:4 /pfhostedapp:a7c8585caa31e376b69e23dd4df7138da8bce0f1 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\LeviLauncher.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x9c,0xa8,0x7ffcf5875fd8,0x7ffcf5875fe4,0x7ffcf5875ff0
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\LeviLauncher.exe\EBWebView" --webview-exe-name=LeviLauncher.exe --webview-exe-version=0.3.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1760,i,11373321559457319354,8565104191625087864,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:a7c8585caa31e376b69e23dd4df7138da8bce0f1
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\LeviLauncher.exe\EBWebView" --webview-exe-name=LeviLauncher.exe --webview-exe-version=0.3.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2216 --field-trial-handle=1760,i,11373321559457319354,8565104191625087864,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:a7c8585caa31e376b69e23dd4df7138da8bce0f1
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\LeviLauncher.exe\EBWebView" --webview-exe-name=LeviLauncher.exe --webview-exe-version=0.3.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1760,i,11373321559457319354,8565104191625087864,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:a7c8585caa31e376b69e23dd4df7138da8bce0f1
    3⤵
    PID:5536
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\LeviLauncher.exe\EBWebView" --webview-exe-name=LeviLauncher.exe --webview-exe-version=0.3.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3492 --field-trial-handle=1760,i,11373321559457319354,8565104191625087864,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:a7c8585caa31e376b69e23dd4df7138da8bce0f1 /prefetch:1
    3⤵
    PID:4904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-AppxPackage -Name 'Microsoft.GamingServices' | Select-Object PackageFullName, PackageFamilyName, Version, InstallLocation | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\LeviLauncher.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2b710ad049949ec194a89c58f37216c39411754207a0aadcf8c791ade8bb33aa
MD5 c5e1b4e136c242f031d920515f345ce9
SHA1 fb48ec2ad38c8d66d4143834d44fb4db69255832
SHA512 6f52369cb6dd43107d5c6e6d87b30a43370ed3c3d4fe95b41da09ee5bed39126034a9de0551287c24cc1ac441d37007c37297a68a69fd868f9bb14ba03a2a354
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\LeviLauncher.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 de66fbf4f431427bbcbc5e7541f21d6a37f526ff546aae584eea508d21d4ad6c
MD5 8a882cdf9a93dd2a888ecb1f0d25aa3a
SHA1 dc18bc6fadc3e9df1fa909eab257b987caa04726
SHA512 ee5aa44baa7ea66b8ca9f217259cfb51c9fd8af83b09381ae414fe1f3d1895bca9652d19a85afb15cbbd15af14c30737faf840ca63b65f01993a767c0df0eef2
TLSH
T19DD02417370111F4CC1070330403714C0550C13FC005C040D43CC57D5F14C700F07441
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 c9084c06f73ed7f0c0c47a0fb9c8bc9eeacafdd8f2b7ce6ee63b9e38f3568a53
MD5 5025179493cbfecd337a87c80223b291
SHA1 24fca91c2d75c023409910906af7eba137d635e0
SHA512 8b1371998aeda15eb8ef8813a85b6ceaf55ed29bc7d89553f445d5f4f110ff11d975a3668db4a230d575dc83a3d93035bde53daf49dba0ac15ff3d78ffbe984f
TLSH
T10D01C9C408633E12E345437468C129E5383409211F33ADEC0FB25E38E74236298E163E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5923ab.TMP

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5923ab.TMP
Size 48B
SHA256 f1e7a299a1519a8157cb88d904f035dafe050b3e43c962814714378c11725bd4
MD5 63309485fe1da5dd1742548d533aa999
SHA1 e8a2d370d73c059ccfe4aedcaacf308d076df5b0
SHA512 f1e9ad5e9eeaef26ef9f7dcbd8300247467f7d77bb417db7d55b63b56f351afdd337e42c9d6cb3cc49a4e2f4513d2236a0883a6a6df27a27b1c1bbaf5bd98257
MD5 SHA1 SHA512

