Edit tour

Windows Analysis Report
RobloxCheats.exe

Overview

General Information

Sample name:	RobloxCheats.exe
Analysis ID:	1461732
MD5:	d891ad15a4abc94edc9a712eb2a952c9
SHA1:	23742c7ba270889f4f6af375f2588eb4d452171f
SHA256:	5c3c865fd0f2aa2cb9276b483fda48136b12ef39ce98e4cb65bdf3316347cfd9
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

.NET source code contains potential unpacker

AI detected suspicious sample

Contains functionality to capture screen (.Net source)

Machine Learning detection for dropped file

Machine Learning detection for sample

Allocates memory with a write watch (potentially for evading sandboxes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

RobloxCheats.exe (PID: 6552 cmdline: "C:\Users\user\Desktop\RobloxCheats.exe" MD5: D891AD15A4ABC94EDC9A712EB2A952C9)

RD-127.0.0.1_53842_121767.EXE (PID: 2996 cmdline: "C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE" 0.tcp.in.ngrok.io<ZTPLG>12315 MD5: 31333ACFD60F9348F7ADC8B0D777239B)

taskkill.exe (PID: 5232 cmdline: taskkill /f /im RD-127.0.0.1_53842_121767.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RobloxCheats.exe (PID: 3228 cmdline: "C:\Users\user\Desktop\RobloxCheats.exe" MD5: D891AD15A4ABC94EDC9A712EB2A952C9)

RobloxCheats.exe (PID: 1668 cmdline: "C:\Users\user\Desktop\RobloxCheats.exe" MD5: D891AD15A4ABC94EDC9A712EB2A952C9)

RobloxCheats.exe (PID: 2520 cmdline: "C:\Users\user\Desktop\RobloxCheats.exe" MD5: D891AD15A4ABC94EDC9A712EB2A952C9)

RD-127.0.0.1_53857_899270.EXE (PID: 4112 cmdline: "C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE" 0.tcp.in.ngrok.io<ZTPLG>12315 MD5: 31333ACFD60F9348F7ADC8B0D777239B)

cleanup

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\Desktop\RobloxCheats.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\RobloxCheats.exe, ProcessId: 6552, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RobloxCheats

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\Desktop\RobloxCheats.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\RobloxCheats.exe, ProcessId: 6552, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RobloxCheats

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RobloxCheats.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Avira: detection malicious, Label: HEUR/AGEN.1314370
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Avira: detection malicious, Label: HEUR/AGEN.1314370

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: RobloxCheats.exe

Joe Sandbox ML: detected

Source: RobloxCheats.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source:	Binary string: C:\ZT_Rat\FileManagerPlugin\obj\Debug\FLM.pdb source: RobloxCheats.exe, 00000000.00000002.2969175029.0000000003346000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2964497796.0000000000570000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\ZT_Rat\ProcessPlugin\obj\Debug\TSK.pdb source: RobloxCheats.exe, 00000000.00000002.2969175029.0000000003346000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2964497796.0000000000570000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\ZT_Rat\RemoteDesktopPlugin\obj\Debug\RD.pdb source: RobloxCheats.exe, 00000000.00000002.2967429149.00000000023F4000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000000.00000002.2969175029.0000000003346000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2964497796.0000000000570000.00000004.08000000.00040000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2969106282.00000000024F8000.00000004.00000800.00020000.00000000.sdmp, RD-127.0.0.1_53842_121767.EXE, 00000008.00000000.1999350900.0000000000688000.00000002.00000001.01000000.0000000A.sdmp, RD-127.0.0.1_53857_899270.EXE.7.dr, RD-127.0.0.1_53842_121767.EXE.0.dr
Source:	Binary string: C:\ZT_Rat\ChatPlugin\obj\Debug\CH.pdb source: RobloxCheats.exe, 00000000.00000002.2969175029.0000000003346000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2964497796.0000000000570000.00000004.08000000.00040000.00000000.sdmp

Source: global traffic	TCP traffic: 192.168.2.4:49733 -> 3.6.98.232:12315
Source: global traffic	TCP traffic: 192.168.2.4:59033 -> 3.6.115.182:12315

Source: global traffic	HTTP traffic detected: GET /xml/?fields=countryCode,query HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/?fields=countryCode,query HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/?fields=countryCode,query HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/?fields=countryCode,query HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 3.6.115.182 3.6.115.182
Source: Joe Sandbox View	IP Address: 3.6.98.232 3.6.98.232

Source: unknown	DNS query: name: ip-api.com
Source: unknown	DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/?fields=countryCode,query HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/?fields=countryCode,query HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/?fields=countryCode,query HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/?fields=countryCode,query HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: 0.tcp.in.ngrok.io
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: RobloxCheats.exe, 00000000.00000002.2967429149.00000000023B4000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000000.00000002.2967429149.00000000023AC000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000000.00000002.2967429149.00000000023A6000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000002.00000002.2967541144.00000000023E4000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000002.00000002.2967541144.00000000023DC000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000006.00000002.2966576687.00000000023BC000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000006.00000002.2966576687.00000000023B6000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000006.00000002.2966576687.00000000023C4000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2969106282.00000000024A8000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2969106282.00000000024B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: RobloxCheats.exe, 00000007.00000002.2969106282.000000000247B000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2969106282.0000000002427000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/xml/?fields=countryCode
Source: RobloxCheats.exe, 00000000.00000002.2967429149.00000000023B4000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000002.00000002.2967541144.00000000023E4000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000006.00000002.2966576687.00000000023C4000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2969106282.00000000024B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.comd
Source: RobloxCheats.exe, 00000000.00000002.2967429149.0000000002327000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000002.00000002.2967541144.0000000002357000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000006.00000002.2966576687.0000000002331000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2969106282.0000000002427000.00000004.00000800.00020000.00000000.sdmp, RD-127.0.0.1_53842_121767.EXE, 00000008.00000002.2222860101.0000000002951000.00000004.00000800.00020000.00000000.sdmp, RD-127.0.0.1_53857_899270.EXE, 0000000C.00000002.2967487462.0000000002781000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: RD-127.0.0.1_53842_121767.EXE.0.dr, RD.cs	.Net Code: GetScreen
Source: 0.2.RobloxCheats.exe.23fed98.0.raw.unpack, RD.cs	.Net Code: GetScreen
Source: 0.2.RobloxCheats.exe.334d314.2.raw.unpack, RD.cs	.Net Code: GetScreen
Source: RD-127.0.0.1_53857_899270.EXE.7.dr, RD.cs	.Net Code: GetScreen
Source: 7.2.RobloxCheats.exe.576184.0.raw.unpack, RD.cs	.Net Code: GetScreen
Source: 7.2.RobloxCheats.exe.25025c8.4.raw.unpack, RD.cs	.Net Code: GetScreen

Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_00A0EA20	0_2_00A0EA20
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_00A00D80	0_2_00A00D80
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_00A00D70	0_2_00A00D70
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_04F936D4	0_2_04F936D4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_04F936C4	0_2_04F936C4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_04F90204	0_2_04F90204
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_04F91990	0_2_04F91990
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_04F91BE5	0_2_04F91BE5
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_04F93B90	0_2_04F93B90
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_04F93B94	0_2_04F93B94
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_064837D8	0_2_064837D8
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_0648BDF7	0_2_0648BDF7
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06485B68	0_2_06485B68
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06484708	0_2_06484708
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD36D4	0_2_06BD36D4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD46A4	0_2_06BD46A4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD3AD9	0_2_06BD3AD9
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 2_2_00A0EA20	2_2_00A0EA20
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 2_2_00A00D80	2_2_00A00D80
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 2_2_00A00D70	2_2_00A00D70
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 2_2_04F836D4	2_2_04F836D4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 2_2_04F82C2B	2_2_04F82C2B
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 2_2_04F80204	2_2_04F80204
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 2_2_04F81990	2_2_04F81990
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 2_2_04F83B90	2_2_04F83B90
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 2_2_052F37D8	2_2_052F37D8
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 2_2_052FC159	2_2_052FC159
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 2_2_052F5B68	2_2_052F5B68
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 2_2_052F4708	2_2_052F4708
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 2_2_052F8E10	2_2_052F8E10
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 6_2_021F0D7B	6_2_021F0D7B
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 6_2_021F0D80	6_2_021F0D80
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 6_2_04F836D4	6_2_04F836D4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 6_2_04F836C4	6_2_04F836C4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 6_2_04F80204	6_2_04F80204
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 6_2_04F81990	6_2_04F81990
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 6_2_04F83B90	6_2_04F83B90
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 6_2_05376C0C	6_2_05376C0C
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 6_2_053737D8	6_2_053737D8
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 6_2_0537C127	6_2_0537C127
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 6_2_05374708	6_2_05374708
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 6_2_05378E10	6_2_05378E10
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 7_2_007D3AD8	7_2_007D3AD8
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 7_2_00840D80	7_2_00840D80
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 7_2_00840D70	7_2_00840D70
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 7_2_04F836D4	7_2_04F836D4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 7_2_04F836C4	7_2_04F836C4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 7_2_04F80204	7_2_04F80204
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 7_2_04F81990	7_2_04F81990
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 7_2_04F83B90	7_2_04F83B90
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 7_2_051E37D8	7_2_051E37D8
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 7_2_051EC159	7_2_051EC159
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 7_2_051E6BE8	7_2_051E6BE8
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 7_2_051E4708	7_2_051E4708
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 7_2_051E8E10	7_2_051E8E10
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Code function: 8_2_00DDC218	8_2_00DDC218
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Code function: 8_2_00DDDE89	8_2_00DDDE89
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Code function: 12_2_00F7C218	12_2_00F7C218
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Code function: 12_2_00F7DE88	12_2_00F7DE88

Source: RobloxCheats.exe, 00000000.00000002.2964344420.000000000048E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs RobloxCheats.exe
Source: RobloxCheats.exe, 00000006.00000002.2964367678.0000000000488000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs RobloxCheats.exe
Source: RobloxCheats.exe, 00000007.00000002.2965168696.0000000000628000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs RobloxCheats.exe

Source: RobloxCheats.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: RobloxCheats.exe, J3JTPdDiVkJTqP0r5q.cs	Cryptographic APIs: 'CreateDecryptor'
Source: RobloxCheats.exe, J3JTPdDiVkJTqP0r5q.cs	Cryptographic APIs: 'CreateDecryptor'
Source: RobloxCheats.exe, J3JTPdDiVkJTqP0r5q.cs	Cryptographic APIs: 'CreateDecryptor'
Source: RobloxCheats.exe, aCXlgX5HdP6LSxAl2l.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.RobloxCheats.exe.3339550.0.raw.unpack, J3JTPdDiVkJTqP0r5q.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.RobloxCheats.exe.3339550.0.raw.unpack, J3JTPdDiVkJTqP0r5q.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.RobloxCheats.exe.3339550.0.raw.unpack, J3JTPdDiVkJTqP0r5q.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.RobloxCheats.exe.3339550.0.raw.unpack, aCXlgX5HdP6LSxAl2l.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal76.spyw.evad.winEXE@11/2@5/3

Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6180:120:WilError_03

Source: C:\Users\user\Desktop\RobloxCheats.exe

File created: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE

Jump to behavior

Source: RobloxCheats.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RobloxCheats.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "RD-127.0.0.1_53842_121767.exe")

Source: C:\Users\user\Desktop\RobloxCheats.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RobloxCheats.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\RobloxCheats.exe

File read: C:\Users\user\Desktop\RobloxCheats.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RobloxCheats.exe "C:\Users\user\Desktop\RobloxCheats.exe"
Source: unknown	Process created: C:\Users\user\Desktop\RobloxCheats.exe "C:\Users\user\Desktop\RobloxCheats.exe"
Source: unknown	Process created: C:\Users\user\Desktop\RobloxCheats.exe "C:\Users\user\Desktop\RobloxCheats.exe"
Source: unknown	Process created: C:\Users\user\Desktop\RobloxCheats.exe "C:\Users\user\Desktop\RobloxCheats.exe"
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process created: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE "C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE" 0.tcp.in.ngrok.io<ZTPLG>12315
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im RD-127.0.0.1_53842_121767.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process created: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE "C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE" 0.tcp.in.ngrok.io<ZTPLG>12315
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process created: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE "C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE" 0.tcp.in.ngrok.io<ZTPLG>12315	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im RD-127.0.0.1_53842_121767.exe	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process created: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE "C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE" 0.tcp.in.ngrok.io<ZTPLG>12315	Jump to behavior

Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\RobloxCheats.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\RobloxCheats.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: C:\ZT_Rat\FileManagerPlugin\obj\Debug\FLM.pdb source: RobloxCheats.exe, 00000000.00000002.2969175029.0000000003346000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2964497796.0000000000570000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\ZT_Rat\ProcessPlugin\obj\Debug\TSK.pdb source: RobloxCheats.exe, 00000000.00000002.2969175029.0000000003346000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2964497796.0000000000570000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\ZT_Rat\RemoteDesktopPlugin\obj\Debug\RD.pdb source: RobloxCheats.exe, 00000000.00000002.2967429149.00000000023F4000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000000.00000002.2969175029.0000000003346000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2964497796.0000000000570000.00000004.08000000.00040000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2969106282.00000000024F8000.00000004.00000800.00020000.00000000.sdmp, RD-127.0.0.1_53842_121767.EXE, 00000008.00000000.1999350900.0000000000688000.00000002.00000001.01000000.0000000A.sdmp, RD-127.0.0.1_53857_899270.EXE.7.dr, RD-127.0.0.1_53842_121767.EXE.0.dr
Source:	Binary string: C:\ZT_Rat\ChatPlugin\obj\Debug\CH.pdb source: RobloxCheats.exe, 00000000.00000002.2969175029.0000000003346000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2964497796.0000000000570000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: RobloxCheats.exe, aCXlgX5HdP6LSxAl2l.cs	.Net Code: r3RTCC3alDBkA6OhlP System.Reflection.Assembly.Load(byte[])
Source: 6.2.RobloxCheats.exe.3339550.0.raw.unpack, aCXlgX5HdP6LSxAl2l.cs	.Net Code: r3RTCC3alDBkA6OhlP System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_04F963AC push eax; retf	0_2_04F963AD
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_064801F0 push eax; iretd	0_2_064801F1
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD02B9 push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD04B8 push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD00B0 push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD269D push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD0090 push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD02F9 push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD06E1 push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD0AE3 push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD2EC5 push es; iretd	0_2_06BD2F54
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD0AC2 push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD0633 push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD022C push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD042A push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD040C push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD020E push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD0877 push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD0070 push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD0070 push es; iretd	0_2_06BD2F54
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD026C push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD1A54 push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD0857 push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD0651 push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD044A push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD05AC push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD17A8 push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD03AA push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD0BA0 push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD019E push es; iretd	0_2_06BD2EC4
Source: C:\Users\user\Desktop\RobloxCheats.exe	Code function: 0_2_06BD079E push es; iretd	0_2_06BD2EC4

Source: RobloxCheats.exe, J3JTPdDiVkJTqP0r5q.cs	High entropy of concatenated method names: 'ce4DmfsmSrOT856tDgfrkMb', 'Xh82kDYuVA', 'o7ivMEKDRgh5n', 'Bs4Llsonw', 'OMtpyECUQ', 'hEXPrdESx', 'NAoHj86eS', 'zRr9c6faq', 'rwmbA0FEC', 'fSpGhPILm'
Source: RobloxCheats.exe, aCXlgX5HdP6LSxAl2l.cs	High entropy of concatenated method names: 'WtQ29q2Hk9', 'FqN2bv4N6d', 'KiV2GSlHqI', 'YA82OLpvB5', 'TxF2cJWY6I', 'l3o2AjQuK5', 'dCn2oCu6Pg', 'MUF2MTOvlt', 'n6E2m6WrGb', 'rD62B1HfPN'
Source: 6.2.RobloxCheats.exe.3339550.0.raw.unpack, J3JTPdDiVkJTqP0r5q.cs	High entropy of concatenated method names: 'ce4DmfsmSrOT856tDgfrkMb', 'Xh82kDYuVA', 'o7ivMEKDRgh5n', 'Bs4Llsonw', 'OMtpyECUQ', 'hEXPrdESx', 'NAoHj86eS', 'zRr9c6faq', 'rwmbA0FEC', 'fSpGhPILm'
Source: 6.2.RobloxCheats.exe.3339550.0.raw.unpack, aCXlgX5HdP6LSxAl2l.cs	High entropy of concatenated method names: 'WtQ29q2Hk9', 'FqN2bv4N6d', 'KiV2GSlHqI', 'YA82OLpvB5', 'TxF2cJWY6I', 'l3o2AjQuK5', 'dCn2oCu6Pg', 'MUF2MTOvlt', 'n6E2m6WrGb', 'rD62B1HfPN'

Source: C:\Users\user\Desktop\RobloxCheats.exe	File created: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE			Jump to dropped file
Source: C:\Users\user\Desktop\RobloxCheats.exe	File created: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE			Jump to dropped file

Source: C:\Users\user\Desktop\RobloxCheats.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RobloxCheats	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RobloxCheats	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run RobloxCheats	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run RobloxCheats	Jump to behavior

Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\RobloxCheats.exe	Memory allocated: 950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Memory allocated: 2320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Memory allocated: 4320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Memory allocated: 990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Memory allocated: 2350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Memory allocated: 4350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Memory allocated: 2150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Memory allocated: 2330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Memory allocated: 2150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Memory allocated: 840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Memory allocated: 2420000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Memory allocated: 2320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Memory allocated: DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Memory allocated: 2950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Memory allocated: 4950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Memory allocated: CB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Memory allocated: 2780000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Memory allocated: 4780000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\RobloxCheats.exe TID: 7124	Thread sleep count: 103 > 30	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe TID: 1196	Thread sleep count: 197 > 30	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe TID: 6112	Thread sleep count: 135 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: RobloxCheats.exe, 00000007.00000002.2973585483.0000000007323000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: RobloxCheats.exe, 00000000.00000002.2974310032.0000000006C0B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: RobloxCheats.exe, 00000007.00000002.2965168696.0000000000684000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllt
Source: RobloxCheats.exe, 00000007.00000002.2973585483.0000000007323000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}x
Source: RobloxCheats.exe, 00000002.00000002.2964380858.0000000000688000.00000004.00000020.00020000.00000000.sdmp, RobloxCheats.exe, 00000006.00000002.2964367678.00000000004B7000.00000004.00000020.00020000.00000000.sdmp, RD-127.0.0.1_53842_121767.EXE, 00000008.00000002.2222536501.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, RD-127.0.0.1_53857_899270.EXE, 0000000C.00000002.2965617506.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RobloxCheats.exe, 00000000.00000002.2964344420.00000000004EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll$

Source: C:\Users\user\Desktop\RobloxCheats.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\RobloxCheats.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\RobloxCheats.exe	Process created: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE "C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE" 0.tcp.in.ngrok.io<ZTPLG>12315			Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Process created: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE "C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE" 0.tcp.in.ngrok.io<ZTPLG>12315			Jump to behavior

Source: C:\Users\user\Desktop\RobloxCheats.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im RD-127.0.0.1_53842_121767.exe

Jump to behavior

Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Users\user\Desktop\RobloxCheats.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Users\user\Desktop\RobloxCheats.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Users\user\Desktop\RobloxCheats.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Users\user\Desktop\RobloxCheats.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RobloxCheats.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Queries volume information: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Queries volume information: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation

Source: C:\Users\user\Desktop\RobloxCheats.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RobloxCheats.exe	100%	Avira	TR/Crypt.XPACK.Gen
RobloxCheats.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	100%	Avira	HEUR/AGEN.1314370
C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	100%	Avira	HEUR/AGEN.1314370
C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://ip-api.com/xml/?fields=countryCode,query	0%	Avira URL Cloud	safe
http://ip-api.com/xml/?fields=countryCode	0%	Avira URL Cloud	safe
http://ip-api.comd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ip-api.com	208.95.112.1	true	false	unknown
0.tcp.in.ngrok.io	3.6.98.232	true	false	unknown
206.23.85.13.in-addr.arpa	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/xml/?fields=countryCode,query	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com/xml/?fields=countryCode	RobloxCheats.exe, 00000007.00000002.2969106282.000000000247B000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2969106282.0000000002427000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.comd	RobloxCheats.exe, 00000000.00000002.2967429149.00000000023B4000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000002.00000002.2967541144.00000000023E4000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000006.00000002.2966576687.00000000023C4000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2969106282.00000000024B4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	RobloxCheats.exe, 00000000.00000002.2967429149.00000000023B4000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000000.00000002.2967429149.00000000023AC000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000000.00000002.2967429149.00000000023A6000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000002.00000002.2967541144.00000000023E4000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000002.00000002.2967541144.00000000023DC000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000006.00000002.2966576687.00000000023BC000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000006.00000002.2966576687.00000000023B6000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000006.00000002.2966576687.00000000023C4000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2969106282.00000000024A8000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2969106282.00000000024B4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RobloxCheats.exe, 00000000.00000002.2967429149.0000000002327000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000002.00000002.2967541144.0000000002357000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000006.00000002.2966576687.0000000002331000.00000004.00000800.00020000.00000000.sdmp, RobloxCheats.exe, 00000007.00000002.2969106282.0000000002427000.00000004.00000800.00020000.00000000.sdmp, RD-127.0.0.1_53842_121767.EXE, 00000008.00000002.2222860101.0000000002951000.00000004.00000800.00020000.00000000.sdmp, RD-127.0.0.1_53857_899270.EXE, 0000000C.00000002.2967487462.0000000002781000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	RobloxCheats.exe, 00000000.00000002.2972795667.00000000064F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
3.6.115.182	unknown	United States	16509	AMAZON-02US	false
3.6.98.232	0.tcp.in.ngrok.io	United States	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1461732
Start date and time:	2024-06-24 16:20:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RobloxCheats.exe
Detection:	MAL
Classification:	mal76.spyw.evad.winEXE@11/2@5/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 208 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: RobloxCheats.exe

