CMLauncher[.]exe | Triage™

Resubmissions

25/08/2026, 19:44

260825-yf4yvaycjd

25/08/2026, 19:40

260825-ydwvfsvvfz5

Sharing

Copy URL Twitter E-mail

General

Target
CMLauncher.exe
Size 23.2MB
Sample260825-yf4yvaycjd
SHA256 c91191db9b9ddfa354cc66f61784363070f29190824df924a56c6a101309c9fd
MD5 717dd6c28868e986c1b017b4bce6e711
SHA1 3a0464123ee9342f33c8bbee6a2d0d0511c6958b
SHA512 fb6cffd7e92adcaa70e84aea7285e6531027bb1a41067f7e2856966d5ac104ba81a2f6a17cd26323773820b84dbfebe527559313d643dc130797641f25e11e17
SSDEEP 393216:qgX8/3SSCD2t5ngIjdPYzXYu34uEsbUhPn/cO80L/v3FKxpzGeG:VM/3SZqnnZjdgzXh2hPEObL/v1uUt
TLSH
T1F3371212FA82C172E9C2017162BF8BFF593D56340B3584E3A3C419AD99706E3773A799
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
CMLauncher.exe

File Explorer

CMLauncher.exe

.exe 23.2MB

CMLauncher.exe

IMPHASH c5560d7cdd86d3d03c3c6d12e7972730
SHA256 c91191db9b9ddfa354cc66f61784363070f29190824df924a56c6a101309c9fd
MD5 717dd6c28868e986c1b017b4bce6e711
SHA1 3a0464123ee9342f33c8bbee6a2d0d0511c6958b
SHA512 fb6cffd7e92adcaa70e84aea7285e6531027bb1a41067f7e2856966d5ac104ba81a2f6a17cd26323773820b84dbfebe527559313d643dc130797641f25e11e17
SSDEEP 393216:qgX8/3SSCD2t5ngIjdPYzXYu34uEsbUhPn/cO80L/v3FKxpzGeG:VM/3SZqnnZjdgzXh2hPEObL/v1uUt
TLSH
T1F3371212FA82C172E9C2017162BF8BFF593D56340B3584E3A3C419AD99706E3773A799
MD5 SHA1 SHA512 SSDEEP TLSH

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

dd:6a:27:80:6f:a4:10:d1:59:95:2c:a8:9e:0d:03:af:8c:19:0a:eb:e8:87:1c:c3:25:a8:1b:56:b1:c0:c5:80

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=ClientModGame

Chains

Aug 21, 2026

CN=ClientModGame

Minor OS version

Major OS version

Entry point

31040030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

z:\buildworker\clientmod\build\launcher\CMLauncher.pdb

shell32

SHGetKnownFolderPath

imagehlp

StackWalk64

ntdll

VerSetConditionMask RtlNtStatusToDosError RtlCaptureContext RtlUnwind

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

winmm

timeBeginPeriod

version

GetFileVersionInfoSizeW VerQueryValueA GetFileVersionInfoW

ws2_32

shutdown gethostbyaddr inet_ntoa inet_addr listen WSAIoctl recv getpeername accept inet_ntop inet_pton WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent getsockopt WSAGetLastError getservbyport WSASetLastError setsockopt send ioctlsocket connect bind getservbyname gethostname WSAStartup socket closesocket WSACleanup htonl select __WSAFDIsSet gethostbyname ntohl getsockname recvfrom sendto htons ntohs

user32

FindWindowA MessageBoxW GetUserObjectInformationW MsgWaitForMultipleObjects DispatchMessageA PeekMessageA GetDesktopWindow SetClipboardData GetClipboardData EmptyClipboard GetProcessWindowStation EnumDisplaySettingsA EnumDisplayDevicesA IsWindowVisible CloseClipboard OpenClipboard GetCursorPos ReleaseDC SetCursorPos IsIconic SetForegroundWindow ReleaseCapture RegisterClassExA IsWindowUnicode SetProcessDPIAware UnregisterClassA GetClientRect SetWindowLongW GetWindowThreadProcessId FindWindowExA GetWindowLongW AdjustWindowRectEx GetKeyState LoadCursorA DestroyWindow GetDC LoadIconA SetCursor SetCapture SendMessageA SetWindowPos LoadStringA RegisterClassA EnumWindows GetClassNameA BringWindowToTop SetFocus SetLayeredWindowAttributes CreateWindowExA DefWindowProcA GetForegroundWindow GetMonitorInfoA TrackMouseEvent IsChild ClientToScreen SetWindowLongA GetCapture ShowWindow WindowFromPoint SetWindowTextW ScreenToClient EnumDisplayMonitors MonitorFromWindow TranslateMessage