Submit Download

ae7adbf6-4385-45ab-bbf0-8c74d1f3dda8.tmp

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\EBWebView\Default\Network\ae7adbf6-4385-45ab-bbf0-8c74d1f3dda8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\EBWebView\Local State
Size 3KB
SHA256 ca0ba5cc1fa379cadc106c3f622d9c507107e4abe2df41b344a6c0b0f4a1dde6
MD5 36500d35b32dc8417913bb9b7d0bce78
SHA1 2fe745a1f73577efbfcc832c633a177ebdc7952c
SHA512 192ca73d5fab744e1bc0fb934a6feb906100765c5a7a609655553a71cbc35266e534f7281a38573053a0293c6e8ec0651e8c840ac966e193fe6f7af5735ca91c
TLSH
T104819527A875AD378DF3C90AB84A3B06A6E54023E5D53F94D6EC0F0D01D72D90342C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\EBWebView\Local State
Size 2KB
SHA256 ae6912edf2cf41cdb0e96a53dbe5a1bb49e882fd0698d1877a6531634538eeb9
MD5 940768634e7ef83d9e52349d34e2f4a2
SHA1 ab945a33b87774047be17bf3709d9cd97a778cf6
SHA512 3b09f3e0d79fba5781ef71d4522af5fc9a78c7a88ac8e48b65b44da337bf352ae06d7a8eba194451b3dd80588119cb1211ae441b0faa5702bbca71484a9622f6
TLSH
T11E519433A8155B37C9E34A1A794B3B169EF65161FAD22F90A6EC0B1C00CB55C5342C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\EBWebView\Local State
Size 3KB
SHA256 f6d538602860734b3bd2bcf0ab74bec7c96df0431bb7e1269660bd073600befe
MD5 7350c647b4224ec46305fc3b6ddaa457
SHA1 40c2b0e8fecbc1af0a5f84c03d99946035197a80
SHA512 e0a11e8d3fee00907b4459c736c729987ab66fa4632004afb6cb195822b56e555ece6e53c431ce4edc580b3eb62f02e6b823160749b6293924179edfb35c5fbd
TLSH
T11761A937A8759A3B8DE39A16B88A3716B7E55123F9D13F94D6EC0F0D01D72981342C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5916ab.TMP

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\EBWebView\Local State~RFe5916ab.TMP
Size 1KB
SHA256 a02403b917502d1f9318c380f0e4cfb789587ea4d545fddf5013d8f30516b5df
MD5 88dca25f4a89c18d152c71cfb8f83eea
SHA1 bb96a7ea09e84af2a8d8f861825d6c717a6d9efc
SHA512 9c66796583b2e410947b16c0e147955b2d0f2ad595e9766d0a3c3b12ab4a1fd1069d14a262d481d63031dbc8619c3e503f5ac49957d1e3a0659790787347365f
TLSH
T1292165B3D4A51B32ACC2165B310AB65A5EB1116AE2D14E8472DD8B2D01D608DD627C3B
MD5 SHA1 SHA512 TLSH

Submit Download

launcher_api.dll

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\bin\launcher_api.dll
Size 366KB
SHA256 5b14f4e279df4170173de98c1270bd3f44039fd59d8d932e7376914cec84c8c6
MD5 04ef2db80d1c632c690a35a6f0fedd9a
SHA1 d91664542e66cd02a7fb4ee68e6724fcae3c957a
SHA512 676d91d4c0bd54ca43558b24ca6d7846cbadd133b2d01b2ebc5512adc81457c9fa735c9176514ec45023e5bfd3288b22391bee653ce355dabbe5e3675aa2e418
SSDEEP 6144:Ps9405pp1MRo+JKh+DmB2eYvLmOyPOHXu8xXouZOKVO:q405z1M6WNeYznWt4
TLSH
T108844919F36594F0E596C07C8F675906EBF1395407748BDB02F082690D6BBE6EEBBA00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher_core.dll