Simulations

Behavior and APIs

Time	Type	Description
15:21:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RobloxCheats "C:\Users\user\Desktop\RobloxCheats.exe"
15:21:14	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run RobloxCheats "C:\Users\user\Desktop\RobloxCheats.exe"
15:21:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RobloxCheats "C:\Users\user\Desktop\RobloxCheats.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Applikationsprograms.exe	Get hash	malicious	GuLoader	Browse	ip-api.com/line/?fields=hosting
	doc20240624-00073.bat.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	FC4311009.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	#U21162.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	QUOTATION_JUNQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	TBN88-19062024=Devrez -Bunker Supply Tende.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	#U00d6deme onaylama.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	QUOTATION_JUNQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	Purchase List VIXEN International 90349000 PDF.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	RFQ for WIKA pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
3.6.115.182	kuEfaZxkiY.exe	Get hash	malicious	RedLine	Browse	0.tcp.in.ngrok.io:17383/
3.6.115.182	RN2vknsx6G.exe	Get hash	malicious	RedLine	Browse	0.tcp.in.ngrok.io:17440/
3.6.98.232	ae6T8jJueq.exe	Get hash	malicious	Njrat	Browse
	nOZ2Oqnzbz.exe	Get hash	malicious	Njrat	Browse
	iR2UtZj5vP.exe	Get hash	malicious	Njrat	Browse
	ZB7Ot9MOic.exe	Get hash	malicious	Njrat	Browse
	etJZk4UQhS.exe	Get hash	malicious	Njrat	Browse
	jango.exe	Get hash	malicious	XWorm	Browse
	cracksetup.exe	Get hash	malicious	Nanocore	Browse
	LocalStaFvjUblU.exe	Get hash	malicious	njRat	Browse
	JsYdl3ZkOA.exe	Get hash	malicious	njRat	Browse
	ehqsU9jDFb.exe	Get hash	malicious	njRat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
0.tcp.in.ngrok.io	kuEfaZxkiY.exe	Get hash	malicious	RedLine	Browse	3.6.115.182
	ae6T8jJueq.exe	Get hash	malicious	Njrat	Browse	3.6.115.64
	nOZ2Oqnzbz.exe	Get hash	malicious	Njrat	Browse	3.6.115.64
	iR2UtZj5vP.exe	Get hash	malicious	Njrat	Browse	3.6.122.107
	ZB7Ot9MOic.exe	Get hash	malicious	Njrat	Browse	3.6.30.85
	etJZk4UQhS.exe	Get hash	malicious	Njrat	Browse	3.6.122.107
	jango.exe	Get hash	malicious	XWorm	Browse	3.6.30.85
	cracksetup.exe	Get hash	malicious	Nanocore	Browse	3.6.98.232
	LocalStaFvjUblU.exe	Get hash	malicious	njRat	Browse	3.6.122.107
	558EofiXYO.exe	Get hash	malicious	njRat	Browse	3.6.115.64
ip-api.com	Applikationsprograms.exe	Get hash	malicious	GuLoader	Browse	208.95.112.1
	doc20240624-00073.bat.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FC4311009.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	#U21162.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTATION_JUNQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	TBN88-19062024=Devrez -Bunker Supply Tende.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	#U00d6deme onaylama.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTATION_JUNQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Purchase List VIXEN International 90349000 PDF.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	RFQ for WIKA pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	Applikationsprograms.exe	Get hash	malicious	GuLoader	Browse	208.95.112.1
	doc20240624-00073.bat.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FC4311009.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	#U21162.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTATION_JUNQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	TBN88-19062024=Devrez -Bunker Supply Tende.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	#U00d6deme onaylama.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTATION_JUNQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Purchase List VIXEN International 90349000 PDF.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	RFQ for WIKA pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
AMAZON-02US	https://u45250775.ct.sendgrid.net/ls/click?upn=u001.tFoYEKu8c3QV4dCjnENfD8xt5kmuuDSrdqsY1RaUCNHUhTAxpCf-2FkQtKBbJ888oIJWvg_M0oG0U0hSEmcy-2FDc53m2Ovj2gEU6WMOnlcvny0ZS4LdkqR8gSB-2F7PZsO7QHSVd-2FvJEy6PwnLdjJ6S5UoGaQ-2BqWA8TufxvTmFkxvPI-2BZkBgCYJOtfxBDgBQjm9Z9Nn5nVJSXlSys-2BymPhLkfKWqG7N5Z0UXiZhPgvAXtyoH-2FSc13rSPnBmkCBxWKokv0-2BFYFkGLEDuQmLC88YD2BXSQXbWw-3D-3D	Get hash	malicious	HTMLPhisher	Browse	108.157.188.105
	http://portal.tristate.support	Get hash	malicious	Unknown	Browse	99.86.159.65
	193b1bb-ELECTRONIC RECEIPTCabinetworksgroup.html	Get hash	malicious	Unknown	Browse	18.239.83.61
	https://tucowsincteam.freshdesk.com/register/gh9gyHWUi6HhHYWlaM9	Get hash	malicious	Unknown	Browse	52.217.142.241
	2a6d08e-3-ACH-Pages-Confirmation_Receipt.htm	Get hash	malicious	HTMLPhisher	Browse	18.239.83.16
	https://my-account-kyc.com/	Get hash	malicious	Unknown	Browse	108.156.60.8
	https://www.riveronetwo.com/o-hgjk-g32-4d81154e57a5a2807408cf6efa375c5e	Get hash	malicious	Unknown	Browse	18.246.192.99
	https://www.taylorsolely.net/direct&ref_=232&ref=9o4/&u=1xk8k/&eid=xhzo86//utm_medium=email&utm_campaign=popular-searches-email_2021-06-05&personalizedFor=586624e1-11ed-49f9-afea-d58fb9e8f84f&utm_content=displayed	Get hash	malicious	Unknown	Browse	18.246.192.99
	Pago.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	3.29.197.107
	Shipping Documents.pdf.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
AMAZON-02US	https://u45250775.ct.sendgrid.net/ls/click?upn=u001.tFoYEKu8c3QV4dCjnENfD8xt5kmuuDSrdqsY1RaUCNHUhTAxpCf-2FkQtKBbJ888oIJWvg_M0oG0U0hSEmcy-2FDc53m2Ovj2gEU6WMOnlcvny0ZS4LdkqR8gSB-2F7PZsO7QHSVd-2FvJEy6PwnLdjJ6S5UoGaQ-2BqWA8TufxvTmFkxvPI-2BZkBgCYJOtfxBDgBQjm9Z9Nn5nVJSXlSys-2BymPhLkfKWqG7N5Z0UXiZhPgvAXtyoH-2FSc13rSPnBmkCBxWKokv0-2BFYFkGLEDuQmLC88YD2BXSQXbWw-3D-3D	Get hash	malicious	HTMLPhisher	Browse	108.157.188.105
	http://portal.tristate.support	Get hash	malicious	Unknown	Browse	99.86.159.65
	193b1bb-ELECTRONIC RECEIPTCabinetworksgroup.html	Get hash	malicious	Unknown	Browse	18.239.83.61
	https://tucowsincteam.freshdesk.com/register/gh9gyHWUi6HhHYWlaM9	Get hash	malicious	Unknown	Browse	52.217.142.241
	2a6d08e-3-ACH-Pages-Confirmation_Receipt.htm	Get hash	malicious	HTMLPhisher	Browse	18.239.83.16
	https://my-account-kyc.com/	Get hash	malicious	Unknown	Browse	108.156.60.8
	https://www.riveronetwo.com/o-hgjk-g32-4d81154e57a5a2807408cf6efa375c5e	Get hash	malicious	Unknown	Browse	18.246.192.99
	https://www.taylorsolely.net/direct&ref_=232&ref=9o4/&u=1xk8k/&eid=xhzo86//utm_medium=email&utm_campaign=popular-searches-email_2021-06-05&personalizedFor=586624e1-11ed-49f9-afea-d58fb9e8f84f&utm_content=displayed	Get hash	malicious	Unknown	Browse	18.246.192.99
	Pago.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	3.29.197.107
	Shipping Documents.pdf.exe	Get hash	malicious	FormBook	Browse	13.248.169.48

Process:	C:\Users\user\Desktop\RobloxCheats.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	22528
Entropy (8bit):	5.38116804177867
Encrypted:	false
SSDEEP:	384:dfG0igeeKfUuNZXZSoSeqDI39OrOtLklb4jXP9kJ0h3XEYdoky1Uhk1Qjkh:00R5KfPXZSo7aI3MORGkXPX0uoh
MD5:	31333ACFD60F9348F7ADC8B0D777239B
SHA1:	AE9F0ADD63469178491EAD2C840C74318B28EA75
SHA-256:	8B39078C3C93A90629140DDC0F235ECCEF982160BB0B0D026DCAB3A025D08253
SHA-512:	8A756ACD5A2135C0953727566DC99BC0560EBB026A685DD768BFFD0E5E56D4A61DDB693223C1B7D1365556CAAFD53D1959E7C8F5C3211C82A9E48D0DDC19D5BC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....fyf.................L..........nj... ........@.. ..............................*.....`..................................j..W.......B............................................................................ ............... ..H............text...tJ... ...L.................. ..`.sdata..8............P..............@....rsrc...B............R..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE

Download File

Process:	C:\Users\user\Desktop\RobloxCheats.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	22528
Entropy (8bit):	5.38116804177867
Encrypted:	false
SSDEEP:	384:dfG0igeeKfUuNZXZSoSeqDI39OrOtLklb4jXP9kJ0h3XEYdoky1Uhk1Qjkh:00R5KfPXZSo7aI3MORGkXPX0uoh
MD5:	31333ACFD60F9348F7ADC8B0D777239B
SHA1:	AE9F0ADD63469178491EAD2C840C74318B28EA75
SHA-256:	8B39078C3C93A90629140DDC0F235ECCEF982160BB0B0D026DCAB3A025D08253
SHA-512:	8A756ACD5A2135C0953727566DC99BC0560EBB026A685DD768BFFD0E5E56D4A61DDB693223C1B7D1365556CAAFD53D1959E7C8F5C3211C82A9E48D0DDC19D5BC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....fyf.................L..........nj... ........@.. ..............................*.....`..................................j..W.......B............................................................................ ............... ..H............text...tJ... ...L.................. ..`.sdata..8............P..............@....rsrc...B............R..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.6695781196408195
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	RobloxCheats.exe
File size:	120'832 bytes
MD5:	d891ad15a4abc94edc9a712eb2a952c9
SHA1:	23742c7ba270889f4f6af375f2588eb4d452171f
SHA256:	5c3c865fd0f2aa2cb9276b483fda48136b12ef39ce98e4cb65bdf3316347cfd9
SHA512:	10e2af8f862788b89f8ee087212d4fecb50720b9a88936f67b8abab6a3330c3a20a436fe607a66de5a03202a57de331f0733423936b1a20740069691d3e83ae7
SSDEEP:	3072:pcdrQn9irjVEwZHPpkUbbFS37wBQ4ri5VE:pKs9sBEwPXbs37U3r
TLSH:	D7C3190272898B61CD5419B2C0EB703413F6AECB1B32E6867F5D67DD1D033A29D9AB4D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@}yf............................~.... ........@.. .......................@.............................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41f17e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x66797D40 [Mon Jun 24 14:05:52 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f130	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x22000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1d184	0x1d200	0b1f366d71c35d0aa32c3441ea19bfc6	False	0.6510696083690987	data	6.713787496151054	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0x20000	0xb1	0x200	15142b1a0e7e7b8ff431c0ad7465c15f	False	0.267578125	data	2.1685707503907423	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x22000	0xc	0x200	b68e82d322ce9caa6ca95cc452a09f13	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 24, 2024 16:21:06.501319885 CEST	49733	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:06.508694887 CEST	12315	49733	3.6.98.232	192.168.2.4
Jun 24, 2024 16:21:06.508786917 CEST	49733	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:06.587357998 CEST	49734	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:06.594852924 CEST	80	49734	208.95.112.1	192.168.2.4
Jun 24, 2024 16:21:06.594979048 CEST	49734	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:06.595249891 CEST	49734	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:06.600076914 CEST	80	49734	208.95.112.1	192.168.2.4
Jun 24, 2024 16:21:07.062330008 CEST	80	49734	208.95.112.1	192.168.2.4
Jun 24, 2024 16:21:07.116965055 CEST	49734	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:07.338747025 CEST	49733	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:07.344765902 CEST	12315	49733	3.6.98.232	192.168.2.4
Jun 24, 2024 16:21:15.891160965 CEST	49738	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:15.896027088 CEST	12315	49738	3.6.98.232	192.168.2.4
Jun 24, 2024 16:21:15.896126986 CEST	49738	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:15.959223032 CEST	49739	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:15.964128971 CEST	80	49739	208.95.112.1	192.168.2.4
Jun 24, 2024 16:21:15.964222908 CEST	49739	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:15.964503050 CEST	49739	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:15.969297886 CEST	80	49739	208.95.112.1	192.168.2.4
Jun 24, 2024 16:21:16.444227934 CEST	80	49739	208.95.112.1	192.168.2.4
Jun 24, 2024 16:21:16.454912901 CEST	49738	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:16.459748983 CEST	12315	49738	3.6.98.232	192.168.2.4
Jun 24, 2024 16:21:16.491889954 CEST	49739	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:24.090640068 CEST	49742	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:24.095489025 CEST	12315	49742	3.6.98.232	192.168.2.4
Jun 24, 2024 16:21:24.095567942 CEST	49742	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:24.155838966 CEST	49743	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:24.161257029 CEST	80	49743	208.95.112.1	192.168.2.4
Jun 24, 2024 16:21:24.161350012 CEST	49743	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:24.161535025 CEST	49743	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:24.166434050 CEST	80	49743	208.95.112.1	192.168.2.4
Jun 24, 2024 16:21:24.631954908 CEST	80	49743	208.95.112.1	192.168.2.4
Jun 24, 2024 16:21:24.667357922 CEST	49742	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:24.672333956 CEST	12315	49742	3.6.98.232	192.168.2.4
Jun 24, 2024 16:21:24.679312944 CEST	49743	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:32.173182964 CEST	49748	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:32.178224087 CEST	12315	49748	3.6.98.232	192.168.2.4
Jun 24, 2024 16:21:32.178364038 CEST	49748	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:32.276592970 CEST	49749	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:32.288530111 CEST	80	49749	208.95.112.1	192.168.2.4
Jun 24, 2024 16:21:32.288597107 CEST	49749	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:32.289524078 CEST	49749	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:32.296237946 CEST	80	49749	208.95.112.1	192.168.2.4
Jun 24, 2024 16:21:32.751668930 CEST	80	49749	208.95.112.1	192.168.2.4
Jun 24, 2024 16:21:32.759768009 CEST	49748	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:32.764741898 CEST	12315	49748	3.6.98.232	192.168.2.4
Jun 24, 2024 16:21:32.804357052 CEST	49749	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:32.986365080 CEST	12315	49733	3.6.98.232	192.168.2.4
Jun 24, 2024 16:21:33.038711071 CEST	49733	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:33.767265081 CEST	49750	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:33.772211075 CEST	12315	49750	3.6.98.232	192.168.2.4
Jun 24, 2024 16:21:33.775712967 CEST	49750	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:33.782296896 CEST	49750	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:33.787115097 CEST	12315	49750	3.6.98.232	192.168.2.4
Jun 24, 2024 16:21:43.340219975 CEST	80	49734	208.95.112.1	192.168.2.4
Jun 24, 2024 16:21:43.340318918 CEST	49734	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:21:55.296535015 CEST	12315	49733	3.6.98.232	192.168.2.4
Jun 24, 2024 16:21:55.351234913 CEST	49733	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:21:55.711553097 CEST	49750	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:22:47.243956089 CEST	49734	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:22:47.554501057 CEST	49734	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:22:48.163985014 CEST	49734	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:22:49.367206097 CEST	49734	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:22:51.773315907 CEST	49734	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:22:56.461374998 CEST	49739	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:22:56.467241049 CEST	80	49739	208.95.112.1	192.168.2.4
Jun 24, 2024 16:22:56.467324018 CEST	49739	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:22:56.585767031 CEST	49734	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:23:00.574732065 CEST	12315	49748	3.6.98.232	192.168.2.4
Jun 24, 2024 16:23:00.616971016 CEST	49748	12315	192.168.2.4	3.6.98.232
Jun 24, 2024 16:23:01.199503899 CEST	59033	12315	192.168.2.4	3.6.115.182
Jun 24, 2024 16:23:01.205226898 CEST	80	49749	208.95.112.1	192.168.2.4
Jun 24, 2024 16:23:01.205337048 CEST	49749	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:23:01.205889940 CEST	12315	59033	3.6.115.182	192.168.2.4
Jun 24, 2024 16:23:01.206039906 CEST	59033	12315	192.168.2.4	3.6.115.182
Jun 24, 2024 16:23:01.212769985 CEST	59033	12315	192.168.2.4	3.6.115.182
Jun 24, 2024 16:23:01.224354029 CEST	12315	59033	3.6.115.182	192.168.2.4
Jun 24, 2024 16:23:04.649943113 CEST	49743	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:23:04.656352997 CEST	80	49743	208.95.112.1	192.168.2.4
Jun 24, 2024 16:23:04.656420946 CEST	49743	80	192.168.2.4	208.95.112.1
Jun 24, 2024 16:23:06.195137024 CEST	49734	80	192.168.2.4	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 24, 2024 16:21:06.486977100 CEST	61274	53	192.168.2.4	1.1.1.1
Jun 24, 2024 16:21:06.498507977 CEST	53	61274	1.1.1.1	192.168.2.4
Jun 24, 2024 16:21:06.567044973 CEST	51013	53	192.168.2.4	1.1.1.1
Jun 24, 2024 16:21:06.582448959 CEST	53	51013	1.1.1.1	192.168.2.4
Jun 24, 2024 16:21:15.947238922 CEST	61913	53	192.168.2.4	1.1.1.1
Jun 24, 2024 16:21:15.954792976 CEST	53	61913	1.1.1.1	192.168.2.4
Jun 24, 2024 16:21:38.922070980 CEST	53	61401	162.159.36.2	192.168.2.4
Jun 24, 2024 16:21:39.405960083 CEST	65321	53	192.168.2.4	1.1.1.1
Jun 24, 2024 16:21:39.413950920 CEST	53	65321	1.1.1.1	192.168.2.4
Jun 24, 2024 16:23:01.127818108 CEST	65198	53	192.168.2.4	1.1.1.1
Jun 24, 2024 16:23:01.194305897 CEST	53	65198	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 24, 2024 16:21:06.486977100 CEST	192.168.2.4	1.1.1.1	0x5971	Standard query (0)	0.tcp.in.ngrok.io	A (IP address)	IN (0x0001)	false
Jun 24, 2024 16:21:06.567044973 CEST	192.168.2.4	1.1.1.1	0x2f6a	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jun 24, 2024 16:21:15.947238922 CEST	192.168.2.4	1.1.1.1	0x4202	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jun 24, 2024 16:21:39.405960083 CEST	192.168.2.4	1.1.1.1	0xb343	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jun 24, 2024 16:23:01.127818108 CEST	192.168.2.4	1.1.1.1	0x870	Standard query (0)	0.tcp.in.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 24, 2024 16:21:06.498507977 CEST	1.1.1.1	192.168.2.4	0x5971	No error (0)	0.tcp.in.ngrok.io		3.6.98.232	A (IP address)	IN (0x0001)	false
Jun 24, 2024 16:21:06.582448959 CEST	1.1.1.1	192.168.2.4	0x2f6a	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jun 24, 2024 16:21:15.954792976 CEST	1.1.1.1	192.168.2.4	0x4202	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jun 24, 2024 16:21:39.413950920 CEST	1.1.1.1	192.168.2.4	0xb343	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jun 24, 2024 16:23:01.194305897 CEST	1.1.1.1	192.168.2.4	0x870	No error (0)	0.tcp.in.ngrok.io		3.6.115.182	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	208.95.112.1	80	6552	C:\Users\user\Desktop\RobloxCheats.exe

Timestamp	Bytes transferred	Direction	Data
Jun 24, 2024 16:21:06.595249891 CEST	89	OUT	GET /xml/?fields=countryCode,query HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 24, 2024 16:21:07.062330008 CEST	292	IN	HTTP/1.1 200 OK Date: Mon, 24 Jun 2024 14:21:06 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 116 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 71 75 65 72 79 3e 0a 20 20 3c 63 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 63 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 20 20 3c 71 75 65 72 79 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 71 75 65 72 79 3e 0a 3c 2f 71 75 65 72 79 3e Data Ascii: <?xml version="1.0" encoding="UTF-8"?><query> <countryCode>US</countryCode> <query>8.46.123.33</query></query>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	208.95.112.1	80	3228	C:\Users\user\Desktop\RobloxCheats.exe

Timestamp	Bytes transferred	Direction	Data
Jun 24, 2024 16:21:15.964503050 CEST	89	OUT	GET /xml/?fields=countryCode,query HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 24, 2024 16:21:16.444227934 CEST	292	IN	HTTP/1.1 200 OK Date: Mon, 24 Jun 2024 14:21:16 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 116 Access-Control-Allow-Origin: * X-Ttl: 50 X-Rl: 43 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 71 75 65 72 79 3e 0a 20 20 3c 63 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 63 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 20 20 3c 71 75 65 72 79 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 71 75 65 72 79 3e 0a 3c 2f 71 75 65 72 79 3e Data Ascii: <?xml version="1.0" encoding="UTF-8"?><query> <countryCode>US</countryCode> <query>8.46.123.33</query></query>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	208.95.112.1	80	1668	C:\Users\user\Desktop\RobloxCheats.exe

Timestamp	Bytes transferred	Direction	Data
Jun 24, 2024 16:21:24.161535025 CEST	89	OUT	GET /xml/?fields=countryCode,query HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 24, 2024 16:21:24.631954908 CEST	292	IN	HTTP/1.1 200 OK Date: Mon, 24 Jun 2024 14:21:24 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 116 Access-Control-Allow-Origin: * X-Ttl: 42 X-Rl: 42 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 71 75 65 72 79 3e 0a 20 20 3c 63 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 63 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 20 20 3c 71 75 65 72 79 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 71 75 65 72 79 3e 0a 3c 2f 71 75 65 72 79 3e Data Ascii: <?xml version="1.0" encoding="UTF-8"?><query> <countryCode>US</countryCode> <query>8.46.123.33</query></query>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49749	208.95.112.1	80	2520	C:\Users\user\Desktop\RobloxCheats.exe

Timestamp	Bytes transferred	Direction	Data
Jun 24, 2024 16:21:32.289524078 CEST	89	OUT	GET /xml/?fields=countryCode,query HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 24, 2024 16:21:32.751668930 CEST	292	IN	HTTP/1.1 200 OK Date: Mon, 24 Jun 2024 14:21:32 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 116 Access-Control-Allow-Origin: * X-Ttl: 34 X-Rl: 41 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 71 75 65 72 79 3e 0a 20 20 3c 63 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 63 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 20 20 3c 71 75 65 72 79 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 71 75 65 72 79 3e 0a 3c 2f 71 75 65 72 79 3e Data Ascii: <?xml version="1.0" encoding="UTF-8"?><query> <countryCode>US</countryCode> <query>8.46.123.33</query></query>

Target ID:	0
Start time:	10:21:04
Start date:	24/06/2024
Path:	C:\Users\user\Desktop\RobloxCheats.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RobloxCheats.exe"
Imagebase:	0x400000
File size:	120'832 bytes
MD5 hash:	D891AD15A4ABC94EDC9A712EB2A952C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:21:14
Start date:	24/06/2024
Path:	C:\Users\user\Desktop\RobloxCheats.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RobloxCheats.exe"
Imagebase:	0x400000
File size:	120'832 bytes
MD5 hash:	D891AD15A4ABC94EDC9A712EB2A952C9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	10:21:22
Start date:	24/06/2024
Path:	C:\Users\user\Desktop\RobloxCheats.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RobloxCheats.exe"
Imagebase:	0x400000
File size:	120'832 bytes
MD5 hash:	D891AD15A4ABC94EDC9A712EB2A952C9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	10:21:31
Start date:	24/06/2024
Path:	C:\Users\user\Desktop\RobloxCheats.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RobloxCheats.exe"
Imagebase:	0x400000
File size:	120'832 bytes
MD5 hash:	D891AD15A4ABC94EDC9A712EB2A952C9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	10:21:32
Start date:	24/06/2024
Path:	C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE" 0.tcp.in.ngrok.io<ZTPLG>12315
Imagebase:	0x7b0000
File size:	22'528 bytes
MD5 hash:	31333ACFD60F9348F7ADC8B0D777239B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:21:54
Start date:	24/06/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im RD-127.0.0.1_53842_121767.exe
Imagebase:	0x790000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:21:54
Start date:	24/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:22:59
Start date:	24/06/2024
Path:	C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE" 0.tcp.in.ngrok.io<ZTPLG>12315
Imagebase:	0x490000
File size:	22'528 bytes
MD5 hash:	31333ACFD60F9348F7ADC8B0D777239B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	99.5%
Signature Coverage:	3.6%
Total number of Nodes:	588
Total number of Limit Nodes:	60

Executed Functions

Function 064837D8 Relevance: 6.9, Strings: 5, Instructions: 654
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hjq, xrefs: 06484CD9
Hjq, xrefs: 06484F3B
Hjq, xrefs: 06484DF3
Hjq, xrefs: 06484D6C
Hjq, xrefs: 06484E7D

Memory Dump Source

Source File: 00000000.00000002.2972574286.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_RobloxCheats.jbxd