kernel32

LCMapStringEx DecodePointer EncodePointer GetStringTypeW GetFileInformationByHandleEx FindFirstFileExW GetLocaleInfoEx GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize GetExitCodeThread TryAcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter CompareStringEx GetCPInfo GetACP CreateSemaphoreA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA LoadLibraryA QueryPerformanceFrequency GetProcAddress GetProcessId GetCurrentProcessId FormatMessageW LocalFree FormatMessageA QueryPerformanceCounter CloseHandle GetModuleFileNameA SetThreadPriority GetCurrentThread OpenProcess Sleep GetExitCodeProcess GetCurrentThreadId CreateToolhelp32Snapshot Thread32First OpenThread SuspendThread Thread32Next ResumeThread GetProcessDEPPolicy SetProcessDEPPolicy SetLastError GetLastError VirtualProtect GetPrivateProfileStringA WritePrivateProfileStringA GetSystemInfo GetCurrentProcess DuplicateHandle SystemTimeToFileTime GetSystemTime CreateFileA InitializeCriticalSectionEx VerifyVersionInfoW EnterCriticalSection TryEnterCriticalSection WaitForMultipleObjects LeaveCriticalSection ResetEvent SetEvent WaitForSingleObject SleepEx CreateEventW QueueUserAPC TerminateThread DeleteCriticalSection InitializeCriticalSectionAndSpinCount ReleaseMutex CreateMutexA SetSearchPathMode GetLocalTime CreateWaitableTimerExW SetWaitableTimerEx GetUserDefaultUILanguage GetLocaleInfoA FreeLibrary CreateEventA GetTimeFormatW GetTimeZoneInformation FileTimeToSystemTime GetSystemTimeAsFileTime GetModuleFileNameW SetEnvironmentVariableW GetEnvironmentVariableW LoadLibraryW ReadConsoleW OutputDebugStringA SetPriorityClass GetThreadPriority GetPriorityClass K32GetProcessMemoryInfo GetLogicalProcessorInformation GlobalMemoryStatusEx GetProcessTimes AreFileApisANSI ReadFile HeapCreate HeapFree GetFullPathNameW WriteFile GetDiskFreeSpaceW LockFile InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW CreateFileW GetFileAttributesW GetVersionExW UnmapViewOfFile HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile WaitForSingleObjectEx GetVersionExA DeleteFileA DeleteFileW HeapReAlloc RaiseException HeapAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx GetFileSize GetProcessHeap CreateFileMappingW MapViewOfFile GetTickCount FlushFileBuffers GetStdHandle GetModuleHandleW Process32First K32GetProcessImageFileNameA TerminateProcess Process32Next VirtualFree VirtualAlloc VirtualQuery GetThreadContext FlushInstructionCache SetThreadContext SetFileAttributesW SetFileAttributesA GetCommandLineA CreateProcessA K32EmptyWorkingSet LCMapStringA GetUserDefaultLCID GetStringTypeExA LoadLibraryExA SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW GetDiskFreeSpaceExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFileTime RemoveDirectoryW SetFilePointerEx DeviceIoControl CreateDirectoryExW CopyFileExW MoveFileExW ReleaseSemaphore CompareStringW OpenEventA SetWaitableTimer TlsAlloc TlsGetValue TlsSetValue TlsFree CreateWaitableTimerA InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS CreateThread UnregisterWaitEx RegisterWaitForSingleObject ExpandEnvironmentStringsA CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus ReleaseSRWLockExclusive AcquireSRWLockExclusive GetSystemDirectoryA MoveFileExA GetFileType PeekNamedPipe FindClose FindFirstFileW FindNextFileW InitializeSRWLock SleepConditionVariableSRW SwitchToThread lstrcmpA FindFirstFileA FindNextFileA GetFileSizeEx LCMapStringW LoadLibraryExW ExitThread GetConsoleMode SetConsoleMode GetEnvironmentVariableA FreeLibraryAndExitThread GetDriveTypeW SystemTimeToTzSpecificLocalTime SetConsoleCtrlHandler ExitProcess GetLocaleInfoW IsValidLocale EnumSystemLocalesW SetStdHandle IsValidCodePage GetOEMCP GetCommandLineW ReadConsoleA WriteConsoleW GetConsoleOutputCP GetDateFormatW GetEnvironmentStringsW FreeEnvironmentStringsW WaitForMultipleObjectsEx