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\bin\launcher_core.dll
Size 2.7MB
SHA256 f557c21c08cd89c58bb6d47dd87d27402d4043ad8741b30fc5df91f796ff89aa
MD5 5ae323977c9109413bf109c1a6ba6c27
SHA1 25c8c23ed7d8e2f8a9cd3771b5f678c35fd7532b
SHA512 d9e2303d4390decff926b5fc5946056ff9ff648d1f7002708fb825332c4291c9d50318b10465341b27b67a0cc13d7da905f84fdf0a28cb0f766207697c1b1446
SSDEEP 49152:oDxBDlq6UIVwASO6GtlqAVIU6iLGkJ4BOn1+6cQ00K30+w1dPeEK:41fy+JNW0H14E
TLSH
T1DCD57C15E7B280B8EE56C47C92476626C7B67A644BF86BDB067086300E177D2DB7FB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libHttpClient.dll

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\bin\libHttpClient.dll
Size 329KB
SHA256 df1a7bc6672b3775fe6ede72c6166cb7faf6a7780f328f34cee38de347c4edff
MD5 db809457a00880eb2354b297c2b89b42
SHA1 e7b7ca1ed130a6466365c5044c72f729e5ded698
SHA512 b21c45cea500859c7eaa2e38e884f0e3cdc5319a041c669ad0a97bc8a3163a6833449af6a9bed2c88b5383617dc17efa3b9c36aae93411f9c0762609c0a39484
SSDEEP 6144:z2T8f2b4mVuJ3W4VQxVSEJZm6QU0zGvuEWq+UJ+t9WbjC4ZA1w:zP28/3xqVSEeU0zGvuER+qht
TLSH
T17B744B26BB581872D5B3C278CDD28286F7F374960B7056C707A09A3E6E736E05A39246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\levilauncher.exe\bin\vcruntime140_1.dll
Size 516KB
SHA256 bcfab879bc0bf382ee042d423ad2af1195492dc4a2304dacc2ea79d0bffad4d6
MD5 779f6430b424968323576da193626ac3
SHA1 3a9126b3a225ed09f362f95f208939d8a3bde257
SHA512 f43634fd88662d776d0aae58227bc80d9643d65031279c45e48aeb7168dfa82c6305cad9ff0353c8bd96d7a516b4b412f9d2e4e84806e262b1d5371adb845602
SSDEEP 6144:KX0dv+EYV/Ir0u6RbwfSmdkoqJRYPuIJMzrKfoEBGOY2j4fz8kiPEjxBk/KDy821:U2+ukbwfSmeoqJRjGR62jlGzy8A
TLSH
T1EBB44B267A462A7EC18BC4B8934758A2192538CB0F75BDEF1BC4A7353D65AF41F3B204
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2792-212-0x000001E67D400000-0x000001E67D406000-memory.dmp

Download

memory/2792-214-0x000001E67D620000-0x000001E67D628000-memory.dmp

Download

memory/2792-209-0x000001E67D850000-0x000001E67D86A000-memory.dmp

Download

memory/2792-210-0x000001E67D8E0000-0x000001E67D90A000-memory.dmp

Download

memory/2792-211-0x000001E67D3F0000-0x000001E67D3F8000-memory.dmp

Download

memory/2792-176-0x000001E67D640000-0x000001E67D6F2000-memory.dmp

Download

memory/2792-213-0x000001E67D410000-0x000001E67D41A000-memory.dmp

Download

memory/2792-208-0x000001E67DA60000-0x000001E67DC64000-memory.dmp

Download

memory/2792-215-0x000001E67DE40000-0x000001E67E002000-memory.dmp

Download

memory/2792-216-0x000001E67D8A0000-0x000001E67D8C6000-memory.dmp

Download

memory/2792-170-0x000001E67D230000-0x000001E67D252000-memory.dmp

Download

memory/2792-175-0x000001E67D620000-0x000001E67D63E000-memory.dmp

Download

memory/4596-28-0x00007FFD17540000-0x00007FFD17541000-memory.dmp

Download

memory/4904-104-0x00007FFD17540000-0x00007FFD17541000-memory.dmp

Download