Similarity

API ID:
String ID: Hjq$Hjq$Hjq$Hjq$Hjq
API String ID: 0-1529018591
Opcode ID: 9172a4fbd51f32f76df7d21058f176696628f1fc3197fc4df3c25fbb6dd34ea0
Instruction ID: 84b92131083a1f126187c7c2af609d8cb23a9ac57e46bfa4907a411f35bf5c54
Opcode Fuzzy Hash: 9172a4fbd51f32f76df7d21058f176696628f1fc3197fc4df3c25fbb6dd34ea0
Instruction Fuzzy Hash: AE427F70E002599FDB95EFA9C89479EBBF2EF88300F14856AD409AB385DB349D41CF91

Function 0648BDF7 Relevance: 1.9, APIs: 1, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2972574286.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b82d0ee94c8966b07ce4d8e7b6b160c00de7731b7ecba2ba428b64479ac5c02
Instruction ID: 66e7101ebea0cc6de4f8e1d98a0fce2a7936280c451aa4b4657d538178710923
Opcode Fuzzy Hash: 1b82d0ee94c8966b07ce4d8e7b6b160c00de7731b7ecba2ba428b64479ac5c02
Instruction Fuzzy Hash: 59F17D30E00209CFDB55EFA9C888BAEBBF1FF45314F15815AE405AB3A5DB74A945CB90

Function 06BD46A4 Relevance: 1.7, APIs: 1, Instructions: 223
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,00000000,?), ref: 06BD48A1

Memory Dump Source

Source File: 00000000.00000002.2974248289.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bd0000_RobloxCheats.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 36da943b6074a209c12e8029b1605a81e28b52820aaf2c74dc5cf832ef12cc6a
Instruction ID: 81b377acebd7ef69ff4869e43cedb90d8300b679e37f828cd3082224b624bbda
Opcode Fuzzy Hash: 36da943b6074a209c12e8029b1605a81e28b52820aaf2c74dc5cf832ef12cc6a
Instruction Fuzzy Hash: 099116B1D00649DFDB64CFA9C8447DEBBF2EF88300F25812AE415AB250E774A945CF91

Function 06BD36D4 Relevance: 1.7, APIs: 1, Instructions: 218
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,00000000,?), ref: 06BD48A1

Memory Dump Source

Source File: 00000000.00000002.2974248289.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bd0000_RobloxCheats.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 12361141b53d04d4ba5a4402e57e47e6a7442e02b97958499949bd2d29e55df4
Instruction ID: dc89c76e147d8df7edc55a4410cf28cf8e070f673cc24c06848f7daced637e2b
Opcode Fuzzy Hash: 12361141b53d04d4ba5a4402e57e47e6a7442e02b97958499949bd2d29e55df4
Instruction Fuzzy Hash: E19116B1D00609DFDB64CFAAC8447DEBBF2EF88300F25812AE415AB250E774A945CF91

Function 00A0EA20 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2966020766.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20234dc9f10aefe869a835d2fc6a4da9ff7cc485c06aa522d39110be86e46c66
Instruction ID: bc34416aec364d7eafb4335f4db9c352dbf8abb82849a04559607dc5ae15b4b4
Opcode Fuzzy Hash: 20234dc9f10aefe869a835d2fc6a4da9ff7cc485c06aa522d39110be86e46c66
Instruction Fuzzy Hash: 25528131A00619CFDB24CF58D880BAEB7B2FF45304F5588A9E819AB691D771FD85DB80

Function 06485B68 Relevance: .7, Instructions: 669COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2972574286.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5a72e24c165e500b7433b0b1493628920016a1801de02b5d8a0f76e1077354
Instruction ID: 70631838924d945c87ff73bd9087910480b5c362e1a2913adfde4679c1bff1d3
Opcode Fuzzy Hash: 2c5a72e24c165e500b7433b0b1493628920016a1801de02b5d8a0f76e1077354
Instruction Fuzzy Hash: 05522E34B002598FDB94EBB8C954BAE77B2EF89300F1084B9951EAB395DE359D81CF50

Function 06484708 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2972574286.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dde80d53d9500f99ec14b16572318e8ba1a52dc5fc27d21f206d244925aebc7
Instruction ID: 78afb2ea49087e05e1b4d1d597fe19af284f67733526a6a1f2840910d0a9b464
Opcode Fuzzy Hash: 5dde80d53d9500f99ec14b16572318e8ba1a52dc5fc27d21f206d244925aebc7
Instruction Fuzzy Hash: 68C15B74E002599FDB95EFA5C88079EBBF2AF88310F04C5AAD419AB255DB70D984CF90

Function 04F936D4 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69bc6820feb68e1ccd4ec3a59cd65b661c13d507a53e26f3bb8ae4aee292434
Instruction ID: d2dfa844e3e24168cdd9e6eab3e8159fc945e6c3bdb21bcfaba3d7d04e274122
Opcode Fuzzy Hash: b69bc6820feb68e1ccd4ec3a59cd65b661c13d507a53e26f3bb8ae4aee292434
Instruction Fuzzy Hash: 9EA18135E0031A9FDF04DFA4D8949ADB7FAFF89300F158615E816AB2A4DB30AD46CB50

Function 04F936C4 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc6970521021d6d7a4a32e04f9c3aed31d97801de04cc8a73f3c51561f682bf
Instruction ID: 3f5e3966ea1316aa4036d7f244b8c91a25d133a4019195709f51bc72878fe420
Opcode Fuzzy Hash: 8fc6970521021d6d7a4a32e04f9c3aed31d97801de04cc8a73f3c51561f682bf
Instruction Fuzzy Hash: FD917135E0031A9FDB04DFA4D8949DDBBFAFF89310B158615E816AB2A4DB30AD46CB50

Function 04F93B90 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3939a3e4a1e01c8b07774a54c76622c489449192182beeea7e98ca05ad89f4c
Instruction ID: e841b637fbaa430180795bc50fa314864217ce01192c85c1ab155c020c82e5ff
Opcode Fuzzy Hash: b3939a3e4a1e01c8b07774a54c76622c489449192182beeea7e98ca05ad89f4c
Instruction Fuzzy Hash: 97916E35E0031A9FDF04DFA4D8849DDB7FAFF89310B158615E816AB2A4DB30AD86CB50

Function 04F93B94 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb4b05695d569275c62880f1aab616afd0c0bc55b8f92639f51070058be6003
Instruction ID: 0ce37de04fe6b21f7d771a5f84154786571bbf9fe241fc9d409e278e4cbd75a0
Opcode Fuzzy Hash: dbb4b05695d569275c62880f1aab616afd0c0bc55b8f92639f51070058be6003
Instruction Fuzzy Hash: FE915F35E0031A9FDB04DFA4D8449DDFBBAFF89310B158615E816AB2A4DB30AD86CB50

Function 00A0ADF8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00A0AE76
GetCurrentThread.KERNEL32 ref: 00A0AEB3
GetCurrentProcess.KERNEL32 ref: 00A0AEF0
GetCurrentThreadId.KERNEL32 ref: 00A0AF49

Memory Dump Source

Source File: 00000000.00000002.2966020766.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_RobloxCheats.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1d2f7aa06f5842d612ba9e27604682e8abcd7b2aaa8c54a4c05bd3e2ab137e1e
Instruction ID: 78bf1e51162386e33eb25fcb46939ee42a6ba6986df1e3397c8a33a1ce1489ba
Opcode Fuzzy Hash: 1d2f7aa06f5842d612ba9e27604682e8abcd7b2aaa8c54a4c05bd3e2ab137e1e
Instruction Fuzzy Hash: 255168B09003498FDB14CFAAD548B9EBBF5EF48314F20845AE019A73A0DB74A944CB66

Function 04F901E4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000037,00000000,00000000,0332430C,02372920,?,00000000,?,00000000,00000000), ref: 04F90957

Strings

Hjq, xrefs: 04F90840

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: Hjq
API String ID: 2492992576-3368716452
Opcode ID: cd90c85abd65a43c292f32c9af57f6700515a4e86cc31288a74a551f82cf8d1f
Instruction ID: 7c58e81aaf218086f9c1fb5b5c4ecb8b836fe29fe59f41ecf137656aabfc3d33
Opcode Fuzzy Hash: cd90c85abd65a43c292f32c9af57f6700515a4e86cc31288a74a551f82cf8d1f
Instruction Fuzzy Hash: 375158357006108FEB58AA69D854B2E77E6EFC5B14B148469E50ACB3A1CF34EC03CBA5

Function 04F91298 Relevance: 1.7, APIs: 1, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 04F914EE

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 73b4d4b127a2a872520e0bd2e0e719b7c1f854913c7663b1f1d7adfa9becd673
Instruction ID: bf814b874eb2445e0097250b94d1dd503bcbf865a196999daffae63d9a4bced9
Opcode Fuzzy Hash: 73b4d4b127a2a872520e0bd2e0e719b7c1f854913c7663b1f1d7adfa9becd673
Instruction Fuzzy Hash: 1B711470A00B068FEB64DF6AD540B5ABBF1FF88304F00892DD48AD7A50DB75E946CB91

Function 04F93484 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F935A2

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2ef35ee7a9c23c70ddc7350c9079140f563631e641465f91b25409dd34054fed
Instruction ID: e412f585124be9fffb7caf3bca3d3598efdca8b1326c66f8b195edcf644d9b24
Opcode Fuzzy Hash: 2ef35ee7a9c23c70ddc7350c9079140f563631e641465f91b25409dd34054fed
Instruction Fuzzy Hash: E251BFB1D103099FEF14CF99C984ADEBBF5BF48314F64812AE819AB210D771A845CF90

Function 04F93490 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F935A2

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a20efa63b78228d19b9fc052028ee6f1215fcfa8902eeab852c5ee60982f97de
Instruction ID: 6a2ef08526fefee04d51dd43dd9dc3dd4db253d6ed3c40ff86ba879c61c0216d
Opcode Fuzzy Hash: a20efa63b78228d19b9fc052028ee6f1215fcfa8902eeab852c5ee60982f97de
Instruction Fuzzy Hash: 0341AEB1D103099FDF14CF9AC984ADEBBF5BF88314F64812AE819AB210D775A945CF90

Function 04F9348B Relevance: 1.6, APIs: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F935A2

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0c938af3e66f47e9339e4868f531c06704ed5946f48f67b747dfd1d65ca01cab
Instruction ID: 97f1f353d6e8b64ef595fd902e74237ec1518130618cf45264af416badfc5be6
Opcode Fuzzy Hash: 0c938af3e66f47e9339e4868f531c06704ed5946f48f67b747dfd1d65ca01cab
Instruction Fuzzy Hash: 7641AEB1D003099FDF14CF99C984ADEBBF5BF48314F64812AE819AB210D775A945CF90

Function 04F937D4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04F95F21

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: f30a1ba5c0d7d675a16d28784025ec7bba41649ec1aef83bb6d61f52f649dd9e
Instruction ID: 577f1bdade9611bf18be33d8869db3ca3e02c422c18afb0a1145337fd84519d7
Opcode Fuzzy Hash: f30a1ba5c0d7d675a16d28784025ec7bba41649ec1aef83bb6d61f52f649dd9e
Instruction Fuzzy Hash: A5412AB5A00309DFDB15CF99C488AAABBF5FF88314F248459E419AB321D775AC41CFA0

Function 064851E8 Relevance: 1.6, APIs: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 0648529D

Memory Dump Source

Source File: 00000000.00000002.2972574286.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_RobloxCheats.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: dd9b1df1e6aca52ae66e279e2b2e5ad9eb112c06394673685bedb604b1081dbc
Instruction ID: 2d526c21592f5606a612905a92e255ee5d3b37a80de140a13787e1dca5a67c66
Opcode Fuzzy Hash: dd9b1df1e6aca52ae66e279e2b2e5ad9eb112c06394673685bedb604b1081dbc
Instruction Fuzzy Hash: A02128B59002489FCB54DFAAD885ADEBFF8FF48320F10845AE519A7350CB75A944CFA1

Function 04F90898 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000037,00000000,00000000,0332430C,02372920,?,00000000,?,00000000,00000000), ref: 04F90957

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: c777ce238b8c4a77ab52215bfbbf4df6633847aa3d617d16181166b9c062c08c
Instruction ID: 1c5ed669c65b27805a53069b52a4b1c34915289913572c3b566cd267cce751fc
Opcode Fuzzy Hash: c777ce238b8c4a77ab52215bfbbf4df6633847aa3d617d16181166b9c062c08c
Instruction Fuzzy Hash: 812168313006119FEB18EB69D855B2E72E6FF88B14F108129E00ACB390CF30EC02C794

Function 0516E7C8 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 0516E857

Memory Dump Source

Source File: 00000000.00000002.2971725146.0000000005160000.00000040.00000800.00020000.00000000.sdmp, Offset: 05160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5160000_RobloxCheats.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: 4243d5d8b011949ae14eb40f16f8ef03d1e68505532775716d32aef82e3a8bc8
Instruction ID: 4424e3bc9cc10d1506dab216fe3ee2abe16c479979fe826efd0abff96334c746
Opcode Fuzzy Hash: 4243d5d8b011949ae14eb40f16f8ef03d1e68505532775716d32aef82e3a8bc8
Instruction Fuzzy Hash: 6A216B749002489BDB10DF99D405BAFBBF9EB89310F14811AE855A7380C779A909CFA1

Function 06BD49D4 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(00000000), ref: 06BD4A60

Memory Dump Source

Source File: 00000000.00000002.2974248289.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bd0000_RobloxCheats.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: afd43c75e8528e9b8dae0977fbcac14459ec8cb89802dd91edec78ca6f4fe612
Instruction ID: f8d62eea996a65b9b0b176898bc56522dba14cc49e15abac6fc82fd502fde23e
Opcode Fuzzy Hash: afd43c75e8528e9b8dae0977fbcac14459ec8cb89802dd91edec78ca6f4fe612
Instruction Fuzzy Hash: 7B2115B0D106489FDB24CFAAD585BDEBFF5AF48300F24806AE419AB350DB756804CFA4

Function 0648AB01 Relevance: 1.6, APIs: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0648AB85

Memory Dump Source

Source File: 00000000.00000002.2972574286.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_RobloxCheats.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 018248f40f4b0f0692c40d9cc9bd6c9817f7ea4600edc670f0c7fbd22bef1c94
Instruction ID: da348e1647e5d12066e9a46daca831217ae3cf73e7abda8368d70f9c92703178
Opcode Fuzzy Hash: 018248f40f4b0f0692c40d9cc9bd6c9817f7ea4600edc670f0c7fbd22bef1c94
Instruction Fuzzy Hash: 10219AB18053889FDB11CF99C845BEEBFF8EF49320F14849AE554A7252D378A944CBA1

Function 04F93AB7 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 04F93B35

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 377f2a80338290b2aeed5e657b94e21c79aa27c3f4cae3f1951b0bad30036265
Instruction ID: eb4ca64be36b60882f15b4203af7e08307e097c081abe425336ff3e1b6e7d39f
Opcode Fuzzy Hash: 377f2a80338290b2aeed5e657b94e21c79aa27c3f4cae3f1951b0bad30036265
Instruction Fuzzy Hash: 97218EB6D043489FEB10CF99C485BDABFF4EB59314F14844AD854A7241D338A906CFA6

Function 00A0B040 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A0B0C7

Memory Dump Source

Source File: 00000000.00000002.2966020766.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_RobloxCheats.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3debbb1062d89d6a757494b379af3719697be2d47afe0aea924ec2d814a493b4
Instruction ID: 1a84ec65de3cbe530ec2b677228a256bd6f31b3401a880bd973fc5dee8f8ac5d
Opcode Fuzzy Hash: 3debbb1062d89d6a757494b379af3719697be2d47afe0aea924ec2d814a493b4
Instruction Fuzzy Hash: 8521E4B59002089FDB10CF9AD984ADEFBF8EB48320F14841AE914A3350C374A944CF60

Function 06BD49E0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(00000000), ref: 06BD4A60

Memory Dump Source

Source File: 00000000.00000002.2974248289.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bd0000_RobloxCheats.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: 5de68c72310cda79e8918c2a1076fd8167bd46e3bc563cc01708582164840801
Instruction ID: c5da1d995cb88b2b0fb256efcd35389890c98913e97e239bbb90200f5718eb99
Opcode Fuzzy Hash: 5de68c72310cda79e8918c2a1076fd8167bd46e3bc563cc01708582164840801
Instruction Fuzzy Hash: 0C21F4B0D102589FDB14CFAAD585B9EBFF5AF48300F24806AE419BB350DB749804CFA4

Function 04F90418 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,04F91569,00000800,00000000,00000000), ref: 04F9177A

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cb761e8de3a5f825ccdbe57516cd0a7c2e16c25bb1b7641a3693c830ae1e581d
Instruction ID: e5e0a4eda9b0ef01de063650c0282b50f3964a5bd91b6dcd22ceaf7cacd4f709
Opcode Fuzzy Hash: cb761e8de3a5f825ccdbe57516cd0a7c2e16c25bb1b7641a3693c830ae1e581d
Instruction Fuzzy Hash: 1C11D6B6D0034A9FEB10CF9AC544A9EFBF4EB88314F14842AD519A7200C775A945CFA5

Function 06489280 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?), ref: 064892E0

Memory Dump Source

Source File: 00000000.00000002.2972574286.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_RobloxCheats.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: f8b1ba6db3a99e467c89b80eb912775f2ad63be7cbc8b3e2e0cdb2843ad43a1b
Instruction ID: fff614f86719ff291b7b26fdb4623edb12481f10b53ff63c75faffbc4aebc514
Opcode Fuzzy Hash: f8b1ba6db3a99e467c89b80eb912775f2ad63be7cbc8b3e2e0cdb2843ad43a1b
Instruction Fuzzy Hash: 48113AB18007498FDB20CF9AC945BEEFBF8EB48324F10845AE954A3240D778A544CFA5

Function 04F91709 Relevance: 1.6, APIs: 1, Instructions: 50libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,04F91569,00000800,00000000,00000000), ref: 04F9177A

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 438bd68cbf4a9ba08c8e4539616f1c035b57dbcdc37e11a30e90f1b0d67d5000
Instruction ID: 75a7227127fc61e35aa74ec061ae496d05109e5e99dcd504e9d3ea268eaae92d
Opcode Fuzzy Hash: 438bd68cbf4a9ba08c8e4539616f1c035b57dbcdc37e11a30e90f1b0d67d5000
Instruction Fuzzy Hash: E41114B6D0030A8FEB10CF9AC584BDEFBF5EB48310F14842AD929A7200C779A505CFA5

Function 06483E30 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000018,00000001,?), ref: 06483E95

Memory Dump Source

Source File: 00000000.00000002.2972574286.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_RobloxCheats.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: e30278c9b8ca9a16d6c4904beebd719d43d6c5ed1d504ed72a9a2557ff3b802d
Instruction ID: 96add9337fc4c32f428a925cce34a289d5df7daf710fdaaeab27d12940fe2c47
Opcode Fuzzy Hash: e30278c9b8ca9a16d6c4904beebd719d43d6c5ed1d504ed72a9a2557ff3b802d
Instruction Fuzzy Hash: C21125B58003499FCB11DF9AC985BDEFFF8EB48324F14844AE418A7200C374A944CFA1

Function 06489780 Relevance: 1.5, APIs: 1, Instructions: 49comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 064897DD

Memory Dump Source

Source File: 00000000.00000002.2972574286.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_RobloxCheats.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 973443db847e5b890dfa6f91f11a52a354e7091739cfc663797c7f338ecaa1cd
Instruction ID: ef1b860ba3555bcd091cf90ab9b092667e0a847822bcb534926a884c9f7b237f
Opcode Fuzzy Hash: 973443db847e5b890dfa6f91f11a52a354e7091739cfc663797c7f338ecaa1cd
Instruction Fuzzy Hash: C01136B5C007489FCB20DF9AD485BDEBFF8EB48324F24845AD558A7200C775A944CFA1

Function 0648AB28 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0648AB85

Memory Dump Source

Source File: 00000000.00000002.2972574286.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_RobloxCheats.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 66fd5718f33f99ae9ff929e67fa21109dbbd89af08d608abcd28e5f34d175286
Instruction ID: db9681726b61cd27b01cec7fd34ed2a5453b7e2e5ae197c62939317146e0442c
Opcode Fuzzy Hash: 66fd5718f33f99ae9ff929e67fa21109dbbd89af08d608abcd28e5f34d175286
Instruction Fuzzy Hash: DC1136B1800349CFDB10CF9AC985BEEFBF8EB48324F14841AE518A3240D378A584CFA1

Function 04F91488 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 04F914EE

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4225f9c3e1a74d7c1674a8ceb161a22745d4a8e4ebaa54ff4f8fc819c249e669
Instruction ID: e6a4992b06ea9dc8fd3c22f2d09e97c22a111e170e16270d0c49dc6626fc431b
Opcode Fuzzy Hash: 4225f9c3e1a74d7c1674a8ceb161a22745d4a8e4ebaa54ff4f8fc819c249e669
Instruction Fuzzy Hash: 7511DFB5C006498FEB10CF9AC544ADFFBF5AB88324F14846AD829A7610C379A945CFA1

Function 04F905C4 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 04F93B35

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 7e342a9be15e4a0bfa4e9124bcc8e224bc063bf5670dfe3bb45a331848bb2cdd
Instruction ID: cf146d8fa2750816b077e66bdaacbd8779a3a4c137f39c14c0d897a54249fe2f
Opcode Fuzzy Hash: 7e342a9be15e4a0bfa4e9124bcc8e224bc063bf5670dfe3bb45a331848bb2cdd
Instruction Fuzzy Hash: CD11F5B5900249DFDB10CF99C585BDEFBF8EB48324F20845AE914A7740D374A944CFA5

Function 06480610 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000018,00000001,?), ref: 06483E95

Memory Dump Source

Source File: 00000000.00000002.2972574286.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_RobloxCheats.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1d011f0b692c68094f216ed4d5e089523515c243ac22a69e1db55dfea7ee0390
Instruction ID: 4bc07fb86f69968f793c131aedb54b18658c3114680e18e8a2a9ee768cdd4486
Opcode Fuzzy Hash: 1d011f0b692c68094f216ed4d5e089523515c243ac22a69e1db55dfea7ee0390
Instruction Fuzzy Hash: 4E11F5B5800349DFDB50DF99C985BEEBBF8EB48324F10845AE918A7300C375A944CFA5

Function 0648CA40 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 0648CAA5

Memory Dump Source

Source File: 00000000.00000002.2972574286.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_RobloxCheats.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 172e08dced70de4fef688497f31010f2d0e0a74a91b95e3c064992960597f625
Instruction ID: 197836344b89e7848987e1accb2040b5d566b83538691a21a42325a381ae7745
Opcode Fuzzy Hash: 172e08dced70de4fef688497f31010f2d0e0a74a91b95e3c064992960597f625
Instruction Fuzzy Hash: 921103B5C046498FCB10DF9AD984BDEFBF4EB88324F10855AD818A7300C378A545CFA5

Function 06488760 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 064897DD

Memory Dump Source

Source File: 00000000.00000002.2972574286.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_RobloxCheats.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: e18e550367e27b6ed051dbfde28b468a87bd80378f93fb29ce8b3fea53a8a098
Instruction ID: 6b3a2427586c3aa98501dbc25a381be011a9317dee66aecd68994da9551a4ed6
Opcode Fuzzy Hash: e18e550367e27b6ed051dbfde28b468a87bd80378f93fb29ce8b3fea53a8a098
Instruction Fuzzy Hash: 491103B5900749CFDB20EF9AD584BDEBBF4EB48324F24845AD518A7300D774A944CFA5

Function 06489288 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?), ref: 064892E0

Memory Dump Source

Source File: 00000000.00000002.2972574286.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_RobloxCheats.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 68ae6027c9cb1a867f637c22276fd47a6906cff70ded90569d9eb893bae29806
Instruction ID: bd288070882869b0b3714b195b38ab268768050f74b33688e301b5af00dbd2fd
Opcode Fuzzy Hash: 68ae6027c9cb1a867f637c22276fd47a6906cff70ded90569d9eb893bae29806
Instruction Fuzzy Hash: 1D1103B18006498FDB20DF9AC585BEEFBF8EB48320F20845AD958A3640D778A544CFA5