gdi32

GetDeviceCaps

advapi32

CryptCreateHash GetSecurityInfo CryptGenRandom CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegQueryValueExW RegEnumKeyExA RegOpenKeyExW SystemFunction036 GetTokenInformation OpenProcessToken RegCloseKey RegQueryValueExA RegOpenKeyExA RegGetValueA CryptHashData CryptDestroyHash

dbghelp

MiniDumpWriteDump SymFromAddr

ole32

CoInitializeSecurity CoCreateGuid CoUninitialize CoInitializeEx CoCreateInstance CoTaskMemFree CoSetProxyBlanket

oleaut32

SysAllocStringLen SafeArrayGetElement SafeArrayGetUBound SafeArrayGetLBound VariantChangeType VariantClear VariantInit SysFreeString SysAllocString

wininet

InternetGetConnectedState InternetCanonicalizeUrlA

bcrypt

BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty BCryptGenerateSymmetricKey BCryptGenRandom BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptOpenAlgorithmProvider BCryptFinishHash BCryptDestroyHash BCryptDeriveKeyPBKDF2 BCryptEncrypt

crypt32

CertFreeCertificateContext CertOpenSystemStoreW CertFindCertificateInStore CertCloseStore CertEnumCertificatesInStore CertOpenSystemStoreA

iphlpapi

CancelMibChangeNotify2 if_indextoname GetUnicastIpAddressTable FreeMibTable NotifyIpInterfaceChange GetAdaptersAddresses GetBestRoute2 if_nametoindex

wldap32

ord26 ord27 ord32 ord33 ord22 ord79 ord30 ord200 ord301 ord143 ord217 ord50 ord60 ord211 ord35 ord46 ord41

Name

.text

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.msec

Size

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

331KB

Virtual Size

554KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cdata

Size

1024B

Virtual Size

516B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.<%*

Size

Virtual Size

7.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.$$Z

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ez/

Size

13.9MB

Virtual Size

13.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=31, id=259, version=30795,

count=211, id=261, version=30795,

count=22, productName=Unmarked objects (old),

count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=39, id=260, version=30795,

count=10, id=253, version=35207,

count=35, id=259, version=35207,

count=21, id=260, version=35207,

count=72, id=260, productName=VS2019 v16.5.2 build 28612, version=28612,

count=1, id=261, productName=VS2019 v16.10.3 build 30038, version=30038,

count=6, id=261, version=34441,

count=736, id=260, version=33130,

count=3, id=261, productName=VS2019 v16.8.5 build 29337, version=29337,

count=27, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=1, id=260, version=34440,

count=99, id=261, version=34440,

count=77, id=260, version=34123,

count=39, id=260, version=35222,

count=213, id=260, version=34435,

count=120, id=261, version=30147,

count=66, id=260, version=35225,

count=10, id=261, version=35219,

count=107, id=261, version=35207,

count=1, id=262, version=30795,

count=41, id=257, version=30795,

count=653, id=1, productName=Unmarked objects,

count=199, id=270, version=35226,

count=1, id=256, version=35226,

count=1, id=255, version=35226,

count=1, id=151,

count=1, id=258, version=35226,