Function 0648CA48 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 0648CAA5

Memory Dump Source

Source File: 00000000.00000002.2972574286.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_RobloxCheats.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 011c6bcc20cbbd79cd19de6e50bff69aecd64779015725bb4054a733ff44a79a
Instruction ID: cbf441e5a3e3bcbc14ff4f7d74df207da3bae258feae087f6d727c6aca488b76
Opcode Fuzzy Hash: 011c6bcc20cbbd79cd19de6e50bff69aecd64779015725bb4054a733ff44a79a
Instruction Fuzzy Hash: 9B11D0B5C006498FCB10DF9AD984BDEFBF4EB88324F10855AD818A7710D378A544CFA5

Function 04F93AD4 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 04F93B35

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 157b77893999d39b8116069cb7f086f6dae373aa7e21b7f886fc3c9a579eb861
Instruction ID: 9344dd210fb952c42391d4d90621ae2c587ccbdcacd72c972d8328fa84a30b65
Opcode Fuzzy Hash: 157b77893999d39b8116069cb7f086f6dae373aa7e21b7f886fc3c9a579eb861
Instruction Fuzzy Hash: F011D0B5900349CFDB10CF89D585BDEFBF8EB88324F24845AD958A7640C375A944CFA5

Function 04F93B70 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 04F93B35

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f82848785a4ce025c9f9de27a67213cab966d254833d35e9846929fd634b84bd
Instruction ID: f1557abf298e44642d30612e4ed3867262c62bbf97415c6cb6bb57b8b2520c53
Opcode Fuzzy Hash: f82848785a4ce025c9f9de27a67213cab966d254833d35e9846929fd634b84bd
Instruction Fuzzy Hash: 4DF0E9768043448EEF218F94D4457C9FFE0AF64318F14C54BC54592551C3346546CB51

Function 008ED210 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2965250554.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90239c7596895eeb40c2d6b520d16c992746b926dfcb3fccba92e0dc0160fb0b
Instruction ID: 6d2312fe6bfd8c6b60bd16836e81136671e1ca24ef0feeb45a60c1d7c7857dab
Opcode Fuzzy Hash: 90239c7596895eeb40c2d6b520d16c992746b926dfcb3fccba92e0dc0160fb0b
Instruction Fuzzy Hash: 6A2137B2504384EFCB05DF55D9C0B26BF65FB89314F24C569EE098B246C336E81ADBA1

Function 008ED4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2965250554.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bf5e6ba569d11769c99eadc40c511e6ff2c199275214dc2bd948dafa03359ff
Instruction ID: 3c20349c1bb41596da18c663ff4572bbbe7b702aa2160789e8ca910f5a735c35
Opcode Fuzzy Hash: 4bf5e6ba569d11769c99eadc40c511e6ff2c199275214dc2bd948dafa03359ff
Instruction Fuzzy Hash: F82145B1504384DFCB04CF04C9C0B26BF65FB99328F20C569E9098B256C336D84ACBA2

Function 008FD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2965334392.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8fd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f2e9633fd590d48eb2c54c0e3badc53dc546eae9a07c8d8044630eb5cb66b58
Instruction ID: e47ce16db3ae10ee8d26420ca0373aab8f89b3b18727c6330c39dc1f71dbc5a9
Opcode Fuzzy Hash: 0f2e9633fd590d48eb2c54c0e3badc53dc546eae9a07c8d8044630eb5cb66b58
Instruction Fuzzy Hash: E821D375504708DFDB14DF24D5C0B26BB66FBC4314F24C569EB0A8B256CB3AD847CA61

Function 008FD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2965334392.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8fd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 625b9f8c7e6e6ad4fb6e3e00c6c648be82b35478ce34cc9e5d820204b7cd5bd0
Instruction ID: ea6b9e11f91fad70ad24456f41174255cabf9dccf4db13c630dd329aca4be222
Opcode Fuzzy Hash: 625b9f8c7e6e6ad4fb6e3e00c6c648be82b35478ce34cc9e5d820204b7cd5bd0
Instruction Fuzzy Hash: A021F5B1504308EFDB05DF24D5C0B36BB66FB84318F24C56DEB098B255C736E846DAA1

Function 008ED20B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2965250554.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0198dffcca54c8a327979ca184e18e1179e26769679eb7287e54d642110c921c
Instruction ID: 04701cf805d3581a1e05b0684b800aab04e77e5a03b66c8608edcae3c5dd4602
Opcode Fuzzy Hash: 0198dffcca54c8a327979ca184e18e1179e26769679eb7287e54d642110c921c
Instruction Fuzzy Hash: 0221DF76404280DFCB06CF50D9C4B16BF72FB88314F24C5AADD084B656C33AE81ACBA1

Function 008ED4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2965250554.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: 74115ab51c33f87f9898fdb786261da4830c507e387d3a373d67749964849923
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: C211B176504380CFCB16CF14D9C4B16BF72FB95318F24C6A9D9094B656C33AD85ACBA1

Function 008FD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2965334392.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8fd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: 0a554f58064b9b248011fd92d345bfbfd06d836cf30bd9147962523b4136ae51
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: B011BE75504344DFCB12CF20C5C0B25BB62FB84314F24C6AADA498B656C33AE84ACB91

Function 008FD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2965334392.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8fd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: 5881f48b9939d6ea037dca67bc8ec81dfc7f93d54b0f61f1d6299e751f0e49cd
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: 5B11D075504784CFCB15CF24D5C4B25FB62FB84314F24C6AADA098B656C33AD84BCB61

Function 008ED607 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2965250554.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa810776203ef9d91cef5a52a8abed9ef67a2efdb1bcb6da98c31daa8cd8aca
Instruction ID: 4db4e99ad58f3ef9c5c12e59d38b5ddcf9d9329afe1ad59f2f2b8abebd16c151
Opcode Fuzzy Hash: 8fa810776203ef9d91cef5a52a8abed9ef67a2efdb1bcb6da98c31daa8cd8aca
Instruction Fuzzy Hash: 7DF0F9B6600644AF97208F0AD985C27FBADFBD5770715C55AE84A8B612C671EC41CAA0

Function 008ED5F8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2965250554.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3995059c376bf7b948c0ce4546d3b47ce885d1188e216fa2247fe040ae3ce031
Instruction ID: 593e61580187f59f1a8c69654e3e9b845f9eea7381f56c2bd9a45748823fbc0d
Opcode Fuzzy Hash: 3995059c376bf7b948c0ce4546d3b47ce885d1188e216fa2247fe040ae3ce031
Instruction Fuzzy Hash: C9F03175104784AFD7158F06C984C62BFB9FFC67607198489E8494B262C671FC46CB60

Non-executed Functions

Function 04F91990 Relevance: .5, Instructions: 523COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1354e40abd459fa7861d1b7f003dd47e070a2ee96b2d1dc0f33d32df71b5189b
Instruction ID: 1a5a374144a4a48fff73ab9013136c9c90b783679690aff559718899247968f0
Opcode Fuzzy Hash: 1354e40abd459fa7861d1b7f003dd47e070a2ee96b2d1dc0f33d32df71b5189b
Instruction Fuzzy Hash: 625236BCD00B06CFE710CFA9ED881997BB1FB82314B944219D1615B2B2E7B6694BCF44

Function 06BD3AD9 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2974248289.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bd0000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6bbe50f05e339315897fd5fbd2d9a77725b40d669102f62a2a0a86234ebfcfe
Instruction ID: 2de8c8fff90f0f873b3d5831e10a4ace8433b22acc9ed86577abdff1ba4d8d37
Opcode Fuzzy Hash: f6bbe50f05e339315897fd5fbd2d9a77725b40d669102f62a2a0a86234ebfcfe
Instruction Fuzzy Hash: EBB1D671E112198FDF49CF98C8543BEB7F2EF86304F1480B9D112AB286D6349D45CBA5

Function 04F90204 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e8f344bc49f82c41cd08c297f75e121c238df6863f1918d6601d2396886c72b
Instruction ID: c37059357840468e1ad845a3253dd079fb773b35d733b0a49c24dd1baebebb5a
Opcode Fuzzy Hash: 8e8f344bc49f82c41cd08c297f75e121c238df6863f1918d6601d2396886c72b
Instruction Fuzzy Hash: DBA17C36E012198FDF19DFA5C88059EB7F2FF85304B15856AE905AB261DF31ED46CB80

Function 04F91BE5 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971225789.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d9de1bc996aae36f0bfd43a8f437c931c7806ddd98969244aab7e7de69899e4
Instruction ID: 1fbd7911aa468c9bca064812c4513e308914c39654f9ed9ff980e75f66400946
Opcode Fuzzy Hash: 9d9de1bc996aae36f0bfd43a8f437c931c7806ddd98969244aab7e7de69899e4
Instruction Fuzzy Hash: EBC1A1BDC01B468BE714CFB5ED881897BB1BBC6324B604219D2612B2F6DBB6154BCF44

Function 00A00D70 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2966020766.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc4b0b723ce23383513947d5ac46a40f9df91711d9cbeab326120dbb95f3c6d
Instruction ID: 973bc80900360f9e03e82eee8c9f3fc14ed16719e2278b434f608e1bc6ab9030
Opcode Fuzzy Hash: 8dc4b0b723ce23383513947d5ac46a40f9df91711d9cbeab326120dbb95f3c6d
Instruction Fuzzy Hash: 503175B09042448EE349EF3AEC816677FA7BBD6300F24D56E9004D7269EF780945DB51

Function 00A00D80 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2966020766.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86e8dd8e7ca0d1fd5009c087cd41b882dcb6cafc91b6c2742cb57f33223c5cbd
Instruction ID: c702c2d52d1773ce3b0b6acb512f17881c5331407383a9161dac45e8935ec31c
Opcode Fuzzy Hash: 86e8dd8e7ca0d1fd5009c087cd41b882dcb6cafc91b6c2742cb57f33223c5cbd
Instruction Fuzzy Hash: 183163B0A002448EE349EF3BEC8166B7BA7BBD6304F20D96D9008D7269EF781945DB51

Analysis Process: RobloxCheats.exePID: 3228, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	99.1%
Signature Coverage:	0%
Total number of Nodes:	428
Total number of Limit Nodes:	35

Executed Functions

Function 052FC159 Relevance: 1.8, APIs: 1, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2971408726.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52f0000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d8333a767275b33455fa9abe1a7d9125b6fea143faff4d044f4c3bafe8ed6f9
Instruction ID: be42f76addbd544cee1137c7f7da5212540d1e3bb91ae57f7ea81ce69035a014
Opcode Fuzzy Hash: 4d8333a767275b33455fa9abe1a7d9125b6fea143faff4d044f4c3bafe8ed6f9
Instruction Fuzzy Hash: 57D14B30A1420ACFDB14DFA5D988BADFBF2BF48304F158569E509BB2A5DB709D45CB40

Function 00A0ADF8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00A0AE76
GetCurrentThread.KERNEL32 ref: 00A0AEB3
GetCurrentProcess.KERNEL32 ref: 00A0AEF0
GetCurrentThreadId.KERNEL32 ref: 00A0AF49

Memory Dump Source

Source File: 00000002.00000002.2965861239.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_RobloxCheats.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7cd6bc9eae2f37cc5ba4a7fa1d502e9fc4a7a3ac50c2fbc48e863e3f68ddb1bf
Instruction ID: 474b9045d995f7512d053c895470cb7bf6b4e20d67652c291088a9f0f1e44cdc
Opcode Fuzzy Hash: 7cd6bc9eae2f37cc5ba4a7fa1d502e9fc4a7a3ac50c2fbc48e863e3f68ddb1bf
Instruction Fuzzy Hash: 225145B0900749CFDB14CFAAD988B9EBBF5FF48314F208459E409A72A0D7745944CB66

Function 04F801E4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000037,00000000,00000000,0335430C,023A2920,?,00000000,?,00000000,00000000), ref: 04F80957

Strings

Hjq, xrefs: 04F80840

Memory Dump Source

Source File: 00000002.00000002.2970317258.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: Hjq
API String ID: 2492992576-3368716452
Opcode ID: 0b176b2bc85203e1c09f2ef0b07dc9b86079ed84e72c594eff7c75b15263f11c
Instruction ID: 7ac026a62c5a39792aec5c5763a2891b9efd5064cd882a8247dcfce3e50644d9
Opcode Fuzzy Hash: 0b176b2bc85203e1c09f2ef0b07dc9b86079ed84e72c594eff7c75b15263f11c
Instruction Fuzzy Hash: E3519A317006508FDB58AF28D855B2E77A6AFC9704F5644ADE006CB3A1CF74EC46CB94

Function 04F81298 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04F814EE

Memory Dump Source

Source File: 00000002.00000002.2970317258.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d4f3ba37f8f1c650d7e28694a7a5a5bb6dede6864a75014535b35bfd782270eb
Instruction ID: d048154c34cf0346b75ec00198703165b2f48a6d0fd2257be68e2fa3fa8eb83a
Opcode Fuzzy Hash: d4f3ba37f8f1c650d7e28694a7a5a5bb6dede6864a75014535b35bfd782270eb
Instruction Fuzzy Hash: 85812570A00B058FDB24EF6AD54475ABBF1BF88304F008A2DD48ADBA50DB75F946CB91

Function 04F83484 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F835A2

Memory Dump Source

Source File: 00000002.00000002.2970317258.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0f9f20fda4a5143640a12189fde7f4488c74698d33a1fdac965d5684bf86c711
Instruction ID: aec44e718822f64a026dc254a6e293944a7399a7c6efd139c5eee474f553e819
Opcode Fuzzy Hash: 0f9f20fda4a5143640a12189fde7f4488c74698d33a1fdac965d5684bf86c711
Instruction Fuzzy Hash: 1051C0B1D10349AFDF15DF99C984ADEBFB5BF48310F64852AE818AB210D771A845CF90

Function 04F83490 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F835A2

Memory Dump Source

Source File: 00000002.00000002.2970317258.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9c2a8c3cf4c7ab701ccd673f9fee517c539e79469d716d88946993d84a876808
Instruction ID: 26ae197378ed5a19105fc8b87bb5a6d4f213eaf7de2aef73c177b1d66b415fb6
Opcode Fuzzy Hash: 9c2a8c3cf4c7ab701ccd673f9fee517c539e79469d716d88946993d84a876808
Instruction Fuzzy Hash: 6941CFB1D103099FDF14CF99C984ADEBBB5BF88310F64852AE818AB210D775A845CF90

Function 04F837D4 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04F85F21

Memory Dump Source

Source File: 00000002.00000002.2970317258.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 5d4a67355c3617fd619b4c75a59a985c588b5cc98ab3ef1f52eccd1f3228bfb0
Instruction ID: a0b91a59b71e1cc943e236df1e3810b78adca439ab3b1e2bdc6282866e13b24c
Opcode Fuzzy Hash: 5d4a67355c3617fd619b4c75a59a985c588b5cc98ab3ef1f52eccd1f3228bfb0
Instruction Fuzzy Hash: 70411AB5900305DFDB14DF99C888AAABBF5FF88314F24C459E519AB321D774A845CFA0

Function 052F51E8 Relevance: 1.6, APIs: 1, Instructions: 79
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageW.USER32(?,?,?,?), ref: 052F529D

Memory Dump Source

Source File: 00000002.00000002.2971408726.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52f0000_RobloxCheats.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 9f374664cfeb6a8741be0986abfe4211138366ca11efba64e2cba3254d03b2f9
Instruction ID: f018740662837bda6bbd1f6c25bdf00c79dd279093608fbe14aae8959a17a055
Opcode Fuzzy Hash: 9f374664cfeb6a8741be0986abfe4211138366ca11efba64e2cba3254d03b2f9
Instruction Fuzzy Hash: 10214BB5A043089FCB14DFA9D885A9EBFF8FF48320F10446AE519A7751C775A940CFA1

Function 04F80898 Relevance: 1.6, APIs: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000037,00000000,00000000,0335430C,023A2920,?,00000000,?,00000000,00000000), ref: 04F80957

Memory Dump Source

Source File: 00000002.00000002.2970317258.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 37fb4a5157d9bc5fa01ea81c244e93057c9cd57d4bb4676ebac95d4d76724746
Instruction ID: b2d79a9d8a08a1d68da50cea4569b269cbc5dba3d4601f8ed2767421091e6798
Opcode Fuzzy Hash: 37fb4a5157d9bc5fa01ea81c244e93057c9cd57d4bb4676ebac95d4d76724746
Instruction Fuzzy Hash: AB2149313006119FE758EB69D855B2E72A6FF88B14F518169E009CB390CF74FC46C794

Function 050FE7C8 Relevance: 1.6, APIs: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 050FE857

Memory Dump Source

Source File: 00000002.00000002.2970838920.00000000050F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50f0000_RobloxCheats.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: 9d5c85db37a335c23a992bc53a38661fe90f62444522d6fbcc8f952bdcde2188
Instruction ID: 8fe630401bb84f9822aa09b09c0b8d61a0229781ee73c9c8f6763ec016ed7ee3
Opcode Fuzzy Hash: 9d5c85db37a335c23a992bc53a38661fe90f62444522d6fbcc8f952bdcde2188
Instruction Fuzzy Hash: 1221BDB0D00244CFDB50DFA9D8097EEBBB5FB48320F14841AE855AB781C7385A45CF61

Function 00A0B040 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A0B0C7

Memory Dump Source

Source File: 00000002.00000002.2965861239.0000000000A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a00000_RobloxCheats.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 43a3a325a137ac79e5c8e46429fdf8fdf126eacfd74a2a321b76084e1867c7ff
Instruction ID: 87a95a62cc6cf4e69f7c30945ba906ba5e09f3055c25506bd36f546a6bec384c
Opcode Fuzzy Hash: 43a3a325a137ac79e5c8e46429fdf8fdf126eacfd74a2a321b76084e1867c7ff
Instruction Fuzzy Hash: 5B21E4B59002089FDB10CF9AD984ADEBBF9EB48320F14841AE914A3350C374A940CF60

Function 04F83AB7 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 04F83B35

Memory Dump Source

Source File: 00000002.00000002.2970317258.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 4234f371c373d2b1a07a2a46047ff89ab9b895b96a9e4bfcedc158d84d020124
Instruction ID: 8fa9e8acbe1cf142d8c9441887b6129595a4c2e83e74300aa15b7cf76fc9e47e
Opcode Fuzzy Hash: 4234f371c373d2b1a07a2a46047ff89ab9b895b96a9e4bfcedc158d84d020124
Instruction Fuzzy Hash: 062189B18043899FDB10CF99C884ADEFFF8EF49320F14884AE954A7201C374A941CFA1

Function 052FC660 Relevance: 1.6, APIs: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 052FC6D0

Memory Dump Source

Source File: 00000002.00000002.2971408726.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52f0000_RobloxCheats.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 3db2236fa7e46fe4d0c698e52978b27bbd039e1a4ddace7c62423c1f76a0f80d
Instruction ID: edd704dfa03c77b3e468eba2d5ee1eec227e8970217cd7f21a3ec002b4bcc47a
Opcode Fuzzy Hash: 3db2236fa7e46fe4d0c698e52978b27bbd039e1a4ddace7c62423c1f76a0f80d
Instruction Fuzzy Hash: 561117B1C042099FDB10CF9AD845BEEFBF8FB48320F10842AE558A3650C379A944DFA5

Function 04F80418 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04F81569,00000800,00000000,00000000), ref: 04F8177A

Memory Dump Source

Source File: 00000002.00000002.2970317258.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6f2049d39c98c228e4d4f25bed427369ec89ff11bea0f614ee6af475094b10cc
Instruction ID: 45d5a7b8363a92e5d0f3299f96f8535c32663f46b313a19432529605113abdaf
Opcode Fuzzy Hash: 6f2049d39c98c228e4d4f25bed427369ec89ff11bea0f614ee6af475094b10cc
Instruction Fuzzy Hash: 8511E7B6D003499FDB10DF9AC944ADEFBF5EB88310F14852ED929A7200C375A546CFA5

Function 04F81709 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04F81569,00000800,00000000,00000000), ref: 04F8177A

Memory Dump Source

Source File: 00000002.00000002.2970317258.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7b50db04341a8c1b1c278e4765f9fc0780aa48d1c619527e85d3b8652ac6e56e
Instruction ID: 41ffcf35451b72c5059c7a8b6fda476124e2e94526fc60763b9b897895eb059a
Opcode Fuzzy Hash: 7b50db04341a8c1b1c278e4765f9fc0780aa48d1c619527e85d3b8652ac6e56e
Instruction Fuzzy Hash: 5621F4B6C003498FDB10DF9AC984ADEFBF5AF88310F14856ED469A7200C375A545CFA5

Function 052FC668 Relevance: 1.6, APIs: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 052FC6D0

Memory Dump Source

Source File: 00000002.00000002.2971408726.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52f0000_RobloxCheats.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: aa62c54fd7567a0081f896da3b0ffe6fc1e6ce76b71d152d32424cf1a745e9ca
Instruction ID: 14d518492c1311b6f577392ac47431220fe7d5f2307d9dba6088f2447c8ad612
Opcode Fuzzy Hash: aa62c54fd7567a0081f896da3b0ffe6fc1e6ce76b71d152d32424cf1a745e9ca
Instruction Fuzzy Hash: A811F6B5C042499FDB10CF9AD944BDEFBF8FB48324F10842AE558A3251C378A944DFA5

Function 052FAE40 Relevance: 1.6, APIs: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 052FAEA5

Memory Dump Source

Source File: 00000002.00000002.2971408726.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52f0000_RobloxCheats.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b4d7e26e8ce75b480cbb0a699882fcfd4e3c2091027652cbf9b96f681762e50f
Instruction ID: b5895002d1bb4a70f6ab6d27ed4b29880937aeba73cb37d80f8b2750c020545d
Opcode Fuzzy Hash: b4d7e26e8ce75b480cbb0a699882fcfd4e3c2091027652cbf9b96f681762e50f
Instruction Fuzzy Hash: 7E1116B58103499FDB10CF9AC845BEEFBF8FB48320F10842AE958A3240D378A544CFA1

Function 052FAE48 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 052FAEA5

Memory Dump Source

Source File: 00000002.00000002.2971408726.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52f0000_RobloxCheats.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ea595e0d7eaee65e42538fbf8d42a1416cb7b163560b4a39ee7766769c2af828
Instruction ID: 25a6c79e93d9f65b6c2fc5b7854d0fd06d5391745e0303b1d363928778e98ff1
Opcode Fuzzy Hash: ea595e0d7eaee65e42538fbf8d42a1416cb7b163560b4a39ee7766769c2af828
Instruction Fuzzy Hash: 4C11F5B58103499FDB10CF9AC945BDEFBF8EB48320F14846AE558A3641D378A544CFA5

Function 052F82AC Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,052F955C,?,?), ref: 052F9600

Memory Dump Source

Source File: 00000002.00000002.2971408726.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52f0000_RobloxCheats.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b2cc5f0217c2862f77e0d33a8023420b22c65287c1a62e40d302ec8fadf4ad00
Instruction ID: f663f0dfb058bcb4ce6340b10982a9d05fca5183cf03ff55c2162dadcfc64441
Opcode Fuzzy Hash: b2cc5f0217c2862f77e0d33a8023420b22c65287c1a62e40d302ec8fadf4ad00
Instruction Fuzzy Hash: 8B1128B18002098FDB10CF9AD445BDEFBF4EF48320F108469D558A3241D378A544CFA5

Function 052F3E30 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000018,00000001,?), ref: 052F3E95

Memory Dump Source

Source File: 00000002.00000002.2971408726.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52f0000_RobloxCheats.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 94dccc1a345180a4aff0c6349bca015f2b3f67ae8377670d67a4eb1d95ecb051
Instruction ID: cd24f13e2459015b5269aa1d5905c20c716764fd41f8aadc521715d2579d64b9
Opcode Fuzzy Hash: 94dccc1a345180a4aff0c6349bca015f2b3f67ae8377670d67a4eb1d95ecb051
Instruction Fuzzy Hash: D411E3B58003499FDB10CF9AD885BDEBFF8EF58324F248859D558A7600C3B5A544CFA1

Function 052F0610 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000018,00000001,?), ref: 052F3E95

Memory Dump Source

Source File: 00000002.00000002.2971408726.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52f0000_RobloxCheats.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: fa347dc6ed9a9cd7d6033277d4adaa24dc4235795760324270d8569eb96f7b0d
Instruction ID: 603c11fc31913a8971c90b31af4855a3542bb414eda56e9ac1fbbe345abb6b79
Opcode Fuzzy Hash: fa347dc6ed9a9cd7d6033277d4adaa24dc4235795760324270d8569eb96f7b0d
Instruction Fuzzy Hash: 3611E3B58103499FDB20CF99D845BDEFBF8EF58320F108859E918A7200C375A944CFA5

Function 04F81488 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04F814EE

Memory Dump Source

Source File: 00000002.00000002.2970317258.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: db1baa8493f38a43a539f5cc7c8e6e403b9a72a34b5b9bd0407ede97007eb5af
Instruction ID: cfc6593689e132d685bb5aed8f40f18347817dd7a7fac9bfc6c2ceff6a5323af
Opcode Fuzzy Hash: db1baa8493f38a43a539f5cc7c8e6e403b9a72a34b5b9bd0407ede97007eb5af
Instruction Fuzzy Hash: F2110FB5C002498FDB20DF9AC944ADEFBF5AB88324F10855AD829A7200C379A546CFA1

Function 04F805C4 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 04F83B35

Memory Dump Source

Source File: 00000002.00000002.2970317258.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: b9f7bf46db54a797d16d37b7f65a476721d1454e6a7e17b2c69bda29fbdc7560
Instruction ID: b0dd2d970d041b501aa2928d7a173130390f9f0436087a5fd140662c94c5051b
Opcode Fuzzy Hash: b9f7bf46db54a797d16d37b7f65a476721d1454e6a7e17b2c69bda29fbdc7560
Instruction Fuzzy Hash: C11125B5800248DFDB20DF89C485B9EBBF8EB88324F20841AE914A7310C375A944CFA1

Function 052F95A0 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,052F955C,?,?), ref: 052F9600

Memory Dump Source

Source File: 00000002.00000002.2971408726.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52f0000_RobloxCheats.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 90b59b1da0833c17746a1b21654f5636aa0f83b829f199157efa50ba1752a3bd
Instruction ID: c155aa9f2326c54a8755afc12c091feb0ab66526d419035fae32686f2fb6502e
Opcode Fuzzy Hash: 90b59b1da0833c17746a1b21654f5636aa0f83b829f199157efa50ba1752a3bd
Instruction Fuzzy Hash: 651125B1804209CFDB10CF99D445BDEBBF4EB48320F24841AD558A3650C378A544CFA4

Function 052F8B70 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 052F9AFD

Memory Dump Source

Source File: 00000002.00000002.2971408726.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52f0000_RobloxCheats.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 59d33f56dc566681274826e5f6f250d77041c444397278e6a0153823f2db2e1a
Instruction ID: 58b288ca394d8f6eedf31dedf482c22dd291372843436912c66963c8b585291b
Opcode Fuzzy Hash: 59d33f56dc566681274826e5f6f250d77041c444397278e6a0153823f2db2e1a
Instruction Fuzzy Hash: D51103B19143498FDB20DF9AD484B9EFBF8EF48324F208469E519A7240D375A944CFA5

Function 052F9AA1 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 052F9AFD

Memory Dump Source

Source File: 00000002.00000002.2971408726.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52f0000_RobloxCheats.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: a9337c39637823af9d597e530c2e870d00a1e749caa077877202666f70beb9e5
Instruction ID: 6659f408a52b93b6b592493d377d82840820f3fc4dc5c144a6728126656b26f7
Opcode Fuzzy Hash: a9337c39637823af9d597e530c2e870d00a1e749caa077877202666f70beb9e5
Instruction Fuzzy Hash: 0A1103B18103498FDB20DFAAD585B9EFBF8EB48324F20845AD519A7200D375A944CFA5

Function 052FCD60 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 052FCDBD

Memory Dump Source

Source File: 00000002.00000002.2971408726.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52f0000_RobloxCheats.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: b0033429b372850b4abf2a84349df417a3743d97222eb2860dcbd197d3e23487
Instruction ID: c724c88f3e499459e3fd31cbb7d9dfb3f181e7a014c9d2cead165cdf54a5bf6f
Opcode Fuzzy Hash: b0033429b372850b4abf2a84349df417a3743d97222eb2860dcbd197d3e23487
Instruction Fuzzy Hash: 3511FEB5C042498FCB20CF9AD844BCEFBF4EB88320F10842AD529A3200C378A544CFA5

Function 052FCD58 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 052FCDBD

Memory Dump Source

Source File: 00000002.00000002.2971408726.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52f0000_RobloxCheats.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 51fdf08ee1a9deee1353087fcae8b5ff7c6bb483d110378c12a4c734ee920116
Instruction ID: ec2d9e8b2a6861a18d801cb4fcb0ef93d606344e43c131e1fab9bbbebe5f73eb
Opcode Fuzzy Hash: 51fdf08ee1a9deee1353087fcae8b5ff7c6bb483d110378c12a4c734ee920116
Instruction Fuzzy Hash: 3511FEB5C042498ECB20CFAAE545BDEFBF4AB48324F24846AD469A7201C378A544CFA5

Function 04F83B70 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 04F83B35

Memory Dump Source

Source File: 00000002.00000002.2970317258.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 11b10b65d8317205c06530a95ddc59dac2145512a95b71d84b5fde5b1845e8c3
Instruction ID: 2e5a5b8b54c66ee4da237e215e6c9b6936568715242bbc2f5bdb378894cac4fc
Opcode Fuzzy Hash: 11b10b65d8317205c06530a95ddc59dac2145512a95b71d84b5fde5b1845e8c3
Instruction Fuzzy Hash: 13F0C87580D3C08EC722AB789424785FFE05F52218F2984CBC5C58B5A3C13A604AC761

Function 007ED210 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2965251443.00000000007ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 007ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69aa10559eff41870caccd08f4221009c38da27062e8dfeb6773d040b5636cf8
Instruction ID: dc00513e8957522cd47deac80d3b3fe3fcb37694c4f2393e4ac49af1bb551fe0
Opcode Fuzzy Hash: 69aa10559eff41870caccd08f4221009c38da27062e8dfeb6773d040b5636cf8
Instruction Fuzzy Hash: C22125B2505280DFCB25DF55D9C0B26BF69FB8C320F24C569EA094B246C33ADC16DBA1

Function 007ED4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2965251443.00000000007ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 007ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12fca2221de4a1be57a4712e1f1dc290675bc0df4ecda798b4161d37fcabe5d3
Instruction ID: 17bcd1deaadbcd0078519e89f17f736edc4c1017e7d66363694391998581b202
Opcode Fuzzy Hash: 12fca2221de4a1be57a4712e1f1dc290675bc0df4ecda798b4161d37fcabe5d3
Instruction Fuzzy Hash: 012145B1504280DFCB24CF04C9C0B26BF65FB9C328F208569E9090B256C33ADC66CBA2

Function 007FD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2965349374.00000000007FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7fd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ea68a8b4778914e661812d64241bf051f35177a1d2917d68369b7ee870e5af
Instruction ID: 98927942246460de3353f272ac80be6a6fb6d83cb899b26af8c43cdd3e5d846a
Opcode Fuzzy Hash: e8ea68a8b4778914e661812d64241bf051f35177a1d2917d68369b7ee870e5af
Instruction Fuzzy Hash: C521F5B5604208DFDB24DF14D5C4B26BB66FB84314F24C56DEA0A4B356CB3ADC47CA61

Function 007FD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2965349374.00000000007FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7fd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b97a7114187a452cae70287b468886e06578f0fc36d7bf52c993f7b271666da8
Instruction ID: dd563537a2e67afd654dd90a5e95ab4dcbb441ac13d3cb9273ab69baff495aba
Opcode Fuzzy Hash: b97a7114187a452cae70287b468886e06578f0fc36d7bf52c993f7b271666da8
Instruction Fuzzy Hash: 992107B1504208EFDB25DF14D5C0B36BB66FB84314F24C56DEA094B355C73ADC46DAA1

Function 007ED20B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2965251443.00000000007ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 007ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0198dffcca54c8a327979ca184e18e1179e26769679eb7287e54d642110c921c
Instruction ID: a3406764d05f024e5848ccfcc30d5be73c6d7ef8cb5f528a9b0f013aa1c7fcaf
Opcode Fuzzy Hash: 0198dffcca54c8a327979ca184e18e1179e26769679eb7287e54d642110c921c
Instruction Fuzzy Hash: 88210376404280CFCB16CF50D9C4B16BF72FB88314F24C5AADD084B656C33AD82ACBA1

Function 007ED4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2965251443.00000000007ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 007ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: 9aec19a3091a7481a4ee2d3e5178f42e541e046de5da8cc8e0cfe17847467b27
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: F411E676504280CFCB16CF14D9C4B16BF72FB98318F24C6A9D9094B656C33AD86ACBA1

Function 007FD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2965349374.00000000007FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7fd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: 8e7acb8903cdd84ca2e0ded9aff14a7ec829f1f732f7edc5df89a3b3b2d120ec
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: B511BB75504284DFCB22CF10C5C0B25BBA2FB84324F24C6AAD9494B796C33AD84ACBA1

Function 007FD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2965349374.00000000007FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7fd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: 8cbcb80477039502c86fbcfa2f31f9564d8a1f6f3f57d397b31772b10878d318
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: 0911DD75504284CFCB26CF14D5C4B25FBA2FB88314F24C6AAD9094B756C33AD84ACBA2

Function 007ED607 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2965251443.00000000007ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 007ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc4a88b4c315c30b6b8a17a468b4846879cc93c7c4941e1d390ce464f8e1f60a
Instruction ID: 342657adc7a8ebaf99c91e074dce62d5a8135e274ef7ed0bab95a58700040a9c
Opcode Fuzzy Hash: fc4a88b4c315c30b6b8a17a468b4846879cc93c7c4941e1d390ce464f8e1f60a
Instruction Fuzzy Hash: 7FF0F9B6601644AF97208F0ADD84C27FBADEBC4770715C59AE84A4B612C671EC41CEA0

Function 007ED5F8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2965251443.00000000007ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 007ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b6b55ec845d994ce40e33ae91b0354bd3cef0a9c14a72d5f8fb5baa1fb89684
Instruction ID: fb8438f027628c3f40c6b25dd6f24853e82a08d222eebafecf15b968a46350b6
Opcode Fuzzy Hash: 3b6b55ec845d994ce40e33ae91b0354bd3cef0a9c14a72d5f8fb5baa1fb89684
Instruction Fuzzy Hash: 5CF03C75105680AFD7258F06CD84C22BFB9EFC97607198489E8994B252C675FC42CB60

Analysis Process: RobloxCheats.exePID: 1668, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	13.3%
Dynamic/Decrypted Code Coverage:	99.4%
Signature Coverage:	0%
Total number of Nodes:	527
Total number of Limit Nodes:	56

Executed Functions

Function 0537C127 Relevance: 1.9, APIs: 1, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2971365056.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5370000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7562a0778f0ef0b9b6feebdf59f6c868e49a4ae2ce144afea69b5e4227a8afc4
Instruction ID: 576144acd3876fdd1b5681df7dbf56dff88c94f77118f825c5eec7ce737b3a56
Opcode Fuzzy Hash: 7562a0778f0ef0b9b6feebdf59f6c868e49a4ae2ce144afea69b5e4227a8afc4
Instruction Fuzzy Hash: 26E13D70E0020DCFDB24DFAAC988BADBBF2BF44314F159155E405AB2A5DBB99D45CB40

Function 04F83B90 Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 04F83B35

Memory Dump Source

Source File: 00000006.00000002.2970149782.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: baf66e88d24df9c64b73c410db59420c3b1dcc7043a3b9a313bfc756ca6624f4
Instruction ID: 8c5d9eff28c09dcb7eb3df20a72b532776f2b98522ce293c4b69f3a16a474afd
Opcode Fuzzy Hash: baf66e88d24df9c64b73c410db59420c3b1dcc7043a3b9a313bfc756ca6624f4
Instruction Fuzzy Hash: 32A16275E00319DFCB04EFA4D8449DDFBBAFF89310F158619E416AB2A4DB34A946CB50

Function 021FADF8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 021FAE76
GetCurrentThread.KERNEL32 ref: 021FAEB3
GetCurrentProcess.KERNEL32 ref: 021FAEF0
GetCurrentThreadId.KERNEL32 ref: 021FAF49

Strings

ms=*, xrefs: 021FAE14

Memory Dump Source

Source File: 00000006.00000002.2966131996.00000000021F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 021F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f0000_RobloxCheats.jbxd

Similarity

API ID: Current$ProcessThread
String ID: ms=*
API String ID: 2063062207-267167651
Opcode ID: f9adf6a46e9ca35dbd53d3a31270e7e8b74d162963c47ffbba6357bf2a9c02ce
Instruction ID: 2136ede8bf8b3a814338a1b35f452a721ca80db3e16b33bb9beeff06bd6d758c
Opcode Fuzzy Hash: f9adf6a46e9ca35dbd53d3a31270e7e8b74d162963c47ffbba6357bf2a9c02ce
Instruction Fuzzy Hash: AF5179B0900349CFDB54CFAAD548B9EBBF5FF48314F24845AE019A73A1DB38A944CB65

Function 04F81298 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04F814EE

Strings

@p^, xrefs: 04F81426
ms=*, xrefs: 04F814A7
@p^, xrefs: 04F8144B

Memory Dump Source

Source File: 00000006.00000002.2970149782.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: HandleModule
String ID: @p^$@p^$ms=*
API String ID: 4139908857-617401346
Opcode ID: 78f74a2f4c8cf27b4ad6eb935b0bb0aec289d8b3a09857a9a5dc062da184e181
Instruction ID: f8194f2aab507a390c548fbe53dd825f65114dc77e56b73ae6d9e9d298323fa3
Opcode Fuzzy Hash: 78f74a2f4c8cf27b4ad6eb935b0bb0aec289d8b3a09857a9a5dc062da184e181
Instruction Fuzzy Hash: 79710470A00B058FDB64EF6AD54475ABBF1BF88304F008A2ED486DBA50DB75F946CB91

Function 04F801E4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000037,00000000,00000000,0333430C,02382920,?,00000000,?,00000000,00000000), ref: 04F80957

Strings

@p^, xrefs: 04F8086A
@p^, xrefs: 04F80851
Hjq, xrefs: 04F80840

Memory Dump Source

Source File: 00000006.00000002.2970149782.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: @p^$@p^$Hjq
API String ID: 2492992576-2780206844
Opcode ID: 0bc8077a3b86f31125969a6005e9d7b79028641fbaa647dae510e5e9153a8f73
Instruction ID: 39e766a4e0ddabb1e7e6c47c81691c7e744b37346f30c05f9253efbc09e48567
Opcode Fuzzy Hash: 0bc8077a3b86f31125969a6005e9d7b79028641fbaa647dae510e5e9153a8f73
Instruction Fuzzy Hash: 8F517B317406108FEB58AB29D854B2E77AAFFC4704B56846AE406CB3A1CF74EC47CB94

Function 04F83484 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F835A2

Strings

ms=*, xrefs: 04F834DE
ms=*, xrefs: 04F834BE

Memory Dump Source

Source File: 00000006.00000002.2970149782.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: CreateWindow
String ID: ms=*$ms=*
API String ID: 716092398-479262615
Opcode ID: 6a12b83c9ca8d5fb763450bd7047b9c322d6a97f870ede149a8eb3b8c25632bd
Instruction ID: 23a50705d88e18eac58291488e778d3c73b7cd01ae757c2621c10154633b3c96
Opcode Fuzzy Hash: 6a12b83c9ca8d5fb763450bd7047b9c322d6a97f870ede149a8eb3b8c25632bd
Instruction Fuzzy Hash: 3751C0B1D00349DFDF14DFA9C981ADDBBB5BF48310F24812AE819AB260D775A945CF90

Function 04F83490 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F835A2

Strings

ms=*, xrefs: 04F834DE
ms=*, xrefs: 04F834BE

Memory Dump Source

Source File: 00000006.00000002.2970149782.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: CreateWindow
String ID: ms=*$ms=*
API String ID: 716092398-479262615
Opcode ID: 06ab8f845d7ce841307ce53ac9deadfecd52fe2edcf089f577bc5988c3760e9a
Instruction ID: 58530dc3d0d2d83f0543bdd5b2cebfbdc3beb7c1c8b91aec49473a370884a281
Opcode Fuzzy Hash: 06ab8f845d7ce841307ce53ac9deadfecd52fe2edcf089f577bc5988c3760e9a
Instruction Fuzzy Hash: 4041CEB1D10309DFDF14DF9AC984ADEBBB5BF48710F24812AE818AB220D775A845CF90

Function 04F837D4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04F85F21

Strings

ms=*, xrefs: 04F85E77

Memory Dump Source

Source File: 00000006.00000002.2970149782.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: CallProcWindow
String ID: ms=*
API String ID: 2714655100-267167651
Opcode ID: 4143cb57871889e9b51224203f3b9fce57ca56300f18868da0406a1df8d1c5ee
Instruction ID: bbf25361defa75e678a052f3812e97aed468086ca7aec21ab264879983fbfefd
Opcode Fuzzy Hash: 4143cb57871889e9b51224203f3b9fce57ca56300f18868da0406a1df8d1c5ee
Instruction Fuzzy Hash: FD412AB5900305DFDB14DF99C888AAABBF5FF88314F24845DE519AB321D774A841CFA0

Function 053751E8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageW.USER32(?,?,?,?), ref: 0537529D

Strings

ms=*, xrefs: 0537525A

Memory Dump Source

Source File: 00000006.00000002.2971365056.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5370000_RobloxCheats.jbxd

Similarity

API ID: MessageSend
String ID: ms=*
API String ID: 3850602802-267167651
Opcode ID: 748af0e4e96f3d4df70e57f7ff0f85bcaa7c5e0656efbc4b4e54cf0f73771202
Instruction ID: a4c9d6b94a56c10481eebb06ef47dabf12e82ceac730bcc305e60ad541a90b6b
Opcode Fuzzy Hash: 748af0e4e96f3d4df70e57f7ff0f85bcaa7c5e0656efbc4b4e54cf0f73771202
Instruction Fuzzy Hash: BF2148B5904208DFCB24DFA9D885A9EBFF8FF48320F20845AE519A7351C775A941CFA1

Function 04FFE7C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 04FFE857

Strings

ms=*, xrefs: 04FFE7EF

Memory Dump Source

Source File: 00000006.00000002.2970625359.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_RobloxCheats.jbxd

Similarity

API ID: FromMonitorPoint
String ID: ms=*
API String ID: 1566494148-267167651
Opcode ID: b59856502151329705dd1d94c8353920d8fba7bed02ca6f29a0b7e1759059727
Instruction ID: 303449253c915b898a72980969b556349bb10013bf4d1fef714618e0e802bf17
Opcode Fuzzy Hash: b59856502151329705dd1d94c8353920d8fba7bed02ca6f29a0b7e1759059727
Instruction Fuzzy Hash: 5521CE75900209CFDB10DFA9D849BEEBBF1EF84320F14801AE955B7390C634A906CFA1

Function 021FB040 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 021FB0C7

Strings

ms=*, xrefs: 021FB05F

Memory Dump Source

Source File: 00000006.00000002.2966131996.00000000021F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 021F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21f0000_RobloxCheats.jbxd

Similarity

API ID: DuplicateHandle
String ID: ms=*
API String ID: 3793708945-267167651
Opcode ID: 261548573509627a4e526a33a52a5d3a6b593ebf2e43fbe41d02dc3bc0cda052
Instruction ID: a051238bf884b665496bc4dbf549bb2441f63413701909255a83c430957c89e0
Opcode Fuzzy Hash: 261548573509627a4e526a33a52a5d3a6b593ebf2e43fbe41d02dc3bc0cda052
Instruction Fuzzy Hash: 5221E4B5900208DFDB10CF9AD984ADEBBF8FB48324F14841AE924A3350C378A940CFA0

Function 0537C660 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 0537C6D0

Strings

ms=*, xrefs: 0537C687

Memory Dump Source

Source File: 00000006.00000002.2971365056.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5370000_RobloxCheats.jbxd

Similarity

API ID: MessagePeek
String ID: ms=*
API String ID: 2222842502-267167651
Opcode ID: 074064b2c7dac5c8af21defe68d7acc7643360c9aac1727aceb5059217d4ec5f
Instruction ID: 5570d6b64d232a69d6407703e95643105c4a90c4a5de21bd89d57329ac1bbf42
Opcode Fuzzy Hash: 074064b2c7dac5c8af21defe68d7acc7643360c9aac1727aceb5059217d4ec5f
Instruction Fuzzy Hash: 2D2138B5C0024D9FDB10CF9AD880BEEBBF8FB48320F14801AE458A3201C379A944DFA5

Function 04F83AB7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 04F83B35

Strings

ms=*, xrefs: 04F83AF2

Memory Dump Source

Source File: 00000006.00000002.2970149782.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LongWindow
String ID: ms=*
API String ID: 1378638983-267167651
Opcode ID: 63a8a410886eac63af24cd1c9260ca9aa5fb605e0cccfe5be346ff4ce50d9d47
Instruction ID: dc7814a838115fd325d74ebee556202160a7f3bb1ba7e0abef304a37b8a1d5b8
Opcode Fuzzy Hash: 63a8a410886eac63af24cd1c9260ca9aa5fb605e0cccfe5be346ff4ce50d9d47
Instruction Fuzzy Hash: F81197B5800388CFDB10DF98D585BDEBFF8EB48314F14844AD954A7251C378AA02CFA5

Function 04F80418 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04F81569,00000800,00000000,00000000), ref: 04F8177A

Strings

ms=*, xrefs: 04F8172F

Memory Dump Source

Source File: 00000006.00000002.2970149782.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LibraryLoad
String ID: ms=*
API String ID: 1029625771-267167651
Opcode ID: 2c1ccb2365b7004f1f09f554eb63953c715e5a597b2c0f2413827b32a798f2ce
Instruction ID: 258425b80a698c9213bcf5056d5276754df77d211f414a68c842e2c0bb572e3d
Opcode Fuzzy Hash: 2c1ccb2365b7004f1f09f554eb63953c715e5a597b2c0f2413827b32a798f2ce
Instruction Fuzzy Hash: BF11D6B6D002499FDB10DF9AC544A9EFBF4EB48310F14851EE519A7210C375A545CFA5

Function 0537C668 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 0537C6D0

Strings

ms=*, xrefs: 0537C687

Memory Dump Source

Source File: 00000006.00000002.2971365056.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5370000_RobloxCheats.jbxd

Similarity

API ID: MessagePeek
String ID: ms=*
API String ID: 2222842502-267167651
Opcode ID: 7cedc4e3fd821d02e47feecc6011dafb4076c0b7f1f42296ac0d8913620eaca6
Instruction ID: 71c9542222b2c539703490a6eaf095e5704e241c196db0dba1cf3a8509aa0495
Opcode Fuzzy Hash: 7cedc4e3fd821d02e47feecc6011dafb4076c0b7f1f42296ac0d8913620eaca6
Instruction Fuzzy Hash: 7911D6B5C042499FDB10CF9AD584ADEBBF8FB48320F14841AE558A3251C378A944DFA5

Function 04F81709 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04F81569,00000800,00000000,00000000), ref: 04F8177A

Strings

ms=*, xrefs: 04F8172F

Memory Dump Source

Source File: 00000006.00000002.2970149782.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LibraryLoad
String ID: ms=*
API String ID: 1029625771-267167651
Opcode ID: b518dc83d076a52905ee3469c62f328fc84dfe728000529b56769d0c3011eceb
Instruction ID: 87bd6741a8c08a76fbe822bc97d8102a0744d35528fb117a144a73fc5de44a2a
Opcode Fuzzy Hash: b518dc83d076a52905ee3469c62f328fc84dfe728000529b56769d0c3011eceb
Instruction Fuzzy Hash: BC1133BAC002498FDB10DF9AC584BDEFBF5AB48310F10852ED829A7200C378A506CFA4

Function 05373E30 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000018,00000001,?), ref: 05373E95

Strings

ms=*, xrefs: 05373E52

Memory Dump Source

Source File: 00000006.00000002.2971365056.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5370000_RobloxCheats.jbxd

Similarity

API ID: MessageSend
String ID: ms=*
API String ID: 3850602802-267167651
Opcode ID: a08eb29ed322148ecf93c246165f76abb6b26061a64bf0e23661809f9be257a0
Instruction ID: 99be8e5feb164f7a4c8b781117beb7f82d3bfbd8506a5dbd6b4b112bfa5f896f
Opcode Fuzzy Hash: a08eb29ed322148ecf93c246165f76abb6b26061a64bf0e23661809f9be257a0
Instruction Fuzzy Hash: 031116B58003499FCB20CF9AC885BDEFFF8EB48320F14845AE458A7600C375A944CFA1

Function 05379AA1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05379AFD

Strings

ms=*, xrefs: 05379AC2

Memory Dump Source

Source File: 00000006.00000002.2971365056.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5370000_RobloxCheats.jbxd

Similarity

API ID: Initialize
String ID: ms=*
API String ID: 2538663250-267167651
Opcode ID: 87b9144275495ca1610380cd15665634f825eeed1c3c68036dc570a8098d9d3e
Instruction ID: d15a339df11339882fc574ed2b6163d67e8b9180ad9107963712d0637c941bb1
Opcode Fuzzy Hash: 87b9144275495ca1610380cd15665634f825eeed1c3c68036dc570a8098d9d3e
Instruction Fuzzy Hash: 0B1136B5900248CFCB20DF9AD485BDEFBF8EB48320F20841AE518A7300C378A944CFA1

Function 0537B250 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0537B2AD

Strings

ms=*, xrefs: 0537B26A

Memory Dump Source

Source File: 00000006.00000002.2971365056.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5370000_RobloxCheats.jbxd

Similarity

API ID: MessagePost
String ID: ms=*
API String ID: 410705778-267167651
Opcode ID: 9feabfcd0b1d34895e0d123fecb30c982598e20c8039ace4b0e251fce487b075
Instruction ID: 6cf9a0756d7e026b9a94d4bd786ae0536da112ace3f79d9d90e65138fbb2ba15
Opcode Fuzzy Hash: 9feabfcd0b1d34895e0d123fecb30c982598e20c8039ace4b0e251fce487b075
Instruction Fuzzy Hash: 0D11F8B5800349DFDB10CF9AC985BDEFBF8EB48320F14841AE554A3251D379A544CFA5

Function 05378AA4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,0537955C,?,?), ref: 05379600

Strings

ms=*, xrefs: 053795C2

Memory Dump Source

Source File: 00000006.00000002.2971365056.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5370000_RobloxCheats.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: ms=*
API String ID: 2492992576-267167651
Opcode ID: 6c03eee4db039481384dc46f77d5e0deaa934e94a535f6a7c2cdeb89e2bdb7b0
Instruction ID: 5a368bc2eeb06cccbad7d8647837f62a8c537925cd451b0469942d254750e0cc
Opcode Fuzzy Hash: 6c03eee4db039481384dc46f77d5e0deaa934e94a535f6a7c2cdeb89e2bdb7b0
Instruction Fuzzy Hash: E01128B6800609CFDB20CF9AC485BDEBBF4EB48320F108519E558A3241D378A944CFA5

Function 04F81488 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04F814EE

Strings

ms=*, xrefs: 04F814A7

Memory Dump Source

Source File: 00000006.00000002.2970149782.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: HandleModule
String ID: ms=*
API String ID: 4139908857-267167651
Opcode ID: 5a88cb5920f3c6b4d709c19ca44c6681a133501a260f82420ed7de0fb4aa3f08
Instruction ID: 8a1fa584a8fe60ba13505973e9cd12836a3cb7ce1204c56c9e622f1edee67316
Opcode Fuzzy Hash: 5a88cb5920f3c6b4d709c19ca44c6681a133501a260f82420ed7de0fb4aa3f08
Instruction Fuzzy Hash: 42110FB6C002498FCB20DF9AC544ADEFBF4AB88324F10851AD829A7210C379A546CFA1

Function 04F805C4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 04F83B35

Strings

ms=*, xrefs: 04F83AF2

Memory Dump Source

Source File: 00000006.00000002.2970149782.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LongWindow
String ID: ms=*
API String ID: 1378638983-267167651
Opcode ID: 9d3446b3daa56611fc5d071bbf57167e6c2ae555013291d3e30d3c9fbcd65307
Instruction ID: a84575bae75da523353c6f4a9e105749d7c92ac5a49603ffafe90e365345a3da
Opcode Fuzzy Hash: 9d3446b3daa56611fc5d071bbf57167e6c2ae555013291d3e30d3c9fbcd65307
Instruction Fuzzy Hash: E11125B5800248DFDB10DF89C485B9EBBF8EB48724F20841AE914A7310C375A940CFA1

Function 0537CD58 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 0537CDBD

Strings

ms=*, xrefs: 0537CD7F

Memory Dump Source

Source File: 00000006.00000002.2971365056.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5370000_RobloxCheats.jbxd

Similarity

API ID: DispatchMessage
String ID: ms=*
API String ID: 2061451462-267167651
Opcode ID: f68042c81b3d0827659a7fb0d6abfd7bfa19473213819388093b36916e0ed2e9
Instruction ID: 37789dc472376e7f459c34746ac86f0cbcf7860f3922f4865cda9b80b029110f
Opcode Fuzzy Hash: f68042c81b3d0827659a7fb0d6abfd7bfa19473213819388093b36916e0ed2e9
Instruction Fuzzy Hash: 3211DFB5C046498FCB20DF9AD445ADEFBF4EB48324F20851AE419A3210D378A544CFA5

Function 05370610 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000018,00000001,?), ref: 05373E95

Strings

ms=*, xrefs: 05373E52

Memory Dump Source

Source File: 00000006.00000002.2971365056.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5370000_RobloxCheats.jbxd

Similarity

API ID: MessageSend
String ID: ms=*
API String ID: 3850602802-267167651
Opcode ID: 0cfa45758c0aa7e74c3187c8bfcbde158f05de773baf34aa8f713fb1dcb837dd
Instruction ID: 187203390a4dd06fcb0d93c2b2cfd74335e681f9ab4464d7c73e969f599ae043
Opcode Fuzzy Hash: 0cfa45758c0aa7e74c3187c8bfcbde158f05de773baf34aa8f713fb1dcb837dd
Instruction Fuzzy Hash: 6411F5B6800349DFDB20DF99C485BDEBBF8EB48324F108819E558A7700C379A944CFA5

Function 053795A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,0537955C,?,?), ref: 05379600

Strings

ms=*, xrefs: 053795C2

Memory Dump Source

Source File: 00000006.00000002.2971365056.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5370000_RobloxCheats.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: ms=*
API String ID: 2492992576-267167651
Opcode ID: 533827c21e73f4fd0db57a762fe159a6c01b9f4630409fc944b5e5429648fa35
Instruction ID: 226320266507917fca9b867dbfe7753aac338b7dbb9b330993c5d6211766612a
Opcode Fuzzy Hash: 533827c21e73f4fd0db57a762fe159a6c01b9f4630409fc944b5e5429648fa35
Instruction Fuzzy Hash: FE1133B6C00209CFDB20CF9AC485BEEBBF4EB48320F20841AE458A3650C338A544CFA4

Function 05378B78 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05379AFD

Strings

ms=*, xrefs: 05379AC2

Memory Dump Source

Source File: 00000006.00000002.2971365056.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5370000_RobloxCheats.jbxd

Similarity

API ID: Initialize
String ID: ms=*
API String ID: 2538663250-267167651
Opcode ID: 028a913cb6dbc924d363608ee180cc3783094f2d2b59f598eae25d3ec0df9aed
Instruction ID: af068d51f52ed2850761489d6e4fed9a30052aecf9006310186efc58377f3bad
Opcode Fuzzy Hash: 028a913cb6dbc924d363608ee180cc3783094f2d2b59f598eae25d3ec0df9aed
Instruction Fuzzy Hash: 1C1133B5D00648CFCB20DF9AC484BDEBBF8EB48320F20851AE519A7300D378A944CFA5

Function 0537CD60 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 0537CDBD

Strings

ms=*, xrefs: 0537CD7F

Memory Dump Source

Source File: 00000006.00000002.2971365056.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5370000_RobloxCheats.jbxd

Similarity

API ID: DispatchMessage
String ID: ms=*
API String ID: 2061451462-267167651
Opcode ID: 8d4e8146a99bd620b6f178631509c401ae8e40dd2f35bd36767c50c794bd4f10
Instruction ID: b6af699f0b1c7ac9da5f9837bab989331e8bced4cbec3e4e88744e0c509b0003
Opcode Fuzzy Hash: 8d4e8146a99bd620b6f178631509c401ae8e40dd2f35bd36767c50c794bd4f10
Instruction Fuzzy Hash: 4F11BDB5C04649CECB20DF9AD545ADEBBF4AB48324F10851AE419A3610D378A644CFA5

Function 04F80898 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000037,00000000,00000000,0333430C,02382920,?,00000000,?,00000000,00000000), ref: 04F80957

Memory Dump Source

Source File: 00000006.00000002.2970149782.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a545a016136ea4d5cfbf4daf4bae324f7beeefb2183365177ccba41666c1786b
Instruction ID: 040673f8120e486745ccf3703f6bbc2b4d234c5fac3f118de3ab166991d0883e
Opcode Fuzzy Hash: a545a016136ea4d5cfbf4daf4bae324f7beeefb2183365177ccba41666c1786b
Instruction Fuzzy Hash: BC2179313006119FEB58EB69D854B2E72AAFF84B14F518129E10ACB390CF74FC46CB94

Function 04F83B70 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 04F83B35

Memory Dump Source

Source File: 00000006.00000002.2970149782.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 86aede512f5f7d1d1c7dace5ae810e31ca5390e05e43c6dc1689941af7ba0ed8
Instruction ID: 0f5f9fc38fbc7f42b24331c3e73a95e599303fe528bbaae7542c48a14907918b
Opcode Fuzzy Hash: 86aede512f5f7d1d1c7dace5ae810e31ca5390e05e43c6dc1689941af7ba0ed8
Instruction Fuzzy Hash: 39015AF58002098FDB10DF99E886BDABBF4EF98318F10850AD548A7251C379A546CFA1

Function 005DD210 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2965180410.00000000005DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 005DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5dd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867cb144000510c4483e40d1ae45755cbc81d7af9f7057832f06b64d91d8543a
Instruction ID: 7167b623ac66ddd6144856ce3772538f2672174fa7ff6a8316bbb63206e765ad
Opcode Fuzzy Hash: 867cb144000510c4483e40d1ae45755cbc81d7af9f7057832f06b64d91d8543a
Instruction Fuzzy Hash: E321E0BA504200EFCB25DF58D9C0B26BF75FB88310F24896BE9094A346C336D816DBB1

Function 005DD4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2965180410.00000000005DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 005DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5dd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8b06b9402541e7bd44c74f051e8e41b1424a3bd6891780355fa91b31312aed
Instruction ID: 7dfa838e22a1579b9f5fe2952eb83e8f009821344c863d69e1f89dcb6bcf8e9a
Opcode Fuzzy Hash: 7d8b06b9402541e7bd44c74f051e8e41b1424a3bd6891780355fa91b31312aed
Instruction Fuzzy Hash: 6F21E2B1504200DFCB25DF18E9C0B26BF75FB98318F24856BE9090A356C336D856DAB2

Function 005ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2965286229.00000000005ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 005ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba35c5f3561c5624c113ed3ee4abba7cf5f8705da147f3da1fe4c4cbdc1ea077
Instruction ID: d70732298c2be76630652c5bf0e4c48db9c8fb4b2d578fc776a5413df41bf424
Opcode Fuzzy Hash: ba35c5f3561c5624c113ed3ee4abba7cf5f8705da147f3da1fe4c4cbdc1ea077
Instruction Fuzzy Hash: 712103B5504280DFCB18DF15D5C8B26BF75FB84314F28C969D88A4B246D33AD807CA71

Function 005ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2965286229.00000000005ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 005ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b59c4eaf23d4d774db3f4077625d90f3c616234d1a73dc6e94de6aacf5e8b5
Instruction ID: 0ffc38513cf10b085d6062c771eae1d7fa4ef4495adeae22e1463e4ce8f37ef7
Opcode Fuzzy Hash: b3b59c4eaf23d4d774db3f4077625d90f3c616234d1a73dc6e94de6aacf5e8b5
Instruction Fuzzy Hash: AA2107B9504280EFDB09DF15D5C0B26BF75FB84314F24C9ADEA894B291C33AD846DA71

Function 005ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2965286229.00000000005ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 005ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dfa6a5068390e08f94b1be7c1b4db5dece0e20680237e039f8ea7e88ae84bb0
Instruction ID: 2b2f446cade90c264aaeaa54444dd440e36e5544747f539da65ff287456e69d8
Opcode Fuzzy Hash: 0dfa6a5068390e08f94b1be7c1b4db5dece0e20680237e039f8ea7e88ae84bb0
Instruction Fuzzy Hash: 48217F755093C08FCB16CF24D994715BF71FB46314F28C5DAD8898B6A7C33A980ACB62

Function 005DD20B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2965180410.00000000005DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 005DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5dd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0198dffcca54c8a327979ca184e18e1179e26769679eb7287e54d642110c921c
Instruction ID: c110d6e34581254eaac3abbc5e22dd50e92b97d41c31c534cdff2df0d13070ff
Opcode Fuzzy Hash: 0198dffcca54c8a327979ca184e18e1179e26769679eb7287e54d642110c921c
Instruction Fuzzy Hash: 7721DF76404280CFCB16CF58D9C4B16BF72FB88314F24C5AADC084B656C33AD81ACBA1

Function 005DD4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2965180410.00000000005DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 005DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5dd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: e170dc0dabe9a671931a550d794c2d77adb9e804a4bfbe4e99765b258605e1e4
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: 5F11D376504240DFCB26CF14D5C4B16BF72FB94318F24C6AAD9094B756C33AD85ACBA2

Function 005ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2965286229.00000000005ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 005ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: a75d535e7c298fd026d848f0c8f969c6de84df2d115ebac471e32f676abbf328
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: 5B118B79904280DFDB16CF14D6C4B15BFB2FB84314F24C6AAD9894B696C33AD84ACB61

Function 005DD607 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2965180410.00000000005DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 005DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5dd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e216a2e720b2cbc08b97d7b57e4d9eef5d9054bd6e30c6a61a06ed67f101486e
Instruction ID: 3f688e990fd632e881cf427e37cd570e28d6bf5b6d03ae4d80d79299ec974768
Opcode Fuzzy Hash: e216a2e720b2cbc08b97d7b57e4d9eef5d9054bd6e30c6a61a06ed67f101486e
Instruction Fuzzy Hash: 96F0E2B6600604AF97208F0AD984C26FBA9FBC4770719C59AE84A4B712C671EC42CAA0

Function 005DD5F8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2965180410.00000000005DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 005DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5dd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c1b0ccdfe6768c2ce825aaef94b5cdb2408427014c5cf02021074dcc5dddef3
Instruction ID: 1fe3dc05756d0e883420a830f5e99fcc8530e225dd2e5f4fbdca4e96ae33db78
Opcode Fuzzy Hash: 2c1b0ccdfe6768c2ce825aaef94b5cdb2408427014c5cf02021074dcc5dddef3
Instruction Fuzzy Hash: AEF0EC75104680AFD7258F15C984C62BFB9FF85760719848AE89A5B762C671FC42CBB0

Non-executed Functions

Function 0537A908 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 227threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0537AA01

Strings

@p^, xrefs: 0537AC0B
ms=*, xrefs: 0537AC77
ms=*, xrefs: 0537A932

Memory Dump Source

Source File: 00000006.00000002.2971365056.0000000005370000.00000040.00000800.00020000.00000000.sdmp, Offset: 05370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5370000_RobloxCheats.jbxd

Similarity

API ID: CurrentThread
String ID: @p^$ms=*$ms=*
API String ID: 2882836952-5562476
Opcode ID: e67cf7684dce2f8c64614b4d99abc0120f818da62344230d40f6192b1828c60c
Instruction ID: c84a2916b08ad82ddc52045320b8dbf90d5275d1e02e233ed82696e5c868b9db
Opcode Fuzzy Hash: e67cf7684dce2f8c64614b4d99abc0120f818da62344230d40f6192b1828c60c
Instruction Fuzzy Hash: A7817D71D0024CDFDB25DFA9C944AAEBBF5FF88310F14802AD815AB350DB78A845CB91

Function 04FF2F50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000003B), ref: 04FF2FAE
GetSystemMetrics.USER32(0000003C), ref: 04FF2FE8

Strings

ms=*, xrefs: 04FF2F77

Memory Dump Source

Source File: 00000006.00000002.2970625359.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_RobloxCheats.jbxd

Similarity

API ID: MetricsSystem
String ID: ms=*
API String ID: 4116985748-267167651
Opcode ID: 0a8f45f30e1045de4af4b2bfa0ff98500e19b8a2079ab18230b9f25db6423d2b
Instruction ID: ad7b063854a61a4702989f14217e8fb2263d2a21ee029dc2195e1ac586060492
Opcode Fuzzy Hash: 0a8f45f30e1045de4af4b2bfa0ff98500e19b8a2079ab18230b9f25db6423d2b
Instruction Fuzzy Hash: 7D2144B1900349CFEB218F99C44A79EBFF4EF08314F20804AD519A7391C3796946CBA5

Function 04FF3028 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000022), ref: 04FF3086
GetSystemMetrics.USER32(00000023), ref: 04FF30C0

Strings

ms=*, xrefs: 04FF304F

Memory Dump Source

Source File: 00000006.00000002.2970625359.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_RobloxCheats.jbxd

Similarity

API ID: MetricsSystem
String ID: ms=*
API String ID: 4116985748-267167651
Opcode ID: 9079b79835aeee402d1bcca6772bf41dba235e4573d181739bc4eed735e40a47
Instruction ID: 59be7f8c2dc94650aa9a9e5c5c7cfe23b77dcebc044234c4f64bc368fb06192b
Opcode Fuzzy Hash: 9079b79835aeee402d1bcca6772bf41dba235e4573d181739bc4eed735e40a47
Instruction Fuzzy Hash: 7A2169B1C003498FDB20CF99D4497DEBFF0EF08314F24845AD958A7651C378A945CB95

Function 04FFE8C8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000050), ref: 04FFE94B

Strings

ms=*, xrefs: 04FFE8E7
4'fq, xrefs: 04FFE904

Memory Dump Source

Source File: 00000006.00000002.2970625359.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_RobloxCheats.jbxd

Similarity

API ID: MetricsSystem
String ID: 4'fq$ms=*
API String ID: 4116985748-1419163903
Opcode ID: cb49135cf1498fd3cef3ca67308fd3e7dbf1f998c1cdd824300339c4593d63d6
Instruction ID: 8f98a080f8837cbba07442370946e1c99d429a114235d7b1a0ac55c74ac6e699
Opcode Fuzzy Hash: cb49135cf1498fd3cef3ca67308fd3e7dbf1f998c1cdd824300339c4593d63d6
Instruction Fuzzy Hash: 0821F5B190420A8FCB14DF99D845AAEBBF8FB48320F10855AD819B7291C7786945CFA5

Function 04FFE8CA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000050), ref: 04FFE94B

Strings

ms=*, xrefs: 04FFE8E7
4'fq, xrefs: 04FFE904

Memory Dump Source

Source File: 00000006.00000002.2970625359.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ff0000_RobloxCheats.jbxd

Similarity

API ID: MetricsSystem
String ID: 4'fq$ms=*
API String ID: 4116985748-1419163903
Opcode ID: 2b1caa8b2f0fd1a534cf48edcc9f2fd347de9c7259e3c1d99ce7b25e3a552707
Instruction ID: a53560320902a41219e93dbcf512994ec475278b88f2e0ce069ebfe0c185fa7b
Opcode Fuzzy Hash: 2b1caa8b2f0fd1a534cf48edcc9f2fd347de9c7259e3c1d99ce7b25e3a552707
Instruction Fuzzy Hash: E42107B1D0420ACFCB14DF99D8456EEBBF4FB48320F10855AD819B7291C7386945CFA1

Analysis Process: RobloxCheats.exePID: 2520, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	13.8%
Dynamic/Decrypted Code Coverage:	99.5%
Signature Coverage:	0%
Total number of Nodes:	607
Total number of Limit Nodes:	55

Executed Functions

Function 051EC159 Relevance: 1.8, APIs: 1, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2972373514.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_51e0000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23f013ae8dc27ec95667f4d1bd5626c0fdcf10cedb8088822d72a1ba14914266
Instruction ID: 947e19aaf41c1e3f49c39443e6f97bc6dc8600d07e6cd65c1d0ce35ae7bf6552
Opcode Fuzzy Hash: 23f013ae8dc27ec95667f4d1bd5626c0fdcf10cedb8088822d72a1ba14914266
Instruction Fuzzy Hash: 27D11C70A00609CFDB14DFA9CD48BADBBF2BF84308F158559E40AAF2A5DB749D45CB80

Function 04F83B90 Relevance: 1.7, APIs: 1, Instructions: 239
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 04F83B35

Memory Dump Source

Source File: 00000007.00000002.2971660720.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 17af319840fa646cd54b5562f3b138d6477b757dd3f133a6681f94b632321a63
Instruction ID: 297634c0299ebdd2b3f1e1bc7678d6a73ff62f6d166c81809dd27bdd1020ef7b
Opcode Fuzzy Hash: 17af319840fa646cd54b5562f3b138d6477b757dd3f133a6681f94b632321a63
Instruction Fuzzy Hash: D1A18035E003199FCB04EFA4D8949DDFBB6FF89310F158619E816AB2B4DB70A946CB50

Function 04F801E4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000037,00000000,00000000,0342430C,02472920,?,00000000,?,00000000,00000000), ref: 04F80957

Strings

@p_, xrefs: 04F80851
@p_, xrefs: 04F8086A
Hjq, xrefs: 04F80840

Memory Dump Source

Source File: 00000007.00000002.2971660720.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: @p_$@p_$Hjq
API String ID: 2492992576-4072266253
Opcode ID: 168e93fe1e4ad844a20d63bb1b650466a893e167befc2c7def737c953404cec9
Instruction ID: 65995faa28315e5bc59cc8074c5eb565f5652590ecbada91b15e98f3492973d7
Opcode Fuzzy Hash: 168e93fe1e4ad844a20d63bb1b650466a893e167befc2c7def737c953404cec9
Instruction Fuzzy Hash: 6B5178317006148FDB18AB29C859B2E77A6FFC4B04B568469E406CB3A1CF74EC478B95

Function 0084ADF8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0084AE76
GetCurrentThread.KERNEL32 ref: 0084AEB3
GetCurrentProcess.KERNEL32 ref: 0084AEF0
GetCurrentThreadId.KERNEL32 ref: 0084AF49

Memory Dump Source

Source File: 00000007.00000002.2966315492.0000000000840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_RobloxCheats.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 455f64c064c490a64c7529c8d9c17212e9dda9933fc5b84eddc510aa5118fa2d
Instruction ID: 845642d3f2657c4d5c53d9fe9e63196baf414017356eb3f066707f1972080c84
Opcode Fuzzy Hash: 455f64c064c490a64c7529c8d9c17212e9dda9933fc5b84eddc510aa5118fa2d
Instruction Fuzzy Hash: 3A5137B0900749CFDB18CFAAD948B9EBBF5FF88314F248459E019A73A0DB745944CB66

Function 04F81298 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 04F814EE

Strings

@p_, xrefs: 04F8144B
@p_, xrefs: 04F81426

Memory Dump Source

Source File: 00000007.00000002.2971660720.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: HandleModule
String ID: @p_$@p_
API String ID: 4139908857-3811016678
Opcode ID: b77568ee79aa7ad6471ab703369394cd5bcc26214a22d249e7eed722a30015f6
Instruction ID: 1abd22aca28582e407c252772fb7755b00ff1a7552101ad354490e48c2e63fa6
Opcode Fuzzy Hash: b77568ee79aa7ad6471ab703369394cd5bcc26214a22d249e7eed722a30015f6
Instruction Fuzzy Hash: 2D712570A00B058FDB64EF6AD54475ABBF1BF88304F008A2DD48ADBA50DB75F946CB91

Function 04F83484 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F835A2

Memory Dump Source

Source File: 00000007.00000002.2971660720.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 57d52fe64bc101afd8d1f1aeb98b1bf6a72c5f7733cf957b30b8abda8b32d456
Instruction ID: 3fc5ce8c7371cf4daa4468eaf0ed4c01b8ad0acca787004d887b70067573bd87
Opcode Fuzzy Hash: 57d52fe64bc101afd8d1f1aeb98b1bf6a72c5f7733cf957b30b8abda8b32d456
Instruction Fuzzy Hash: C451C0B1D00349DFDF14DFA9C981ADDBBB5BF48310F24812AE819AB250D775A945CF90

Function 04F83490 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F835A2

Memory Dump Source

Source File: 00000007.00000002.2971660720.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: dcfd0bb9e2c46f300e3fd80c82876cbf20ec7113010700cb19dc8bb4480babeb
Instruction ID: a78572620e3e2434bc403c06259752bfb94aae934d1f1abe4a4894acb3272ebb
Opcode Fuzzy Hash: dcfd0bb9e2c46f300e3fd80c82876cbf20ec7113010700cb19dc8bb4480babeb
Instruction Fuzzy Hash: 7D41CFB1D00349DFDF14CF9AC984ADEBBB5BF48710F64812AE818AB210D775A845CF90

Function 04F837D4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04F85F21

Memory Dump Source

Source File: 00000007.00000002.2971660720.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: b82f6a6e61a79d820ae8b2f867cea7ff9d518875bc4bfc87c9168d653ee5ba29
Instruction ID: 76e1856acfc543429c6df4ec3c402eaa9c10f2b7266152e72efd654499f71848
Opcode Fuzzy Hash: b82f6a6e61a79d820ae8b2f867cea7ff9d518875bc4bfc87c9168d653ee5ba29
Instruction Fuzzy Hash: 3A41FAB5900305DFDB14DF99C888AAABBF5FF88314F24845DE519AB321D774A841CFA0

Function 051E51E8 Relevance: 1.6, APIs: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 051E529D

Memory Dump Source

Source File: 00000007.00000002.2972373514.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_51e0000_RobloxCheats.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1a3fb896c091189c2dbbb6f342bffe4e30a945463d1de47f6dfea56dcdc571e4
Instruction ID: 593a6de8883406a203dc60d10983225a380911178c60803bcae537b00f550b08
Opcode Fuzzy Hash: 1a3fb896c091189c2dbbb6f342bffe4e30a945463d1de47f6dfea56dcdc571e4
Instruction Fuzzy Hash: 112177B1904248DFCB14DFAAD884B9EBFF9FF48320F24845AE509A7350C774A940CBA0

Function 04F80898 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000037,00000000,00000000,0342430C,02472920,?,00000000,?,00000000,00000000), ref: 04F80957

Memory Dump Source

Source File: 00000007.00000002.2971660720.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 5642c795338cb03ccee8b203383c1a17c9c8cca35cb8857809933c516dffd8ef
Instruction ID: 3b4871a5603d59fda019948efe6405c79cd10167a4deafbd25afb12c5d9295a4
Opcode Fuzzy Hash: 5642c795338cb03ccee8b203383c1a17c9c8cca35cb8857809933c516dffd8ef
Instruction Fuzzy Hash: 142149313006119FEB18EB69D855B2E76A6FF84B54F528129E009DB390CF74FC46CB94

Function 0515E7C8 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 0515E857

Memory Dump Source

Source File: 00000007.00000002.2972127780.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5150000_RobloxCheats.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: 67c8b0c521ee0ac3695734e8f49353debcef982f6990b2a56bb5667493a5b702
Instruction ID: 5818ca34b548617af1ae0e477cdabb8da12b584fc8141f415a2b2b41494b17e8
Opcode Fuzzy Hash: 67c8b0c521ee0ac3695734e8f49353debcef982f6990b2a56bb5667493a5b702
Instruction Fuzzy Hash: 57216B75900249DBDB10CF99D449BAEBBF5FB88320F148059E866B7380C775A905CFA1

Function 0084B040 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0084B0C7

Memory Dump Source

Source File: 00000007.00000002.2966315492.0000000000840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_840000_RobloxCheats.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d51f03369baeef83f57b68438993b955bea73a7dd03cdd555d575996a333e136
Instruction ID: 51edda66f7631722050de80b0c467d97f455cef88ca21189c6d2e2233eabc32e
Opcode Fuzzy Hash: d51f03369baeef83f57b68438993b955bea73a7dd03cdd555d575996a333e136
Instruction Fuzzy Hash: 6021E4B5900248DFDB10CFAAD984ADEBBF8FB48320F14841AE918A7350D374A944CFA0

Function 04F83AB7 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 04F83B35

Memory Dump Source

Source File: 00000007.00000002.2971660720.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 3744d926fa9735d8b6afe751bb1885311a2ee9ec19dcdf353d6edeb1d129f383
Instruction ID: add43464c7417e508e3d78f3a1d110d02270b24eaa0e347e7ce96f7cf7fb01c2
Opcode Fuzzy Hash: 3744d926fa9735d8b6afe751bb1885311a2ee9ec19dcdf353d6edeb1d129f383
Instruction Fuzzy Hash: 051197B58043888FDB10CF98D585BDEBFF8EB48314F14844AD954A7251C378AA02CFA5

Function 04F80418 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,04F81569,00000800,00000000,00000000), ref: 04F8177A

Memory Dump Source

Source File: 00000007.00000002.2971660720.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 35e906cc6130972ab5b8a05edbe8cac73c14ed087bcc8aa6f9dce4ed42094966
Instruction ID: 3648058c98aedc6aa8570835e736ef5ca6d3fbfbfc9600e2a693a5c2980deb66
Opcode Fuzzy Hash: 35e906cc6130972ab5b8a05edbe8cac73c14ed087bcc8aa6f9dce4ed42094966
Instruction Fuzzy Hash: 0E11D6B6D003499FDB10DF9AD544B9EFBF4EB88310F14852EE519AB200C375A545CFA5

Function 051EC660 Relevance: 1.6, APIs: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 051EC6D0

Memory Dump Source

Source File: 00000007.00000002.2972373514.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_51e0000_RobloxCheats.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 0107697664112469991f4f20265ba2b23c33dff5c985ce7a920b86f1b10d7ac5
Instruction ID: 087a9425408c4c5c55dec24d718e1c56fa32e611eaf3e1c4840ccd94ffd3edd9
Opcode Fuzzy Hash: 0107697664112469991f4f20265ba2b23c33dff5c985ce7a920b86f1b10d7ac5
Instruction Fuzzy Hash: A0111AB18042499FDB10CF9AD945BEEBBF8EB48324F10801AE558A3641C378AA44DFA5

Function 051EC668 Relevance: 1.6, APIs: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 051EC6D0

Memory Dump Source

Source File: 00000007.00000002.2972373514.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_51e0000_RobloxCheats.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 32ad903544440e075fdfc17dbd3b60fbfcb245deaa2b994550e27df0967e9d7f
Instruction ID: 81c7bb6096ea434f2243a1b98088696780a69758980cc539007ac5b0e33c7be7
Opcode Fuzzy Hash: 32ad903544440e075fdfc17dbd3b60fbfcb245deaa2b994550e27df0967e9d7f
Instruction Fuzzy Hash: 5111E4B58042499FDB10CF9AD944BDEBBF8EB48324F10842AE558A7250C378A944DFA5

Function 04F81709 Relevance: 1.6, APIs: 1, Instructions: 51libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,04F81569,00000800,00000000,00000000), ref: 04F8177A

Memory Dump Source

Source File: 00000007.00000002.2971660720.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c2c05e53697ba19e119f5842485fd0b822f20379026f0b2899ca64a80806a23f
Instruction ID: 6b62c8c03ce80c787ee407d6b87b7f241127d01958c409441a0d3d78d4dd36e5
Opcode Fuzzy Hash: c2c05e53697ba19e119f5842485fd0b822f20379026f0b2899ca64a80806a23f
Instruction Fuzzy Hash: D31114B6C003498FDB14DF9AD544BDEFBF5AB48310F14852ED929A7200C379A546CFA5

Function 051EB248 Relevance: 1.6, APIs: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 051EB2AD

Memory Dump Source

Source File: 00000007.00000002.2972373514.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_51e0000_RobloxCheats.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 750984547a45a91e9f9470c0fe8d23e61b162afd1cf58aa8572307872a84bb2f
Instruction ID: 856456493abfa7f69310327b7277bf0cc37c3ec8f34b1b06eb4ad6748793dba4
Opcode Fuzzy Hash: 750984547a45a91e9f9470c0fe8d23e61b162afd1cf58aa8572307872a84bb2f
Instruction Fuzzy Hash: 481116B58043499FDB10CF9AD945BDEBFF8EB48320F14841AE558A3241D378A544DFA5

Function 051EB250 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 051EB2AD

Memory Dump Source

Source File: 00000007.00000002.2972373514.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_51e0000_RobloxCheats.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1111a21f34ef6f9e4187f19352754bff90921667b42af9c583a2beaa1f2e27c2
Instruction ID: 6196c59b61036b2c8a91f75121a0c002447d3e97d842c7a9af8644046dbb3512
Opcode Fuzzy Hash: 1111a21f34ef6f9e4187f19352754bff90921667b42af9c583a2beaa1f2e27c2
Instruction Fuzzy Hash: A611F5B5800749DFDB10CF9AC945BDEBBF8EF48320F14841AE558A3240D378A944CFA5

Function 051E8AA4 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,051E955C,?,?), ref: 051E9600

Memory Dump Source

Source File: 00000007.00000002.2972373514.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_51e0000_RobloxCheats.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b4008ce81099bdf6496ef33ef7402f6e5a6e0eda25ca1f1fb4e5cd31e1d0d1e0
Instruction ID: c9db8c0b275f5dc33b3b9c99864f4fd2b9a8d8a0b415510106d46ab31c251888
Opcode Fuzzy Hash: b4008ce81099bdf6496ef33ef7402f6e5a6e0eda25ca1f1fb4e5cd31e1d0d1e0
Instruction Fuzzy Hash: C31125B1804749CFCB20CF9AC545BDEBBF4EB48320F10801AE558A3241D378A944CFA5

Function 04F81488 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 04F814EE

Memory Dump Source

Source File: 00000007.00000002.2971660720.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a849bbbc1e0f4459119052b098218ab4c16d0e14b489a77516400af3de86c5a2
Instruction ID: 51895be79b845c8f52fc55d7803a1dd0a8f2e2f9cd8ac0638566466c8fde1bdf
Opcode Fuzzy Hash: a849bbbc1e0f4459119052b098218ab4c16d0e14b489a77516400af3de86c5a2
Instruction Fuzzy Hash: 76110FB5C002498FCB10DF9AC544BDEFBF4AB88324F10851AD829AB200C379A546CFA1

Function 04F805C4 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 04F83B35

Memory Dump Source

Source File: 00000007.00000002.2971660720.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 9bb1c4722f609c74b3eaedae229b1c147826eb4ea2e72693a1e3aac56f94fb7a
Instruction ID: c138be381ff3c9048babda2a60da0eda5d073f77e460661ac99b2ba58127e548
Opcode Fuzzy Hash: 9bb1c4722f609c74b3eaedae229b1c147826eb4ea2e72693a1e3aac56f94fb7a
Instruction Fuzzy Hash: 7D1128B5800248DFDB10DF99D485B9EBBF8EB48724F10841AE918A7310C375A940CFA1

Function 051E0610 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000018,00000001,?), ref: 051E3E95

Memory Dump Source

Source File: 00000007.00000002.2972373514.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_51e0000_RobloxCheats.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 948e3afb0908013a8b97e7a94ea1d891eeaab0dc7f48f2fc6e1c6fd7d1570788
Instruction ID: 51ddecdfebfbabd6def6421b11b4a193d01737a00874fa69c7c4698524ee2e3e
Opcode Fuzzy Hash: 948e3afb0908013a8b97e7a94ea1d891eeaab0dc7f48f2fc6e1c6fd7d1570788
Instruction Fuzzy Hash: 831106B5800749DFCB20CF9AC585BDEBBF8EB48320F10885AE518A7300C375A944CFA5

Function 051E3E30 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000018,00000001,?), ref: 051E3E95

Memory Dump Source

Source File: 00000007.00000002.2972373514.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_51e0000_RobloxCheats.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 12a0e6497c58cb9afc39f309b5642168319b6db01c4d5463a5aa64af74476824
Instruction ID: 1f1a9fab01cf21a423d2ba4156e5860943cc42cb0f4eeb5caf5484dd96fe33ef
Opcode Fuzzy Hash: 12a0e6497c58cb9afc39f309b5642168319b6db01c4d5463a5aa64af74476824
Instruction Fuzzy Hash: 9011E3B58003499FCB10CF9AD985BDEBFF8EB48324F14845AE518A7200D379A944CFA1

Function 051E95A0 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,051E955C,?,?), ref: 051E9600

Memory Dump Source

Source File: 00000007.00000002.2972373514.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_51e0000_RobloxCheats.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7958531f58c2eb463eaa36d819ab2367966c300338c753be563c59567afcae94
Instruction ID: af7ac42b274d5c365e76d969c56153627a69129d0b930166778586d480897832
Opcode Fuzzy Hash: 7958531f58c2eb463eaa36d819ab2367966c300338c753be563c59567afcae94
Instruction Fuzzy Hash: AE1118B5804649CFDB10CF9AD585BEEBBF4EB48320F24841AD558A3750D338A544CFA5

Function 051E8B78 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 051E9AFD

Memory Dump Source

Source File: 00000007.00000002.2972373514.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_51e0000_RobloxCheats.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 28428b0854064e297852aed0fda10661b7518ca9577c56e51c81d0cddda971b2
Instruction ID: b51f65067347d5bbd8d564d7da45ede3a1496f42af401131f38a4621814c6848
Opcode Fuzzy Hash: 28428b0854064e297852aed0fda10661b7518ca9577c56e51c81d0cddda971b2
Instruction Fuzzy Hash: DF1100B19047488FCB20DF9AD585BDEBBF8EB48324F20845AE519A7340D379A944CFA5

Function 051E9AA1 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 051E9AFD

Memory Dump Source

Source File: 00000007.00000002.2972373514.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_51e0000_RobloxCheats.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 879a96d4a41c24e4396e3c364f997fef598dbf9ef9d57f472237cff0246fee18
Instruction ID: 87a112737f1fd38d0a15eae85097ebd6245e4f3b55933e934eb79943bb3a37b1
Opcode Fuzzy Hash: 879a96d4a41c24e4396e3c364f997fef598dbf9ef9d57f472237cff0246fee18
Instruction Fuzzy Hash: FA1103B18046498FCB20DF9AD585BDEBFF8EB48320F24845AE558A7240D379A944CFA5

Function 051ECD58 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 051ECDBD

Memory Dump Source

Source File: 00000007.00000002.2972373514.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_51e0000_RobloxCheats.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: bc3910efd27369bf33c774dc073a5bc4510ecce4c3df1e5e8f019afb6320e3bc
Instruction ID: d28b542808dd351960d06ee9945a2628fa854c220fc92f96b8f9de85c86c8850
Opcode Fuzzy Hash: bc3910efd27369bf33c774dc073a5bc4510ecce4c3df1e5e8f019afb6320e3bc
Instruction Fuzzy Hash: 0311EDB5C046498ECB10CFAAD945BDEFBF4EB48324F20851AD419B3700D378A644CFA5

Function 051ECD60 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 051ECDBD

Memory Dump Source

Source File: 00000007.00000002.2972373514.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_51e0000_RobloxCheats.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: c8981116aeea0babdc5e096f8de2eb7243a9e09680b381c475b188d3e17cbf1d
Instruction ID: 539c6e227b2ba41a97f1ce23302a8e724537cac8f8ed580ac32c12c317ceedf5
Opcode Fuzzy Hash: c8981116aeea0babdc5e096f8de2eb7243a9e09680b381c475b188d3e17cbf1d
Instruction Fuzzy Hash: 8F11FEB5C046498FCB10CF9AD945BCEFBF4EB48324F10841AD419A3300D379A544CFA5

Function 04F83B70 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 04F83B35

Memory Dump Source

Source File: 00000007.00000002.2971660720.0000000004F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f80000_RobloxCheats.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 87a96a5bb5010260decaebb8e95c12e8ea62dbe5cc285cfd4a9c4740de147928
Instruction ID: 70846da243e56117999716b1233c44b40f69fa919ec591a1cfa614b1b268da56
Opcode Fuzzy Hash: 87a96a5bb5010260decaebb8e95c12e8ea62dbe5cc285cfd4a9c4740de147928
Instruction Fuzzy Hash: 4B01D1F58042448FEB10EF98D885BDAFBF4FF94318F10C54AD4449B251C33AA446CB61

Function 007D3550 Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2966120239.00000000007D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a1a9056bf246bd5a37ebb10338b2c9b480ebc864b4d8d9f43d2a82af76a1c6
Instruction ID: 4a123cec3fdfc5e6fea2620f1f80a5f95d52c5531f67a430220451c4cd20d6dc
Opcode Fuzzy Hash: 55a1a9056bf246bd5a37ebb10338b2c9b480ebc864b4d8d9f43d2a82af76a1c6
Instruction Fuzzy Hash: 6AD0C92114F3C04FD7038774AD664993FB05D8711570E05EFD1CACB8A3E6551455CB12

Function 005ED210 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2964780928.00000000005ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 005ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b29d974ed827370beba03ab45d71d73950e70a19b34f994e76a70db99cd53f69
Instruction ID: c02ff055ef279997052179919ea2c2ce861acae51cc14999b61b75424683345a
Opcode Fuzzy Hash: b29d974ed827370beba03ab45d71d73950e70a19b34f994e76a70db99cd53f69
Instruction Fuzzy Hash: 582103BA504280DFCB09DF55D9C0B26BF75FB88310F24C969EA490B246C336D816DBB1

Function 005ED4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2964780928.00000000005ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 005ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87372247016a05622c4330480445ec6c33a2e7b48919f634b3eea59e2b441ed2
Instruction ID: b133d98b4f89646513381235bf4b42a72e41f0ef4095b6a42a024681fe4709fb
Opcode Fuzzy Hash: 87372247016a05622c4330480445ec6c33a2e7b48919f634b3eea59e2b441ed2
Instruction Fuzzy Hash: A72128B2504280DFCB09DF15D9C0B26BF75FB98318F24856AE9490B256C336D856DBB1

Function 005FD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2964868768.00000000005FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 005FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5fd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a80232c1ff5b20649774732e388cbb50ed7eca59d5e5df5c4ecbe409fe0dc8
Instruction ID: cd58c235076b039854d9da7ec754a346c62b0b6284541ba76bd8b699dbb06e9b
Opcode Fuzzy Hash: 29a80232c1ff5b20649774732e388cbb50ed7eca59d5e5df5c4ecbe409fe0dc8
Instruction Fuzzy Hash: FA210375504208DFCB14DF14D5C8B26BF7AFB84314F20C969EA0A4B246DB3AD807CA71

Function 005FD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2964868768.00000000005FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 005FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5fd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb2cabaab2622dc79b37ce0b7d3c5eda11006179657ff075b6d9de14186458f9
Instruction ID: b25b51927e06857fb5aa88ae2a2c90e9bbde247856b83ce2f1916725842d05c2
Opcode Fuzzy Hash: cb2cabaab2622dc79b37ce0b7d3c5eda11006179657ff075b6d9de14186458f9
Instruction Fuzzy Hash: 9421D3B9504208AFDB05DF14D5C0B26BF76FB84314F24C96DEA094B255C73AD846DAB1

Function 005FD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2964868768.00000000005FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 005FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5fd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b7ed01ad082ea7404200bf5741346ee8248ddb09a33ffbad80d1284d032695
Instruction ID: 80ef4ff335fa567cc4816923b26731693272436135cee1c60c6a3bb4eef00639
Opcode Fuzzy Hash: 78b7ed01ad082ea7404200bf5741346ee8248ddb09a33ffbad80d1284d032695
Instruction Fuzzy Hash: BB2180755093848FCB12CF24D994715BF72FB46314F28C5EBD9498B6A7C33A980ACB62

Function 005ED20B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2964780928.00000000005ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 005ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0198dffcca54c8a327979ca184e18e1179e26769679eb7287e54d642110c921c
Instruction ID: df4d1e943df1d6efefd2754ae0648baa1640cdc9fe5abf833c45c535efa98ae7
Opcode Fuzzy Hash: 0198dffcca54c8a327979ca184e18e1179e26769679eb7287e54d642110c921c
Instruction Fuzzy Hash: 6921E176404280CFCB06CF50D9C4B16BF72FB88314F24C5AADD480B656C33AD81ACBA1

Function 005ED4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2964780928.00000000005ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 005ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: c371f880e92fc8e638e631426caa25be69f20471d6bcc4047308a2d8da3f3967
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: F411E676504280CFCB16CF14D9C4B16BF72FB94318F24C6AAD9494B656C33AD85ACBA1

Function 005FD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2964868768.00000000005FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 005FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5fd000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: 3d3d67796a8876ca997d12fc7be04579bddadae9d026bd52028d8b33844c232b
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: 7611BB79504284DFCB12CF10C5C0B25BFB2FB84314F24C6AAD9494B696C33AD84ACBA1

Function 005ED607 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2964780928.00000000005ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 005ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe84c120bba2771caffd9546cfd5aa009ba8c93f6d43f8e7551e3e9afefa3ff
Instruction ID: 40a9dbec8d73606c9dd70c1c2d5b98785febb84a091453f256787ec0781872fe
Opcode Fuzzy Hash: 6fe84c120bba2771caffd9546cfd5aa009ba8c93f6d43f8e7551e3e9afefa3ff
Instruction Fuzzy Hash: 1FF0F4B6600644AF97248F0AD984C27FBBDFBD4770719C59AE84A4B612C671EC42CAB0

Function 005ED5F8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2964780928.00000000005ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 005ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5ed000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37ea1b1012c2f2428fccb1030b56fc12c6c961c0789853f7ca409f866216a1b
Instruction ID: f8fd8f74410e616a2161e356b7c0a5b1c2f7b7bfd6612d95d67ebc624f255c6f
Opcode Fuzzy Hash: f37ea1b1012c2f2428fccb1030b56fc12c6c961c0789853f7ca409f866216a1b
Instruction Fuzzy Hash: 86F03C75104680AFD7158F16C984C22BFB9FFC57607198489E89A4B252C631FC42CB70

Function 007D392F Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2966120239.00000000007D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b7e83cece6f5f9b4b8e359cc73f73f65d759d44bd67cd9c2739606bca420b0
Instruction ID: 54b552260ef6eb0722b0d65277dbdb6454b181fe53e076da9f1f1664a7a835d7
Opcode Fuzzy Hash: a1b7e83cece6f5f9b4b8e359cc73f73f65d759d44bd67cd9c2739606bca420b0
Instruction Fuzzy Hash: A9E0927271A25517A30816AE28D962B7FEFA7C8129716407AB54AC7382DD90CD068395

Function 007D3940 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2966120239.00000000007D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c4fed674352edc39fb93e95468587d52ca5c5f3267783f3dfb454e1f235eac
Instruction ID: 381c4c14ec9550e683101db05778e5e3ee7d155a56b7910b6feee04164ceae90
Opcode Fuzzy Hash: 78c4fed674352edc39fb93e95468587d52ca5c5f3267783f3dfb454e1f235eac
Instruction Fuzzy Hash: 09E0C2327152181B230825AF28D883BAEDFFBCC279366407AF54EC3380DD908C0283E1

Function 007D18AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2966120239.00000000007D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8bc29c93cd3ea9eb5aadb5af9b5c4b8519bcd1ac18aaf7c846dcc66fda0097
Instruction ID: 6f3b6b09087acd949903e3b236ab336d3cff47f2220c40879a5fe34471f36600
Opcode Fuzzy Hash: de8bc29c93cd3ea9eb5aadb5af9b5c4b8519bcd1ac18aaf7c846dcc66fda0097
Instruction Fuzzy Hash: 0DD0A932E08604DBC7914B04E8483AC3BB1EFA1322F6094A3E002C1283CB3D5ECBEB04

Function 007D3F00 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2966120239.00000000007D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e249a975bb10d61e41b1741c9277c510d32917daa6f2ad7c1a3957482d4964da
Instruction ID: 1b05f0378a19c610e5855a3b83cb7d71e8028574cf7d69b49838e493d458dbb4
Opcode Fuzzy Hash: e249a975bb10d61e41b1741c9277c510d32917daa6f2ad7c1a3957482d4964da
Instruction Fuzzy Hash: B3B0925249E7A93CC24293E978A07703F2E13D1220E88C29AA44D42A53968D942A9352

Function 007D3910 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2966120239.00000000007D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b131ef2ca193058d7763c9b41e53eaa3828e257fad75158ef50d558a0edba3fd
Instruction ID: 11faddb39aeb8a18b143c4b29f620bd2ef59b68910605a5b14034d000095a3e3
Opcode Fuzzy Hash: b131ef2ca193058d7763c9b41e53eaa3828e257fad75158ef50d558a0edba3fd
Instruction Fuzzy Hash: EFC09B371065844BD74142A0BF56BE627355B41136B4E55F7C31D5F953C1174195C741

Function 007D3F10 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2966120239.00000000007D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3554522f2f333f7feb65cdcd6938a1606d2f3333d57b1869633688ce7f7647fe
Instruction ID: 376c60aa1969a0e9686d47731059af2309a36a565c2056579dff73ccb6ecba83
Opcode Fuzzy Hash: 3554522f2f333f7feb65cdcd6938a1606d2f3333d57b1869633688ce7f7647fe
Instruction Fuzzy Hash:

Function 007D3900 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2966120239.00000000007D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70271be2b9c33b7565b4e7707001719edf69681620964c156b9d273cd4d28b2c
Instruction ID: 3865ea52b93a8d6e0b61cbc956c93e373292f12f496f0ff5e23bda4ee8283a6a
Opcode Fuzzy Hash: 70271be2b9c33b7565b4e7707001719edf69681620964c156b9d273cd4d28b2c
Instruction Fuzzy Hash: D7902230000A0C8F080023A0300A0083B0C800002E3800000B00E000020E0020000280

Function 007D18C8 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2966120239.00000000007D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_RobloxCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a70f767145261fd580894e51fd0d411d5666f457476724e2722a730c68134b0
Instruction ID: d4bcf9c468513443d10f2a8e531d4fd7ba3c8d105d9beec3809e396e84ba52c7
Opcode Fuzzy Hash: 9a70f767145261fd580894e51fd0d411d5666f457476724e2722a730c68134b0
Instruction Fuzzy Hash: 5FA00220308101FF96185765A81843A37B39BE435136084169413C5265DB3D5807F621

Analysis Process: RD-127.0.0.1_53842_121767.EXEPID: 2996, Parent PID: 6552COMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	84
Total number of Limit Nodes:	10

Executed Functions

Function 00DDC59C Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00DDFC42

Memory Dump Source

Source File: 00000008.00000002.2222428390.0000000000DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dd0000_RD-127.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e1800d6a2ddac59d01ec5e5791aa5c688037e1c14fce3abe12a60a9acb19aa26
Instruction ID: cb76ba4e2d62ea8c8a532a8300627dd56339960f27890da7db053c88c932ce12
Opcode Fuzzy Hash: e1800d6a2ddac59d01ec5e5791aa5c688037e1c14fce3abe12a60a9acb19aa26
Instruction Fuzzy Hash: B151CEB1D103499FDB14CF9AC984ADEBBB5FF48310F64812AE819AB310D771A985CF90

Function 00DD6B30 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00DD77A6,?,?,?,?,?), ref: 00DD7867

Memory Dump Source

Source File: 00000008.00000002.2222428390.0000000000DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dd0000_RD-127.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9ad5edbcc2011fd90fe352d49feeae4ae2a5f714d7ecb9d69d27643284473e3a
Instruction ID: 40cba4e17a84c475bea1bb223294e24c2cd340c2ae81cc86d88af5279d552a0f
Opcode Fuzzy Hash: 9ad5edbcc2011fd90fe352d49feeae4ae2a5f714d7ecb9d69d27643284473e3a
Instruction Fuzzy Hash: 032116B5D00249EFDB10CF9AD984ADEBBF4FB48320F24805AE914A3310D374A940DFA0

Function 00DDC428 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00DDD809,00000800,00000000,00000000), ref: 00DDDA1A

Memory Dump Source

Source File: 00000008.00000002.2222428390.0000000000DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dd0000_RD-127.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: efaccc6b0c969cc656f638712938dffb476a5c14a6ea4b340994f82b74a2ad3b
Instruction ID: d8cda45039c0214c3906174d6608d4bc035561341f314e90811b753e3c21c355
Opcode Fuzzy Hash: efaccc6b0c969cc656f638712938dffb476a5c14a6ea4b340994f82b74a2ad3b
Instruction Fuzzy Hash: 4711E4B6D042499FDB10CF9AC444ADEFBF5EB98320F14842AE519A7300C375A945CFA5

Function 00DDD9A8 Relevance: 1.6, APIs: 1, Instructions: 52
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00DDD809,00000800,00000000,00000000), ref: 00DDDA1A

Memory Dump Source

Source File: 00000008.00000002.2222428390.0000000000DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dd0000_RD-127.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3f7f58144147061267dd9b6085d30028ba8c253e308ea891057daf677963945e
Instruction ID: b79e85aeee09b6d2f717744c5156e61d32dd50cff7db394db3814e2c8e6bccc5
Opcode Fuzzy Hash: 3f7f58144147061267dd9b6085d30028ba8c253e308ea891057daf677963945e
Instruction Fuzzy Hash: 2D11F3B6D002498FDB10CF9AD484ADEFBF5AB58314F14841AD829A7300C375A545CFA5

Function 00DDC3D4 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,00DDD554), ref: 00DDD78E

Memory Dump Source

Source File: 00000008.00000002.2222428390.0000000000DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dd0000_RD-127.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 50398104c07c0bb6fb3f8dbd15e1d14514b8523e7744ba811caebc866d65c82f
Instruction ID: a4fbba71e8b0a785c8802e1aa716e9ba3b1cd3f278099977ebb45124a2f9ef81
Opcode Fuzzy Hash: 50398104c07c0bb6fb3f8dbd15e1d14514b8523e7744ba811caebc866d65c82f
Instruction Fuzzy Hash: D711F0B5C006499FDB20CF9AC484A9EFBF5EB88324F24846AD419A7310D375A945CFA1

Function 00DDF74C Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,00DDFD60,?,?,?,?), ref: 00DDFDD5

Memory Dump Source

Source File: 00000008.00000002.2222428390.0000000000DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dd0000_RD-127.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 437212938824a4f42733419877aae7581bc617090ff1504063af2d8a575248b3
Instruction ID: 17df756a3dcdf4b5c0f404b0ee704e38a5965fc34d442e70bd1608ad25b84ea9
Opcode Fuzzy Hash: 437212938824a4f42733419877aae7581bc617090ff1504063af2d8a575248b3
Instruction Fuzzy Hash: 5411F2B58003499FDB10CF9AD585BAEBBF8EB48324F20845AE959A7740C375A944CFB1

Function 00C5D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2222138250.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c5d000_RD-127.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d4ae8d2424bae0c39671e52b18b7bc65999c017b681d949877581ab1e2a0b5
Instruction ID: cd7210220e8abe5bd4c22b252e7a2b7dda9d207b52117017c4e08fb6174f541b
Opcode Fuzzy Hash: 97d4ae8d2424bae0c39671e52b18b7bc65999c017b681d949877581ab1e2a0b5
Instruction Fuzzy Hash: 9C2136B9504300DFCB25CF04C9C0B26BF65FB98319F208569ED0B0B256D336D98ACBA2

Function 00C7D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2222215701.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c7d000_RD-127.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3748d7ec110222482281f1550630fcb10e9e73021c837421fae075f11dac9c8f
Instruction ID: 96dddc5b6000f679f90cdad0babf4b1c19570589bcf74c51506f0c9a18707e45
Opcode Fuzzy Hash: 3748d7ec110222482281f1550630fcb10e9e73021c837421fae075f11dac9c8f
Instruction Fuzzy Hash: 4021CFB56042009FCB14DF14D9C0B26BB75EB84314F24C969E90E4B296C33AD846CA61

Function 00C7D2BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2222215701.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c7d000_RD-127.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d780735df8072a3a88664356d4416344d78a0dbbf29f0e0bf5ce6f6f2bddc8b
Instruction ID: cf4edfaca5b15a895688513ff7c48c4566298f8d71bfb2a0b24e349ad3e16149
Opcode Fuzzy Hash: 1d780735df8072a3a88664356d4416344d78a0dbbf29f0e0bf5ce6f6f2bddc8b
Instruction Fuzzy Hash: 4521F3B5504644DFDB14DF15D9C0B2ABB75FF84324F24C569E84E4B252C33AD846CAA2

Function 00C7D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2222215701.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c7d000_RD-127.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c56dcff09fa9a47596515d33f57331062da708d259b5ca7efb7ed332d10564
Instruction ID: d6fffa718ae2ad9e7f2d7fddc6b443590a0fc734871b46fd48ab6dc91e85f985
Opcode Fuzzy Hash: 90c56dcff09fa9a47596515d33f57331062da708d259b5ca7efb7ed332d10564
Instruction Fuzzy Hash: BB218E755093808FCB12CF24D990B15BF71EF46314F28C5EAD8498B6A7C33A990ACB62

Function 00C5D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2222138250.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c5d000_RD-127.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: 7e78eee134374ab7e5dcd66b39ecc71605f656cd0b8ab79f7598579cd81ce3ab
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: DC11E1B6404340CFCB16CF00D5C0B16BF72FB94318F2482A9DC0A0B256C33AD99ACBA1

Function 00C7D2B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2222215701.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c7d000_RD-127.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6571a979d86382cef3f3a0ee6dcd591210bcaba3c37dfea3d6794a8d99f67603
Instruction ID: 74669ce5b4597731479d7aa1424355e88322bb5d3ebcc0ae6250ef1914c35b3c
Opcode Fuzzy Hash: 6571a979d86382cef3f3a0ee6dcd591210bcaba3c37dfea3d6794a8d99f67603
Instruction Fuzzy Hash: 5C119D76504680CFDB12CF14D5C4B19BB71FB84324F28C6AAD84A4B656C33AD94ACBA2

Function 00C5D607 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2222138250.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c5d000_RD-127.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0340985abebdf928da1f62c6535775f99b7092cbd8749653e072b482ec32138d
Instruction ID: 9e1769ea03faaec3f30057f47ff043304fcdf560cfcd549db838d631ad0c5d2d
Opcode Fuzzy Hash: 0340985abebdf928da1f62c6535775f99b7092cbd8749653e072b482ec32138d
Instruction Fuzzy Hash: A6F0E776600604AF9720CF0AD984C26FBA9EBC4770715C55AE84A4B612CA71EC42CAA4

Function 00C5D5F8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2222138250.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c5d000_RD-127.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17feace7e2828289384dd4ecad18a839e0f4ae1a8029136c1a237380285c6b3
Instruction ID: c20911f7f30098d7e5760ecbbfdccda14d1c5d54ba516e08536ea47c0d5240ca
Opcode Fuzzy Hash: d17feace7e2828289384dd4ecad18a839e0f4ae1a8029136c1a237380285c6b3
Instruction Fuzzy Hash: 15F03C75104780AFD725CF06CD84C62BFB9EF897607198489F88A4B352CA31FC46CB60

Analysis Process: RD-127.0.0.1_53857_899270.EXEPID: 4112, Parent PID: 2520COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	54
Total number of Limit Nodes:	5

Executed Functions

Function 00F77597 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F77616
GetCurrentThread.KERNEL32 ref: 00F77653
GetCurrentProcess.KERNEL32 ref: 00F77690
GetCurrentThreadId.KERNEL32 ref: 00F776E9

Memory Dump Source

Source File: 0000000C.00000002.2965891422.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f70000_RD-127.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 62f5a4a741a881bfe5edec173e5c8e06cb77a33b28ccc83c0fc5ad809e986caf
Instruction ID: 7bea0469964163a9337e058fb30f01fa6927597baee4a13363e2e67a2c6bdfdc
Opcode Fuzzy Hash: 62f5a4a741a881bfe5edec173e5c8e06cb77a33b28ccc83c0fc5ad809e986caf
Instruction Fuzzy Hash: DD5146B090074ADFDB14DFA9D948B9EBBF2EF48314F24C41AE009A7250D774A944CF66

Function 00F77598 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F77616
GetCurrentThread.KERNEL32 ref: 00F77653
GetCurrentProcess.KERNEL32 ref: 00F77690
GetCurrentThreadId.KERNEL32 ref: 00F776E9

Memory Dump Source

Source File: 0000000C.00000002.2965891422.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f70000_RD-127.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2b4bab6b50cb87b6bf59b22fd051774ad94cf51c4f822df36625760b2c3cea8f
Instruction ID: 200c45662e2b8b1ca30e17651ca4a020a65e68ade5cee578ac35b712bb485c23
Opcode Fuzzy Hash: 2b4bab6b50cb87b6bf59b22fd051774ad94cf51c4f822df36625760b2c3cea8f
Instruction Fuzzy Hash: BB5146B090074ADFDB14DFAAD948B9EBBF2EF48314F24C41AE009A7250D774A944CF66

Function 00F7FB30 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00F7FC42

Memory Dump Source

Source File: 0000000C.00000002.2965891422.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f70000_RD-127.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6a8d10de34fc35a58bde392ea98406003ef366c53966bbbd47d8ddb4d7b57c30
Instruction ID: 114a4fe5f8ff797277aea77b48f61c0cdad397b0f7b8724c7cf33bbe597f5c73
Opcode Fuzzy Hash: 6a8d10de34fc35a58bde392ea98406003ef366c53966bbbd47d8ddb4d7b57c30
Instruction Fuzzy Hash: 3141CEB1D103499FDB14CF9AC984ADEBBB5BF88310F24812AE818AB210D771A945DF91

Function 00F777DB Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F77867

Memory Dump Source

Source File: 0000000C.00000002.2965891422.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f70000_RD-127.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7c7fd5a8ebdc658a2b6402014017b89a80298eb22bd7d493cce001ef031ab2f5
Instruction ID: 40dfe0b5d5903415eb0d06198a515c93fe7b144e0ce23a12bffe4411da8a22bd
Opcode Fuzzy Hash: 7c7fd5a8ebdc658a2b6402014017b89a80298eb22bd7d493cce001ef031ab2f5
Instruction Fuzzy Hash: 0621E6B5D00249AFDB10CF9AD584ADEFBF5EB48324F14841AE918A3351C374A944DFA5

Function 00F777E0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F77867

Memory Dump Source

Source File: 0000000C.00000002.2965891422.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f70000_RD-127.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c588d3a0d9f7ee3e49f92efa036f43d79752f2aeaf98155e252c8c975ff5025b
Instruction ID: 2c6a1204e7e99195b530075e33a795f62657d26a22071d31cd0948540bc2aaec
Opcode Fuzzy Hash: c588d3a0d9f7ee3e49f92efa036f43d79752f2aeaf98155e252c8c975ff5025b
Instruction Fuzzy Hash: 0E21E6B5D002499FDB10CF9AD584ADEFBF5EB48320F14841AE918A3350C374A940DFA1

Function 00F7C428 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F7D809,00000800,00000000,00000000), ref: 00F7DA1A

Memory Dump Source

Source File: 0000000C.00000002.2965891422.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f70000_RD-127.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 29a71cd8f3e2fd80d7cd75f3aeb044932430eb0eadf16998a9e2f6fba89968d7
Instruction ID: bd96261f72cae25352ed15bb8de1c3f6de7fa602914997d8fe89e340e527e61f
Opcode Fuzzy Hash: 29a71cd8f3e2fd80d7cd75f3aeb044932430eb0eadf16998a9e2f6fba89968d7
Instruction Fuzzy Hash: 651103B6C042499FDB10CF9AC444ADEFBF5EF88324F14842AE519B7200C379A944CFA5

Function 00F7D728 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F7D78E

Memory Dump Source

Source File: 0000000C.00000002.2965891422.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f70000_RD-127.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e49b9d12d9149df396adc1a1381fac150a7d30f6d615ddad5b82492a5ddc22df
Instruction ID: 41759a23bb30916e24b1f85fb54f456773bd8a8bf49d2912fbf84551c922f9f0
Opcode Fuzzy Hash: e49b9d12d9149df396adc1a1381fac150a7d30f6d615ddad5b82492a5ddc22df
Instruction Fuzzy Hash: 0A11E0B6C006498FDB14CF9AC844ADEFBF5EF88324F14842AD819B7610C379A545CFA1

Function 00F7FD78 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?), ref: 00F7FDD5

Memory Dump Source

Source File: 0000000C.00000002.2965891422.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f70000_RD-127.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 663c3f65290713a89d08c7d7e0f3f41c6d2228cd564abf7c45469f6c101db66e
Instruction ID: 24ab4dc75eed0b206619bc2369e68b67d14a527bd692419b07c5b451b1fdf6da
Opcode Fuzzy Hash: 663c3f65290713a89d08c7d7e0f3f41c6d2228cd564abf7c45469f6c101db66e
Instruction Fuzzy Hash: 3411E2B5800249DFDB20CF9AD585BDEFBF8EB48324F20845AD919A7740C375A944CFA5

Function 0097D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2964603581.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_97d000_RD-127.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3506b539bf8c64ff389ab8ebc1bb221af5d5681c9f0f70ad582c61ef9329ac
Instruction ID: 33102456986ac7f4d8eaca1d3778a38dd35c8c419dd44ecb9a4ff8f975da2145
Opcode Fuzzy Hash: 1d3506b539bf8c64ff389ab8ebc1bb221af5d5681c9f0f70ad582c61ef9329ac
Instruction Fuzzy Hash: 2121F1B2505200DFDB05DF14D9C0B26BF79FF98328F24C569E9094B25AC33AD856DAA2

Function 0098D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2964750008.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_98d000_RD-127.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43e8d91b6e3f5a5308e0b1efc3c5452339ec918db30658db89801c33b0c71b4
Instruction ID: b91ac453d84e45a800b9c52255caa552517301a46e698205373e5da8f7f066e8
Opcode Fuzzy Hash: d43e8d91b6e3f5a5308e0b1efc3c5452339ec918db30658db89801c33b0c71b4
Instruction Fuzzy Hash: 762122B1604200EFDB14EF14D9C0B26BB69FB84314F20C96DE80A4B386C33AD807CB61

Function 0098D2BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2964750008.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_98d000_RD-127.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b159f63120a3795d0f98cc353e08371845adc0dc40c6d04ce279611a41feb71c
Instruction ID: 9a2b947ded81c574bfa7379f6351fb7bca5afff396d141aed619da2242161292
Opcode Fuzzy Hash: b159f63120a3795d0f98cc353e08371845adc0dc40c6d04ce279611a41feb71c
Instruction Fuzzy Hash: 332138B1505204DFDB05EF14D5C0B2ABB69FB84328F24C96EE8494B381C33AD806DBA2

Function 0098D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2964750008.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_98d000_RD-127.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089817e4a97c556e25e59088938445a80019e051a2419788a41527d54ab63f3a
Instruction ID: d3ff6561d9e78684d6a8d0118e9ba32b0490668cbc64388af27b49fa519ee3af
Opcode Fuzzy Hash: 089817e4a97c556e25e59088938445a80019e051a2419788a41527d54ab63f3a
Instruction Fuzzy Hash: F6218E755093808FDB12DF24D990B15BF71EB46314F28C5EAD8498B6A7C33AD80ACB62

Function 0097D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2964603581.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_97d000_RD-127.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: 7341171f4a43ad00093133a60406c8ed7419f56dd451c828524db12a3a8e8f8d
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: 3811E676504240CFDB16CF14D5C4B16BF72FF94328F24C6A9E9094B65AC33AD85ACBA1

Function 0098D2B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2964750008.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_98d000_RD-127.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6571a979d86382cef3f3a0ee6dcd591210bcaba3c37dfea3d6794a8d99f67603
Instruction ID: 21ea85911db3780ef588ed6afbcd8005e690ea8103a19c548b918df1a686a632
Opcode Fuzzy Hash: 6571a979d86382cef3f3a0ee6dcd591210bcaba3c37dfea3d6794a8d99f67603
Instruction Fuzzy Hash: 9611E275504680CFCB12DF10D5C0B19FB71FB84328F24C6AAD8494B782C33AD80ACB92

Function 0097D607 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2964603581.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_97d000_RD-127.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786ce5c674348aea00945eea52fa4c2fb90efc15916ce922c291ad6b63a7985c
Instruction ID: 93463fa79bcedf78e55bad3c7fdc0f1d395df630ccd87647eadd4cd540598138
Opcode Fuzzy Hash: 786ce5c674348aea00945eea52fa4c2fb90efc15916ce922c291ad6b63a7985c
Instruction Fuzzy Hash: E7F0F9B6600644AF97208F0ADD84C67FBBDEFD4770715C55AE84A4B612C671EC41DAA0

Function 0097D5F8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2964603581.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_97d000_RD-127.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e613c5e9a77863c62b44545a77550e78e1e40f25242aba9d2e9d8b0852d16fb
Instruction ID: 3613d69543a65e0af865a032302ef8a22bd26e548c97e3fa427044691d7a5d6f
Opcode Fuzzy Hash: 7e613c5e9a77863c62b44545a77550e78e1e40f25242aba9d2e9d8b0852d16fb
Instruction Fuzzy Hash: 5CF03C75104680AFD3158F06CD84C62BFB9EF85760719C489E8894B652C631FC42DB60

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RobloxCheats.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53842_121767.EXE

C:\Users\user\AppData\Local\Temp\RD-127.0.0.1_53857_899270.EXE

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

Windows Analysis Report
RobloxCheats.exe

Function 064837D8 Relevance: 6.9, Strings: 5, Instructions: 654
COMMON

Function 0648BDF7 Relevance: 1.9, APIs: 1, Instructions: 375
COMMON

Function 06BD46A4 Relevance: 1.7, APIs: 1, Instructions: 223
processCOMMON

Function 06BD36D4 Relevance: 1.7, APIs: 1, Instructions: 218
processCOMMON

Function 00A0ADF8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 04F901E4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 161
COMMON

Function 04F91298 Relevance: 1.7, APIs: 1, Instructions: 192
COMMON

Function 04F93484 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 04F93490 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 04F9348B Relevance: 1.6, APIs: 1, Instructions: 110
COMMON